Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Stolen credit card info

Hi, I'm new to this forum.

I am on a MACBook PRO running Mtn Lion 10.8.5 and Sophos 8.0.20C

Yesterday I was on what is known to be a reputable website to sign up for classes at the upcoming Tucson gem & Mineral show (jewelrytools.com).  I selected classes and followed through to pay for them by entering my credit card information.  My transaction was denied at first but I noticed I had entered the wrong expiration year.  I corrected it and tried again.  Still denied.  I quick call to my credit union revealed that they red flagged it and stopped my card.  They saw no other transactions or attempts at this point.  I assured them it was me and they freed my card up for use.  A few minutes later I tried again to complete the transaction but it was denied again.  Then I noticed my computer was froze.  Beach ball spinning away.  Sophos showed it was downloading updates.  It continued for several minutes, in the mean time I couldn't open up any other page or move anywhere.  I did a hard shut down.  Went back to the site again to try and complete the transaction and was denied again.  I called my credit union to discover that in that small time frame of approximately 20-30 minutes after my card had been freed up again, there were numerous transactions attempted at numerous businesses/websites for amounts from $1.52 to thousands of dollars.  Some were approved before the card got shut down for the second time.  The interesting part of this is that many of the attempts tried to use the incorrect expiration date, the one I had entered in the first place to complete my transaction at jewelrytools.com.  

I ran a full scan on Sophos, it revealed nothing out of order.  I've been leery of updating to Mavericks.  I also learned today in this forum that Version 9 is out for Sophos so I will update today.  My question is how did this happen?  Where is the hole?  Is there some protection on my system that is lacking?  How do I protect myself from this happening again?   I appreciate any help here.

:1014977


This thread was automatically locked due to age.
Parents
  • Thing you should do/can do:

    1. Update to version 9 and force an IDE (signature file) update immediately afterwards. Make sure the product is fully up to date.
    2. Run a full scan of the computer to ensure no local malware is present.
    3. Check your browser's internet history and see if you (or your browser) went to any site that wasn't strictly jewelrytools.com - maybe something similar.
    4. Consider how you got to the site. Did you click a link from an email or enter it manually yourself. Entering manually is safer (e.g., if you get a banking email with a link, then best practice is not to use it and open a tab and type the address in yourself)

    You may have ended up at what is called a phishing site (looks and feels like the real site but it's a front for harvesting keystrokes of personal details and credit information).  In all fairness it may not have been the jewelrytools, it could have been from a previous site visited where you used your card.

    How good are you at spotting a phishing attempt? The phishing quiz below (non Sophos related) is worth running through.

    http://www.opendns.com/phishing-quiz/

    I just ran through the test and...

    Screen Shot 2013-12-11 at 21.58.53.png

    :1014995
Reply
  • Thing you should do/can do:

    1. Update to version 9 and force an IDE (signature file) update immediately afterwards. Make sure the product is fully up to date.
    2. Run a full scan of the computer to ensure no local malware is present.
    3. Check your browser's internet history and see if you (or your browser) went to any site that wasn't strictly jewelrytools.com - maybe something similar.
    4. Consider how you got to the site. Did you click a link from an email or enter it manually yourself. Entering manually is safer (e.g., if you get a banking email with a link, then best practice is not to use it and open a tab and type the address in yourself)

    You may have ended up at what is called a phishing site (looks and feels like the real site but it's a front for harvesting keystrokes of personal details and credit information).  In all fairness it may not have been the jewelrytools, it could have been from a previous site visited where you used your card.

    How good are you at spotting a phishing attempt? The phishing quiz below (non Sophos related) is worth running through.

    http://www.opendns.com/phishing-quiz/

    I just ran through the test and...

    Screen Shot 2013-12-11 at 21.58.53.png

    :1014995
Children
No Data