A not very reassuring tale of a cosmetics company whose website has been hacked.
Customers' credit card details have been used fraudulently to buy goods elsewhere.
The site was first breached in October, but the firm has only just noticed.
www.techwatch.co.uk/2011/01/21/lush-cosmetics-website-hacked-credit-cards-compromised/
Are we all getting too casual about entering our card details online?
Last edited by: Iffy on Fri 21 Jan 11 at 20:18
|
Yawn
Old news in a new wrapper.
|
|
Only as risky as using an ATM machine or even using your card in a chip and pin. In fact it is about as risky and breathing in oxygen.
|
...Old news in a new wrapper...
How so?
The site was working yesterday, but has been taken down today.
Customers who ordered goods up to and including yesterday are advised to check their card has not been used fraudulently.
www.lush.co.uk/
|
Remember when credit cards used multiple paper dockets with interspersed carbon papers?
In those days thieves targetted the carbons, raiding retailer's bins etc. Only a tiny %age of customers actually lost money as most frauds were too blatant.
Nowadays the crims hack website but the %age of customers who even see a fraudulent transaction never mind needing to challenge it remains miniscule.
|
>> ...Old news in a new wrapper...
>>
>> How so?
Its an old story, on a new site, on a different date, with the same outcome.
That's how so.
|
...Its an old story, on a new site, on a different date, with the same outcome...
In those terms, there are no new stories, only names, dates, and places change.
If you want 'new', you ain't gonna get it on this forum or any other.
|
|
I've been buying on line for 15 years. Never had a problem, other than with the company involved and usually sorted out pretty quickly.
Last edited by: Stuartli on Sat 22 Jan 11 at 00:12
|
>> Never had a problem, other than with
>> the company involved and usually sorted out pretty quickly.
>>
Same here, just about the only shopping now done in person is nipping into the supermarket, Lidl's tomorrow.
I'd rather the negligible risk of internet fraud, which is covered by the credit card i use solely for that, than the real horror of mixing it with assorted ne'er do wells on road and pavement in town centres.
|
The one time I've had my card cloned and its number used fraudulently was as a result of using it in a petrol station. Someone had a fantastic (£3000) weekend in Switzerland on it.
As above, I've been buying online for years and never had a problem.
|
|
I'm sorry if I'm repeating myself but YOU personally can't be the victim of online fraud. Your bank or credit card provider is the victim. The 'protection' policies that they sell are a scam in my eyes. You don't need protection, you've nothing to protect! MBNA even accepted this point when I took my last credit card.
|
>> I'm sorry if I'm repeating myself but YOU personally can't be the victim of online
>> fraud. Your bank or credit card provider is the victim.
That may well be the case but even in a one off credit card transaction you're likely to spend quite a bit of time being jumped through hoops to satisfy the 'taking care of card & PIN test.
In my case it was the joint current account that was hacked. Bank, Santander, accepted pretty quickly that SWMBO & I were blameless; the transactions were done over telephone banking which I never use. The investigator asked a lot of questions about my use of Amazon; nothing concrete but clearly they suspected a compromise of card data.
Took a good four weeks of hassle to get the new account set up and only now, eighteen months later, have I finally seen the last of letters about failed direct debits or payments against out of date account/card details.
Last edited by: Bromptonaut on Sat 22 Jan 11 at 10:25
|
|
Alternatively, give them one shot at the help they need, by answering reasonable questions. If they persist in being difficult, repeating themselves, or failing to put the account back to where it was, then go to the banking ombudsman. You're their customer, not their runner. Up to them to prove fraud on your part if that's what they suspect. Probably fair to tell them you're going to do this. The account isn't yours, it's for the bankers administrative ease. they issue you a card, with approval (implied or explicit) for use in a variety of ways. Any fraud is against that administrative 'account'. You'll find in most of theit T & C's that you are required to report any fraud to the Police. A further example of the customer doing their work for them. I've advised a couple of people that they might like to remind their bank that they can do that themselves, since they are the victim, and the bank have backed off. I've personally gained compenstaion from the ombudsman for a rather long story where the bank caused me embarrassment because of their errors and incompetence. If there were fraud on my account my response would be to close the account immediately, open up at a new bank and then leave them to it. If they didn't put the account back straight I'd go to the ombudsman, but at least I'd be functioning properly with the new bank. Bit of a nuisance with DD's and all that I know.
|
Woodster,
I'm professionally involved with various Ombos and have nothing but respect for the way they resolve disputes that might otherwise jam up the courts. The FSO is certainly a shot in one's locker with banks, but a lot of the hassle is way below the point that might reasonably awake his interest.
I'm reasonably sure for example that Santander informed all my DD holders of the change. That didn't stop several, including the Youth Hostels Association and the CTC from trying to claim from the old account 8 months after it was closed. My breakdown cover nearly lapsed as well. All sorts of outfits from retailers to TfL (Oystercard auto top up & Boris Bikes) and Meteor Parking (pay by text @ Station Car Park) store my card details for my convenience. I guess I should have list of them but have to confess I dont!!
|
When my account was tinkered with, it seemed to me Barclays thought it was something to do with PayPal, although they didn't quite say as much.
All straightened out within a few weeks, but only after a fair bit of form filling, phone calls and a few branch visits.
I'm surprised so many on here are quite so laid back about the fraud risks of online shopping.
