Scam (compromised security) regarding Amazon Prime

Snickers Man · 24-01-2018 12:13pm #1

Having a slight problem with Amazon and the situation is ongoing.

Noticed on my bank statement that a regular debit has been taken for the past few months for Amazon Prime, which I never asked for.

I know of somebody who had unwittingly signed up for this service when making a one-off purchase from Amazon and found themselves paying for Prime for about a year without ever availing of it. But in their case, they had clicked the wrong button (or not clicked the right button) and had received e-mails from Amazon telling them they were now signed up for Prime and gave instructions how to access, or cancel, the service. It was my friend's mistake, in other words.

Thinking that I might have done the same after buying a book from Amazon some time ago, I checked my email logs for info on how to access Amazon Prime. Found nothing.

So I got on to the Amazon website, found the help page and accessed the form whereby you can query a suspicious payment. I gave details of the dates and amounts that had been deducted from my bank account and demanded to know how this had happened.

To be fair, I got a phone call within a few hours from an Amazon employee (with an Irish accent, not an Indian one. Kudos!) and together we investigated the issue. He found that the request for Amazon Prime came from another email address, not mine.
I asked him what it was; he told me that under data protection laws he couldn't tell me!
I replied that surely he could, after all, the money was coming out of MY bank account.
He told me he couldn't and furthermore, because it was not my e-mail address he could not accept my instruction to cancel the service!!
Instead, he said I would have to contact my bank to cancel further payments; which I did.
He also informed me that I would have to go through my bank to instigate a process whereby I could be reimbursed for the payments which Amazon admits, in a subsequent e-mail to me, that I did not authorise. He also suggested I cancel my card and ask for a new one to be reissued, which I have done but that is a pain in the arse.

Has anybody else experienced this? If you ever purchased anything on Amazon, you might want to check your bank statements to make sure there are no surprising payments being made to Amazon Prime.

This is clearly a malicious action by a rogue party and not by Amazon themselves, who have been helpful if frustratingly legalistic in dealing with the matter. I am being sent from pillar to post (or bank to Amazon and back again) to sort things out.

I'll keep you posted how things work out but I'm just wondering if anybody else has experienced this.

The_Valeyard · 24-01-2018 1:28pm

I think if you do not use Amazon Prime within that year, you are refunded or if you get rid of it without using it, they refund you.

I purchased an item within the trial period, but then forgot to cancel it afterwards. About five months later, I cancelled it and got a full refund as I had not used the service.

me_irl · 24-01-2018 1:30pm

Snickers Man wrote: »

Has anybody else experienced this?

No... never.

Riveting story though.

Needs a cliffhanger.

Mr. Incognito · 24-01-2018 1:31pm

How did a random email authorise payments from your card?

This sounds fishy

I'd make a data access request for your information they hold

me_irl · 24-01-2018 1:32pm

Mr. Incognito wrote: »

How did a random email authorise payments from your card?

This sounds fishy

...or phishy... eh? EH?

The_Valeyard · 24-01-2018 1:44pm

me_irl wrote: »

...or phishy... eh? EH?

*SLAP*

Fr_Dougal · 24-01-2018 1:51pm

How could someone with a different email address order something on your behalf? It doesn’t add up.

If Amazon provided the service to a 3rd party, the onus is on them to refund you. It really sounds as if they have been breached in some way. Might be worth your while contacting the Data Protection Comissioner.

razorblunt · 24-01-2018 2:04pm

You have one account that's linked to one email. Why would Amazon allow a second, none registered email address to invoke Prime?
That's not your fault or then bank's fault it's theirs.

Snickers Man · 24-01-2018 2:23pm

The_Valeyard wrote: »

I think if you do not use Amazon Prime within that year, you are refunded or if you get rid of it without using it, they refund you.

I purchased an item within the trial period, but then forgot to cancel it afterwards. About five months later, I cancelled it and got a full refund as I had not used the service.

Useful to know. I'll tell my friend that. Thanks.

Snickers Man · 24-01-2018 2:31pm

Fr_Dougal wrote: »

How could someone with a different email address order something on your behalf? It doesn’t add up.

If Amazon provided the service to a 3rd party, the onus is on them to refund you. It really sounds as if they have been breached in some way. Might be worth your while contacting the Data Protection Comissioner.

I don't know. It's worrying. As I find out more, I will update. But if you have ever bought something in good faith from Amazon, it might be worthwhile checking your bank statement to make sure it's not happening to you.

I do subscribe to some online services (eg Microsoft 365) which deduct monthly payments from my account but they all follow the best practice of e-mailing me in advance to notify that they intend to debit my account, which I have previously authorised, and offering me the opportunity to cancel.

In the case of the Amazon scam, of course, given that the email account which requested the service is not mine, I get no such warning.

