Hacker News Reader

Comment by nathanaldensr | Hacker News Reader

I had a similar experience quite some time ago. Somehow small AWS charges were appearing on my credit card--on the order of around a dollar. I called Amazon and asked them where the charges were coming from and they wouldn't tell me. I had no personal AWS account nor had I ever used the card with AWS. They refused to provide me any level of assistance. It was very frustrating. This meant every month my wife had to request a chargeback through the credit card company.

View on HN

This has happened to me on a corporate level as well. We had many teams that opened their own AWS accounts with a shared credit card. They wouldn't tell us what accounts were using the card, even though we simply wanted to migrate things to separate cards.

Useless, unhelpful, and borderline braindead. And yes, we have paid enterprise support.

> many teams > a shared credit card

Sharing CCs across teams is a business antipattern. You should use expense reporting, or switch to invoicing.

Regardless, when I was a consultant we had success with the email admins tracking the signup and/or billing emails, which arrived at the account numbers.

Uh yeah, thanks for pointing out what we were already trying to fix.

Did you cancel the card and replace it to prevent further charges?

This doesn't always work. I had a similar problem with Chase, and the charges kept appearing on the new card. Chase explained to me that the charges can follow the person, not the specific card number.

> Chase explained to me that the charges can follow the person, not the specific card number.

Can anyone explain this? It goes against all I thought I knew about online payments and credit cards.

This can happen sometimes if you get a new credit card number (but the same account). If you have a reoccurring purchase, like a subscription, the billing was already authorized, so the new charge is automatically applied to the new card number.

If you get a completely new account, that can't happen. I'm not sure what happens if you get a new card from the same company (like getting a brand new Chase account). I'd guess it would depend on their backend as to if new charges followed you.

It works like this. Chase is trying to be helpful so let's say you set up your utility bill to go through their credit card. Now, you get a new card with Chase because you lost it. Chase can see that the old number and new number are both attached to your account history and the charge from the utility company has the same utility account number so they happily approve it for you so you don't have to change your utility billing. It isn't such an awful feature except in this case where you want it stopped. This is one argument for not using credit cards for recurring online bills and ACH instead. Most people love the rewards though.

We need better online payments options that prevent these scams. It would be nice to have the ability to whitelist and blacklist online vendors.

> It would be nice to have the ability to whitelist and blacklist online vendors.

Isn't that basically a direct debit mandate?

I believe Visa/MasterCard/etc will send processors like Stripe certain types of updates to card information.

See this section in the Stripe docs: https://stripe.com/docs/saving-cards#automatic-card-updates

It's a common feature of payment processors to reduce the number of transaction failures due to expired but not updated payment records. Here's Braintree's page on it: https://www.braintreepayments.com/features/account-updater

Other people have told you how this "account update" process works so I'll skip that.

I just went through this with Citi/Mastercard.

I'm not sure if other companies do this, but I was able to opt out of this "account update" feature to hopefully stop a Comcast charge from going through to my new card number. I'll find out on Dec 10 if it works, but the customer rep I spoke to says it should. It basically cancels that feature so that I now have to manually go through every merchant and update them to my new credit card.

Then I'd take that to small claims court, and make them prove a legitimate debt or default if they don't show.

I can understand this is your deep, gut reaction - "sue them!", but have you ever been to small claims court? Are you aware that most ToS define the resolution mechanism which includes the jurisdiction?

Isn't up to the company to send a representative and point out the ToS to the judge? Just because the ToS says that doesn't mean the end user can't file.

Company can most likely just reply via motion to dismiss and not ever send anyone.

If a bank told me that, I'd cancel that card and go to another bank.

It's a feature they provide to be helpful to their customers. Absent any info from you about needing to stop it why would they not do it, it's there to make losing a card much less painful than it used to be.

It's not so much the person as the account. Some merchants/processors get updated card information.

https://developer.visa.com/capabilities/vau

That's an awful lot of work just because Amazon can't charge the right account.

It also doesn't necessarily solve the problem. The charges could accumulate in their systems until Amazon hands them to a debt collector, or the bank might helpfully transfer them to the new card anyway.

This would have the benefit of putting the onus on Amazon to justify the charges.

Simply reporting the fraud via chargeback is easier and puts the onus on Amazon.

Evidently it didn’t work.

Going to be fun when Amazon retaliates by locking you out of your AWS accounts.

I didn't, but it was eventually reported as compromised anyway, so the credit card company issued me a new number.

In what way is this not theft?

It is theft, but it's not amazon stealing it, it's somebody else. Amazon knows there is somebody scamming them, but, here's the kicker, they don't know if it's the caller complaining or the person placing the order.

The best thing to do is exactly what they said, file a chargeback and eventually Amazon can take action.

You'll notice the person running the website never cooperated with answering Amazon's questions, it's no wonder they didn't work with her. If you don't want to work with the merchant, then contact the credit card company. Not hard to figure out.

At a minimum Amazon should have to help clearing up the issue. I guess some entities are above the rules most of us have to live by. Same with hospitals that can repeatedly charge bogus items without any consequences.

Just because they won't tell your they're looking into it (because they don't know you or you're not authorized to discuss someone else's account) doesn't mean they're not taking action behind the scenes.

That’s not acceptable. They take money from a credit card and make no effort to explain why? That’s not ok.

It's not their job to secure your card outside of their own system. Assuming these cards aren't stolen from within Amazon's own servers, it's up to you and your credit card to protect it from unauthorized use.

Yet there's this alternate universe where there are laws against facilitating a crime, receiving stolen property, etc. I'm not saying that sort of thing applies to Amazon, just saying isn't it weird that it doesn't?

They don't have a way of telling if the person calling is the actual owner of the card, or the scammer.

A traditional method used was to send two very small random payments, say 0.03 and 0.09 to the card in question, then ask the caller to confirm the payment details, how much etc, once they'd arrived. If they could provide these details that is pretty much as far as they can go in terms of verification.

And if the card has two authorized users, with the second person making purchases the first one doesn't know about? How is that at all Amazon's problem?

Where did I say this was Amazon's problem?

The trick is balancing account privacy with fraud prevention. Without being the account owner or having any real relationship with Amazon OP has a hard task of proving who they are and generally you wouldn't want Amazon sharing any account information with non account owners.

I think the real solution would be for them to just provide an auth mechanism for people to prove they are the CC owner so they can remove the payment method from any accounts and not give out any info on the name or email on the account. I've seen a few things that use a small charge that gets refunded and you enter it back in the app as a 2FA.

>> You'll notice the person running the website never cooperated with answering Amazon's questions ...

Where do you see that? The only question asked was the phone number the scammer used for the scam account.

I'm confused by this as well. It's either theft or the easiest business model...

Switch to a new charge account, close this one.

If they ever pursue the debt, make 'em prove it and only pay if they have proof.

Reply on news.ycombinator.com