Apparently it's a smart phone app that allows people to transfer money (similar to Paypal). And it has some serious security flaws - feel free to Google them.
So here's my story: my wife and I have never used it or even heard of it until Monday. I stopped at the gas station Monday afternoon and was told that my card was declined due to insufficient funds...... didn't make sense to me since I got paid last Thursday. My wife called the number on our debit cards and there were almost 20 transactions to Venmo, each were for between $50 and $75. Immediately we called our bank and explained to them what was going on and they cancelled my debit card (since the Venmo charges were coming from it). Then my wife called customer service at Venmo and told them that we don't use their services, nor did we authorize anybody else to take money from our account. The guy on the phone said he understands, and they wouldn't send to money to the person requesting it. He did say however, it would take "3 to 5 business days" to get our money back into our account.
The customer service rep did say that the charges were requested locally (so the thief didn't get my card info online), and the rep gave us the first name and last initial of the thief. The only places I used my debit card locally (for the past 2 weeks anyway) are a few gas stations, a beer distributor, and a hardware store. I'm generally pretty protective of my card, so I don't know how they could have hacked it...... nobody saw my pin when it was entered or the security code on the back. Only thing I can think of is the thief was able to use the numbers on the front of the card and opened a fake account on Venmo, and then requested money from my debit card.
I'll update this with information as I get it, but I wanted to get the word out.
tbh never heard of em. by chance does your debit have an rfid chip on it? (or is that a credit only thing?) btw if youve not already, get law enforcement involved.
Aaron
Yep - my card is chipped.
And the police are getting involved, believe me. Funny thing - the service rep "kinda" hinted that it wasn't necessary since the money wasn't fully transferred to the thief. We actually laughed and said "if it's a local that did it, what makes you think they won't do it again?".
I have heard of Venmo, but I don't use it myself. If I need to send anyone money, I just use paypal.
Sorry to hear about your card though. At least you didn't lose the money for good.
I've never used it before, and I'll steer clear. Thanks for the heads up.
One thing that gets a lot of people around here are "card skimmers" installed on gas pumps. I've seen close to a half-dozen reports of them locally in the last several months. The thieves open up the card reader on the gas pump, and install some device that records your card information when it is swiped at the pump. A best practice is to look for the security sticker that verifies the card reader has not been opened/tampered with. I tend to frequent one gas station where I know the employees are very diligent about monitoring the pumps.
from what ive heard, there are card scanners that a lloser would use. just has to be i think within a foot or two. shady ppl out there :technical:
Aaron
I just want to point out that it really isn't Venmo that is the problem here, it's that someone stole the OPs card info and then just happened to use Venmo to try and send money to themselves (or a dummy account). The app itself wasn't trying to scam them or anything. So, you don't need to try to "steer clear" of Venmo any more than you should steer clear of Paypal.
I absolutely QC. I'm should have phrased that differently.
It wasn't Venmo's fault per se, but their lack of security features allowed the thief an access point into my account. My bank (which has my cell #, email, DOB, social security #, etc) should have notified me that there was some type of portal into my account. So I look at it as a 50/50 split for the lack of security- my bank should have notified me as to the recent (absurd) charges, but Venmo should have pushed for some type of alert.
"You're about to be screwed out of $2,995 per week" would have worked wonders.
Quote from: qcbaker on July 06, 2017, 06:00:50 AM
I just want to point out that it really isn't Venmo that is the problem here, it's that someone stole the OPs card info and then just happened to use Venmo to try and send money to themselves (or a dummy account). The app itself wasn't trying to scam them or anything. So, you don't need to try to "steer clear" of Venmo any more than you should steer clear of Paypal.
Good point. In fact, it sounds like they've gone to some lengths to help solve the problem, which is more than you could say for some other companies who may or may not bother to help you out.
Quote from: Big Rich on July 06, 2017, 07:02:16 AM
I absolutely QC. I'm should have phrased that differently.
