Tackle warehouse scam

[BayouSlide]

Got a TW gift card at Christmas and planned on using PayPal for the balance for an added level of protection. For some reason, checkout required a credit card for the $12 remaining charge...the PayPal select wasn't active/allowed. ?

 

So I used the credit card I use only for purchases on websites where I'm unsure of their level of security. That card is seldom used and easily cancelled.

[bigspirit]

Well. It happened again. 
 

Used my PayPal account to order a couple things from TW with the balance I had on there (credit card was in my account as well) and wake up this morning to 131 emails on my gmail account that my email had been signed up for a mailing list to various places. Within these emails, there were a couple order confirmations from Igloo Coolers, Lowes, and a small farm and fleet store. Also had 2 texts on my phone for temporary security codes from when they were trying to login to my account. 
 

All together for the transactions it was about $500. Called the credit card company and informed them of the fraud, canceled the card, and called the stores to make them aware as to not ship these items to the scammers. 
 

**Turns out it’s a common thing that they spam your email with all of the similar mailing list emails so that you overlook the order confirmations which gives them time to process and ship the order.**

 

The only other time I’ve had fraud in the past 6 months was again, right after ordering from TW. I’m done. Not placing another order with them. Closed my PayPal account and that’s it. They didn’t even apologize or anything; it was stupid easy to close the account too. Too easy. Done with them as well. Hopefully this info can save someone else from a similar situation 

[garroyo130]

1 hour ago, bigspirit said:

Well. It happened again. 
 

Used my PayPal account to order a couple things from TW with the balance I had on there (credit card was in my account as well) and wake up this morning to 131 emails on my gmail account that my email had been signed up for a mailing list to various places. Within these emails, there were a couple order confirmations from Igloo Coolers, Lowes, and a small farm and fleet store. Also had 2 texts on my phone for temporary security codes from when they were trying to login to my account. 
 

All together for the transactions it was about $500. Called the credit card company and informed them of the fraud, canceled the card, and called the stores to make them aware as to not ship these items to the scammers. 
 

**Turns out it’s a common thing that they spam your email with all of the similar mailing list emails so that you overlook the order confirmations which gives them time to process and ship the order.**

 

The only other time I’ve had fraud in the past 6 months was again, right after ordering from TW. I’m done. Not placing another order with them. Closed my PayPal account and that’s it. They didn’t even apologize or anything; it was stupid easy to close the account too. Too easy. Done with them as well. Hopefully this info can save someone else from a similar situation 

 

That sucks. How did someone pay with your Paypal without getting through the 2-factor authentication? 

[Glenn]

For the record, I've ordered dozens of times from TW without incident.

 

Interesting coincidence.  But correlation is not causation.  Curious if you're going to post the next time it happens to you.

[MickD]

5 minutes ago, Glenn said:

For the record, I've ordered dozens of times from TW without incident.

Me too.  

[DitchPanda]

5 minutes ago, Glenn said:

For the record, I've ordered dozens of times from TW without incident.

 

Interesting coincidence.  But correlation is not causation.  Curious if you're going to post the next time it happens to you.

 

Just now, MickD said:

Me too.  

X3...bet in the past 5 years I've ordered at least 30-40 times. Never had an issue.

[JbroBass]

I've had at least 10 orders from TW since last Nov all using PayPal and no issues so far. 

[Chris Catignani]

On 6/18/2022 at 1:23 PM, bigspirit said:

Well. It happened again. 
 

Used my PayPal account to order a couple things from TW with the balance I had on there (credit card was in my account as well) and wake up this morning to 131 emails on my gmail account that my email had been signed up for a mailing list to various places. Within these emails, there were a couple order confirmations from Igloo Coolers, Lowes, and a small farm and fleet store. Also had 2 texts on my phone for temporary security codes from when they were trying to login to my account. 
 

All together for the transactions it was about $500. Called the credit card company and informed them of the fraud, canceled the card, and called the stores to make them aware as to not ship these items to the scammers. 
 

**Turns out it’s a common thing that they spam your email with all of the similar mailing list emails so that you overlook the order confirmations which gives them time to process and ship the order.**

 

The only other time I’ve had fraud in the past 6 months was again, right after ordering from TW. I’m done. Not placing another order with them. Closed my PayPal account and that’s it. They didn’t even apologize or anything; it was stupid easy to close the account too. Too easy. Done with them as well. Hopefully this info can save someone else from a similar situation 

I have been following this thread for some time...

One thing about this particular incident @bigspirit is that you used PayPal. All that kind of transaction will do is just pay TW. It doesnt send any credit card information to TW...only the money. By no means am I making excuses for TW...it is obvious (IMO) that they do have (or have had) some serious security issues.

So...how could this happen when you used PayPal?...is the question.

