Just now I heard a notification and saw an Active Card Check in my Monzo for " World Market Ecomm " and it says £0 / $0 so I would assume this is definitely fraudulent.
Thankfully just blocked the card asap and ordered a new one. The only thing different I used my card for this week was at an ATM, but this was done at a legacy bank so surely cannot be from that.
Is this a common occurrence when someone gets your card details ? Perhaps a data breach somewhere ?
Have you got a Lyca sim or ever used the card with Lyca?
Yes. I just suspected this too. Please give more info if you have any
There’s a few reports here and over on ispreview that people who have Lyca, have been subject to such fraudulent transactions.
@jonj1 solely created a virtual card for Lyca, and that miraculously had an attempt too.
I’ve not used Lyca for some time, but my old card assigned to Lyca hasn’t had any attempts.
Yeah I am suspicious of Lyca to be honest as I got some odd SMS messages directly to my Lyca sim card a few weeks back after never even using the number anywhere.
Looks like I will be leaving them ASAP. Thanks for the information dude, at least that gives some indication of what it was
Tricky to point fingers but they’ve had breach reports in the past, it doesn’t look good for them.
@AlanDoe any chance you could merge in the posts from the Mobile Networks thread regarding the suspected Lyca breach to this one?
Edit: Nevermind realised this thread isn’t directly about Lyca
Hi, sorry to jump on this thread a little late. Just had an active card check from Indo-Mim Inc for £0 and I’d been racking my brain for why this happened but I do have a Lyca sim so will get that changed asap.
discussion for this is mainly in mobile networks thread
your the 4th person to have a Lyca exclusive virtual card compromised
did you see the ispr thread?
Yes, had a quick look at it. I can’t see how this isn’t linked to the data breach.
I’m glad I also used disposable email addresses in my dealings with them. I hope there’s no adverse impact on any other data in the hands of malicious actors🤞
Absolutely fascinated by this thread! We had an active card check this week and immediately froze our cards (one personal each and one joint between us) and then another attempt of taking money. We also have a Lycamobile so it must be linked. Was honestly a bit surprised by how poorly Monzo responded to our report and was looking to move away but this gives us a bit more information that helps. I do find it frustrating that you can’t remove the frozen account so keep getting notifications.
Had one on my account for Pontoon Specialists in Quincy USA. Being new to Monzo and Lyca Mobile (so nothing to do with the October data breach), my card has only been used in a couple of places, with Lyca mobile being one of them. Card has been cancelled now and moved my mobile from Lyca as I suspect it was their system that was the breach.
Yeah feel like it’s helpful to add we only joined Lycamobile in December so after anything that happened with them in October.
The last one you had for the marriage one, that’s the one I had too. Of course there can be a coincidence but lightning can’t strike this many times!
Monzo will know for a very high certainty that this is Lyca, they’ll have probably thousands of virtual cards that are used exclusively for them, as well as the correlation between normal card spend, but it’s incredibly dangerous ground for them to say something publicly/to a customer. If/when Lyca admit it then maybe, I wonder at what point they start advising customers to replace cards?
Also, nobody seems to have lost any money yet? All just active card checks?
I imagine the vast majority of people will be freezing and replacing them as soon as they see the active card check notification.
Allowing people to stop this issue in its tracks before it can do any real damage. Something we never had in a world prior to Monzo.
Not great for Lyca, and perhaps a bit stressful for their customers, but it’s the best kind of advertising for Monzo and Monzo Perks. They’ve got your back.
Someone on ISPR lost £150 last night
People who don’t see the active card check won’t know until it’s too late, unless their banks flag the $0 transaction as suspicious
The same people are unlikely to be using a neobank / virtual cards and probably wouldn’t be able to figure it out
I think most mainstream with notifications show card checks too.
Tried triggering it with Amazon and Netflix but both wanted auth. Not sure of a website that will go without approval.
This is comforting, unsure if it’s a visa page or Lloyds page.
Did they actually authenticate after that? Or just show the warning and let you continue
The whole idea of 3DS is that the customer provides proof of who they are; for some reason Zilch and similar apps instantly approve it with a countdown timer to wait a few seconds
It doesn’t show it in the app as £0.00, only time you see it is on the approve request page.