It wasn't Venmo's fault per se, but their lack of security features allowed the thief an access point into my account. My bank (which has my cell #, email, DOB, social security #, etc) should have notified me that there was some type of portal into my account. So I look at it as a 50/50 split for the lack of security- my bank should have notified me as to the recent (absurd) charges, but Venmo should have pushed for some type of alert.
"You're about to be screwed out of $2,995 per week" would have worked wonders.
A lot of banks seem to be rather lax about this sort of thing, except when it comes to credit card transactions. That probably has something to do with the fact that it's your money being stolen, rather than the bank's.
Quote from: Big Rich on July 06, 2017, 07:02:16 AM
I absolutely QC. I'm should have phrased that differently.
It wasn't Venmo's fault per se, but their lack of security features allowed the thief an access point into my account. My bank (which has my cell #, email, DOB, social security #, etc) should have notified me that there was some type of portal into my account. So I look at it as a 50/50 split for the lack of security- my bank should have notified me as to the recent (absurd) charges, but Venmo should have pushed for some type of alert.
"You're about to be screwed out of $2,995 per week" would have worked wonders.
I work in IT security, so I totally agree with you here. Both Venmo and your bank's analytics should have caught on to a sudden large amount of non-trivial transactions via an application you have never used before. That should have triggered their fraud alert and they should have called or texted you to confirm those transactions.
But, since I do work in this field, I understand Venmo's side of this and I'm not really sure that any additional security features would have prevented this particular instance of fraud. You didn't have an existing Venmo account, so the thief simply created a dummy account. No real way to prevent that. Two factor authentication and email alerts for password changes and the like (some of the stuff Venmo is missing) would have done nothing here. Then, if they had a robust fraud alert system, Venmo would maybe call the number listed on the account sending the money, but that would be the thief's, who would just confirm the transactions anyway. It's not like Venmo is going to ask you for your SSN and then try to confirm it with the bank. What if you have a legitimate reason to be using someone else's card (significant other/spouse, relative, or close friend offering to pay for you)? There's no surefire way to 100% verify the legitimacy of the transaction, since the thief had all the card info. And it does sound like Venmo was at least trying to help you set this straight (which, as far as I've read, is much more than they've done for other fraud victims). I mean, they gave you the alleged name of the thief (Which, if I'm being totally honest, is a risky move. What if it was someone you knew, and you decided to take matters into your own hands? Venmo would be at least partially responsible for whatever happened there...).
Venmo might have some legitimate security issues (again, I work in IT security, and I refuse to use Venmo lol), but I think that the bank is really the one you should be blaming in this instance. They're the ones who have the information necessary to
actually verify your identity. Their fraud alert system should have red flagged it.
Just so I'm being clear, I wasn't trying to imply that it was
your fault. I was merely pointing out that it wasn't really
Venmo who was scamming you, it was the thief who scammed you. They just happened to use Venmo to do so, and I don't really think there's too much Venmo could have done to prevent it.
Good luck, BigRich. Hope you get everything back and serve someone some justice!
Since relevant I want to plug an app called "Square Cash" that I've been using a lot lately.
It connects to your bank account and operates through your debit card. You need to make a profile for it and setup a pin and all the typical authentication stuff, and it seems at least as secure as PayPal and etc, but the advantage to Square is everything is instantaneous.
I use it to pay rent and often use it to "split a check" at restaurants (one person pays the whole check and all the other diners square them some money). I also use it to "pay it forward". Like, ask my sister to stop at Taco Bell while she's out and get me some burritos and a quesadilla, square her $10.
To send money you need to use a pin and it sends an immediate email/text to your phone saying where it went and how much you paid.
When you receive money you can cash out and the two options are a regular deposit that takes about a business day or an instantaneous deposit that costs IIRC 1% of the deposit. So I can send someone $100 and they can get $99 in their bank account almost immediately.
It's a handy little app.
i get the same results with paypal ( and its debit card) never a delay unless i forward/deposit funds to a bank account ( up to 24 hrs. usually sooner)
Aaron