POST Security In Practice

I was at dinner with a friend when I got a text message from my bank in the UK confirming that I had changed my address (I hadn’t) and that I had ordered a replacement credit card (I hadn’t). Oh well, another day, another fraud. I thought I should do something immediately, but then I remembered that it was the bank’s money at risk, not mine, so I went back to finish the meal.

Later that evening, back at my hotel, I went on to my bank app and found the “contact us” button which gave me two choices: call (which I tried and got “call failed”, but anyway I was in Australia and it was 2am UK time and the “help” desk doesn’t open until 7am) or chat (which I tried, and after going through some menus about whether I wanted marine insurance or something I got a message saying the chat function is down but they were working on it). Oh well.

At night I called again, around 10am UK time, and got through to chap who told me that a replacement card had indeed been sent to Croydon. So I blocked the card and reset the correct address. No harm done.

But then I began to wonder. This is a “back up” credit card that I keep in my desk at home in case of some circumstances in which my other cards have been stolen or Amex has gone down or agents of a foreign power have blocked my Visa card, or whatever. As far as I can recall (I can’t log in to the credit card app because I forgot the password and can’t be bothered to reset it) I used it once when it arrived, just to check it was working, and have never used it since.

How did the criminals get that card number and how were they able to convince my bank to change the addeesss?

Leave a comment

Design a site like this with WordPress.com
Get started