EDITOR’S NOTE: This is a bonus guest post from SideShowBob233 thrown together after another run-in with a bank.
After hearing about another recent incident with a similar result, I wanted to share my story and my lessons learned from having my American Express account hacked.
I woke up to a bunch of emails from AmEx showing my password was reset, my phone number was changed and there were some gift card redemptions. Not a pleasant thing to see, but I had to get the kids to school so I had to put it off. The emails were hours old anyway, whatever damage happened was already done.
When I checked later, I found the scammer had managed to reset the password on one of my personal Platinum cards, (because who doesn’t have more than one $695 annual fee card lying around under a pile of rakes?) get into my login, and apparently used chat to go to town (he – and I’ll refer to the scammer as he but it could have been a she as I’m all for equal opportunity scamming) seemingly had my 3 digit code from the back of the card and possibly my security word, but I’m not sure. Below is a redacted (to protect the innocent, or in this case the mildly guilty) chat log of the scammer’s interactions with AmEx:
2 AM local time, SideShowBob233 is snoring loudly while sleeping in a room filled with rakes:
Amex chat: Hi Bob, please select one of these options, or in a few words tell me what you need help with.
Scammer: Hi. My name is SideShowBob233 (the 233 is my IQ). I want to request my pending points to be available. I want to use them right now. I make all my payments through Autopay and all my payments are on time. I also have orange hair.
Amex: A Customer Care Professional will be with you shortly.
Amex: Hi Bob. This is Francis [likely not the Pope – but I wasn’t 100% sure]. I see that you are chatting to accelerate pending points.
Amex: Let me go ahead and review your account and also browse the internet while I make you wait.
Amex: Kindly verify the last five digits of the card in question and then when you last had sex
Scammer: 96969 and right now
Amex: Thank you. I am checking on it.
Scammer: Let me change that last answer as I’m already done 😬
Amex: Are you referring to the 69,420 points?
Scammer: Yes
Amex: I have accelerated pending points and it has been added into your reward points balance.
Scammer: Thank you kindly now can you help me scam some more?
Scammer: Can you help update my new office or business phone number on my accounts, cell number remains the same and I also want to use some of my Platinum card rewards balance and order 1 $69 egift card.
Amex: To update the number, I will help you to update it on the account.
Amex: Please share the business phone number you wish to add on the account.
Scammer: The online option does not seem to work, When I add the gift card to cart, the page keeps on loading
Amex: I kindly ask that you consider switching to a different browser, or alternatively, you may clear the cache, cookies, and browsing history of your current browser.
Amex: After doing so, please open a new tab and log into your online account once more; this should resolve the issue.
Scammer: I am not doing all of this right now. Can you just order it or I will try later?
[Note the angryish/insistent tone – red flag]
Scammer: XXXXXXXXX (his phone number – surprisingly NOT 1-800-SCAM-MER)
Scammer: This is the new business phone number
Amex: Do you have platinum card handy ending with 96969?
Scammer: I do
Amex: Perfect. To proceed, I will need to ask you a few security questions to ensure the process is conducted accurately on your account.
Amex: To protect your account security, please answer the following question.
Scammer: Submitted
Amex: To protect your account security, please answer the following question.
Scammer: Submitted
Amex: I have added the business number to the account.
Amex: I have ordered your $69 egift card. You will receive confirmation E-mail for the same and it will be available to use in next 4-24 hours.
Now some comments:
The scammer seemed to have had to have both the 4 digit code on the front and 3 digit code on the back of my card. Not clear how they got it as the card rarely leaves my house and in fact is almost never used. It was replaced recently, which is how I am guessing it was compromised – but I am not more than 69.420% convinced that’s the case. A swiper wouldn’t get the 3 digit code on the back but I guess if there was a camera there too, it could have. The card was used in person exactly one time, at a Saks a few weeks ago. Did not see anything on the card reader and I was there a while; our family likes to buy stuff at Saks for some reason (might be the large clown shoes they sell).
Now SideShowBob233 you say to yourself, again out loud while streaking through your backyard again because it’s the only way to talk over the voices you’re hearing in your head, how could you have prevented this? I have some ideas only some of which come from the voices in my head.
First, turn on two factor authentication in your logins. I always avoided it and complained extensively in the few cases where AmEx forced it on me (My friends, neighbors and even random hobos near Dollar General can confirm my complaining). No longer. Yes, it’s a PITA but it would have kept the scammer out of my login. Second, turn on 2FA some more. If you don’t know how to do level two 2FA, what are you even doing with your life? I mean come on dude.
Also change your security word periodically, I don’t know if the scammer had mine or not, but mine was a word nobody would ever guess (not, it’s not rake, not even with a 69 after it), if they did they would have had to have gotten it from Amex rep when I called in the past. It’s not something you’d know about me either. P2 doesn’t even know it.
Not many people are aware of it, but the AmEx card numbering scheme is very outdated, and there are not all that many unique numbers on AmEx cards. Losing your card and getting a replacement number gives a very predictable result, both for the new card number AND the expiration date, meaning the 4 and 3 digit codes are the only things that are really secure once your card number is compromised. This is likely what led to the tons of Facebook $2 fraud but who knows, maybe Zuck just needed a new island. So if a number is compromised consider losing the card 2-3 times to randomize it a little bit (both the replacement expiration date and the last digit).