 

Also had 2 texts on my phone for temporary security codes from when they were trying to login to my account. 

What account?

[Kirtley Howe]

On 12/30/2021 at 10:37 AM, GReb said:

Fwiw, my wife and I both used PayPal and our cards were still compromised. 

 

 

Fraud is not going anywhere. Use avenues that protect you and keep an eye on your accounts. It’s unfortunately part of our life now and it’s not a matter of if but when. And please put those debit cards away. Only use them for ATMs

My debit card is covered for fraud just like my charge cards. Most banks and credit unions now do that. 

[Dogface]

My son and I were away last week and when we returned home he checked his bank account to find 6 unauthorized debits. We went to the credit union to file a claim and get a new card. The CS rep at the CU told us that half her day is spent handling unauthorized charges and debits. 

 

Cards are convenient but can be big trouble. 

[MN Fisher]

3 hours ago, Kirt Howe said:

My debit card is covered for fraud just like my charge cards. Most banks and credit unions now do that. 

Same with mine - they treat it like a credit card in such cases.

[VolFan]

Fwiw - it’s much more likely to be a local issue with your email account, phone, laptop, or how you access the internet. Use complex passwords.

Don’t use those passwords on public WiFi.
Don’t use the same password for multiple accounts.

Don’t leave accounts/computers/routers set to the default password.

Don’t click on links in emails. 

If you follow the above you will cure 99.99% of the problems we might see.

[MN Fisher]

13 minutes ago, VolFan said:

(cut)

If you follow the above you will cure 99.99% of the problems we might see.

Using a VPN will help as well. I've always got my VPN up...

[Johnbt]

Posted December 28, 2021  -  "I don't think it will be too long before we get a more thorough explanation and response from TW."

 

Did anyone ever get a more thorough explanation and response?

I know they never sent me a follow-up or apology for the poor way they handled the entire episode.

[fin]

3 hours ago, Johnbt said:

Posted December 28, 2021  -  "I don't think it will be too long before we get a more thorough explanation and response from TW."

 

Did anyone ever get a more thorough explanation and response?

I know they never sent me a follow-up or apology for the poor way they handled the entire episode.

 

Has any website ever?

[bigspirit]

On 6/18/2022 at 6:01 PM, Glenn said:

For the record, I've ordered dozens of times from TW without incident.

 

Interesting coincidence.  But correlation is not causation.  Curious if you're going to post the next time it happens to you.

Totally get what you are saying and it is wild to me that some people order so much and don’t have an issue. I however do not believe in coincidences happening multiple times. In this case, the last 2 times I’ve had to deal with fraudulent charges have been directly after dealing with TW. And both times we’re using my credit card through PayPal after going through the TW login. If it was only PayPal, why the correlation to TW when I have used it for other purchases and never had an issue?

 

Either way, I will not be tempting fate again. I’ve spent hours cancelling orders that were made with my card so that the sellers do not ship a product and never receive payment. I’m glad some of you haven’t had to deal with it, but in my case I do not believe lightning strikes the same place twice. 

[Trox]

As much as this sucks, it happens... I'm a cyber security engineer by trade, who makes a living by building security infrastructure and automations for a fortune 100 bank... and I can tell you that no matter what method of payment, besides cash in hand, that you use, you will always assume a risk (no matter how small, the risk exists) when shipping your (very much encrypted) banking/payment information over the wire. 

Think of it this way... if a company could promise 100% security for all of your information for the end of time, wouldn't they? Couldn't that feature be heavily monetized? well... it's not, because it doesn't exist. Billion dollar banks still have breaches and companies like LifeLock will continue to exist in this digital age

 

"We have the perfect security, we can send our IR (Incident Response) team home" - no one

 

My best suggestions...

- Set up MFA/2FA (multi-factored auth) on EVERYTHING - as much of a pain in the rear as this can be to always have your phone on you or to check your email to verify banking activity, it is worth it, and any company worth a grain of salt offers it these days

- Know the companies that are processing your payments (unless you are giving your CC to a TW employee over the phone to update an order, they will likely never see your banking info - AfterPay is a 3rd party, PayPal is a 3rd party, etc)

- Take a glance at your bank account transactions and verify them at least once per day

- Stop responding to "fun" posts on your social media feeds that say things like "share where you were born!"... because you will have given them the answer to a very common security question... THIS IS HUGE, but only one example of this...

 

And don't think that I'm just sitting over here nodding a finger at yall... I've been a victim as well

 

[Glenn]

Ok @bigspirit  Hope that works for you.  I also hope you post about it when it happens to you again.

[JbroBass]

2 hours ago, bigspirit said:

Totally get what you are saying and it is wild to me that some people order so much and don’t have an issue. I however do not believe in coincidences happening multiple times. In this case, the last 2 times I’ve had to deal with fraudulent charges have been directly after dealing with TW. And both times we’re using my credit card through PayPal after going through the TW login. If it was only PayPal, why the correlation to TW when I have used it for other purchases and never had an issue?

