Minor Compromise
A few weeks ago I was subject to what I deem to be a minor compromise - it seems my credit card had a fraudulent charge added. This has happened once before, and like the previous time this was likely a site where I had used my credit card had been breached.
Initial Signs
I received an email stating that my order for a “new iPhone” was being processed. While I had recently purchased a new iPhone, per the email this was a completely different order which did not have the same features, plus the date was off by a few weeks. Interesting. I checked my online credit card account and saw that yes, the order had gone through my bank. The order had gone through on a Saturday evening and it was the next morning before I discovered this.
What made this particular fraud attempt even more interesting was that at the exact time of the transaction I was also subscribed (via a script of some kind) or signed up to several hundred mailing lists and websites, so mixed in with the fraudulent charge was a huge volume of spam. This type or style of attack is becoming increasingly common - trying to hide an indication of a fraudulent charge in an inbox filled with junk mail.
How I Handled Things
It is certainly not the first time I’ve dealt with being signed up for a lot of websites and mailing lists either via scripts or the usual basic data brokers sharing lists. Additionally I run my own mail server, so existing mitigations thwarted tons of extra emails. I also have a large number of filters configured in my mail client (Thunderbird) that moved a majority of the emails to the trash.
As I regularly receive the typical (and not so typical) phishing attempts, I keep a security eye out for interesting phishing. Frankly I thought this was a phishing attempt, and that Sunday morning I was going through the suspicious email by hand (there is always 4-5 a week that seem to get through email defenses) and I noticed that the email headers did seem to indicate the email originated from Apple. I still didn’t click on the link, but immediately confirmed with my bank online that there was an erroneous charge from the evening before.
I immediately disputed the charge and was able to report online that the credit card number was compromised. Fortunately since I use a digital wallet on my iPhone and virtually all of my online bills are autopay with that credit card, the bank immediately disabled the old card number and pushed out a new one to my digital wallet, pretty much instantly. That digital push happened at around 10am, and I was able to go out for lunch that Sunday and pay for my meal with my Apple Watch via my digital wallet like normal. There was even an autopay bill that was paid later that afternoon as all of my autopay items were also updated. The replacement physical card arrived at my doorstep the following Tuesday. Yes I did have to manually update the card number in a few places, but that was no big deal at all - all the major items were instantly fixed online by the bank. For good measure I rotated my Apple ID password although it didn’t look like the account itself had been compromised.
Why Bring This Up?
The last time I had a credit card breach more or less the same process was followed by the bank so it was much more tedious that distressing. This time, with the advent of flooding my inbox to kind of “hide” the notice of a purchase in a flood of odd messages meant that the fraudster could have had time to make the transaction actually happen. Later on Monday, I received another notification from Apple that the order was ready for pickup. so I called Apple who put me on hold, contacted the store where the pickup was ready and told them it was fraudulent, and then canceled the order.
I wanted to provide a few details for others, just in case something similar happens to them at some point in the future. A new wrinkle to look out for with that flood of forged mailing list subscriptions. Anyway, stay vigilant and stay safe!
