Credit cards: criminals could still use them after they're cancelled

Many of us consider ourselves relatively savvy, keeping a close eye on our online banking, catching that suspicious transaction and frantically contacting our bank to stop fraud before it goes any further. The relief when our bank refunds our transaction, sends out a new card and the pride we feel when we have manoeuvred the fraudsters. Be aware, this may not be the end, this may just be the beginning.

Here's how non tech:

Recuring fraud can happen due to an invisible background technology called ABU (automatic billing updaters) this is run on Amex, Mastercard and Visa. They store your card details and pass them onto a network notification who then updates your subscriptions and wallet amongst other stored card services you have requested such as Netflix, Prime, Sky etc.

Here's how technical:

Recuring fraud can happen due to an invisible background technology called ABU (automatic billing updaters) this is run on Amex, Mastercard and Visa each have their own version (Visa account updater, and Amex Cardrefresher). These are secure, network level communication services that automatically update stored card numbers and expiry dates for participating merchants when a consumer requests a new card.

Card Changes: When your bank replaces your card (stolen, damage, fraud or update). It updates a central database.

Network Notification: The card network, Visa, Mastercard, American Express securely log changes in their global lifecycle repository.

Merchant Enquiry: Merchants or their payment processors (where you have saved card on file details for recurring subscriptions) check these networks for updates.

Profile Refresh: If an update exists the network passes your new card details safely behind the scenes.

This is convenient for the consumer, saves time avoids late fees and is completely free.

So how does the scam work?

Original Setup: When your card information is stolen scammers often store your card details on merchant websites and digital wallets, or use them for recuring subscription payments. Your first subscription payment may not have left your account at the time you spot the first fraudulent transaction.

The Cancellations: You report fraud, your bank cancels your old card & issues your new card.

The Auto Update: Next to prevent interrupted services and subscriptions your card network pushes your new card information to merchants.

Continued Fraud: The scammer saved merchant account or digital wallet allows them to keep spending your money.

A fraud researcher for Which? published an article about her experience.

Technical Knowledge is a must!

• Once your card has been defrauded ongoing vigilance is paramount. Watch your bank statements. Monitor spending notifications.

• The technical term for your card saved in a mobile wallet or on file in a merchant’s website, is a ‘token.’ If your card is scammed, request your bank checks if new tokens have been set up recently you should then confirm they’re genuine.

• Your card data can be stolen in data breaches, however it is more likely you have willingly entered your information via a scam website. Only save your card details online for essential subscriptions.