If you have credit cards for long enough, you’ll almost certainly deal with credit card fraud at some point. The good news is that if you simply have unauthorized charges, credit card issuers offer a high level of protection, so that you’re not on the hook for those charges, as long as you report them in time.
Well, I just dealt with my latest case of credit card fraud. All credit card fraud gets me wondering how something happened, but this one is especially strange, since it seems to be related to previous fraud I had… with another card issuer!
In this post:
My unauthorized Amex card purchases in Malaysia
I have the Amex Business Platinum, and it’s a card that I primarily keep for the perks, rather than for actual spending. As a matter of fact, I’ve made a total of four transactions on the card this year, and they were all to unlock perks associated with the card.
Of course I always monitor my credit card statements, to make sure there’s no fraud, even for statement periods where I’m not anticipating any purchases. While reviewing my recent transactions on the card, I noticed two small charges — a $2.46 charge on July 10, and an $0.86 charge on July 19, both with Google. One was for Bongo Movies (“a modern African film industry in Tanzania”), and the other for WhatsApp.
Those transactions were small enough that I might not have thought much of them, but I also knew something looked off. Sure, I probably can’t keep track of all of the purchases I make that involve Google, but I couldn’t figure out any reason that I’d put those charges on this card, since this isn’t a card that I have connected to any auto-billing services.
Just to be extra sure, I clicked on the details of the transactions, and saw that the purchases were both actually in Malaysian Ringgit. Okay, so that’s definitely fraud!
I disputed both charges, indicating that I never authorized them. Usually Amex is great at resolving card disputes in the favor of cardmembers, but I was surprised to get a rejection within a few days. Per the email I received from Amex:
We’ve rebilled the $0.86 amount you disputed from GOOGLE.
Here’s what happened: We gathered the attached documentation we needed to explain this charge, and we’ve determined that you’re responsible for the amount in question.
They then attached the receipt that acted as proof, to show that I authorized the transaction. The issue is that the “customer email” — [email protected] — is not me. And that was the same emailed used for both transactions.
Honestly, that’s rather disappointing handling on Amex’s part, when I suggest I didn’t make the purchase, and then they deny the claim on account of the “proof” of me having made the purchase, with a receipt that uses an email that has nothing to do with me. I can’t expect Amex to know the email addresses I use, but I’m not sure how this is “proof” that the purchase wasn’t fraudulent.
The Malaysia fraud connection gets more interesting
In isolation you might not think much of this, but here is where the story gets stranger, as I see it. Several months ago I covered how I dealt with fraud on a Citi credit card, specifically involving Grab “Poi Funding Transactions” in Malaysia (Grab is a competitor to Uber, particularly in Southeast Asia). The purchases were spaced out over the course of weeks, and totaled over $380.
They were all on my Citi Double Cash, which is another card that I don’t actually use much for spending nowadays, and it had also never been linked to my Grab account.
I know I’m unlikely to ever get to the bottom of credit card fraud, given what a big underground industry this is. However, curiosity does get the best of me. What I found strange is that this fraud happened just weeks after traveling to Malaysia for the first time in years. The thing is, I hadn’t used that card for any purchases there (it has foreign transaction fees), though I did have the card in my backpack, along with around a dozen other cards, including the Amex Business Platinum.
With this latest Amex Business Platinum situation, I’ve now had two cards compromised that I traveled to Malaysia with, but didn’t actually use there, with all the fraud being in Malaysia (or at least processed from there, as there also seems to be an Africa connection).
My theory here is that someone went through my personal belongings for the brief time I was in Malaysia, and maybe photographed my credit cards (rather than physically taking them, which would arouse more suspicion). Then they’re trying to take a very slow but steady approach toward fraud, doing this over months, or possibly just even selling the numbers on the dark web. I dunno…
It’s possible that I’m way off here, but I just find it to be a strange coincidence that this all involves Malaysia just weeks after I visited. I understand that a data breach of some sort is often the most common source of fraud, but we’re talking about two different card issuers here, so the cards wouldn’t even be linked in the same database anywhere.
