Quantcast

Security breach for recent CRC purchases. A heads up.

Inclag

Turbo Monkey
Sep 9, 2001
2,752
442
MA
http://www.theregister.co.uk/2011/03/17/cc_fraud_follows_bike_store_purchases/

A security breach at popular UK-based biking site chainreactioncycles.com has been linked by victims to multiple instances of fraud.

Various bike enthusiast forums are alive with complaints (here and here) from customers of the site, several of whom are reporting unauthorised charges on their credit or debit cards. The majority of fraudulent transactions reported seem to involve mobile phone top-ups to either Vodafone or O2, typically two transactions valued at £15 or so for a total fraudulent amount of £30. However, a small percentage of victims have been taken for thousands of pounds.
 

ustemuf

Monkey
Apr 8, 2010
198
15
Bay Area
ive ordered tons of stuff from crc recently..... but i've used paypal every single time.

sucks for those who get jipped.. but thats what fraud insurance is for.
 

-KB-

Chimp
Aug 31, 2010
22
0
Granite City
thats why you dont use credit cards.
That's exactly why I use credit cards and not debit cards. Credit cards (or most at least) are insured against fraud and therefore it shouldn't cost you a penny. Someone ran up almost 2K on my card but it hasn't cost me.
 

p-spec

Turbo Monkey
May 2, 2004
1,278
1
quebec
That's exactly why I use credit cards and not debit cards. Credit cards (or most at least) are insured against fraud and therefore it shouldn't cost you a penny. Someone ran up almost 2K on my card but it hasn't cost me.

winner,never been scamed,and aren't scare of because of insurance.Actualy I have been scammed but not a bike compagny,only localy with gas stations ( super popular for scams ).

Thats why I use my CC all the time,you cant access my bank stuff,and insurance.
 
Last edited:

buildyourown

Turbo Monkey
Feb 9, 2004
4,832
0
South Seattle
It shouldn't cost the customer anymore than a phone call and 5 min. My cc has been hacked 4-5 times in the last year. Everytime, I get a new card next day and all the charges are erased. Try that with your bank account.
 

sethimus

neu bizutch
Feb 5, 2006
4,960
2,177
not in Whistler anymore :/
That's exactly why I use credit cards and not debit cards. Credit cards (or most at least) are insured against fraud and therefore it shouldn't cost you a penny. Someone ran up almost 2K on my card but it hasn't cost me.
in the old world you normally pay by bank transfer. my bank offers an electronic tan generator (looks like a small calculator), in which i type in the account number i want to transfer money to. it generates a tan i can only use within 90secs and only works with this specific account number. if someone would phish this tan, he can't use it for anything. most secure thing in my eyes (as long as you don't lose the tan generator and the pin to your online banking account...) :thumb:
 

NWS

Chimp
Sep 19, 2010
66
0
thats why you dont use credit cards.
Actually, this is exactly why I use credit cards.

I've had mine poached a couple times in the last few years and it hasn't cost me a thing. Like KB said, most cards have fraud protection. If yours doesn't, you just need to get one through a bank that doesn't suck.

I did a couple of purchases through CRC in the last month, but if bogus crap shows up on my statement I'll just click the "dispute" button at my bank's web site and the problem will go away.
 

sethimus

neu bizutch
Feb 5, 2006
4,960
2,177
not in Whistler anymore :/
having the need of fraud protection is a flaw in the system. why using something with flaws? plus you always have to deal with your bank, waiting for new cards, the need to learn a new pin...

for everything offline = cash
for everything online = bank transfer

but better systems are on their way, 2 years from now most phones will have nfc...
 

NWS

Chimp
Sep 19, 2010
66
0
Do you have fraud protection when a bogus bank transfer shows up on your statement?

And how is NFC going to help with trans-Atlantic purchases?
 

Transcend

My Nuts Are Flat
Apr 18, 2002
18,040
3
Towing the party line.
having the need of fraud protection is a flaw in the system. why using something with flaws? plus you always have to deal with your bank, waiting for new cards, the need to learn a new pin...

for everything offline = cash
for everything online = bank transfer

but better systems are on their way, 2 years from now most phones will have nfc...
Giving someone your banking information is about the most INSECURE thing you could ever do.

