Stolen credit card info

Thing you should do/can do:

1. Update to version 9 and force an IDE (signature file) update immediately afterwards. Make sure the product is fully up to date.
2. Run a full scan of the computer to ensure no local malware is present.
3. Check your browser's internet history and see if you (or your browser) went to any site that wasn't strictly jewelrytools.com - maybe something similar.
4. Consider how you got to the site. Did you click a link from an email or enter it manually yourself. Entering manually is safer (e.g., if you get a banking email with a link, then best practice is not to use it and open a tab and type the address in yourself)

You may have ended up at what is called a phishing site (looks and feels like the real site but it's a front for harvesting keystrokes of personal details and credit information).  In all fairness it may not have been the jewelrytools, it could have been from a previous site visited where you used your card.

How good are you at spotting a phishing attempt? The phishing quiz below (non Sophos related) is worth running through.

http://www.opendns.com/phishing-quiz/

I just ran through the test and...

Thanks for the info ruckus.  I've upgraded to version 9 and forced all updates.  Ran the scan and it found no threats.  

I took the phishing test and got 13 out of 14.  I would say YAY! good score, but it's the one you miss that gets you, darn it!

---

ruckus wrote:

 ..... In all fairness it may not have been the jewelrytools, it could have been from a previous site visited where you used your card.

---

I really think it all happened while I was entering my financial information through (what I thought was) the jewelrytools.com website.  The reason I say this is because many of the attempted purchases were using the wrong expiration date, that same incorrect year that I first entered.  Also, if it was a redirect to a phishing page mock up, how is it that my bank's card log shows all of my attempts to make the purchase too?  If I were entering my information into a bogus site meant purely for collecting information how would card have been run trying to make a purchase at jewelrytools.com?  This is why I'm worried that there's something or some way that someone logged my keystrokes while I was attempting to make a legitimate purchase at a legitimate site, yet the scan shows nothing.    

And here's another thing...

I looked into my history yesterday and found one suspicious looking entry.  I didn't capture a screen shot then, but today when I look at that same history for the day this happened, my history is different.  Here's the shot from today:

All things I looked at on jewelry tools.com show that website in the start of the url, yet the last entry (Debora Mauser) shows something about a redirect.  The difference between today and yesterday's history is that yesterday that same url (mailjet.com/redirect) wasn't showing up under Debora Mauser.  It was further up in the Kate Richbourg line.  

I am so bewildered.

:smileysad:

I think it's worth contacting the jewelrytools and explaining what has happened to them.  They may be aware of a problem with their website that would help explain it.

Also, another thought.  Is there any significance to the fact that I was using a free public wifi network at this time this happened?  Just trying to think of all possible reasons why this happened so I can avoid it happening again.

Thanks!

Did the free wifi have security enabled?  Nothing, WEP, WPA2?

If it wasn't WPA2 then there's a hole.

No password was required to join this free pblic wifi network.  :smileyembarrassed:

Have a read of this: http://www.onguardonline.gov/articles/0014-tips-using-public-wi-fi-networks