By Jackson Godwin. Cybersecurity Analyst & Penetration Tester
The Fraud Team Explained What Happened
When the bank’s fraud investigator called me, I expected one simple answer.
Instead, he gave me several possibilities.
He explained that criminals don’t always need the physical card.
If they obtain the card details, they can often attempt online purchases where the physical card is never required.
That type of fraud is commonly known as card-not-present (CNP) fraud.
It was the first time I realised my card could be stolen without ever leaving my wallet.
I Started Looking Back
I thought about every place I had used my card over the past few months.
I had paid at:
- Online shopping websites.
- Restaurants.
- Hotels.
- Fuel stations.
- Streaming services.
- Food delivery apps.
Somewhere along the way, my card details had probably been exposed.
But where?
I couldn’t tell.
One Website Suddenly Came to Mind
A few weeks earlier, I had ordered a product from a small online store.
The website looked genuine.
The prices were reasonable.
The checkout process worked normally.
I received my order.
I never suspected anything was wrong.
But later, I realised the site didn’t use extra payment verification like many larger retailers.
Could that have been where my card details were stolen?
I couldn’t prove it.
But it became one of my strongest suspicions.
The Transactions Kept Coming
Although I had already locked my card, the fraud investigator showed me something alarming.
The criminals didn’t make just one purchase.
They attempted several transactions within minutes.
Some were successful.
Others were blocked because the card had already been frozen.
That pattern suggested they were trying to spend as much as possible before the bank detected the fraud.
The Purchases Didn’t Match My Life
The bank asked me to review every suspicious transaction.
None of them belonged to me.
The purchases included:
- Electronics.
- Designer clothing.
- Gift cards.
- Digital services.
The spending pattern looked completely different from my normal shopping habits.
That helped the bank identify the activity as suspicious.
I Learned About Card Testing
The investigator explained another common technique.
Sometimes, criminals don’t immediately make expensive purchases.
Instead, they begin with very small transactions.
A few dollars.
A subscription.
A tiny online payment.
If those succeed, they know the card details are valid.
Only then do they attempt much larger purchases.
I remembered seeing a small unfamiliar charge on my statement weeks earlier.
I had ignored it.
Now I realised it may have been a test transaction.
I Checked My Online Accounts
I logged into every shopping website where my payment card had been saved.
To my surprise, many accounts still stored my old card information.
Although convenient, saved payment methods can become risky if an account is compromised.
I removed the stored card details from accounts I no longer used and updated my passwords.
One Mistake Could Have Cost Me Much More
The bank representative told me something I’ll never forget.
“You noticed the fraud quickly.”
Many victims don’t.
Some only discover fraudulent charges weeks later after criminals have made dozens of purchases.
Because I locked my card immediately, the financial damage was limited.
But I realised how easily things could have become much worse.
In the final part of this story, I’ll explain how the investigation ended, share practical ways to protect your credit card from card-not-present fraud, and reveal the lessons every online shopper should know before entering their card details online.
Continue Reading: My Credit Card Was Charged While It Never Left My Wallet (Part 3)
