Protecting Yourself in the Age of the Internet is Darn Hard: 3 Credit Cards Compromised in 2 Weeks after Mortgage Refinance Application
I recently applied for a mortgage refi with no points and very low fees.
I’ve worked with this local outfit several times before, so I know them to be solid. But there is a long chain of custody for my information between them and the processing end. All it takes is one crook somewhere in that chain.
In the past ~2 weeks, all of our credit cards have been compromised: business debit card, then personal ATM/debit card, then personal credit card, about 7 days apart for each of them. Because of the timing and the way they were tested in each case, it was clearly designed to fly under our radar. My conclusion is that somehow my mortgage refinancing information was compromised, and I have to assume—in its entirety. I've taken mitigation measures.
How credit cards are “tested”
In each case, a small charge was made to test the card first, subtle enough that most people are unlikely to notice—a few dollars at a frequented store or place. For example, a $6 charge at a local CalTrain station, a small charge at gas station, etc. In the last compromise, it was even more secretive—a small charge, then radio silence, presumably for a bigger heist later.
It sucks being held hostage: I cannot lock my credit because the loan has to close/fund first.
And the refinancing process these days is taking 2 months to complete due to enormous demand overloading the system. There is no way to speed it up.
Be aware of credit card or debit card activity
Most banks have some kind of alert service for both bank accounts and credit card.
Set it up so that you are both emailed and texted whenever any transaction occurs above a very small amount, e.g., 10 cents. You know when you charge something, so the idea is that you’ll be made aware when someone else is using your card via text message and email.
Also, scan your credit card charges and bank activity at least once a week. In this latest credit card compromise, the charge were made to look innocuous and five days had gone by before I saw it—I could easily have overlooked it.