Ripped off!

So there I was, diligently scanning through the online statement from our bank, when I came across this particular entry for the amount of $84.35:

12-11-05 PAYPAL *USIPM1668 402-935-7733 NY

And I thought, “what the”? This struck me as unusual for a number of different reasons:

1. I didn’t recognize the merchant (“USIPM1668″)
2. I didn’t recognize the amount (i.e. I couldn’t remember buying something through PayPal for $84.35; and most disturbingly
3. The credit card that the transaction appeared on is not registered with PayPal!

Immediately, I googled the merchant name, and – not surprisingly – got a hit on an eBay item (for those of you that don’t know, PayPal is owned by eBay – hence why I wasn’t surprised). Something about gold for a final fantasy game? Anyway, the seller has a gaming website listed, so putting the pieces together I figured that perhaps Kristy had spent the money on a game for me, for Christmas.

After calling to ask if this was the case, and Kristy most assuredly telling me that it wasn’t, it was panic time. Not only am I clearly not getting any new games for Christmas, but it appeared as though our credit card had been ripped off! After a few hours on the phone with both PayPal and our bank, our fears were confirmed. It turns out that somehow, some guy has got all of the required information to open a PayPal account in Kristy’s name – specifically, her full name, phone number, address, and – of course – credit card number. They had opened an account on the 10th of December, and made the purchase on that same day. (It took a day before it got registered in my account though).

Needless to say, we have cancelled the cards and had new ones reissued, as well as reporting the fraudulant transaction. Since it was done on PayPal, we’ll get the money back in a couple of weeks. And even if PayPal wouldn’t reverse the charge, Visa has a “Zero Liability” policy to protect consumers against fraudulent charges. So it’s not the money that worries me – I’m more concerned with how they got the credit card number in the first place.

And yet, as awful as it makes us feel, there’s a glimmer of hope. Since the transaction was done through PayPal, its completely traceable. What’s more, I have acquired the e-mail address that was used to open the PayPal account. It could be fake – but they would have had to receive at least a few mails there in order to activate the PayPal account – so maybe it isn’t. At the very least, I used the e-mail’s domain (techie.com) to establish that it’s registered to someone in New Jersey. So if I can figure that out without raiding any databanks, let’s hope that the cops can do an even better job of finding and charging the crook.