Back in June this year I received my Visa statement through the post but since I hardly use the card I left the letter on the desk for a few days. The balance isn’t that much and I had already set up payment to occur later in June. I also tend to access the account details via the web and had recently checked the status after my last online purchase.
I tend to make a purchase and then set up a payment for the same amount to occur the following month.
One of the reasons for doing this is that:
About a week later I was going through some paperwork and came across the statement and opened it in preparation to file it away. What I didn’t expect to see was the amount I reckoned on, plus another £3,750.
Having come down from the ceiling I began to wonder what I had purchased in the last few weeks for that amount and scanned the list for the £3,750. There it was against #BETFAIR LONDON back at the end of the month.
At that time I had never heard of BETFAIR but I think you could guess it was something to do with a Bookmakers. As it happens, since I have been watching the Test Cricket, BETFAIR have been splashed all over the place and even the blimp that provides the aerial coverage is sponsored by Betfair.
One thing I did know is that neither me or the wife had made a purchase with Betfair. I wasn’t really worried about it since I knew that I am extremely careful when it comes to online credit card usage. I also knew for a fact that this card had never left the house and was only used for online purchases.
I phone the credit card company who looked after my Visa account who promptly apologized there and then, and credited back any interest calculated on the amount and promised to begin an investigation. The following month the £3,750 was credited back to my account and there ended my responsibility for it. The credit card company had sent a questionnaire which I had completed and sent back and were conducting their own investigation.
After phoning them today to see how far they had gone with their investigations mainly because I wanted to know more about how this could have happened just incase I had contributed to it in some way. The only way I could think of this happening is if one of my previous online purchases had involved the credit card number being used by someone at that company. This narrowed it down to only two purchases that did not use the Verified by Visa process but after looking in to those companies it didn’t seem likely to me.
As it transpired, the purchase was made either online at the Betfair web site, or via the phone. Even the Visa company cannot be sure of that at this time. What they are sure of is that Betfair did not follow the industry accepted practice of customer verification. They only required the Visa Card number and didn’t have a name or address. This makes the credit card company think that one of the Credit Card Random Number generators was used to create a sequence of credit card numbers.
Most credit cards have a fixed number of digits followed by what is meant to be 10 random digits (which are in fact a known sequence, but its not meant to be known by you or I). Had Betfair requested other user identification the transaction would not have taken place since who ever made the purchase only had this ‘made up number’ and no other details. So the blame lies fairly at the hands of Betfair, who my credit card company will be claiming the £3,750 back from in the near future.
I would like to follow this up with Betfair and find out how they could allow this to happen. You can bet that for every person who finds an unknown amount on their statement, there are those that don’t bother to check their statements that closely. Obviously this was quite a large transaction and stuck out quite obviously, but how many people check ALL of their transactions. If you use your credit card a lot, as most people do these days, I doubt that all of use pay attention to the smaller purchases.
Just imaging you generated a million random credit card numbers and charged just a £1 to each of those accounts. It is not an amount that is likely to jump out at you when checking your statement but it soon adds up. Obviously it should be quite easy to follow the trail back to wherever the money is being paid into.
In my instance, I would like to know how someone can open a Betfair account, pay in £3,750 in credit and then use that account. How are any winnings paid? Into some foreign account that can’t be traced. This seems like a great method of money laundering, or in fact a nice litter earner for the fraudsters. I have not checked into Betfair too much, but I wonder how much information is required to open an account. I suspect that very little if any verification is performed, else this incident would never have happened in the first place.
I would say if you were going to Bet Fair, then they should play by the rules. I don’t believe them to be the only ones who are suffering from this problem either as there has been a large increase in this type of online activity in the past few years.
I will be writing to BetFair to see what they have to say about the matter, but I won’t be able to discuss the specifics with them because of the potential Police investigation being taken. It should be interesting to hear their side of the story… I’ll post more details when they get back to me.
I was interested to read this. My husband and I have discovered exactly the same thing as you this morning from our VISA debit card. Please let me know if you have any joy with Betfair.
I am not surprised that there isn’t much noise being made about this in the press.
In fact now that you have mailed me, I am going to create a report about it and forward it to Watchdog on BBC1.
