I was trying to buy tickets for a show on an official web page. This will be the last show of this band so the server went down pretty quickly. The band tweeted about difficulties and then someone posted a link to another known ticket selling page (which was also having a hard time but was occasionally able to load) There I was asked for:

  • Full name
  • Email address
  • Postal code

Then you had to check the "I accept" checkbox and go to the next step. Here I was asked for:

  • Credit card number.
  • Credit card expiration date.
  • Credit card 3 security digits.

I provided those and was redirected to what seemed like a legit payment gateway asking for a security code being sent to my phone number via SMS. I received the SMS, provided the code and after a fairly long time, I was told my payment hasn't been proceed. I assumed it was because the page I was in was having a hard time due to high demand.

But now I realice it was stupid to follow a link someone just posted on a response twit. The band has not said anything about tickets being sold on another web page, so I searched for the name of that other page on Google and the first result is ticketsellingpage.com, and the second one is ticketsellingpage.net (what I just told happened on .net). Entering on .com, I search for this show and found nothing. Entering on .net gives me the Chrome privacy error.

So: have I been phished here? I "turned off" my card (not cancelled, I can turn it on later) very quickly after this, so I can not see any strange movements on my account. Should I just cancel my card and get a new number?

  • 1. This isn't phishing. 2. Yes, you should just cancel and get your card reissued.
    – thepip3r
    Commented Dec 19, 2018 at 15:41
  • @thepip3r why is this not phishing?
    – schroeder
    Commented Dec 19, 2018 at 15:47
  • This is not so much an information security question but a question for your credit card company. They will likely just reissue a card.
    – schroeder
    Commented Dec 19, 2018 at 15:48
  • I suppose it is. I mostly deal with phishing via email but I suppose an errant link anywhere could be phishing.
    – thepip3r
    Commented Dec 19, 2018 at 15:49


Browse other questions tagged .