Checking bank statements is the only way to discover it.

irelandrover · 24-01-2018 2:35pm

It sounds like it has nothing to do with Amazon. Someone got you card details and used them on Amazon. Amazon do not know that they dont have authorization to use them.

They could have used them on any website. Check your account for any other suspicious transactions and cancel your cards immediately would be my advice.

Snickers Man · 24-01-2018 3:13pm

irelandrover wrote: »

It sounds like it has nothing to do with Amazon. Someone got you card details and used them on Amazon. Amazon do not know that they dont have authorization to use them.

Well it's the only suspicious payment to come out of my account so if somebody had my cards they would probably have gone to town on cleaning my account out, no?

It seems at this point in time to be a security breach within Amazon and that somebody was managing to divert the Prime Service to themselves while diverting the payments to me.

I have stated already that Amazon have been quick to respond to my alert and have advised on steps to take to rectify it. It's a bit frustrating that I have to cancel my cards and go through my bank for restitution but that's all in train now.

I was just wondering whether this was a common scam and whether anybody else here had experienced it. I'm not blaming Amazon for the fact that some droid is abusing their systems; it's how they rectify it that counts.
So far they have been co-operative. I'd still like to know what exactly happened though. If they tell me I'll pass it on.

irelandrover wrote: »

Check your account for any other suspicious transactions and cancel your cards immediately would be my advice.

Way ahead of you

Spear · 24-01-2018 3:58pm

Snickers Man wrote: »

Well it's the only suspicious payment to come out of my account so if somebody had my cards they would probably have gone to town on cleaning my account out, no?

No. Because large or sudden spending will trigger checks by the card issuer, if not blocked outright immediately. Someone intended this to fly below the radar and be a long term thing.

Snickers Man · 24-01-2018 4:55pm

Spear wrote: »

No. Because large or sudden spending will trigger checks by the card issuer, if not blocked outright immediately. Someone intended this to fly below the radar and be a long term thing.

Point taken. Still, 10 euro or so a month over a long period which only increases the chance of being caught doesn't sound like the most profitable return for a serious fraudster.

And the only benefit they are getting is free Amazon Prime. Hardly resellable, is it?

Sounds like an opportunistic small-time scammer who found a way to get hooked up to an online TV service and have the payments directed to me.

Just how they did it though, I'm not sure. But I'd love to know.

ytpe2r5bxkn0c1 · 24-01-2018 4:57pm

Snickers Man wrote: »

Point taken. Still, 10 euro or so a month over a long period which only increases the chance of being caught doesn't sound like the most profitable return for a serious fraudster.

And the only benefit they are getting is free Amazon Prime. Hardly resellable, is it?

Sounds like an opportunistic small-time scammer who found a way to get hooked up to an online TV service and have the payments directed to me.

Just how they did it though, I'm not sure. But I'd love to know.

They are testing the water with the card, possibly.

Snickers Man · 24-01-2018 4:58pm

Heath Brave Translator wrote: »

They are testing the water with the card, possibly.

Happy to report it's just dried up in that case

dulpit · 24-01-2018 5:02pm

I used work for Amazon CS way back. Prime was a pain in the neck, the amount of people that used complain of it being a scam/etc when they had signed up for it was unreal.

This particular issue sounds like 1 of 2 options:

Somebody else you know (parent/child/spouse) has your card details. They signed up for Prime (deliberately or unwittingly) using your card, on their account.
Your card has been scammed, and the person who scammed it used it just to get Amazon Prime...

Check with friends/relatives first.

Caliden · 24-01-2018 5:06pm

Sorry to say but you definitely signed up for it.

Most likely while making a purchase and you clicked without reading.

Metric Tensor · 24-01-2018 5:07pm

Do you have kids (or other family members) who might have your credit card details OP?

One of them could have ordered Amazon Prime either by accident or on purpose! They make it easy to sign up to if the card details are already saved on an account.

You get the first month free so subtract a month from when the first payment was taken for an approximate date of when someone clicked subscribe. (That might have it happening right around the Black Friday "sales" or Christmas shopping)

Snickers Man · 24-01-2018 6:10pm

Caliden wrote: »

Sorry to say but you definitely signed up for it.

Most likely while making a purchase and you clicked without reading.

Nope. Definitely not. As explained in OP, I know somebody who did and thought that's what I MIGHT have done. But it's not what happened. Amazon have acknowledged that in writing. It was an e-mail other than mine that made the request.

As for friends/family: well I can ask my obstreperous kids, but I don't think they would have. And if they say they didn't, I can't check because Amazon can't/won't tell me the name of the e-mail that made the request.

I sense some defensiveness. I'm not here to have a go at Amazon. They responded promptly and have been helpful, if pernickity. I hope they can tell me at some stage what is likely to have happened. It has spooked me about making online purchases. But I'll get over it, hopefully

MOH · 24-01-2018 6:13pm

Caliden wrote: »

Sorry to say but you definitely signed up for it.

