Here is my situation. I had a debit card where I could transfer funds to it for limited use. I usually kept a low amount on this card just for little purchases. It was recently used in a fraudulent purchase online and now it is blocked and cancelled by my bank but the kicker is I have only used this debit card on 3 different websites.

I have never used this card in person at a store and I did not keep this card on my person either. It was only used for 3 online purchases. So can it be confidently assumed that one of these 3 websites were compromised and should I report the incident to each of those websites?

The three websites that this card was used on were:

  • GoDaddy
  • Playstation Network
  • St. Jude Children's Hospital

I am trying to think of any other possibilities of how this card could have been stolen and used in a fraudulent online purchased. The card was kept in a safe until I needed it and did not touch any other websites or stores outside of the 3 listed. My only conclusion is that one of these 3 websites have been compromised. Should I report this incident to these 3 websites or any other organizations or people?

  • Sure, you tell report it to the company but Odds are they won't believe that their website was compromised. After all, they probably (and rightfully) believe you use this card in a thousand different places. The moment the card exists, there are many other ways of it being leaked.
    – pm1391
    Commented May 31, 2018 at 5:02
  • 2
    Probably it was the hospital. Generally, hospitals have less secure systems.
    – Overmind
    Commented May 31, 2018 at 5:05
  • 1
    Short of you contacting the sites and talking to your bank, we can't really help you with this one.
    – user173641
    Commented May 31, 2018 at 6:30
  • I assume that you have reported it already to the bank/card company?
    – schroeder
    Commented May 31, 2018 at 8:18
  • @schroeder yes I did Commented May 31, 2018 at 14:37

1 Answer 1


Keep in mind this is how many companies find out they were breached so please do report it even though you are not sure which of the three it was. Companies do occasionally get calls like this, they are rare but generally very well received.

Reporting the information may be very helpful to the timing of their incident response team. Some companies may choose to ignore individual reports by themselves but if they more than one report within a short period of time it may cause them to trigger an internal investigation. Some companies are more proactive to this type of reporting than others.

The key here is timeliness. The faster you let them know the faster their incident response team will be engaged and in theory the faster other cards can be deactivated to reduce overall damage. It's also helpful to give them all the details you have of the fraudulent transaction.

Additionally, this is helpful because the faster compromised cards can be deactivated the less money will go towards funding the criminal organization behind it. So you're act of reporting this may help protect others from damage short-term and long-term.

Side Note: Don't sign an NDA or anything if they ask you to. Ninety-nine percent of companies won't ask this but if it comes up simply say no, it's not to your advantage especially when you are simply trying to be helpful.

  • It sounds like I did the right thing, I just suffered through this myself. Its amazing how non-chalant banks handle these cases simply because the cost of implementing security safeguards for their customers is higher. Well, I wanted to start getting into infosec as a career, here is my first hard first week lesson.
    – Daniel
    Commented Nov 6, 2019 at 23:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .