How did scammers know my bank balance?

August 31, 2024 12:39 AM

Today fraudulent charges were made to my debit card in two amounts that almost exactly totalled my whole balance. How is this possible?

I lost my debit card a few days ago, and I set it to limit charges to $150 maximum. I'm overseas so I was hoping to find it and avoid the hassle of getting a new one. How would it be possible to know the balance without, for example, knowing the PIN?

posted by matkline to Work & Money (6 answers total)

Response by poster: (To be clear, the charges were both cancelled by my bank but I got emails telling me about them. I also find it strange that I now don't see any record at all of those charges in my banking portal.)
posted by matkline at 12:41 AM on August 31

Any chance that those emails were part of a phishing attempt somehow?
posted by eirias at 1:11 AM on August 31

Response by poster: @eirias No, I also received notifications of the charges through my banking app.
posted by matkline at 2:57 AM on August 31

Best answer: It’s possible to run a debit card as a credit card transaction which would be declined if you have insufficient funds. Maybe they tried larger amounts first and the only attempts you’re seeing are the ones that weren’t declined?
posted by staggernation at 5:31 AM on August 31 [4 favorites]

Best answer: It’s possible to run a debit card as a credit card transaction which would be declined if you have insufficient funds. Maybe they tried larger amounts first and the only attempts you’re seeing are the ones that weren’t declined?

This. Using a simple binary chop, you could arrive at someone’s balance in remarkably few attempts.
posted by Tell Me No Lies at 7:33 AM on August 31 [2 favorites]

With the physical card in their possession (versus 'got the credit card number in a text file downloaded from a sketchy website") they may be sophisticated enough to have social engineered information from your bank. If they reset the PIN, they could see your available balance.
posted by AzraelBrown at 7:35 AM on August 31