Am I wild for coming up with this theory, or does anyone else have a good explanation? I’m certainly channeling my inner George Bush here.
Bottom line
My Amex Business Platinum Card, which I don’t use much for spending, was recently compromised with two small, fraudulent purchases, charged in Malaysian Ringgit. What makes this stranger is that my Citi Double Cash Card was also recently compromised with some purchases in Malaysian Ringgit.
I traveled to Malaysia with both of these cards in my bag, though didn’t actually use them for any purchases. Maybe this is a total coincidence, but I’m starting to think that someone went through my bag, took note of all my credit card numbers, and then is slowly but surely committing fraud on them.
Is my theory totally off, or does anyone have a different idea of how this could happen?
USE THE SAFE FOR VALUABLES NO MATTER THE PROPERTY!
If Amex pulled this sort of stunt with me, I'd cancel all of my cards.
Just use a card on your phone I know this doesn't seem that common in America
As a former FBI Supervisory Special Agent overseeing fraud, a very likely method that we saw time and time again was someone likely brushed up against you with a device that was able to contact your credit cards and elicit the information. This device is exactly the same as when you “tap”’your card for a transaction at the point of sale.
This is almost certainly how they were able to access your card without...
As a former FBI Supervisory Special Agent overseeing fraud, a very likely method that we saw time and time again was someone likely brushed up against you with a device that was able to contact your credit cards and elicit the information. This device is exactly the same as when you “tap”’your card for a transaction at the point of sale.
This is almost certainly how they were able to access your card without ever stealing your wallet and cards.
Suggested remedy: there are wallets and credit card sleeves that protect from RF access and keep your cards safe. Just a suggestion.
I had almost the same pattern of charges that start with Google on one of my cards after visiting Bangkok earlier this year. There was one small charge under a dollar and then a monthly subscription charge a week later. I am fairly certain my Google account was hacked, probably from using a public or hotel wifi. When I noticed the charges a month later, my google account was still showing an open login from...
I had almost the same pattern of charges that start with Google on one of my cards after visiting Bangkok earlier this year. There was one small charge under a dollar and then a monthly subscription charge a week later. I am fairly certain my Google account was hacked, probably from using a public or hotel wifi. When I noticed the charges a month later, my google account was still showing an open login from Bangkok. I changed my password, but 30 min later, it changed again. I was able to recover it and changed the password again a couple of times. I didn't have any issues with the dispute through Chase.
We have had similar charges to our debit and credit cards from visits to Singapore and Malaysia. Fortunately we have always had them resolved satisfactorily.
My son's Visa card was attacked and drained (cash card with several hundred dollars) when he used a free wifi site at a McDonalds restaurant in Ottawa.
I'm pretty sure RFID is real. I always use tap to pay and some of the mobile readers can scan my card while several inches from the reader. With a more sensitive scanner it could easily be scanned a larger distance. It should be called wave and go,...
My son's Visa card was attacked and drained (cash card with several hundred dollars) when he used a free wifi site at a McDonalds restaurant in Ottawa.
I'm pretty sure RFID is real. I always use tap to pay and some of the mobile readers can scan my card while several inches from the reader. With a more sensitive scanner it could easily be scanned a larger distance. It should be called wave and go, not tap and go.
Card limits used to be up to $100 but with covid they raised the limits to several hundred dollars. To be totally safe set a low limit on tap or just turn it off while not in a safe region.
I worked for Amex for nearly 10 years in "Black Card" membership services and I was really shocked from time to time when I recognized fraud on a card members account, flagged and reversed it only to have " Phoenix" re-instate it and then I had to seriously escalate " Do you have any idea who this card member is ????!!!!!"
I feel like apologizing for my former employer.
Hotel check-in staff are the main source of fraud on foreign trips in my experiment.
My experience is that some hotel check-in staff are the source of fraud. They can secretly note down your credit card details and commit fraud later. Earlier this year I checked into a rural hotel in Australia. I used a particular Amex credit card only once on my Australia trip. Two days later, there were several attempted large purchases on the card, mainly alcohol purchases. Thankfully, they were rejected by Amex.
