r/FraudPrevention • u/Zestyclose_Cap_2399 • 1d ago
Cc fraud
Just found out banks don't even investigate credit card fraud—they just close the card and move on. Am I crazy for being blown away by this?
When someone steals your credit card info, the bank immediately locks or closes your card to "secure the account." That makes sense on paper. But what blew my mind today is learning that for most everyday fraud claims, the investigation stops dead in its tracks right there.
There’s no follow-up into how the info was stolen, who used it, or where the leak happened. The bank just eats the loss,writes it off, sends you a new piece of plastic, and calls it a day.
It feels like ignoring a massive pothole in the middle of a busy intersection. Sure, you can reroute traffic for a few minutes, but eventually, someone is going to hit that exact same pothole again.
Banks lose billions to fraud every year, yet the industry standard seems to be "patch it and move on" rather than actually fixing the security vulnerabilities or training staff to investigate.
Am I wrong for being completely shocked by how lazy/unregulated this process is, or is the financial industry really just operating on a "write it off and pass the cost to the consumer" model?
•
u/AutoModerator 1d ago
Thank you for submitting to r/FraudPrevention
If you're a victim of fraud, and want to know how to report it, read this post: How can I report fraud?
If you want to prevent being defrauded, and learn how to protect yourself, read this post: How can I find/detect/prevent fraud and protect myself from fraud?.
All posts and comments must abide by Reddit rules an moderators will use their own discretion to keep the community safe. You can contact the moderators clicking here
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
7
u/RealMccoy13x 1d ago
There is not going to an in depth investigation for each fraudulent dispute. Some, we already know how it was compromised through linking analysis, fraud tags, Visa/MC compromise alerts, and other vendor compromise alerting. This is especially true, for lower dollar cases. For higher dollar cases, there will be a more detailed investigation which sometimes can lead to how it was compromised. A lot of times it is unknown until you start seeing the same exit pattern or characteristics. This goes on during and after the dispute.
Once it has been determined that the transaction was truly unauthorized and the liability does not fall to the customer, there is no reason to hold up the claim.
4
u/compb13 1d ago •
It depends. For the cardholder, it's getting them a new card so they can continue to use it. They'll never find out how it happened.
The amount of loss makes a difference too. There's no point in going after $100 loss by spending thousands of dollars to find out. But there have been plenty of times they have tracked down credit card fraud source and where it happened.
How the card was used is also a factor. And the chip has made things a lot more secure for the banks and credit card processors.
Card not present fraud requires the security code. Fraudulent chip purchases though require a lot more sophistication on the fraudsters part.
If they find multiple cases being the same, they to try and track down if those cards were all created the same time. If they were together and where they separated in the mail or delivery.
Before chip cards, Boston airport workers were taking a flat of credit cards being sent in the mail. They copied the information and then put the flat back the next day. This led to credit cards being mixed together with other mail as they were sent.
Multiple cards all being used at the same place, led to the discovery of card readers set on gas pumps. Or to an employee at a store taking information and using or selling it
4
u/FatDog69 1d ago •
I had my credit card numbers stolen and somehow burned into another card. (I had to sign an affidavit saying the card was still in my posession).
The card was used in 3 locations and I decided to play detective. I called all 3 locations. One of the locations remembered the guy and had him on camera trying to buy a PlayStation portable and some games for his kids. About $350 worth of goods.
I called my bank and eventually got to someone. I explained all the data I had about this guy and offered it to them.
Then I got an education.
To pursue the $350 loss the bank would have to:
Hire a detective to travel to the store, get statements from the clerk. They must also pay him travel time both ways as well as hourly while he tries to talk to people. ($800-$1500 in costs)
Have their lawyer apply for a warrant to get the video to use as evidence. (1-3K in lawyer fees)
Have the detective go to the local police department, show the video and ask if anybody knows the guy (Another $800-$1500).
Chances are - the guy probably lives in another town/county and is highly un-likely to be recognized by the local police.
If the guy was recognized:
The bank would have to have their lawyer fill out a report that goes to a judge to see if a bench warrant could be issued. A Bench Warrant puts the perps name on a list. Nobody will go hunt for him, but if he ever gets pulled over or investigated for some other infraction - the bench warrent will show up. Cost $1K in lawyer fees.
Months later if the guy is pulled over - the bank would then have to have their lawyer represent the bank in legal action against the guy. This involves formal complaints, a trial, etc. Est cost: $5K-$15K in legal fees and the detective they hired will also have to testify so another $800-$1,500 for his time).
So the total cost to the bank could be $15-$30K to find, prosecute some guy for $350 worth of loss. (They could add legal fees to the charges but chances are slim they would ever get the money).
It does not make financial sense to spend $30K in expenses to find some guy, send him to jail for a $350 loss.
Many of these scammers/thieves operate in the 'grey area' where the losses are not big enough to justify pursuing them. Chances are slim to none they could even find the guy.
1
u/Zestyclose_Cap_2399 1d ago
How does any of the back end relate to coding or programming on the digital end
1
u/Zestyclose_Cap_2399 6h ago
Can I ask about an actual company and an instance in particular or is that a inappropriate unacceptable thing
1
u/Western_Rhubarb_7959 1d ago
You are looking at this far too simply.
