Scammed on Wise, how did this happen?

[simon43]

I have an online account with Wise bank (UK), and this has operated just fine since I opened it last year.

 

Since I am currently in the UK, I was eligible to get a Wise ATM 'real' card.  I requested this on the Wise website a few days agoand selected a 4-digit PIN to use with the card, and confirmed this using the 2-step OTP to my mobile phone. The Wise website confirmed that the card was being sent to my UK address.

 

Fast-forward to today, and no sign of the card in the post.  But when I logged into my Wise account, I was horrified to see 3 separate transactions using that new card!  The first was an Uber Taxi transaction for zero pounds, to check if the card was activated, the second was about 6 pounds from Uber Eats and the third was about 170 pounds (big meal!) from Uber Eats.

 

Naturally, I notified Wise immediately, froze the ATM card and transferred the remaining balance in my Wise account to my bank account in Thailand.  I hope that Wise refunds me for these fraudalent transactions.

 

But how was it even possible to charge that card?  Surely it needs the authorisation PIN?  Surely Wise don't send a 'live' card by unregistered post?

 

Perhaps someone who has a UK Wise ATM card can tell me if one needs to provide the PIN to buy Uber Eats etc......

 

I've checked my laptop for a keylogger, viruses etc, but nothing found.

 

 

[Upnotover]

You certainly don't need the card PIN to make an online purchase.  Just the card number/name/expiry/security code, those should be enough to initiate the transaction but the app should then ask you to authorise the individual transactions, either by the app password or biometrics.

 

It doesn't really matter if you have the "live" card or not, as soon as they issue a card number the details are on the app and it can be used whether you actually have received it or not.

 

I don't think any of this is only applicable to a Wise card.

[simon43]

12 minutes ago, Upnotover said:

You certainly don't need the card PIN to make an online purchase.  Just the card number/name/expiry/security code, those should be enough to initiate the transaction but the app should then ask you to authorise the individual transactions, either by the app password or biometrics.

 

It doesn't really matter if you have the "live" card or not, as soon as they issue a card number the details are on the app and it can be used whether you actually have received it or not.

 

I don't think any of this is only applicable to a Wise card.

Thanks - it would make sense that these fraudalent charges didn't require the PIN/OTP etc.  In that case, either the postman stole the card or the slimy youth who is employed at this guesthouse where I'm staying - I suspect the latter....

 

I hope I get my money refunded from Wise.

[asf6]

Are you able to view the location of the Uber Eats delivery or the restaurant? 

[Upnotover]

2 minutes ago, simon43 said:

Thanks - it would make sense that these fraudalent charges didn't require the PIN/OTP etc.  In that case, either the postman stole the card or the slimy youth who is employed at this guesthouse where I'm staying - I suspect the latter....

 

I hope I get my money refunded from Wise.

The app should still have asked for your authorisation - that seems to be a security flaw.  Hopefully someone will ask Uber where they delivered this feast to.

[NextG]

https://wise.com/help/articles/2977977/how-do-i-freeze-or-unfreeze-my-wise-card

 

 

[simon43]

15 minutes ago, asf6 said:

Are you able to view the location of the Uber Eats delivery or the restaurant? 

Unfortunately no.  The large transaction actually says 'Uber Eats Pending'  which sounds to me that it isn't yet authorised.  But below on the transaction details it says 'spent' which suggests that the purchase has been completed.  At no time was any OTP or 'click to approve' push message sent to my mobile phone. I certainly will forgo the convenience of having this ATM card if the security is so lax that anyone can charge their big fat Uber meal to my account.....

[Upnotover]

You can easily turn on and off different payment types for the card to restrict it only to ATM withdrawals for instance, as well as limiting the maximum transaction values.  Or freeze it at all times except when you want to use it.  This does of course require that all these security features actually work, which is by no means certain.

[parafareno]

and i was today freaking out about pqyoneer security issues....i am glad they are so strict...you cant pay anything without confirming pin on your phone.....so nobody can steal your money without your phone

[CartagenaWarlock]

3 hours ago, simon43 said:

Naturally, I notified Wise immediately, froze the ATM card and transferred the remaining balance in my Wise account to my bank account in Thailand.  I hope that Wise refunds me for these fraudalent transactions.