My experience is that it is hotel check-in staff that secretly note down your credit card details and try to commit fraud. I was in a rural part of Australia earlier this year. I only used a particular Amex card once on the trip at a motel check-in. Within two days, there had been several attempted purchases in Australia after that, mainly bulk purchases of alcohol. Thankfully, they were not authorised by Amex.
This used to happen a lot back in the day but now it is very rare. However, just 2 weeks ago my Chase Reserve got fraud charges when someone used it at Domino's. Chase was quick enough to block it, ask if it was me and block the card. I guess fraudsters will keep trying to get innovative.
This is a super interesting story. I work for a company that makes "faraday" back packs, we test all the time, pretty sure you got scanned by RFID. I doubt someone removed your cards, my bet is on the scanner device. I have had this happen to me too. Maybe try a backpack that has faraday inside. or if you are really game, I would send you one of ours, of course you have to...
This is a super interesting story. I work for a company that makes "faraday" back packs, we test all the time, pretty sure you got scanned by RFID. I doubt someone removed your cards, my bet is on the scanner device. I have had this happen to me too. Maybe try a backpack that has faraday inside. or if you are really game, I would send you one of ours, of course you have to say nice things!
Try Xtreme Site Line dot com and let me know what color and style, not kidding, think of it as me paying you for all the stuff I've read!
If you are "pretty sure" it was RFID scanning why are there no documented cases of international criminal gangs grabbing literally every card on flights they target and hundreds of cards per day in airports?
The real story here is how awful Amex is with disputes, always being against the customer. Reddit has thousands of similar stories of customers having legitimate disputes rejected over nonsense and having to resubmit disputes numerous times. Seems like Amex cares a lot more about their merchant base than even platinum customers (just like how the big hotel chains now care more about the hotel owners than the guests). That Amex actually recharged you for...
The real story here is how awful Amex is with disputes, always being against the customer. Reddit has thousands of similar stories of customers having legitimate disputes rejected over nonsense and having to resubmit disputes numerous times. Seems like Amex cares a lot more about their merchant base than even platinum customers (just like how the big hotel chains now care more about the hotel owners than the guests). That Amex actually recharged you for a few dollars when you disputed for fraud, without even looking at the email on the receipt, shows how terrible they've really become.
Being a platinum member, Amex just dropping the charge or enagging a bit more with the customer before deciding are reasonable options. That said, what Amex did is not unreasonable either based on my experience. A while back I notied an Amex charge (not platinum) I did not recognize and disputed it. Few days later, Amex sent me the receipt and noted that am responsible for it. It took me a few days to realize...
Being a platinum member, Amex just dropping the charge or enagging a bit more with the customer before deciding are reasonable options. That said, what Amex did is not unreasonable either based on my experience. A while back I notied an Amex charge (not platinum) I did not recognize and disputed it. Few days later, Amex sent me the receipt and noted that am responsible for it. It took me a few days to realize that it was indeed my charge (Cleveland Progressive Field food vendors' name was something weird which threw me off) & I sent a note to Amex apologizing for my boo-boo.
What I find astounding is that Amex (and others) have departments, teams, units, etc. whose sole job it is to deal with fraud, yet appear utterly incompetent in resolving cmplaints.
You would imagine with a giant customer base they would get multiple identical complaints and see a pattern quickly emerging and deal with it. After all, you can't be billed for anything that is not from a Amex 'merchant'. Surely they can cut the...
What I find astounding is that Amex (and others) have departments, teams, units, etc. whose sole job it is to deal with fraud, yet appear utterly incompetent in resolving cmplaints.
You would imagine with a giant customer base they would get multiple identical complaints and see a pattern quickly emerging and deal with it. After all, you can't be billed for anything that is not from a Amex 'merchant'. Surely they can cut the scammer 'merchants' off, or better still, do some vigorous vetting in the first place.
@ Ben -- ALWAYS use that hotel safe. You cannot trust anyone. Of course, using the safe is not a guaratee either. Just be glad it wasn't cash that was stolen.