Most likely while making a purchase and you clicked without reading.

How does that make any sense when Amazon CS have confirmed it's not the OP email address?

Franz Von Peppercorn · 24-01-2018 6:14pm

Snickers Man wrote: »

Nope. Definitely not. As explained in OP, I know somebody who did and thought that's what I MIGHT have done. But it's not what happened. Amazon have acknowledged that in writing. It was an e-mail other than mine that made the request.

As for friends/family: well I can ask my obstreperous kids, but I don't think they would have. And if they say they didn't, I can't check because Amazon can't/won't tell me the name of the e-mail that made the request.

I sense some defensiveness. I'm not here to have a go at Amazon. They responded promptly and have been helpful, if pernickity. I hope they can tell me at some stage what is likely to have happened. It has spooked me about making online purchases. But I'll get over it, hopefully

Odd that people dont believe you. I think they didnt really read the original post and assumed you automatically signed up for prime ( like so many others) because theres a Big Green button asking you to evertytime you buy something, and a small button for normal purchase deliveries. Plus clicking that will automatically create the subscription since they have your details.

In this case the email was different so it has to be someone with access to your credit card, and it probably is family. Sorry.

kneemos · 24-01-2018 7:21pm

Why would they bother with Prime on somebody else's card?

dirtyden · 24-01-2018 8:31pm

This sounds very unusual.

Why would someone scam your card for amazon prime? If they use it for shipping or content they can be traced straight away. Makes absolutely no sense. Would be an incredibly dumb crime.

It must be someone you know? Is it possible that your card details were remembered by your internet access device and someone using it accidentally submitted an order using your card details?

STB. · 24-01-2018 8:34pm

Its fraud and I am guessing when you contact your bank they will contact Amazon to ask for the supporting documentation. I am guessing that Amazon wont have it!

Just like this exact same case

Hmmm I wonder have Amazon had a data loss that they are telling no one about. Somebody certainly has.

Data protection legislation does not excuse fraudelant transactions.

Snickers Man · 24-01-2018 8:46pm

STB. wrote: »

Its fraud and I am guessing when you contact your bank they will contact Amazon to ask for the supporting documentation. I am guessing that Amazon wont have it!

Just like this exact same case

Hmmm I wonder have Amazon had a data loss that they are telling no one about. Somebody certainly has.

Data protection legislation does not excuse fraudelant transactions.

Well my bank has, as they promised, reimbursed me for the three payments that were taken from my account. They did say they would probably be in touch as they follow up with Amazon.

I am very curious to learn how this happened. The "Friends or family" argument is highly unlikely. Nobody in the family is using Amazon Prime, so far as I can see. It certainly never appears on the TV. They all deny using my card and I believe them.

Also, my computer stays where it is in my office and everybody has their own PC/tablet anyway so the inadvertent use of my computer to purchase something using my "remembered" card is unlikely.

Besides, data protection rules or not, I am sure that if the Amazon support person to whom I spoke noticed that the email address had the same surname as mine they might have mentioned that use by a member of my family was the most obvious explanation.

I'm really curious as to how it happened and it seems I am not alone, or so that Independent report from three years ago would suggest.

I will update when I get any more communication from Amazon or my bank. I've been reimbursed and have killed by old card. So I'm relieved but still want more info.

Metric Tensor · 24-01-2018 8:52pm

Sorry if you took my post as an accusation OP. None intended. I just know what happens with kids sometimes!!!

STB. · 24-01-2018 8:59pm

Snickers Man wrote: »

I am very curious to learn how this happened.

Make sure that there are no family accounts linked to your card. This is like a guarantor system whereby Account 2 can be accessed if Account 1 has no funds.

Amazon have been in trouble in the past for reactivating prime accounts even though they are not live.

If no family member has ever associated your card with their amazon account this should not happen. Did you have an old email address previously associated with an amazon account ? You need to check that too. Something is compromised. Amazon should at the very least be able to tell you where the prime was accessed from....

Passwords change em all. Keep an eye on transactions on your new card.

kneemos · 25-01-2018 12:40am

I think Prime is the key here. The part where Columbo would stop and turn back with his finger raised.

dulpit · 25-01-2018 5:24pm

Snickers Man wrote: »

I am very curious to learn how this happened. The "Friends or family" argument is highly unlikely. Nobody in the family is using Amazon Prime, so far as I can see. It certainly never appears on the TV. They all deny using my card and I believe them.

I would be close to 100% certain that somebody you know used your card for something on their amazon account. At the same time they inadvertently enabled prime trial, which will kick in fully if you don't cancel. It's also possible you did this yourself using a different email address in error.

Snickers Man wrote: »

Besides, data protection rules or not, I am sure that if the Amazon support person to whom I spoke noticed that the email address had the same surname as mine they might have mentioned that use by a member of my family was the most obvious explanation.

