14
votes
Is there a lookup tool for credit card leaks?
A few months ago, my credit card number was used in a few unauthorized transactions. The charges were reversed, and I got a new card, so overall, no big deal. But I am curious as to how the thief actually got their hands on my information.
Are there any lookup tools for leaked credit cards, similar to Have I Been Pwned, that might tell me how my credit card number was exposed? Since my card has already been cancelled, I don't even mind typing the number into a somewhat sketchy site.
Interesting discussion here about why HIBP doesn't index CC numbers:
https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6888992-include-credit-cards-as-another-search-dimension
Yeah, there are a lot of good reasons to not have such a service, so I understand hibp's reluctance to do so, but I am surprised that no one less legitimate has been willing to provide this.
Unfortunately, unlike passwords that can be different for each service to limit my exposure, I have to use the same credit card number everywhere, which means there's a non zero chance that whoever leaked my card number in the first place will get my new number and do it again.
If you're really worried & you're mainly referring to online payments, I'd say look into alterative payment methods. Either on the card side of things (e.g. temporary or prepaid virtual debit cards) or on the payment side of things (e.g. google/apple pay? IIRC they base it on tokens & your card info doesn't actually reach the site?). I've done both, myself.
Thanks, I should probably look more into the technicals of Google Pay. I used to use PayPal for this sort of thing online, but stopped using them after they made me jump through a lot of hoops for what should have been a very simple refund.
Some countries have national standardized payment services that let you pay online through your bank's mobile app without entering your card details. Russia's СБП, Dutch iDEAL and Belgian/Luxembourgish Payconiq are the ones I know (iDEAL and Payconiq will also be phased out in favor of Wero, which has already launched in Germany and is supposed to be Europe-wide). Having lived in Russia and the Netherlands, those systems are super convenient and the security benefit of not having to share your details is nice as well.
It's annoying to wait for a new card in the mail but you shouldn't be financially exposed in this situation anyway. It can help to use intermediary services like Google Wallet, PayPal, or pay in full Klarna, etc.
Some other ideas:
I love the brutal honesty on this page:
Large banks have gotten very good at finding sources of stolen card numbers through data science. I wouldn't worry about their losses when they refund the unauthorized charges.
I think the best way to deal with the annoying 1-2 weeks without a card is to just have more cards. As long as you can keep track of all of them, opening accounts can be a good way to earn some pocket money via sign-up bonuses--at least in the US, in other countries maybe it's not quite as crazy
I like the idea behind privacy.com, but unfortunately they don't support non-US customers. Seemingly, there are no banks in Canada that support temporary credit cards.
I have multiple credit cards, so losing one temporarily wasn't a big setback, I just want to be able to avoid this as much as possible in the future. Looks like Google Pay doesn't transmit card information to websites, so that might shield me somewhat.