Most hotel safes use AA batteries. Remove the batteries momentarily and the safe defaults to the default passcode that you can find using Google in 10 seconds.
I had the safe removed from my room at Hotel Opera, Madrid, after someone broke into my room while I was out. Front desk nonchalantly said “well the only way out is past the front desk and we didn’t see anything”! I’m pretty confident it was an inside job!
i find it best to keep valuable locked inside luggage, not in hotel safe, where employees can access it.
Can we PLEASE have GW back? PRETTY PLEASE!
Fool? We can't get fooled again!
Don't understand why you still carry all your physical cards. I take only two on trips and have the rest in my Apple wallet.
I don't understand that either.
I only take the credit cards that I actually intend to use on my trip. So weird to me that Lucky would take over a dozen credit cards, especially one that he admits that he does not intend to use.
Taking only the cards you "intend" to use is a recipe for disaster. "I know I won't be staying at any Hiltons or flying on any Oneworld carriers"? Famous last words
Honestly, if amex doesn't believe you. You should go ahead and close the account. What if it was a much larger transaction and your request was denied?
Your experience with Amex support mirrors mine perfectly. Always and consistently sides against the customer for the most nonsense reasons. All while definitely real people online keep cheerleading how supposedly good they are. Consistently the worst customer service in the industry; I've literally had better experiences with Citi. I closed my Amex cards after a few years; I don't need to put up with this when so many other banks have much better support.
Absolutely. Many years ago, I had a situation with a sign up bonus where I signed up with a second company I owned. To be sure I would get a second bonus, I contacted them through chat and was assured that I would get the bonus. I proceeded to complete the spending, got no bonus and when I presented them with the transcript of the chat, was told that they were not accountable for what their chat reps say!
I couldn't agree more. AMEX is horrible about customer disputes. Chase is much better.
Sorry to hear what happened to you, though a minor point of correction: Grab is not a competitor to Uber in Southeast Asia. Grab acquired Uber's Southeast Asia business.
Go ahead and request replacement cards credits for the ones you took with you on that trip. With the replacement you will get a new expiry date and CVC.
Do you keep all of your cards on a spreadsheet saved on Google Drive or locally to your phone or laptop? If so, someone may have access to your Google Account or you may have spyware on your laptop or mobile phone. May want to change your PW and do a spyware scan on both devices.
A similar situation happened to me recently as well with my Chase Checking debit card. The card showed I made physical purchases in a different state that I had not traveled to, so there is no way my card was compromised there. Furthermore, the only time I ever use my debit card is at the ATM since I'm very concerned with potential fraud and the lack of points. Fortunately, Chase reimbursed me for the charges...
A similar situation happened to me recently as well with my Chase Checking debit card. The card showed I made physical purchases in a different state that I had not traveled to, so there is no way my card was compromised there. Furthermore, the only time I ever use my debit card is at the ATM since I'm very concerned with potential fraud and the lack of points. Fortunately, Chase reimbursed me for the charges without any fuss.
Back when I lived in South Florida my cards were compromised at least once every 6 months. Hasn't happened in the 5 years since I moved...
You can get a Chase ATM card without it being a debit. Just ask for it.
Surprised Amex even investigated.
Always thought for such small amounts they just refund and eat the cost.
I had an out-of-country online service which I had hard time canceling - so I started disputing charges (US Bank visa) trying to get the service's attention this way - but US Bank just kept refunding me 9.99 per month..
Malaysian here. Sorry for your predicaments but I just lol-ed at the email address. "Barua" is a Malay curse word - roughly translates to "lackey". Whoever it is behind the fraud, they're certainly having fun at it
I have a different explanation: Ben mentioned a charge was for bongo movies from Tanzania. In Swahili (spoken in Tanzania and Kenya), "barua" means "letter" ("barua pepe" is "e-mail").
Why on earth did you dispute the charges as opposed to alerting AMEX to fraudulent charges and requesting a new card? Had you properly reported the fraudulent charges, they would have been immediately reversed.
