Originally Posted by Shkspr
Right now I'm leaning towards one of three vectors:
a) Keylogger. We run AVG scans every week and I had seen a few hits, but nothing major. My wife generally visits a very few specialized websites, so any infection likely came in under a banner ad. I found enough in MalwareBytes to have the guys who built her computer wipe the HD and wash the files. We took advantage of the wipe to upgrade RAM and OS to Windows 7, so we laid out a few bucks.
b) Infected business site. The only transactions my wife does online are to purchase e-books. Most of the vendors she uses are small sites likely run out of someone's home, with business conducted via e-mail. Someone could easily have slipped something into their site to harvest addresses, I suppose. This dovetails into
c) Fraudulent business site. Since these e-book publishers have small sites, I wouldn't necessarily trust that one of the operators themselves help themselves to their "customers" information and either charge fraudulent purchases themselves or sell the CC#s to someone disreputable. I admit to a tinge of paranoia myself whenever I buy a game online via CC direct from a one-man publishing house. Except for you, Jim.
We've also added a new CC to be used solely for online purchases, that should help keep the amount of account switching we have to do when an alert like this occurs to a minimum (I should have learned my lesson about that when my CC was possibly compromised in the TJX scandal. No fraud occured, but I had a nasty two weeks of changing CC payment info on utilities, WoW, Steam, etc.). Finally, we bought my wife a Kindle for XMas, and she should be able to get most of her online-only books ordered through the device from here on out without having to resubmit a CC#.
Of those vectors, I'm betting it's the keylogger. The only places other than the Internet she uses that card are Wal-Mart, the gas station, and my store. I know I'm running a closed shop, I doubt Wal-Mart's been hacked without it being front page news, and if a sniffer hit her at the gas pump, I would be shocked if the number went to Miami. I'd expect it to wind up in Dalls, Houston, or points West before Florida.
The big downside is that she's got to get this signed affadavit back to the CC# company by Sunday (Friday, really) or they'll put the charges back on. She just got the packet in the mail today. Don't these people know there isn't going to be mail delivery anymore?
|