NFC won't help with online purchases. It's called NEAR field communications for a reason. Near as in, 3 feet.
 

zdubyadubya

Turbo Monkey
Apr 13, 2008
1,273
96
Ellicott City, MD
or.....

my personal favorite. my bank has this online feature with a cc through the bank where you can generate a short-term fake cc. it will generate a fake cc number, expiration date, and card id code. all you have to do is choose a time of life (usually just enter 1 day) and a spending limit. i click generate and bam, I have a cc that is only usable one time for under a certain amount. the vendor doesn't even get my real cc info and i get my stuff worry free.
 

Udi

RM Chief Ornithologist
Mar 14, 2005
4,915
1,200
having the need of fraud protection is a flaw in the system. why using something with flaws? plus you always have to deal with your bank, waiting for new cards, the need to learn a new pin...

for everything offline = cash
for everything online = bank transfer
Your argument is great apart from the fact that you can't really do sh*t with a bank transfer these days. Maybe you don't get out much, but there are a LOT of things you can't pay for at all if you don't have a credit or debit card.
 

Eastern States Cup

Turbo Monkey
Feb 29, 2008
2,465
2
East Coast
or.....

my personal favorite. my bank has this online feature with a cc through the bank where you can generate a short-term fake cc. it will generate a fake cc number, expiration date, and card id code. all you have to do is choose a time of life (usually just enter 1 day) and a spending limit. i click generate and bam, I have a cc that is only usable one time for under a certain amount. the vendor doesn't even get my real cc info and i get my stuff worry free.
care to share the name of that bank, I may become a customer,:thumb:
 

sethimus

neu bizutch
Feb 5, 2006
4,960
2,177
not in Whistler anymore :/
Giving someone your banking information is about the most INSECURE thing you could ever do.
?????

do you know how a bank transfer in europe works? aparently not...

if i buy something, i'll get an invoice with the bank details of the receiver:

the giro number
the bank number
the name of the bank (not needed anymore as the bank number is unique)

so you go into your online banking application, type in the 2 numbers from above, the amount of money you want to transfer and a reference for the receiver. to complete the transfer youll need a tan number, something like your "online signature", some banks give you lists with them (unsecure), some have mobile tans youll get per sms on your phone (semi secure) or youll have a tan generator like me (secure). the whole process takes 1-2 working days but is normally the cheapest way to get stuff. most shops want a service fee if youll pay by cc, paypal or you let it ship by cash on delivery (very expensive).

where in this process do you give now your banking information to someone?

NFC won't help with online purchases. It's called NEAR field communications for a reason. Near as in, 3 feet.
i know, they'll replace the credit cards when you shop in a store, but i think cash is still the best way here, as it is non traceable -> does swift rang a bell? i dont want the americans sniff in my financial details, thank you very much.
 

sethimus

neu bizutch
Feb 5, 2006
4,960
2,177
not in Whistler anymore :/
Your argument is great apart from the fact that you can't really do sh*t with a bank transfer these days. Maybe you don't get out much, but there are a LOT of things you can't pay for at all if you don't have a credit or debit card.
show me one european based online shop that doesnt allow bank transfers...
 

DIRTWRKS

Monkey
Aug 13, 2003
615
0
Canada EH !
Issues are still ongoing at CRC , my card was just used for fraudelent purchases in Europe over the last 24 hrs ! I last placed an order with them on the 14th of March.
 
Last edited:

- seb

Turbo Monkey
Apr 10, 2002
2,924
1
UK
In which case DIRTWRKS, why do you say the issues are ongoing? Your details were obviously nabbed on 14th of March, not yesterday.
 

