My dog woke me up this morning at 5:30AM for his morning walk, and as I was leaving the house I noticed I had 6 new SMS messages from last night. When I opened them, it took me a few seconds to make sense of it.
The messages all came in at around 10:58PM Kuwait time when I was already fast asleep.
- Your account has been debited with GBP 0.00 at 19:58:32PM
-
Your OTP for card ending with XXXX at Microsoft, 1249.99 GBP is XXXXX. Do not share etc..
-
There is insufficient funds in your account to authorize your transaction at 19:59:24
-
Your account has been debited with GBP 279.99 at 20:00:32
-
Your account has been debited with GBP 279.99 at 20:02:12
-
There is insufficient funds in your account to authorize your transaction at 20:03:15
Being half asleep because it was so early in the morning, I had to really work my brain to try and figure out if this was me or not. I’ve placed pre-orders before on things that get charged and shipped months later, and so I was trying to figure out if I might have ordered something from Microsoft months ago. I logged into my NBK bank app, clicked on my credit card and saw I had 0 pending transactions. I then assumed maybe this was my work’s credit card (I get those messages to my number as well) and that one of the employees might have been trying to purchase something for work.
But, I looked at the last 4 digits and it wasn’t the work credit card. Then it hit me, this wasn’t my credit card, it was my debit card! So I went back into the app, clicked on my debit card and checked under pending transactions, and sure enough there were two. This wasn’t me, so I called my bank up right away to report the fraudulent transactions.
The call lasted exactly 20 minutes which I think was a bit too long, at least for me that early in the morning while walking the dog. The first thing the bank did was lock my cards, lock my access to the app and online banking website, write a report up after asking me a bunch of questions, and then submit a request for a new debit card. In the next 24 hours, someone from the fraud claim request department is going to call me for more information.
I guess this was bound to happen eventually even though I’m really careful and smart about where I use my cards. But, I didn’t think it would happen with my main debit card since I never use that online. I don’t even use my debit card to withdraw money from ATM machine’s when I travel, I don’t even physically use it anymore since Apple Pay became available nearly 2 years ago! And thats whats confusing about all this.
If this was my credit card I can at least try and imagine how it might happened. I don’t use my credit card on dodgy websites, but I do use it online a lot so I can come up with plenty of scenarios on how someone could have gotten my credit card number. But my debit card? I have questions!
- This is a brand new card I was issued around 20 days ago
-
I don’t have my debit card number saved on any website since I use my credit card for subscriptions or online purchases
-
I just got back from a trip to Greece but I only used Apple Pay while there
-
I don’t use my cards to withdraw money from ATM machines when I travel so a card skimmer couldn’t have been used
-
Based on the messages I got, the bank requested an OTP number for the large 1249.99 GBP transaction. But the message right after says the order couldn’t go through because I had insufficient funds. Does that mean whoever tried using the card had somehow gotten the OTP number but the order didn’t go through because I didn’t have any money? Or does the bank ask for the OTP first and at the same time check to see if I have funds which is why I got both messages? I’m curious about that.
-
Finally, why did NBK allow the two other transactions without requiring an OTP or Pin code? It’s not like they were small amounts, they were 100KD+ each and I’ve been asked for an OTP for much smaller amounts
It’s really really odd, only because this was my debit card AND it’s brand new, I got it issued earlier this month. It’s the same old debit card number I’ve had for years, but with a brand new expiry date and CCV number. It’s been around 20 days since I got this new card so it isn’t difficult to know where exactly I’ve used it. Physically, like actually taking the card out and touching or inserting it into a machine, I think I’ve only used it at a couple of ATM machines, and only locally. That’s it. The rest of the time I’ve used it through Apple Pay. So, brand new debit card, with a brand new CCV number, how did they get it? I have a lot of questions to ask the fraudulent department when they call me!
Right now I’m leaning towards the idea that one of the ATM’s I used must have had a skimmer installed. I think I only used two ATM machines with this new card, a Warba machine inside a Trolley near me, and a Burgan Bank drive thru machine. So I might pass by them today and try and see if there is a skimmer installed, in case the bank’s hasn’t already found it.
Update: So I just got a call from the fraud department. The amount is still pending so they’ve submitted a claim to release it back into my account and I should get it in around a week. That’s the good news.
I then discussed how this could happen and although they’re still investigating, the person I spoke to seemed to be leaning towards the fraud happening online. He made it seem like ATM skimmers weren’t a thing anymore or at least they weren’t a thing in Kuwait because our ATM machines are newer and more advanced. I told him that it’s a new card issued just 20 days ago and I hadn’t used it online. He said he could see I used it with Talabat and PayPal. When I asked if they would inform me after their investigation where the fraud happened, he said they wouldn’t.
The bank would inform the other party about the fraud but not me. So for example if the fraud was due to Talabat having some sort of security leak, they wouldn’t tell me about it. I thought that was very odd.
Anyway, if I get more information I’ll update this post but I think for now they’ve considered the issue sorted with me. Other than my new ATM card and the amount refunded back to me, I don’t think the bank will be communicating anything else with me about this.
Update2: Looks like the issue might be with Talabat! A friend just sent me a link to an article on @dailyarabi that points to an article about a database belonging to Talabat being leaked.
Update3: I got my money back a week later.