Nope, data protection would prohibit them from saying this, the best they could do is tell you its a different email address and/or name.

I say both of these things as a former amazon employee, it's based on experience.

Snickers Man · 27-01-2018 7:47pm

dulpit wrote: »

I would be close to 100% certain that somebody you know used your card for something on their amazon account. At the same time they inadvertently enabled prime trial, which will kick in fully if you don't cancel. It's also possible you did this yourself using a different email address in error.

I'm close to 100% certain that this is NOT what happened in this case. I could verify it very quickly if I could only learn what e-mail address was being used to authorise spurious payments from my account. I am mystified as to why Amazon can't tell me this.

Why is it a matter of Data Privacy that I am not allowed to know who is authorising payment from MY OWN ****ING BANK ACCOUNT??

Maybe it is one of my kids acting the bollox and lying about it to me. But why should I be in the position of holding my little treasures up to suspicion for this if I am being prevented from learning information that would easily exonerate them?

I don't understand the logic at all.

Maybe a letter to the Data Commissioner is in order.

Franz Von Peppercorn · 27-01-2018 8:06pm

Snickers Man wrote: »

I'm close to 100% certain that this is NOT what happened in this case. I could verify it very quickly if I could only learn what e-mail address was being used to authorise spurious payments from my account. I am mystified as to why Amazon can't tell me this.

Why is it a matter of Data Privacy that I am not allowed to know who is authorising payment from MY OWN ****ING BANK ACCOUNT??

Maybe it is one of my kids acting the bollox and lying about it to me. But why should I be in the position of holding my little treasures up to suspicion for this if I am being prevented from learning information that would easily exonerate them?

I don't understand the logic at all.

Maybe a letter to the Data Commissioner is in order.

I agree that there should be some way to get that information.

You do seem to be certain that it wasn’t your own family for unknown reasons. To me it’s almost certainly your family, as I don’t see why some thief would steal a credit card just for one purpose.

Snickers Man · 29-01-2018 12:41am

Franz Von Peppercorn wrote: »

To me it’s almost certainly your family, as I don’t see why some thief would steal a credit card just for one purpose.

You see, you have just cast an unproven slur on my family right there. Don't worry. I'm not going to hunt you down and prosecute you. I'm not angry with you in the first instance. I'm angry first of all with whatever scrote tried to rip me off and second of all with Amazon for not letting me know (so far) the identity or at least the email address of whoever did it.

As for "why would they only rip me off for one purpose", some plausible explanations for that have already been given earlier in the thread.

SteelyDanJalapeno · 29-01-2018 1:28am

It was more than likely somebody you know. Who's gonna steal Amazon prime, it's shiit.

Go a month back on your card statements from the 1st bill date, and check what was purchased a few days either side.

Franz Von Peppercorn · 29-01-2018 1:46am

Snickers Man wrote: »

You see, you have just cast an unproven slur on my family right there. Don't worry. I'm not going to hunt you down and prosecute you. I'm not angry with you in the first instance. I'm angry first of all with whatever scrote tried to rip me off and second of all with Amazon for not letting me know (so far) the identity or at least the email address of whoever did it.

I’m impressed that you are not going to prosecute me for implying that your pseudonymous self and your family might have access to your credit cards in a situation where a credit card “fraud” situation happened. Thanks. But you can’t defame pseudonyms. You asked a question here and you don’t like the answer. Tough.

As for "why would they only rip me off for one purpose", some plausible explanations for that have already been given earlier in the thread.

What plausible situation?

I’ve had my credit card details used 3 times. In all cases I was defrauded of significant money. Averaging about 300€. In all cases I was fully refunded as it was clear I wasn’t in Russia or New York.

That’s how credit card fraud works. Fraudsters don’t do it to sign up to a 7€ a month service which is going to be discovered within a month when they go to the trouble of stealing credit cards. They act fast too. If they get one purchase that works - typically for a dollar or a euro - they will buy as much as they can in the next few hours until the system catches them.

It’s someone you know.

Franz Von Peppercorn · 29-01-2018 2:04am

Also if there’s fraud on your account you should recover the money not just cancel the card. The banks will do that without opposition provided you sign a document later (they’ll give the money back first) in which you sign that you are certain that the money you recovered was fraudently stolen by illegal use of your card. There will be a list of fraudulent transactions. The document is clear that if you lie or overclaim it is itself fraud.

Then it becomes a criminal case. A british policeman called me in a case where I signed that document as he wanted some information on a restaurant I had visited the day before. That’s all I heard but presumably some worker was scanning cards.

This will solve the amazon issue as the police will be able to get the details and if any case is brought you may be called.

So if certain it’s not family that’s the route to go. You get your money back and scrote is jailed. You seem certain so you should do this.

Scam (compromised security) regarding Amazon Prime

Comments