Hi fellow OzBargain members,
I've found a few of my cards that have been compromised bought from this deal - 10% off $100 & $250 Mastercard Gift Cards ($4.50/$6.30 Activation Fee Applies) @ Coles
posted in June 2022
Exact same issue from this forum post just under a year ago but appears to be different merchants that are draining the balances this time
Last time round it was Google Play of some sort
Screenshots of unauthorised transactions as below:
Sample 1 - Healthy Land Massage
Sample 2 - Healthy Land Massage
Sample 3 - Pending Charge - serverblen
Since then, the third card has been blocked by the Incomm operator, and I've been asked to call back in a week for that particular card
The Incomm hotline operator also noted there were three transactions on the third card, a purchase and a refund (which doesn't show on the mybalancenow.com website)
When you card becomes blocked by Incomm, you will get the below message when you attempt to check your balance on the Mybalancenow website
The card details entered are invalid. Please contact Customer Care for assistance.
Most likely the third card affected for me is being tested before they put in through a large purchase
The company that issues the cards bought in the June 2022 promotion are different to the 2021 ones (Coles Financial Services)
This is by Incomm Payments
As per the back of the card, the Customer Service line can be reached via +61 (07) 5660 6022
If you are affected by this issue - contact them, and go through the phone menu to go to "Lost/Stolen" card menu and you'll be able to speak to an operator.
You'll then be asked for your details and given a dispute form (PDF) via email which you'll need to fill and send to a different email ([email protected])
Dispute process is supposed to take anywhere between 45 days and 90 days.
Hopefully by raising awareness, and by gathering more data for Incomm we can help catch these culprits and reach a speedy resolution for all those affected
Probable Cause
From the discussion in the previous attack, it's most likely a brute force attack.
Looks like they put in a small pending charge to test cards (most likely using a payment processor that doesn't have captcha protection), then they use the card instore that doesn't require CVV or PIN (notice how my two cards are above $200, even if I had set a PIN on them, this would not stop the payment because anything above $200 reverts back to Signature Required)
As per the previous Coles Gift card deal/issue
These Coles gift cards have got the same expiry dates 03/27 and leading first 8 digit numbers (at least for the $250s they do)
Suggestions
From the discussion in the previous attack and my own experience as an OzBargainer who delves in saving money via discounted eGift cards regularly..
1) Do not hoard these cards (or ANY eGift cards) in large amounts, only buy any gift cards (especially VISA/MC Prepaid cards) when you have expected bills to pay or planned expenditure
2) If you are exposed with a significant amount of balance, you can attempt to reduce your exposure by consuming the balance as fast as you can:
- These include prepaying your utility bills into credit (keep your physical cards in case unexpected credit refunds by some utility companies, so don't prepay too much into one account)
- Convert to other types of cards, that you can load into an account that has significantly higher security than the Visa/MC prepaid cards (Amazon, enable 2FA to login for example), WISH/Coles eGift cards if you have access to purchasing portals
Thanks for reading and hope not too many OzBargainers are affected.. however this time round so far I have had 3 cards affected out of a sample size of 20 cards which is much higher than last time.
Stay safe and happy saving!
Cheers
Cwongtech
My card was also hacked. It was the new $100 card purchased during the early August offer.
8/21/22, 12:47 AM
PENDING - SERVERBLEN* SERVERBLEN - O400266BAB15
- $2.48
ServerBlend | Five-Star Game Server Hosting.
Used up the remainder immediately and the $2.48 was refunded a couple of days later. Very disappointing. They just introduced this card and it seems a major improvement regarding physical tampering but not these brute force attacks. Can a foolproof system not be devised? We need to ensure any lost funds are refunded in full otherwise future purchases will need to be considered very carefully.