Most big banks in the USA immediately return the money, freeze the card and send a new card. If they use MC/VISA network, by US Federal law, a consumer is not responsible for more than $50 of  any fraudulent activities. Not sure about UK laws and UK banks. That is the main reason I never deal with any fintech financial institutions for keeping my money in their custody. 

[Straight8]

Sounds like <deleted>-weak security system

 

Let us know how you go getting your money back

[attento]

Isn't the WISE card a debit card ?

 

Edited March 10, 2023 by attento
spelling check

[SuperSilverHaze]

54 minutes ago, attento said:

Isn't the WISE card a debit card ?

 

This makes a big difference at least in US.

 

Credit vs debit

 

Many more safeguards with credit card

[CharlieH]

Many cards so not require anything under a certain value like £30 and are used as "touch n go" etc.That could be why the small went through and the large didnt and is pending.

 

[scubascuba3]

the last bank cards i received didn't need to be activated which was surprising, but the thread's a good reminder to freeze a card when issued before it arrives, if possible

[NedR69]

Another reason to use cards that will protect you and not hold you liable if someone scams your account or even fools you into thinking the purchase is legit.  Instead, use a CC with no international transaction fees, and use the app or web portal from your home country bank and pay the card's balance every month.  Have a back up, and maybe two or three backups to pay from.  

[KhunLA]

Never had an 'active' card sent, or asked to assign a pin to it before it arrives.  That's just bad business.  One to stay clear of.   Hope they have better security measures when transferring 1000's from one account to another.

[Thomas KH]

When I use my DKB card (German bank) I switch it on on the app, then immediately switch it back to off after the transaction. The app has a switch or toggle feature to allow not just disabling the card altogether but also temporarily disabling it when the card is not being used. The thing I love most is the geolocking feature. You can enable just one or more countries for the card and disable the rest. This means transactions done in other countries are rejected.

 

For online payments, I use a virtual card which has a customisable spend limit. 

 

Pays to be paranoid. Thieves and scammers everywhere. 

[iaminwa]

1 hour ago, scubascuba3 said:

the last bank cards i received didn't need to be activated which was surprising, but the thread's a good reminder to freeze a card when issued before it arrives, if possible

The Wise physical card I received needed to be activated.

 

Activation PIN was in the App. So, even if the card was stolen from home mailbox, does not add up.

 

[sammieuk1]

Just checked my card and it appears to be bristling with security its due for renewal soon and now alerted!

if you are forced to choose a pin before the card arrives its active to tap and go and that's not wise at all even more so if the over £50 transaction is successful .. keep us informed please ???? 

[MJCM]

1 hour ago, iaminwa said:

The Wise physical card I received needed to be activated.

 

Activation PIN was in the App. So, even if the card was stolen from home mailbox, does not add up.

 

Same here. Card was sent to my address in Europe and then send via Fedex by my friends to me in Thailand.

 

After that I had to activate the card on the website / app.

 

Suggestion for the OP.

 

Change your Password on the Wise App.

And then follow these steps

 

https://wise.com/help/articles/2932125/how-do-i-set-up-step-login

 

Set up app-based 2-step login is the best thing to do

Edited March 11, 2023 by MJCM

[ignore it]

Guess its one thing to be ripped off, but it seems like you've been Uber ripped off.

Edited March 11, 2023 by ignore it

[fceligoj]

I am a bit surprised, but once you establish a PIN, only who knows what transpires.  It is hard to believe that in the same breath of requesting an ATM Card anyone would ask you for the PIN you want to use, AND would not request that once you received the card, you would have to activate.  (Almost sounds like your phone had been hacked and they were monitoring your calls or your access to WISE's internet connection, at least the ones that provided them insight into your financial transaction, bank, Wise, etc.)

