Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Exactly what kind of information does a scammer need to scam someone money?

For example, if there's a website which wants me to provide my details, Exactly what kind of information can I divulge and guarantee that the scammer does not have the ability to scam me?

Basically, could I be scammed by a website who has my country, physical address, email address, phone number, full name, and credit card number?

For example, when signing up for a free trial account (watch free movies) on https://www.vidcannon.com/,

Even though it says that for the trial no money would be charged, it asks for my:

  1. First Name

  2. Last Name

  3. Card Number

  4. Expiry Date

  5. CVV2 Code

  6. Zip Code

  7. Country

Basically I was wondering if I do provide my real details there, could I have been defrauded?

share|improve this question

5 Answers 5

To answer the precise question; No, YOU can not be defrauded if you acted in good faith. You can be INCONVENIENCED while your credit card company works out what happened. But at the end of the day, YOU will not be out of pocket with regard to the fraudulent transactions. It is YOUR BANK bank that ends up being defrauded. To re-iterate - this only applies if you act in good faith and not recklessly.

Disclaimer: This is the situation if your card is issued in Western Europe, US and Canada. Your liability in other jurisdictions may vary.

share|improve this answer
1  
I don't quite understand you.. do you mean to say that I don't have to worry so much because ultimately as long as I report my bank will return me back the money? –  Pacerier Jan 5 '12 at 23:28
1  
It means that the bank is responsible for securing the credit card, not you. The whole credit card system is broken at its core, security-wise, but as long as you take reasonable precautions (only send CC number over SSL connections, only use CC on trustworthy web shops, don't e-mail CC number, etc.), and abide by the terms of service, the bank cannot hold you responsible for any damage. Which is why, for example, you will receive a phone call the instant you do something suspicious with your credit card, such as use it at several ATMs within a short period. –  tdammers Jan 6 '12 at 7:17
1  
+1 @James - this is a very good point. The process should mean that while you may be defrauded you have an expectation that you will be reimbursed. However...this does require the fraud to be detected, by you, the bank, the supplier etc. and does require some effort to sort out. –  Rory Alsop Jan 6 '12 at 9:48
    
This would be a pretty stupid thing to risk, even if there are 'chances' of getting your finances sorted back out. –  ekaj Apr 13 '12 at 0:59

Simple answer for you - yes (however, read @JamesRigby's answer for why it can be a no in reality):

When you buy a product online, the internet shop asks for card number, name, expiry date, physical address and CVV

So if a scammer gets those, then they could purchase goods online. If those goods are services, they don't even need to worry about intercepting a delivery.

It is known as card-not-present fraud. Have a read of the wikipedia page on it and this HSBC page

As @Andrew commented - there are scams which require far less info, for example some successful identity theft scams have just needed the victim's name and bank. A large part of social engineering is persuading people to give access where they should deny. For example if I forget a phone banking password the operator should not let me progress, but often you can plead forgetfulness (as humans are fallible) and get clues or alternate ways to gain access.

At the end of the day, people on the whole are helpful and stupid - which an attacker can take advantage of.

share|improve this answer
    
Also, even without your credit card number they could have a pop at some identity theft –  Andy Smith Jan 5 '12 at 16:28
    
Or another way: if somebody you make a purchase with that information, then somebody else can as well. –  Jeff Ferland Jan 5 '12 at 16:29
    
@Rory Doesn't it mean that when I buy things with my credit card offline, and someone manages to have a look at my credit card and remember the details (the seller), he has the ability to make purchases using my account? –  Pacerier Jan 5 '12 at 19:27
    
@Pacerier - pretty much, yes. I used to be very good at remembering credit card numbers from just a glance and I'd scare people by reciting them back to them to try and get them to take more care in hiding info like that. –  Rory Alsop Jan 6 '12 at 1:03

Yes they can use that information to make fraudulent charges.

However, in this specific case it appears that they take that information to automatically charge you after the "free" trial is over. This is usually not considered fraud and you would be out the money unless you dispute the chareges.

Always read the fine print.

share|improve this answer

If you give somebody your personal payment information you must keep in mind that, unfortunately, that information could be illegitimately used.

To answer your question, to steal money the scammer would need name, surname, card number and CVV2 code, because this is the information that websites ask when doing credit card transactions online. Expiry date may be needed too, although usually it is asked only when you add a new credit card to an account, non for every transaction.

This said, you also have to think that if the scammer somehow managed to have access to this information, he probably has other information about you.

And as Mitnick shows, it is possible to defraud somebody knowing only their phone number basically, so imagine having their financial information too :)

share|improve this answer

Blockquote For example, when signing up for a free trial account (watch free movies) on SomeRandomWebsite

Even though it says that for the trial no money would be charged, it asks for my:

Credit Card, Name, and Address ...

1) Those movies are not free.

2) A free trial means that the service normally costs money.

3) Your being asked for your information, which means you must provide your valid payment information, otherwise when you are billed you won't be able to continue to use the service you signed up for.

Basically, could I be scammed by a website who has my country, physical address, email address, phone number, full name, and credit card number?

Anyone with the information like that could use your credit card. It of course is also a crime, it also is easily tracked, and in the case of a credit card charged easily refundable. Determine how your bank will protect you.

Even though it says that for the trial no money would be charged

I have to repeat this statement, movies are not free, so its only free during the TRIAL period. I highly suggest you read their terms.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.