- seb

Turbo Monkey
Apr 10, 2002
2,924
1
UK
http://www.theregister.co.uk/2011/03/25/chain_reaction_fraud_follow_up/

also on 23rd march this was posted on other forums:

"Hi Folks,

Since our last communication, we have continued to carry out a full forensic investigation following recent reports and concerns from our customers experiencing credit card fraud after placing an order with CRC.
The independent forensic investigation has shown that our infrastructure was the target of a sophisticated attack which resulted in the theft of card details relating to a number of our customers. Details were being stolen ‘real time’ and only a small proportion of recent CRC customers were affected.

Recent customers of CRC may find that, as a precaution, their credit card company will issue a new card. Be assured that if this does occur it does not indicate that your details have been compromised.

The access point of the theft has been identified and permanently closed off so we are confident that we have fully addressed any weakness in our infrastructure.

We are sincerely sorry for what has happened in recent weeks and would like to thank you for your patience and support throughout this difficult period.

Our site is safe to use and will be continually monitored and tested by independent on-line security experts to ensure your details are safe.
If you have further enquiries about this issue please contact us on +44 (0)2893343758 between 9am – 5.30pm or email enquiries@chainreactioncycles.com and we will be glad to help you.
Thanks again for your patience and support,

Michael Cowan
CRC Senior Management"
 

DIRTWRKS

Monkey
Aug 13, 2003
615
0
Canada EH !
http://www.theregister.co.uk/2011/03/25/chain_reaction_fraud_follow_up/

also on 23rd march this was posted on other forums:

"Hi Folks,

Since our last communication, we have continued to carry out a full forensic investigation following recent reports and concerns from our customers experiencing credit card fraud after placing an order with CRC.
The independent forensic investigation has shown that our infrastructure was the target of a sophisticated attack which resulted in the theft of card details relating to a number of our customers. Details were being stolen ‘real time’ and only a small proportion of recent CRC customers were affected.

Recent customers of CRC may find that, as a precaution, their credit card company will issue a new card. Be assured that if this does occur it does not indicate that your details have been compromised.

The access point of the theft has been identified and permanently closed off so we are confident that we have fully addressed any weakness in our infrastructure.

We are sincerely sorry for what has happened in recent weeks and would like to thank you for your patience and support throughout this difficult period.

Our site is safe to use and will be continually monitored and tested by independent on-line security experts to ensure your details are safe.
If you have further enquiries about this issue please contact us on +44 (0)2893343758 between 9am – 5.30pm or email enquiries@chainreactioncycles.com and we will be glad to help you.
Thanks again for your patience and support,

Michael Cowan
CRC Senior Management"


I find it odd that they "CRC" would post this on a forum rather than directly on their web site or at least send out an email to clients that purcahsed during this time period to alert them to this potential issue. I even sent them an email inquring if my personal information was now save and never got a response back !
 

norbar

KESSLER PROBLEM. Just cause
Jun 7, 2007
11,368
1,606
Warsaw :/
or.....

my personal favorite. my bank has this online feature with a cc through the bank where you can generate a short-term fake cc. it will generate a fake cc number, expiration date, and card id code. all you have to do is choose a time of life (usually just enter 1 day) and a spending limit. i click generate and bam, I have a cc that is only usable one time for under a certain amount. the vendor doesn't even get my real cc info and i get my stuff worry free.

My bank gives you an internet card. The expiration date is long but it works a bit like a separate account - you have to transfer your cash on it for someone to be able to get paid with it.
 

- seb

Turbo Monkey
Apr 10, 2002
2,924
1
UK
I find it odd that they "CRC" would post this on a forum rather than directly on their web site or at least send out an email to clients that purcahsed during this time period to alert them to this potential issue. I even sent them an email inquring if my personal information was now save and never got a response back !
From their point of view that would be business suicide though - if the problem's fixed and 95% of your customers don't even know there WAS a problem, do you really want to go around highlighting it to them, and scaring a large percentage of them off, even though everything's now "safe" again?

CRC are sending out £30 vouchers "to those affected". Or more likely to "those who have realised they're affected and have contacted CRC" - which is the best they can do really...

...well, short of, as you say, putting a notice up on their site. Which would be nice, but I don't find it at all surprising that they haven't.