Checking account hacked by Tagged member. 48 hours, no response from Tagged.

http://www.taeyoungwoo.com/checking-account-hacked-by-taggedcom-member-n

by taeyoungwoo • 14 years ago

50 37 14 years ago

jimminy• 14 years ago

"Because I had a debit card, I could not have more money withdrawn from my account than how much I had. Therefore, when this idiot tried to keep purchasing 200,000 gold, he/she was stopped. Thank God it wasn't a credit card--the bank would've eventually stopped the transactions from suspicious activity, but who knows how much money could have been taken from my account."

This seems to be a bit naive, credit-cards have far superior fraud protection, so no money is actually taken from your account, and it's easier and quicker to fix by the institutions.

[EDIT] As pointed out below, yes they both have the same fraud protection backed by a credit agency like Visa. However, if it's debit you lose cash and it can take up to several weeks for it to be refunded. That versus being out the amount of credit you can borrow for a few days.

A few years ago, with the debit he would have been at risk for possible overdraft or insufficient fund charges.

I keep a low-limit credit card($500), that would have the exact same characteristic that he is claiming makes the debit card better. This is the one that is used for the majority of my transactions.

InclinedPlane• 14 years ago

This is a persistent myth, but it's not really true. Many banks offer equivalent protections for debit cards as on credit cards.

bpeebles• 14 years ago

It's not a really a "myth". Both have zero or a small amount of fraud liability (i.e., they give you back all of the money, or all but say $50 of the fraud). But! If you have fraudulent activity on a credit card, you're out that much credit until they remove the charges. If they do that much fraud on a debit card, you're out that much cash out of your checking/savings account until they credit your account back.

I'd much rather have one of my credit cards less usable for a day or two than have the account I use to pay a lot of bills from drained for a day or two

alastairpat• 14 years ago

I don't know what it's like elsewhere, but here in Australia my Visa Debit card has exactly the same transaction protection system as a Visa Credit card.

apsurd• 14 years ago

As a rule, I only use credit cards. I have a debit card for the sole purpose of using ATMs.

In the case your card is lost or stolen, you aren't liable for any fraudulent purchases and the most important thing - you haven't actually lost any money; only the credit card company has.

I'd hate to have to jump through hoops and wait a month to get my money back. For a large percentage of the population, losing a couple grand quite literally means they can't eat or pay the rent that week/month.

Credit is great!

smsm42• 14 years ago

For many card transactions the credit card company would issue chargeback in the case of fraud for the merchant, which will end up losing money and paying additional fees. So the losing party is frequently not the CC company but the seller.

Losing credit can be a problem too, especially if one has regular bills coming through credit card, which are not problem regularly, but if part of the credit is frozen by the fraudulent activity, this may become a mess. I'm not sure how all banks behave during a fraud dispute, but they very well may reduce credit by the disputed amount until the dispute is resolved, even without the owner having to pay anything.

Anechoic• 14 years ago

However, if it's debit you lose cash and it can take up to several weeks for it to be refunded.

I know this is true in theory, but is it true in practice? I've had two debit cards used for fraudulent transactions (one a Visa debit issued by a local bank, the other a MasterCard debit issued by PayPal) and in both cases the money was returned within hours of my reporting the missing cash.

seabee• 14 years ago

When you have bills to pay, having to deal with the worst case is not a fun prospect.

calbear81• 14 years ago

Totally agree. I know it's a different situation in Europe/Asia in regards to debit vs. credit card usage, but I transact almost exclusively on credit unless it's under $5 because:

1) Cash Back - I get about 3-5% back on all of my purchases which adds up to a few hundred dollars a year in cashback money. 2) Fraud and Price Protection - I've had my card stolen twice and in both cases, I just reported the lost card and I had zero liability. I also have AMEX that gives you price protection and a longer warranty for free on things you buy. 3) Credit Building - You need to build credit so having at least two credit cards in good standing with a long account history is important. This makes financing a car/house much more easily later in life.

dsl3• 14 years ago

Tagged does not need to respond to you, and there is not a single thing they can say or do that will make the situation better for you even if they did. You've contacted your bank, opened a dispute, and now the issue is between Bank of America and Tagged (unless BoA contacts you for additional info).

Having your money stolen sucks dude. Keep your cool and everything will work out for you. Most of all, just try to remember you are not a unique and special snowflake - this happens thousands of times a day and everyone except you involved has established procedures for dealing with it. Let the fraud investigation and resolution run its course.

Maxious• 14 years ago

Maybe not for him but there's a lot they can do for themselves if they act fast - freeze the ill-gotten funds and make a profile of who they went to. Wouldn't direct contact with victims be faster and more rewarding for Tagged than waiting for business hours credit card industry processes?

devicenull• 14 years ago

And how do you tell someone who is actually reporting a legitimate issue, versus someone who's trying to piss off one of your users?

zeroboy2• 14 years ago

Protip: Don't work in an industry which requires interacting with people and getting their trust, "dude". You aren't cut out for it.

palish• 14 years ago

If that's how you feel, then there's no reason to post that here.

illumin8• 14 years ago

This is correct. It's not tagged that stole money from you - tagged is just a merchant that someone purchased gold at with your stolen wallet. You did what you're supposed to do and filed a dispute with your card issuer. Tagged most likely will end up losing the money due to the chargeback, so your anger is being directed at the wrong person.