My case had a (mostly) happy ending – AmEx apparently caught the fraud and invalidated the cards before I even called. After uploading a DNA sample, stool sample, and Clorox wiping down my scanner, my accounts were cleared and I am now free to go back into the AmEx void to be scammed again. My scanner still isn’t speaking to me though.
– SideShowBob233
SideShowBob233’s two factor authentication (level two) helps protect lunch.
BestBuy is generally the best choice for resale rates for manufactured spenders, but lately there are activation issues with certain BestBuy cards (those with serial numbers starting with FD seem fine, those in the 1124 batch are bad news bears). Other brands may be better choices for rookies.
The part that worries me the most about the shutdown is where all the volume is going to go, and what it’ll do to the next thing when it goes. (Thanks to Anthony, Sam, and mpohl)
– $50 back on $250+ at IHG properties in North America through August 26 – $100 back on $500+ at Opal properties in Florida by September 30 – $100 back on $500+ at Omni Hotels through September 12 – $100 back on $500+ at Wyndham properties through October 31
It’s been a while since we’ve played a round of the Breeze Route Dartboard Bingo™, so let’s call another route: Wilkes-Barre, PA – Fort Meyers, FL, or AVP-RSW for the ICAO geeks out there! If you’ve made a bingo, reach out for a 44% off of base fares promotional code on any Breeze route, including this one.
Have a nice Wednesday!
Spending $506.95 for a Swedish Fish shows that inflation’s already hit Big Gummy.
Giftcards.com has had a storied past with shopping portals, with rules that spanned the entire distance between “rewards on nothing” and “rewards on everything”, and plenty of stops in-between. Most recently, they’ve only awarded spend on a rolling $20,000 in purchases in a rolling 365 day period. Terms didn’t make it clear about whether that was per loyalty account, per shopping portal, per giftcards.com account, or something else. While science made progress in answering the question, the point is now moot because that weird language is gone. All the major airline shopping portals have reverted to the following terms:
Orders over $2,000.00 are not eligible. To qualify for rewards, you must complete your purchase within the same session you start the purchase without exiting your browser. Opening a new tab or returning later will result in rewards not tracking.
Changing it again is a bold strategy Cotton, we’ll have to see if it pays off for them.
Barclays+[Frontier,JetBlue,Arrival+]
Today, Barclays has both card linked and shopping portal offers for card holders under a program named “Barclays Simple Earn”. Maybe giftcards.com will show up here too? I’ve been able to find press releases about Frontier, JetBlue, and Arrival+ cards, but I’d be surprised if they don’t show up on AA and Hawaiian co-brand cards even though both will soon be leaving the Barclays portfolio.
Barlcays has had “Barclays Card Rewards Boost” for a long time, and from the outside it appears to be run by the exact same technology and backend provider as the US Bank shopping portal. My educated guess is that they’ll use the exact same thing for co-brand cards, so tricks that work at US Bank’s portal will probably work here too. (Thanks to David)
Southwest T-0
Today is the last day for the old Southwest way of doing things. Basically, you’ve got until midnight in who-knows-which timezone to do the following:
Book travel that includes free bags on all fares
Consolidate Ticketless Travel Funds (TTF) now, because they’ll have expirations if issued after today
Book Wanna Get Away or Wanna Get Away+ fares before they pumpkin
Convert LUV vouchers to flight credits which are transferrable and have no expiration
Add any companions to existing reservations to ensure they’ve got old-school benefits too
Thanks to Southwest guru Brian M for the comprehensive list!
Happy Tuesday!
Giftcards.com’s analysis team uses cutting edge technology to calculate its optimum rewards strategy.
I’m 100.000001% sure (aka fluz sure) that my travel patterns are different than yours, but I love the Accor program for Europe and I’ll be transferring in quite a lot as part of this promotion. (Thanks to VFTW)
Word on the street is that mortgage validation is an incomplete process, and so is reporting to credit agencies. I expect both of those things to tighten up in the future. They’ve added transfer partners for points earning too, with Finnair and Accor ALL being the most interesting.
Have a nice Monday friends!
View of the Mesa mortgage validation team’s workbench.
When this card was introduced, you could open eight of them at the same time, hit the minimum spend, and cancel all before the annual fees hit. Those days are long gone from Citi, but not every bank is Citi.
– 3x at grocery, transit, gas, and EV charging – 3x on a selectable category which is largely lame
If you want the Strata card, you’ll be able to apply on July 20.
Bank of America’s Alaska card’s bonus often bounces between 60,000 and 70,000 miles, and whenever it bounces there’s discussion. But, alaska75k.com has been around for a long time and continues to work. Can we stop talking about the other ones yet? [end micro rant]
Stop & Shop, Giant Foods, and Martins earn 10x points on Zift Zillions cards through Thursday. Their little step brother Giant earns 4x over the same time. No, Giant Foods and Giant being the same company but different isn’t confusing, why would you think that?
And with Target resale rates recently returning to 91%+, I think it’s safe to say the major brand bulk gift card reselling market has healed from its Pepper burns.
Blit Rewards* cut earnings on rent payments made with a credit card to 0.5x.
Note that linked cards can be unlinked in the future, but it does weird things to points held in your account and may inadvertently cause points expiration depending on your card portfolio. To be safe if you ever unlink, make sure every card has earned at least one point in the last 18 months.
*The company gets too much undeserved press, so (1) I’m not linking them, and (2) quoting reader Jim’s sage advice “I don’t care what the media says about me as long as they spell my name right.”
