Expired credit card number leaked. Problem?

January 8, 2012 4:32 PM

How much should I worry about an expired credit card number being leaked in the Stratfor Lulzxmas event?

Back in 2008, I took advantage of a one week free trial on Stratfor which required me to sign up with my card. I never paid them any money and cancelled after the trial period.

Recently I got 3 spam emails that alerted me to the fact my details were probably leaked, so I delved into the world of AntiSec and found the list of names, cc numbers etc. As I suspected, there I am. My name, email address, expired credit card number, and my old address (slightly incorrect as it happens). There's also the md5 hash of my password, which won't resolve to anything on the various md5 lookup sites I've come across. I don't actually remember what it was, but I assume this would be a good excuse to change all my passwords to new things anyway.

What should I do in response to this? I've heard from other sources that sometimes expired cards can still be used on certain websites, is this accurate? I'm planning on talking to my bank tomorrow.

(Also, given that the AntiSec press release saying this, "Who really pays $39.95 a month for daily right-wing political spam and access to a shitty drupal site?" I feel that I should stress that I didn't pay them anything and, as an impoverished graduate student, was doing it to see how awful their 'intelligence' was inside the paywall. Turns out I should have just circumvented their security, damn.)

posted by anonymous to computers & internet (4 answers total)

My credit and debit cards tend to keep the same account number after the old card expired. The only difference is the 3 digit code on the back and the expiration date. And, back in the day, for subscriptions and the like, a biller could do a charge with an expired card automatically, but it was only when there was an existing subscription. But I don't think they do that anymore.

You should call the number on the back of the card right now and ask to speak with the fraud or security department. They'll mail you a new card and account number. Once the card is cancelled, any autopay or other legit charges will not go through so make sure any auto pays are suspended or sent to another card until you get the new on in the mail.

Note: if you do nothing, the probability is still pretty low you'd ever have a charge. But why risk it?
posted by birdherder at 5:11 PM on January 8, 2012

My credit and debit cards tend to keep the same account number after the old card expired.

Mine don't, and I was just sent one a month ago. There are some similarities, but mine aren't the same number. I don't think there's much to worry about (but always check to be sure).
posted by rhizome at 5:41 PM on January 8, 2012

There was good advice in this thread.
posted by mlis at 5:50 PM on January 8, 2012

I wouldn't worry at all. In my experience, having a credit card stolen is nothing but a minor headache these days (you just have to reset all recurring payments on your card). The bank will call you if transactions on your credit card seem amiss, don't bother calling them.
posted by crazycanuck at 8:55 PM on January 8, 2012