Fraud transaction SBI CARD by Telstra prepaid

Hi,

I also got a transaction of USD 369 on my SBI card on 01-09-2017. I immediately blocked the card and I could see several declined messages for around two hours which means these transactions are done by some people who are trying to completely use the card limit and get the money to the possible extent.

Based on my research after the incident, any transaction on credit or debit card is normally by two ways.

Card present ( Swipe or Chip usage) - Authenticated by Signature or PIN

The hacker can steal the card data at any ATM or POS terminal and later prepare a duplicate card and do the transactions.

There could be some proof that the customer is not present at that location if such thing happens.

Card Not Present ( Over internet through CVV) - Authenticated by CVV number

All the payment gateways in India are now mandated by RBI to use additional authentication for CNP transactions and it is not necessary that the same is followed internationally by other countries.

I came to know similar experience with my friend for SCB credit card where the 35000 transaction was done through paypal and the Bank investigation reported that the transaction is done through CVV authentication method. He reported the transaction within 5 minutes but the bank said they cant even stop the transaction as it is not in their control as it is done through Master or Visa network.

Banks claim that CVV is not stored by them or known to them and they have closed my friends SCB case that customer lost the CVV credentials and bank is not liable to pay for CVV authenticated transactions even though the customer claims that he has not done the transaction.

Technically they are true to a large extent. Because all the internet transactions we do through our cards in India are also normally authenticated by CVV number at the first layer. The OTP or Secure Password is only a second layer of protection.

So the Technically CVV can be captured at any fraudulent payment gateway or if any payment gateway is compromised.

It is very rare that the card details are captured by the dispatch people and later misused. My SBI credit card is issued more than a year back when it is replaced by chip card.

Banks will always argue that the customer without knowledge might have used the card somewhere by which the details of the card are stolen by the hacker and legally it is just similar to a thief that steals money from our pocket.

Banks will normally say even if such transactions are not done by the customer, customer is liable to pay as the CVV number is not known or stored by them.

I have called all the banks for my cards and most of them can disable the magnetic stripe on the credit card which will limit the international transactions by duplicate card made physically at POS but they cannot stop any transaction that happens through the internet by CVV method.

I have verified this by testing some of my cards at google play store which will normally go through without asking for OTP. My friend claimed that only HDFC is preventing all international transactions ( CVV and POS) if we disable the international facility on the card. HDFC fraud protection team will call the customer if such transaction happens when the customer blocked international transactions. I have not tested this with SBI as my card is currently blocked.

As of now I have requested to replace all my cards as there is no proof that the compromise happened at SBI alone. It could be that the compromise might have happened at the payment gateway that normally SBI uses to authenticate its cards.

I am thinking to close all my cards and use only the virtual card provided by some banks even for transactions in India which will be valid for only one transaction or to the limit of the card preset while requesting.

Hope it helps

Thanks

Raja