If you have credit cards for long enough, you’ll almost certainly deal with credit card fraud at some point. The good news is that if you simply have unauthorized charges, credit card issuers offer a high level of protection, so that you’re not on the hook for those charges, as long as you report them in time.
Well, I just dealt with my latest case of credit card fraud. All credit card fraud gets me wondering how something happened, but this one is especially strange, since it seems to be related to previous fraud I had… with another card issuer!
My unauthorized Amex card purchases in Malaysia
I have the Amex Business Platinum, and it’s a card that I primarily keep for the perks, rather than for actual spending. As a matter of fact, I’ve made a total of four transactions on the card this year, and they were all to unlock perks associated with the card.
Of course I always monitor my credit card statements, to make sure there’s no fraud, even for statement periods where I’m not anticipating any purchases. While reviewing my recent transactions on the card, I noticed two small charges — a $2.46 charge on July 10, and an $0.86 charge on July 19, both with Google. One was for Bongo Movies (“a modern African film industry in Tanzania”), and the other for WhatsApp.
Those transactions were small enough that I might not have thought much of them, but I also knew something looked off. Sure, I probably can’t keep track of all of the purchases I make that involve Google, but I couldn’t figure out any reason that I’d put those charges on this card, since this isn’t a card that I have connected to any auto-billing services.
Just to be extra sure, I clicked on the details of the transactions, and saw that the purchases were both actually in Malaysian Ringgit. Okay, so that’s definitely fraud!
I disputed both charges, indicating that I never authorized them. Usually Amex is great at resolving card disputes in the favor of cardmembers, but I was surprised to get a rejection within a few days. Per the email I received from Amex:
We’ve rebilled the $0.86 amount you disputed from GOOGLE.
Here’s what happened: We gathered the attached documentation we needed to explain this charge, and we’ve determined that you’re responsible for the amount in question.
They then attached the receipt that acted as proof, to show that I authorized the transaction. The issue is that the “customer email” — simonbarua124@gmail.com — is not me. And that was the same emailed used for both transactions.
Honestly, that’s rather disappointing handling on Amex’s part, when I suggest I didn’t make the purchase, and then they deny the claim on account of the “proof” of me having made the purchase, with a receipt that uses an email that has nothing to do with me. I can’t expect Amex to know the email addresses I use, but I’m not sure how this is “proof” that the purchase wasn’t fraudulent.
The Malaysia fraud connection gets more interesting
In isolation you might not think much of this, but here is where the story gets stranger, as I see it. Several months ago I covered how I dealt with fraud on a Citi credit card, specifically involving Grab “Poi Funding Transactions” in Malaysia (Grab is a competitor to Uber, particularly in Southeast Asia). The purchases were spaced out over the course of weeks, and totaled over $380.
They were all on my Citi Double Cash, which is another card that I don’t actually use much for spending nowadays, and it had also never been linked to my Grab account.
I know I’m unlikely to ever get to the bottom of credit card fraud, given what a big underground industry this is. However, curiosity does get the best of me. What I found strange is that this fraud happened just weeks after traveling to Malaysia for the first time in years. The thing is, I hadn’t used that card for any purchases there (it has foreign transaction fees), though I did have the card in my backpack, along with around a dozen other cards, including the Amex Business Platinum.
With this latest Amex Business Platinum situation, I’ve now had two cards compromised that I traveled to Malaysia with, but didn’t actually use there, with all the fraud being in Malaysia (or at least processed from there, as there also seems to be an Africa connection).
My theory here is that someone went through my personal belongings for the brief time I was in Malaysia, and maybe photographed my credit cards (rather than physically taking them, which would arouse more suspicion). Then they’re trying to take a very slow but steady approach toward fraud, doing this over months, or possibly just even selling the numbers on the dark web. I dunno…
It’s possible that I’m way off here, but I just find it to be a strange coincidence that this all involves Malaysia just weeks after I visited. I understand that a data breach of some sort is often the most common source of fraud, but we’re talking about two different card issuers here, so the cards wouldn’t even be linked in the same database anywhere.
Am I wild for coming up with this theory, or does anyone else have a good explanation? I’m certainly channeling my inner George Bush here.
Bottom line
My Amex Business Platinum Card, which I don’t use much for spending, was recently compromised with two small, fraudulent purchases, charged in Malaysian Ringgit. What makes this stranger is that my Citi Double Cash Card was also recently compromised with some purchases in Malaysian Ringgit.
I traveled to Malaysia with both of these cards in my bag, though didn’t actually use them for any purchases. Maybe this is a total coincidence, but I’m starting to think that someone went through my bag, took note of all my credit card numbers, and then is slowly but surely committing fraud on them.
Is my theory totally off, or does anyone have a different idea of how this could happen?