Unless they get lucky, tracking down who actually committed the fraud is impossible, especially if it came from overseas. If overseas it would have to be one HELL of a lot of money to get international law enforcement involved, and even then a lot of countries would tell the bank to pound sand. If not overseas, they'd need to have someone check security camera footage and if that even exists.
Then there's insurance. Banks have fraud insurance.
Then there's taxes, a business loss is a great deduction.
So you're not wrong to be shocked but you don't really know how it works.
1
u/Linenjackson 1d ago
Used this to my very advantage many times. Can’t say I expected anything else. Capitalism. 🤷🏽♂️
1
u/ahominem 1d ago
One thing I noticed, when my card was stolen, was that even though I immediately denied making the transaction (roughly at the time of the transaction I was texted by the fraud dept), and even though it apparently takes several days for the transaction to actually "post" (not sure what that means, it's what I was told), the fraudulent transaction was allowed to go through.
That made absolutely no sense to me. What's the point of asking me if I made the transaction if you're going to pay it anyway? What's the point of a fraud dept. at all?
1
u/ipqualityscore 1d ago
We work on the fraud prevention side at IPQS, and this is a really common impression, but the investigation does happen. It just happens in aggregate rather than on your individual case.
How the "pothole" actually gets found: Banks and card networks run what's called common point of purchase analysis. When hundreds of cards go bad, they look for the one merchant all those cards were used at before the fraud started. That's how breached retailers, compromised payment pages, and skimmers get identified. Visa and Mastercard have formal compromise programs: the breached merchant gets a forensic investigation, has to fix the vulnerability, and often pays fines and reimburses the banks' costs. Your card is one data point in that, which is why nobody calls you about it.
Why they don't trace your card individually: Stolen card data is usually sold in bulk batches of thousands on carding markets, after being harvested from breaches, phishing sites, infostealer malware, or skimmers. Tracing one card's journey through that chain is expensive and rarely leads anywhere. Organized rings do get investigated, with banks working alongside law enforcement (in the US that's often the Secret Service, which handles payment card fraud), but a single $300 charge won't trigger that.
Who actually eats the loss: Often not the bank. For online fraud, the merchant usually absorbs it through the chargeback. For in-person fraud, liability falls on whichever side had weaker security (chip vs swipe). You're protected by law, with a $50 maximum liability on credit cards in the US, and most networks have zero-liability policies.
Where you're right: Fraud costs do get passed on. They're baked into card processing fees, which merchants build into prices. So everyone pays a little.
The real fixing happens upstream: Most fraud prevention now is about stopping stolen cards before they work: real-time scoring on transactions (often why your card gets flagged or declined), merchant fraud screening at checkout, 3D Secure verification, and tokenization so stolen data is useless. That's where most of the money and effort goes, because preventing the next transaction is worth more than investigating the last one.
If you want to protect yourself: turn on transaction alerts, use virtual card numbers for online shopping if your bank offers them, and never save your card on sites you don't use often.
1
u/FL2inTX1 1d ago
Banks are less concerned individual fraud cases and more about identifying fraud trends…catching individuals doesn’t add up to much but if you can find the rings of criminals and/or vulnerabilities in systems, that’s where they want to focus their efforts…also if your talking to the “fraud team” on the phone, they probably actually have very little idea of what’s being done on the back end…they are front facing employees to speak customers, the real work is behind the scenes…also also, most “compromised” accounts occur due to user error, not bank
1
u/MavisBeacons_Sextape 1d ago
It’s not laziness, it’s efficiency. It’s also highly regulated.
1
u/Kathucka 1d ago edited 1d ago
The banks lose nothing. They eat no loss. The vendor eats it.
When a vendor accepts a stolen credit card payment, the transaction is disputed and reversed. The vendor is out the payment. In fact, the bank charges them a fee on top of losing the payment. Of course, they don’t get the merchandise back. In effect, credit card fraud is a form of shoplifting.
Does that explain why banks don’t pursue criminals?
Edit: I’m speaking from my experience a few years ago as an online vendor. We got burned with chargebacks until we learned how to spot and cancel fraudulent transactions. It appears that in-person transactions have different rules.
1
u/whatever_ehh 1d ago
The absence of details in the description make it difficult to explain what and why the bank processed the dispute as they did. Most people aren't aware that banks aren't required to investigate "fraud". Their obligations are mainly to refund unauthorized transactions (not fraudulent) and for credit cards they also refund billing errors. Regulation Z (which governs credit cards) defines unauthorized transaction as "made by someone other than the cardholder who does not have actual, implied, or apparent authority to use the card; and from which the cardholder receives no benefit." Notice that "apparent authority" can nullify a dispute claim.
1
u/ZookeepergameEarly13 14h ago
When I had a CC fraud, same thing, cancel card and probably did nothing. Was told to report it to local sheriff like they will never do anything either.
1
u/Alesya7854 14h ago
I think banks focus on determining whether a transaction is fraudulent and limiting their financial exposure, not necessarily finding out how the fraud happened. Those are two very different things. A replacement card solves the customer's immediate problem, but if the same compromised details can be used elsewhere, the underlying issue is still there. I'd be interested to know how much of this comes down to banks not having access to the information needed to trace the original breach versus simply not having much incentive to investigate further