 

Either way, I will not be tempting fate again. I’ve spent hours cancelling orders that were made with my card so that the sellers do not ship a product and never receive payment. I’m glad some of you haven’t had to deal with it, but in my case I do not believe lightning strikes the same place twice. 

 

Are you saying your credit card was hacked after using it through PayPal at TW? That means PayPal would have to have been hacked and not TW, because PP does not share your account info with merchants. 

[Cgolf]

2 hours ago, Glenn said:

Ok @bigspirit  Hope that works for you.  I also hope you post about it when it happens to you again.

Glenn I respect the heck out of this site and what you have going, and I now except the quirks too. I am curious why you are so dismissive though of people that had their cards hacked after shopping at TW. As I said before many of us have been solid TW customers for years and I still wear one of their t shirts at least once a week lol. All I am saying what happened and that I will take a wait and see approach. I think some others are there too. 
 

We had 2 cards hit,  mine on Black Friday and my wife’s during the 25 days sale using the virtual card thankfully. Mine we got the dreaded email from TW, so that was likely the source, but my bank had shut the card down well before that. My wife’s was very close to the time we ordered from TW. We didn’t press the card holder to see if it was the virtual number that was attempted to be used, we probably should have. I will say the other charges around those purchases are places we regularly use the card at and haven’t seen any issues since. We have probably been both lucky and careful over the years, knock on wood, because these are the only times we have ever had an issue. 
 

In my case and maybe others we are hesitant to try again regardless of the success of others. My budget was more limited last year and my only 2 TW orders potentially/likely had issues. 

[Glenn]

There's no proof.  Just conclusions based upon coincidence.  That's it.  

 

I once had 3 cards from 3 different banks hacked all at the same time.  Turns out the card info was stolen months prior and sold on the black market.  It took months, not hours, for the thieves to use the cards.

 

Where did they get it from?  A credit reporting agency.  Not from any transactions, bank accounts, paypal accounts, or otherwise.

 

Point is, there are so many different ways your information can be stolen that there's no way anyone can single-handedly determine their card info was taken from a single transaction solely based upon the proximity of the latest transaction prior to the unauthorized use.

 

You can disagree all you want. But without concrete evidence to back up the claims, I stand by my words.

 

You asked....

[J Francho]

Just cancel your card if you see any suspicious transactions.  It takes two seconds, and usually you get a new card in a day or two.  Here's another tip: don't enter you card info online.  Use Apple pay, PayPal, or whatever.  Definitely don't do any banking or shopping while on any private, free WiFi.  None of it is secure.  None.  I can hack it in a minute, and I'm not even that good.  If you have to enter your card info, make sure you navigated to the site yourself, not through a link from someone or somewhere else and check to see that the address starts with "https" and that there is a lock icon next to it.  Even then, use a card with a low max limit.  I keep a couple cards open with $500 limits just for this.  Just pay them off after you make a purchase, and you'll incur no interest and your risk is only $500, not your full credit allowance. 

[Johnbt]

"As I said before many of us have been solid TW customers for years and I still wear one of their t shirts at least once a week lol."

 

I wear one 4 or 5 days a week - I retired in 2012 - and have at least 6 more new ones that have never been unfolded.

Week before last I only wore one a single day because when we're on Ocracoke Island for a week or so I wear Tradewinds Tackle shirts or the Working Watermen's Association shirts from their seafood shop.

 

 

[Cgolf]

16 minutes ago, J Francho said:

Just cancel your card if you see any suspicious transactions.  It takes two seconds, and usually you get a new card in a day or two.  Here's another tip: don't enter you card info online.  Use Apple pay, PayPal, or whatever.  Definitely don't do any banking or shopping while on any private, free WiFi.  None of it is secure.  None.  I can hack it in a minute, and I'm not even that good.  If you have to enter your card info, make sure you navigated to the site yourself, not through a link from someone or somewhere else and check to see that the address starts with "https" and that there is a lock icon next to it.  Even then, use a card with a low max limit.  I keep a couple cards open with $500 limits just for this.  Just pay them off after you make a purchase, and you'll incur no interest and your risk is only $500, not your full credit allowance. 

 

I do like the low limit card idea. It was painful for us, not because of any money lost, there was zero, but because we each only have one credit and one debit card. So not having a credit card for 5 days was a little rough. The other thought I had was just get a prepaid card and just go to a store or gas station to use the remainder of the card up the after the order, but that isn't foolproof because I don't think stores charge the card instantly.

[J Francho]

It usually takes a business day to hit the ACH.

35 minutes ago, Cgolf said:

because I don't think stores charge the card instantly