 

At least in the USA, once one requests a card, the bank sends you a separate letter with their defined PIN.  Most times the PIN letter arrives before the card.  Once you get the card, you have to contact the bank using the phone number (or an internet address) provided to activate the card.  Then, if you want, you can change the PIN, but you have to use the original PIN they sent you for that initial access.

[simon43]

1 hour ago, MJCM said:

Same here. Card was sent to my address in Europe and then send via Fedex by my friends to me in Thailand.

 

After that I had to activate the card on the website / app.

 

Suggestion for the OP.

 

Change your Password on the Wise App.

And then follow these steps

 

https://wise.com/help/articles/2932125/how-do-i-set-up-step-login

 

Set up app-based 2-step login is the best thing to do

To confirm, I only access my Wise account using my laptop, not my phone.  I have 2-step authorisation set up and have never had any security issues receiving/sending funds to/from Thailand etc.

 

When I requested the ATM card on the Wise website it specifically asked me to choose a 4-digit PIN number, which I did.  The website made no mention that the card would need to be activated upon receipt and there is nothing on the website under 'My cards' that mentions entering an activation code or whatever.  I find that very strange.... 

 

Anyway, I'm waiting for the response from Wise.

[MJCM]

@simon43

 

It is already a long time since I have that Card, but Wise choose the pin code for me, but maybe this has changed 

 

IMHO install the App on your phone and then a authorization goes through your phone. Only caveat is that it needs internet connection 

[DrCosmix]

A word to the wise: have nothing to do with WISE. Nobody  on this forum wants to have  a genuine discussion about them.

Your cc scam is common  apparently-

Their call centre support  may not be reliable- they have no call centre staff in the  UK.

https://www.theguardian.com/business/2023/mar/10/european-markets-spooked-by-us-bank-shares-sell-off

Digital  banking like  digital  currency  is not safe. Its not underwritten by anything except confidence often of people promoting the product  such as on  forum 

 

If you are  thinking of opening an account  with WISE or REVOULT slow down and think again.

If you already  have one think about winding it  down because one thing is guaranteed if you have a problem YOU WILL GET NO HELP FROM WISE- AND THEY ARE NOT PART OF A GOVERNMENT  SCHEME. 

They are not a  bank . They just shift  money around for  people.

As regards the OP Im sorry about your loss but thanks for letting  people  know.

Im closing  my account  down after several years. It's just  not worth the risk

[chilly07]

I keep  all my cards frozen  and unfreeze when I want to use.  Especially when a replacement is in the post! I also use a  CC for on line transactions  as they have a verification procedure

[chilly07]

8 minutes ago, DrCosmix said:

A word to the wise: have nothing to do with WISE. Nobody  on this forum wants to have  a genuine discussion about them.

Your cc scam is common  apparently-

Their call centre support  may not be reliable- they have no call centre staff in the  UK.

https://www.theguardian.com/business/2023/mar/10/european-markets-spooked-by-us-bank-shares-sell-off

Digital  banking like  digital  currency  is not safe. Its not underwritten by anything except confidence often of people promoting the product  such as on  forum 

 

If you are  thinking of opening an account  with WISE or REVOULT slow down and think again.

If you already  have one think about winding it  down because one thing is guaranteed if you have a problem YOU WILL GET NO HELP FROM WISE- AND THEY ARE NOT PART OF A GOVERNMENT  SCHEME. 

They are not a  bank . They just shift  money around for  people.

As regards the OP Im sorry about your loss but thanks for letting  people  know.

Im closing  my account  down after several years. It's just  not worth the risk

Wise are regulated in the UK like all other financial institutions including all banks. I have found their  call centre  staff to be  very helpful. Alarmist commentaries can mislead! 

[FritsSikkink]

Why did you choose a pin number while you didn't have a card yet?

[simon43]

18 minutes ago, FritsSikkink said:

Why did you choose a pin number while you didn't have a card yet?

Because that was required on the Wise website.  After I clicked to request the card it then asked me to enter a 4-digit PIN for the card.  I did this and I then received an OTP on my mobile phone to confirm this PIN.  This was not a phishing website - it was the real Wise website because I had just used it in the same session to send funds to my Bangkok bank account.