My girl was scammed and entered my home address and my credit card number on a fake website (through a Facebook ad). What risks am I additionally incurring, apart from having lost €40 (the money that was on the card, and luckily that is one of the cards that you have to charge in advance to make a purchase)? Is there something especially urgent I have to do?
My card description:
Can only pay what I first charge in
Do not allow to transfer money to my bank account
I choosen that card to lose at most the money is in it (Even if my bank insisted I choose instead another type of card).
Call the credit card company! They have procedures for this including blocking your credit card and replacing it. You might even be able to get the 40€ back.
There is a lot of articles about this online.
If you knowingly ignore the issue you might be liable for any future damages by fraudulent credit card charges.
The hacker could attempt to use the credit card number for other purchases
The hacker could attempt to use your address and credit card information to impersonate you. For example, if you bank web site has a "forgot my password" feature that asks you to enter your credit card number.
The hacker, if local (not likely), could visit your home address, and can try to get into your mailbox or trash to steal any other credit cards, PIN mailers, or other personal information.
What should I do?
Contact your bank to report the incident. They may recommend issuing a different card, or placing limits on the current card (e.g. bar it from use in certain countries). They can also set up alerts on the card so they can notify law enforcement when and where it is used next.
Monitor your statements for other improper charges and report them in a timely fashion.
Ask the bank for a chargeback, which will allow you to fully recover your 40€ immediately. This is usually a pretty painless process.
Always, always use a locked mailbox, and always shred any sensitive documents before putting them in the trash or recycling.
It heavily depends on what exists in the contract you signed with the bank and in which country you live - some banks protect the customer more than others...
In any case, as you know the card number has been compromised you should immediately call the bank. Failure to do so could be classed as serious negligence and subsequent actions by the attacker could be argued as your responsibility.
If you do report it, depending on your country and your contract, part or all of the expenses could also be recovered.
Recently in my country there were several campaigns to prevent people from giving out information on their debit card. The main reason was not the loss of money, but the responsibility in money laundering schemes.
Here is what would typically happen:
Someone steals, or even borrows your debit card and pin
They transfer illegally obtained funds to your account
They withdraw the money from your account
And of course, later the following happens:
The authorities track down the illegal transaction
The person whose debit card is used is held accountable for at least 100% of the withdrawn sum (even if they are not the ones who have withdrawn the money). And sometimes even penalties were dealt out.
Rules and regulations may be different where you live, but be aware that this could become a very unpleasant experience if you don't take immediate action.
I'd like to throw in one additional angle here, if somebody manages to steal enough information to fraudulently charge something on a credit card, you have no real control over what they use the money for. You're letting somebody not only use your money but leave a very clean paper trail that makes it look like you, personally, authorized the purchase.
Imagine trying to explain to the police at some point in the future why your credit card and your address was mixed in with a child porn ring or the purchase of explosive chemicals for a terrorist attack.