I bought someone a couch

[Murray20c8]

So, it appears a site I had been to many years ago was hacked and never told anyone.
They got that email address and password.
It is one of many passwords I use. I have about 100 sites that have usernames and passwords.
I don't use the same one on all sites, but it appears I used this one a few too many times.
The one I used on here was also discovered in a compromise (houzz . com).
I found this site to be helpful in checking all my passwords.
Anyway, I also normally do not leave my credit card info on sites except ones I use a lot like Amazon.
Well, I thought I could trust Walmart and I likely can, but I can't trust myself. I got too lazy.
So some script kitty discovered my email and password for Walmart and ordered a couch worth about $250.00.
I got an email Early Sunday morning 3:20 am from Walmart thanking me for my order.
I compared it with others I'd received from Walmart and the links were very short and unidentifiable so I thought it was a phishing scam and ignored it.
Later on Sunday I noticed the visa entry and immediately called Visa to cancel my card and report the fraud.
I also called Walmart late Sunday night and told them of the fraud and to cancel the order.
They said they did, but I got another email from Walmart telling me "Your order is on the move, Brandon"!!
So I looked up the address that Canpar is delivering it to and it doesn't exist! Weird! Who will receive the couch???
Is someone at Canpar the fraudster?

Anyway, my passwords have now all been checked and changed. It has taken me about a day to get them all changed and checked.
I feel like an idiot because I know better. I was a computer security officer for many years. I got complacent.
So, I tell all this just to advise. Don't be an idiot like me. While I do store my passwords in an encrypted password program I got lazy and used too many, too many times! I'll also never store a credit card on any site if I don't have to. This guy stumbled upon the one site that happened to have it.

Phew.....

 

[MKC8]

Online shopping can be a bonus or a bust. Too many websites can/do store the payment information, even though you only shopped as a guest, and they "promised" they wouldn't. Even sites like Amazon can fall prey to hackers, or theft of data by staff. Our beloved federal government recently being among them. Social media sites are probably the most hacked.
It's a crap shoot these days. I've been exploited twice in the last 5 years, and it was hard to tell exactly when/where. Theories only.
One card was used to purchase a Dexcom diabetes monitor in BC, and another paid for plane tickets and merchandise in Abu Dabi, Qatar, and Australia. The 2nd one was the hardest to recover from. The card company didn't believe me, and their reinstatement process was onerous at best. It's the sites that require you input your CVV/CSC numbers that cause the downstream problems. If someone gets and uses them, the purchases look legit, and that's a hard one to explain.
It was a few years ago, but the first card was probably physically skimmed at a public parking lot, on a well know London Ontario University Medical Campus, to pay for parking there. My best guess on the second card abuse may have been physically skimmed somewhere in the USA, at a Pay At The Pump gas pump, or other POS machine. I usually look for both, signs of tampering, but I'm no expert on what gas pumps or parking meters that accept credit cards should normally look like.

 

[KTJF]

It’s everywhere now. My corporate purchase card has been hacked 3 times in 2 years. For furniture in Australia, gift cards in Singapore and camping gear in Minnesota.

Being corporate card, never had hassle other than paperwork to fill but it sure is very common nowadays.

 

[Nik]

Password manager guys. Use it.

Ps. They didn't have couch in red

 

[MKC8]

Say it ain't so, Joe.......

 

[Nik]

Say it ain't so, Joe.......

It's a risk mitigation strategy never should be treated as 100% prevention.

Yes some are hacked (namely lastpass) but usually passwords are not leaked (or not leaked in a usable manner i.e. they are stolen encrypted) not to mention they do reach out to you to give us the deets (or should) after an attack. Your attack vector is still significantly lower than finding out after someone's bough their next vacay on your card.

 

[Murray20c8]

Password manager guys. Use it.

Ps. They didn't have couch in red

Do they even have couches in the C++ galaxy? lol
Third star on the right and on to morning.

 

[MKC8]

It's a risk mitigation strategy never should be treated as 100% prevention.

Yes some are hacked (namely lastpass) but usually passwords are not leaked (or not leaked in a usable manner i.e. they are stolen encrypted) not to mention they do reach out to you to give us the deets (or should) after an attack. Your attack vector is still significantly lower than finding out after someone's bough their next vacay on your card.

Thanks, but I'll take a pass on password managers. Just another false sense of security, usually for a price.
They can't protect you from online shopping theft/misuse of credentials, which is usually the point of failure.
Once the info has been handed over to the 3rd party online, you have no control over where it ends up, or how it's used, so you could say we should all stop shopping online, but we all know that isn't going to happen.

 

[Rruuff Day]

Do they even have couches in the C++ galaxy? lol
Third star on the right and on to morning.

Weird. My buddy at Canpar just called me and the couch he was selling me is no longer available.

 

[1st Vette]

I would think some of you will be familiar with this but for those that aren’t there is a site called “ Have I been been pwned “ where you can enter your various e-Mail addresses and check if they have appeared in any data breaches. 100% legitimate. Highly recommended. I would also personally recommend encrypted e-Mail clients such as Proton Mail . Developed by the scientists at CERN. These are the people who designed and built the Large Hadron Collider. Uses 256 bit AES encryption. Military grade. And of course a paid not free VPN . As well as a good password generator/manager . Bitdefender have an excellent one . If you really want to lock things down get a hardware firewall such as Sonic Wall and perhaps install PFSense and configure it, although that one could be tricky for most.