You should be directing your anger to the individual who stole your Google wallet and made fraudulent charges. Did you turn on 2-factor authentication for your Google account yet? Did you at least change your password?

taeyoungwoo5• 14 years ago

I am trying to find out the identity of the person who made the fraudulent charges--that's why I contacted Tagged. Tagged should be able to quickly identify which user used my card information to purchase goods from their website. I sent them three separate requests as a follow-up of the three separate transactions made through Google Wallet, but did not receive a response for any of them.

Yes, I do have the 2-factor authentication and yes, I change my password quite frequently (and changed my passwords for all my accounts on various sites as soon as I found out about this).

cbs• 14 years ago

there is not a single thing they can say or do that will make the situation better for you even if they did.

In his case, even a form letter response saying how they generally respond to chargeableness would be make that situation better.

just try to remember you are not a unique and special snowflake - this happens thousands of times a day and everyone except you involved has established procedures for dealing with it

Did he really have to come to HN to find that out? Wouldn't it have been better if Tagged had told him that in the first place?

LVB• 14 years ago

I'd like to know if Mr. Woo had two-step authentication turned on for his Google account. (He mentions only that they, "gained access to my Google account.") It's the potential for this sort of damage, or much worse, that prompted me to turn it on and incur the slight nuisance of generating new keys every 30 days.

Good article on the far-reaching calamity resulting from a hacked email account: http://www.theatlantic.com/magazine/archive/2011/11/hacked/8...

drivebyacct2• 14 years ago

Is it even that much of a nuisance? Last Pass and two factor auth are no brainers for me. I ALWAYS have my phone with me so two factor is a given and Last Pass has mobile apps and lets me have a unique password for every single site. I honestly have a hard time taking people seriously if they're too lazy to use something as simple as Last Pass, etc.

videoappeal2• 14 years ago

1) Have you been using a shared computer? 2) Did you have a weak password? 3) Do you use same password (or a small pool of passwords) for most sites and service?

Answering yes to any of the above and you really should not be posting on HN

theDaveB• 14 years ago

So that means I shouldn't be posting on HN because I use a shared computer.

Are you on drugs or some kind of prescribed medication ?

Dave

videoappeal2• 14 years ago

I should add "Have you been accessing sensitive sites such as your Google accounts" on a shared computer." The HN reference was to distinguish if the poster's complaint was worth of a discussion or is it one of 100k+ people a day that get caught by keyloggers/phishing/social-engineering through their own stupidity (like accessing Google wallet on a shared computer)

taeyoungwoo5• 14 years ago

1) No 2) No 3) No

I rarely check my email or sign onto my Google account on any other computer.

andrewcooke2• 14 years ago

school internet turns off at night?! where is this?

amurmann• 14 years ago

That also was the most interesting part of the article for me. I would really like to hear more about that.

taeyoungwoo5• 14 years ago

Many independent high schools throughout the country (mostly boarding schools) have similar Internet policies, mine included.

andrewcooke2• 14 years ago

thanks (i was confused by the word "school" - the uk and us terms for school, college, university, etc, differ, and so i thought this was what a university rather than a high school).

hope you got/get your money back.

taeyoungwoo5• 14 years ago

First, thank you all for your comments--I just recently opened my first checking account so I am new to this whole credit/debit card business. It's great to receive feedback from people who know a lot more than I do about these issues.

Tagged contacted me today at noon (Sunday Feb 12), but NOT as a response to the direct contacts I made. They responded after reading my blog post (which I'm pretty sure they saw through HN or through Twitter). Interesting.

I have screenshots of all the transactions, which include the date/time of transaction and the order ID, and I sent this information to Tagged. They responded within 20 minutes saying that they are "looking into [their] systems to gain some clarity."

$200 of the $300 has been restored to my checking account, and I am still waiting for the final $100 to be returned. However, regardless of having the money returned quickly, I wanted to (and still want to) find out exactly who did this. That is why I contacted Tagged on top of Bank of America (which responded very quickly). Google Wallet advices to contact the seller directly about the orders, which I did.

To answer some of the common questions among the comments: yes I do have 2-step authentication for Google, yes I changed my password, and I rarely log onto my Google account on shared computers.

dangrossman3• 14 years ago

An IP address is not a person. Tagged doesn't know who did this, so they can't tell you. Even if they wanted to, they'd be violating data protection laws, their own privacy, and possibly their merchant agreement by giving out that information.

taeyoungwoo5• 14 years ago

Not an IP address--the user. A user account had to use my card info to purchase the goods. If Tagged can't tell me who did it, at least they can shut down that account for fraud.

I'm looking through Tagged's terms of service and privacy policy right now to see what their terms are on issues like this.

Checking account hacked by Tagged member. 48 hours, no response from Tagged.

Related Stories