I recently had a fraud in Australia on my VISA card. The odd thing is that in my app settings, an authentification is required for foreign transactions (in my case me using faceID on my iPhone for my bank app).
So i wonder how they managed to get around this.
Definitely get an RFID blocking wallet. Most likely they had one of those scanners and passed it near your bags to grab the info from the chip.
RFID skimming is a myth created by wallet manufacturers. There are no confirmed cases. Do your research.
foboscan - Not sure why you think it's a myth, but I don't mean creating a copy of the card either. If Ben's items are left unattended, it would be easy enough to use an RFID device pressed against his bags to connect to a nearby terminal (maybe portable).
No evidence it was RFID, pure speculation.
You were probably a victim of RFID skimming
I am wondering to place the card with RFID protection or card books? And believe to be Apple Pay, Google Wallet, and digital card, instead of present physically and contactless.9
The best way to prevent this kind of fraud these days is to have online transactions disabled on physical cards, and then using virtual cards for anything purchased over the internet. That way even if someone access the data from your physical card, it's basically impossible to use in any way.
ROTFL, the Bush clip. Oh how I miss those simpler times.
Recall we were at the PH KUL at the same time...thankfully no fraud on my cards. I guess I got spared on the 107th floor!
@ Matthew - LALF -- Simpler times indeed! Yes, missed you by hours there.
You can get a Chase ATM card without it being a debit. Just ask for it.
If you left your cards in your backpack, then someone probably went through it.
If your stay was at the Park Hyatt KL, then this is both a little surprising and a LOT disappointing. I had a three-night stay there last month, and was very impressed.
I've found that disputes can be a little bit trickier with business cards than with personal cards, but that may be just me. Of course, you went back...
If you left your cards in your backpack, then someone probably went through it.
If your stay was at the Park Hyatt KL, then this is both a little surprising and a LOT disappointing. I had a three-night stay there last month, and was very impressed.
I've found that disputes can be a little bit trickier with business cards than with personal cards, but that may be just me. Of course, you went back to Amex, didn't you? What did they say when you pointed out that the fraud was indeed fraud?
@ TravelinWilly -- Yeah, I'd be very disappointed if this happened at the PH KL, so that's concerning. I'm trying to figure out if there's any way someone could've gone through my bag at the airport, or something, because I'd rather not think it happened at the PH. I called them up and explained the situation, so they are resubmitting the claim now.
Most new cards have tap and go.
I've had card readers that would read up to several inches from the tap zone. They should call it wave and go
Not to difficult to increase the range of the transceiver. Most cards were limited to a few hundred dollars and with covid much higher. You could set a lower limit or just turn tap off when in a danger zone.
I think you have to assume, no matter the status of the hotel, you are always at risk for fraud/theft.
My wife and I stayed at the Six Senses, Douro Valley, and both passports disappeared. Of course I have no way of proving it, but it's 100% plausible, given the remoteness of the hotel and who might have had access to our room during turndown service.
Even the safes are not 100% reliable, but...
I think you have to assume, no matter the status of the hotel, you are always at risk for fraud/theft.
My wife and I stayed at the Six Senses, Douro Valley, and both passports disappeared. Of course I have no way of proving it, but it's 100% plausible, given the remoteness of the hotel and who might have had access to our room during turndown service.
Even the safes are not 100% reliable, but at least it's a stronger deterrent than hiding your valuables in your luggage.
Working in luxury travel and constantly booking clients at top properties all over the world, I've learned that people are people no matter how well trained and it can happen anywhere. I've had to deal with several reports of clients having items or money stolen out of their rooms over the years. Even happened to a client on a privately chartered yacht once (they caught the crew member). The most notable was a large sum...
Working in luxury travel and constantly booking clients at top properties all over the world, I've learned that people are people no matter how well trained and it can happen anywhere. I've had to deal with several reports of clients having items or money stolen out of their rooms over the years. Even happened to a client on a privately chartered yacht once (they caught the crew member). The most notable was a large sum of cash from Cheval Blanc Paris. Always always always protect and lock your belongings.