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

pfSense® - World's Most Trusted Open Source Firewall

pfSense is a free and open source firewall and router that also features unified threat management, load balancing, multi WAN, and more

www.pfsense.org

Proton — Privacy by default

Over 100 million people use Proton to stay private and secure online. Get a free Proton account and take back your privacy.

proton.me

https://www.sonicwall.com/

Bitdefender - Global Leader in Cybersecurity Software

Bitdefender is a cybersecurity software leader delivering best-in-class threat prevention, detection, and response solutions worldwide.

www.bitdefender.com

 

[Murray20c8]

I would think some of you will be familiar with this but for those that aren’t there is a site called “ Have I been been pwned “

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

I linked to this one above. Nice to see people who give a darn.

 

[DAL]

So, it appears a site I had been to many years ago was hacked and never told anyone.
They got that email address and password.
It is one of many passwords I use. I have about 100 sites that have usernames and passwords.
I don't use the same one on all sites, but it appears I used this one a few too many times.
The one I used on here was also discovered in a compromise (houzz . com).
I found this site to be helpful in checking all my passwords.
Anyway, I also normally do not leave my credit card info on sites except ones I use a lot like Amazon.
Well, I thought I could trust Walmart and I likely can, but I can't trust myself. I got too lazy.
So some script kitty discovered my email and password for Walmart and ordered a couch worth about $250.00.
I got an email Early Sunday morning 3:20 am from Walmart thanking me for my order.
I compared it with others I'd received from Walmart and the links were very short and unidentifiable so I thought it was a phishing scam and ignored it.
Later on Sunday I noticed the visa entry and immediately called Visa to cancel my card and report the fraud.
I also called Walmart late Sunday night and told them of the fraud and to cancel the order.
They said they did, but I got another email from Walmart telling me "Your order is on the move, Brandon"!!
So I looked up the address that Canpar is delivering it to and it doesn't exist! Weird! Who will receive the couch???
Is someone at Canpar the fraudster?

Anyway, my passwords have now all been checked and changed. It has taken me about a day to get them all changed and checked.
I feel like an idiot because I know better. I was a computer security officer for many years. I got complacent.
So, I tell all this just to advise. Don't be an idiot like me. While I do store my passwords in an encrypted password program I got lazy and used too many, too many times! I'll also never store a credit card on any site if I don't have to. This guy stumbled upon the one site that happened to have it.

Phew.. is t

So, it appears a site I had been to many years ago was hacked and never told anyone.
They got that email address and password.
It is one of many passwords I use. I have about 100 sites that have usernames and passwords.
I don't use the same one on all sites, but it appears I used this one a few too many times.
The one I used on here was also discovered in a compromise (houzz . com).
I found this site to be helpful in checking all my passwords.
Anyway, I also normally do not leave my credit card info on sites except ones I use a lot like Amazon.
Well, I thought I could trust Walmart and I likely can, but I can't trust myself. I got too lazy.
So some script kitty discovered my email and password for Walmart and ordered a couch worth about $250.00.
I got an email Early Sunday morning 3:20 am from Walmart thanking me for my order.
I compared it with others I'd received from Walmart and the links were very short and unidentifiable so I thought it was a phishing scam and ignored it.
Later on Sunday I noticed the visa entry and immediately called Visa to cancel my card and report the fraud.
I also called Walmart late Sunday night and told them of the fraud and to cancel the order.
They said they did, but I got another email from Walmart telling me "Your order is on the move, Brandon"!!
So I looked up the address that Canpar is delivering it to and it doesn't exist! Weird! Who will receive the couch???
Is someone at Canpar the fraudster?

Anyway, my passwords have now all been checked and changed. It has taken me about a day to get them all changed and checked.
I feel like an idiot because I know better. I was a computer security officer for many years. I got complacent.
So, I tell all this just to advise. Don't be an idiot like me. While I do store my passwords in an encrypted password program I got lazy and used too many, too many times! I'll also never store a credit card on any site if I don't have to. This guy stumbled upon the one site that happened to have it.

Phew.....

The scammer is ”trying-out” your card credentials with the Walmart order. If it works, he/she will then try to use it for their own use, such as at an ATM, etc. The Walmart transaction protects the scammer from arrest, etc. Cancel Your cards. Cheers!

 

[Murray20c8]

Kudo's to Walmart! After a few phone calls they decided to eat the cost of the couch.
I mean it was my fault, but I did call them the same day the order went in.
"Brandon" made the order at 3:20 am and I called then around 9 pm that day.
Walmart's policy is that the order can only be cancelled "within the first 30 minutes of it being placed."
I complained because I was asleep and there was no way I could cancel the order.
Perhaps they found my argument valid, but either way they removed the charge from my credit card.

I'd still like to know why and how Canpar could deliver the couch to an address that doesn't exist!

Brandon Hewitt
65 Mitchell st
Latchford, ON
P0J 1N0