Within a few hours of me phoning MBNA they credited the money back to me. (Or at least refunded the interest and stopped any more being claimed against it). It was less than a week before they refunded the full amount back to my account. All of this with no hassle to me what so ever, and appeared to me they were aware of this fraud.
From speaking to someone at MBNA who told me off record, because they don’t like to admit publicly what is going on, this is what I assume to be going on.
All companies that use VISA or credit cards are meant to perform a certain level of authentication when they accept Visa cards.
This can be card number, address, 3 digit code, address, name of holder etc. If they do that then they themselves have a level of protection against fraud.
In the case of Betfair, it appears that they don’t require much in the way of authentication. In fact, hardly anything other than a credit card number.
So what they think has happened is that someone, or a gang, has used a card number generator to create a series of credit card numbers. (There are simple applications that you can download off the web that create valid numbers. They might be valid accounts, but imagine it to be like creating a huge ring of keys… Not all of them will fit the lock, but there is a chance that a few will open the door).
Well it just so happens that the numbers they came up with worked for yours and my accounts. Which means they didn’t supply any other information other than a number to Betfair.
That is what they are saying off the record.
Now personally, I don’t think that is 100% true, because I can’t see them allowing a transaction without at least two methods of authentication.
The card in question in my case was one I specifically use for online purchases, so I keep a good eye on it. Now all of them bar one or two transactions were made through a verified by VISA process which pretty much rules them out.
I have a hunch that if you and I were to compare purchases made by our credit card, there would be a match somewhere. I reckon that someone has legitimately made a payment to my card and then kept a record of the card number, and one or two more pieces of info. Then at a later date, they have either sold off that information, or, used it themselves.
I mean how can you charge almost 4000 pounds and not checked up on whether it was valid or not.(US Keyboard, never have found the pound sign). Then you have the fact that where would any winnings be paid to? There must be some traceability. I could still 40,000 from just 10 people, and stick it all on favourites in every race and I am going to make a winner. I can’t lose because I never had anything to start with. Well that must pay the winnings somewhere. None of those details were released to me, because that could only come from Betfair. And they say they don’t have a problem with card fraud. Right…
Anyway, I am going to right this up and send it to Watchdog, or failing that, I’ll pick a few of the newspapers. People think Chip and Pin makes things safer these days, but all that stops is signature fraud. When did you last use your pin when you ordered something online or over the phone. You don’t need your pin when you pick up your tickets at the theatre or cinema. The only time you use chip and pin is when you are at the shop and use that instead of signing.
Progressive, hungry financial ‘power houses’ such as Betfair and Paypal seldom get the respective negative press their conduct truly warrants.
It is well documented that there are a number of sources which actively ‘sells’ credit card information, including name, address, card details and that 3 digit number on the rear of the card.
Quite how they get the information is beyond me, although even if one is ultimately refunded it most certainly does not cater for the experience of feeling violated when it does indeed happen to you, like it did me.
Getting credit card numbers is easy. I could post a list of valid numbers and names here in under 5 minutes.
The trouble is that companies such as BetFair don’t have proper validation processes in place to prevent the use of them. When all you have to provide is a name and a number, that doesn’t help. If you have to provide an address and some other details, then it gets harder to verify.
BetFair may well have tightened up their act now, but I have yet to see proof of that.
Do a google for credit card number generator and you’ll find loads of applications to create fake credit card details.
Once the bad boys find a site that has lax security they will attack it. It is pure bad luck if they happen to hit on your credit card.
Then of course there is the method of using credit card details found from a number of sources. Maybe you have shopped online and someone at that company has sold on your details. Or a system has been hacked somewhere in the chain and your details found. There are countless methods available.
The verified by VISA process is probably the best method of protection and all on line shops should use this and we the consumers should avoid those that don’t.
Well – boy am I pleased i found this. The exact same thing happened to me. £212.00 was taken from my barclaycard account and I had no idea who betfair was. I managed to find contact details on www and was told that I had an account a betfair and bets had been made on ‘austrian markets’? I checked numerous details with them, i.e. dob, email address etc all of which did not match my own and that my query would be passed on to the ID verification dept. It appears to me there is very little security with regard to opening accounts and any tom, dick or harry can have an account with someone elses credit card. Its also strange that no-one seems to have reported any financial gains received onto their credit cards so you must wonder, if these fraudsters are winning – where is the money going? Certainly not in my bank account/credit card thats for sure! 🙁