Yes, you will almost certainly get your money back, but there is hassle involved.
|
I wouldn't say I'm laid back Iffy. My bit of personal risk assessment tells me that while card fraud has quite a high score for consequence it's possible to manage things in a way that keeps probability reasonably low.
My internet shopping is limited to sights I know are reputable. Examples are the web arms of big retailers (DSG stores, John Lewis, Tesco etc) or reputable big name on line only outfits such as Amazon. Very chary of pay pal and there's one big web e-seller of bike stuff whose name comes up too often (though I think the've been victims of an inside job).
There are also risks 'in store' as well with card skimming/cloning etc. There's at at least one filling station locally where I'd only pay cash.........
|
...I wouldn't say I'm laid back Iffy...
Bromp,
I was more thinking of some of the earlier posters to the thread.
|
|
My bank has now introduced "one-time" numbers for on-line shopping - you can specify the payee and put a limit on. In addition they send a text message whenever you use the card with a new payee, confirming the name and amount.
|
|
I've read and acknowledge both your replies. What frustrates me is the attitude of the banks and the expectation that customer have to jump through hoops to prove their innocence and compliance with the terms and conditions. That's why I won't play ball beyond a first set of reasonable questions. It annoys me that you had to make 'a few phone calls, fair bit of form filling and few branch visits'. Why? What did you do wrong? The answer is probably nothing, so you shouldn't have to waste your time at the banks expense. In my case I made one reasonable response to the bank which was ignored. I then went to the banking ombudsman (Not the FSA) and was awarded £250 (payable by my bank) for my embarrassment. (A long story but I felt embarrassed due to my occupation and the specific circumstances). My bank then had the cheek to write to me and say that my referral to the ombudsman was unnecessary! If their clerk hadn't dismissed me out of hand, and listened, then it wouldn't have happened.
|
Brompt - who is the seller of bike stuff as I buy a fair bit of that.
|
|
Iffy - sorry to go on but one final point - you're not trying to get your money back, that's the crux of it - it's the bank that are victims and it's their money. If they can't show some complicity on your part then they are the loser, hence their money not yours.
|
...Iffy - sorry to go on but one final point...
Woodster,
No worries.
In my case money was taken from my current account after its security was somehow breached.
The account was in credit, so I viewed it as my money.
I was faced with the not too difficult task of proving I had not bought a telly in Colchester.
The banks are no mugs and other activity on the account indicated to them it had been tinkered with.
Apparently, one transaction that often pops up is for £1 and seems to relate to pay as you go mobile phones.
I believe if that one goes through, the scammers know they're onto a winner.
|
Woodster,
I'd rather not say on line as I think it's a bit too close to name/shame. I'll PM you via the mods.
|
the answer is to use a credit card for all online transactions, not a debit card.
The hastle after it all goes wrong is far less.
|
And the benefits...
Yesterday I bought 2 batteries on line using www.watchbattery.co.uk/ as recommended by someone on this site (thanks!). Even including p&p they're cheaper than buying in town. I don't mind supporting a local business but the last time I bought similar batteries the price was eye watering. This morning - they've arrived.
Yesterday I bought an OS map from www.dash4it.co.uk/store/ as recommended on this site by myself and others and after receiving a promtional email offering 5% off their already very low prices. It's here.
I'll just have to wait to see if my card has been hacked.
John
|
>>the answer is to use a credit card for all online transactions, not a debit card.>>
My Halifax Visa debit card delivers virtually 100 per cent of the cover of my LloydsTSB Trustcard, further boosted now by Halifax Secure (also on offer with LloydsTSB which, of course, owns HBOS).
|
>>I'll just have to wait to see if my card has been hacked.
My wife buys a lot online and has ordered another couple of items this morning. No problems so far.
|
|
I should be receiving them shortly then.
|
|
Do send them back if they're not the right size.
|
|
Stuartli - what is that cover that you're talking about? Do you pay for it?
|
>>Stuartli - what is that cover that you're talking about? Do you pay for it?>>
No, it's free. Many on-line retailers are subscribers to the system which, when you go to pay for an item(s) on a website, a Halifax or LloydsTSB Secure panel appears depending on which card is being used.
You have to enter a password which you have previously chosen when signing on for the service. After that payment is approved by the bank and the transaction continues.
See:
www.securesuite.co.uk/hbos/registration/welcome.jsp
I have different passwords for each bank.
|
Alas, laughingly easy to bypass.
Pretend to have lost your password to find out how....
|
>>Pretend to have lost your password to find out how.>>
I did recently in the case of the LloydsTSB card (I use the Halifax card more often) - it took around 10 minutes to get the right to create a new password from a very on the ball LloydsTSB call centre male operator.
|
>> to pay for an item(s) on a website, a Halifax or LloydsTSB Secure panel appears
>> depending on which card is being used.
The system is used by Visa and mastercard too. They have their own names for it. It is reportedly not welcomed by all customers as protecting their interest:
www.theregister.co.uk/2008/10/23/vbyv_analysis/
www.theregister.co.uk/2010/01/27/3d-insecure/
www.theregister.co.uk/2008/08/07/verified_by_visa_compulsion/
Last edited by: John H on Sat 22 Jan 11 at 20:38
|
>>The system is used by Visa and mastercard too>>
Both my Halifax and LloydsTSB debit cars are Visa and the Trustcard is Mastercard; not sure why LloydsTSB switched from Visa in the latter case.
|
Risks of online shopping - Zero
