2

My friend's credit card details were randomly used to make a two small purchases on a food delivery app, by someone other than my friend. They have already contacted the bank and cancelled the card.

My friend contacted the app company to let them know, and the app company replied requesting that my friend provides the following information to help investigate:

  • Last 4 digits of card number
  • Card-issuing company
  • Card expiry date
  • Country/region the card is registered to

Is this normal / safe practice?

2
  • That's pretty typical information to look up a transaction by.
    – Bobson
    Jan 20, 2021 at 6:56
  • Some ask last transaction amount to verify the card holder. It varies with banks. But you have to verify yourself to have it blocked. Most banks offer online account service to self-manage your account though.
    – defalt
    Jan 20, 2021 at 7:57

1 Answer 1

1

It is safe.

The delivery app MUST NOT know the full 16-digits number of the card, but SHOULD keep a smaller record, namely last 4 digits, to identify the card.

4 digits are not enough to uniquely identify a card, so they must be combined with other information. But 4 digits are not sufficient for the employee that reads email to make additional fraudulent purchases (irrelevant, as the card was revoked).

The delivery app will indeed have to return the money as the bank will claim it back, but this information helps them identify the orders and the account associated to them. And likely block the account or get info ready before someone else 🚔 asks.

A while after the original post I'd also say your friend should have never bothered to contact the food delivery company (the merchant) unless they are customers of the app.

Assuming Alice (hacker) has an account and used a fraudulent card, the company should never be speaking to Bob (victim, OP's friend) under privacy-savy jurisdictions. The bank will care about handling the dispute.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .