My Credit Card Was Actually Stolen?!

Lately, my cram-school classes have started to feel like they did not long after Taiwan lifted Level 3 COVID restrictions last year: I teach every class at one of the school’s branch locations.

Teaching at the branch basically means I have no teaching assistant. From opening and closing the doors, taking attendance, and preparing handouts to managing students and transferring the class recordings afterward, I handle everything myself.

Oh, and because of the pandemic, I have also been disinfecting every seat my students used with alcohol after each class. There is seriously way too much to do Orz.

I heard that the high-school teachers for the other two subjects had both moved their classes back to the main location. Students asked why high-school physics had not moved too. How would I know? Honestly, I often hear the news at exactly the same time they do der.

But I only have two cohorts left anyway, so I am getting too lazy to think about—or investigate—the reasons behind certain decisions.

Then, as class ended this Sunday, a student told me that footage recorded by a camera—the .MTS files—could be merged in Premiere. That sounded like a great idea. Just as I was about to give it a try, a text notification suddenly appeared on my phone.

“05/15 18:25 CTBC card ending in 3443: NT$1,250 charged.” I have text alerts enabled for every credit-card transaction, regardless of amount, so the message simply popped up.

Huh? Why had this charge suddenly appeared?

I do have plenty of recurring charges, such as web-hosting fees and subscriptions like Netflix. But Cloudways had charged me only recently, and Netflix did not cost that amount.

This particular CTBC League of Legends card with the RGB design was the one I had applied for to cover electronics and online purchases, so a charge of that kind would not have been especially strange.

So what exactly was it?

I wanted to open online banking and check, but the signal on the first floor of the cram school was awful. Online banking would not load, and the internet was completely dead. I decided to check later and call the credit-card service line after a little while.

While I was thinking that, my phone suddenly erupted in a frenzy of text alerts.

“Oh, damn—what is happening?” I looked closely and could not believe it. There were far too many charges. In addition to the first NT$1,250 transaction, two more NT$1,250 charges appeared. Then it became even more ridiculous: a new NT$1,234 charge arrived less than every 30 seconds. By the end, I counted nearly thirty transactions.

It was an absolute charging spree. And every single one was NT$1,234—what, were they using my card for a microphone test? = =?

“Did someone steal my card details???” The pace of the transactions made me almost certain this was a burst of fraudulent charges. I had to drop my investigation into quickly merging the .MTS files and immediately contact the card issuer, CTBC Bank.

CTBC’s credit-card support uses text chat. There is, of course, a long voice menu first to route calls and keep the lines from clogging up, but after following the process you can reach a real person—still through text chat, though.

That is slightly inconvenient, but it also avoids jammed phone lines. Personally, I think it works pretty well.

After calling, I completed a basic online-banking identity check. I explained that every charge from the NT$1,250 transaction at 18:25 onward was unauthorized and asked the bank to stop payment.

Many people online say you must tell the bank to classify the charges as “disputed transactions.” In my case, I simply said that they were fraudulent and not made by me, and the bank representative handled the rest.

Oh, and while I was contacting support, whoever was doing this kept charging the card without stopping. The notifications repeatedly covered the chat window between me and the representative. It was unbelievably annoying.

When I later logged in to CTBC online banking, none of those thirty-plus card transactions appeared there.

Naturally, to prevent any more fraudulent charges, I asked the bank to cancel the card and issue me a new one.

During the cancellation process, I also saw Apple Pay remove the connection among my phone, the card, and the bank, which confirmed it was complete. No more fraudulent-charge alerts arrived afterward, so that finally ended the whole farce.

I asked the representative where the charges had gone. They gave me two destinations: one was PayPal, and the other began with B and ended with KR. I had no idea what it was; either way, the source was unfamiliar to me.

I am normally quite protective of my card information and monitor the money moving through every card. For online purchases, I almost always use Apple Pay encryption and rarely type in a card number. Even when I do enter one, I never let a website save it. So where could my card information have been stolen?

When I saw PayPal, I suddenly panicked. To apply for a LINE sticker creator account and make it easier to receive payments from overseas, I seemed to remember linking a credit card for identity verification.

I logged in to PayPal and, sure enough, the linked card was this very CTBC card = =. At the time, seeing PayPal among the transactions made me suspect that the problem might involve this account. Those clues alone could not establish where the breach happened.

I immediately unlinked the card. I only used the account to receive money anyway, not to make payments.

When I looked into it afterward, I found accounts of similar PayPal-related complaints, but they did not prove what had happened in my case.

Once I had checked everything and the problem was finally resolved, I suddenly felt incredibly angry. No one else was at the cram school, so I sat on the floor and raged for a solid thirty minutes XDDDDDDDD. I completely forgot to continue researching the .MTS conversion until a student reminded me after I got home.

After this happened, I felt that my usual account-management habits had helped stop the wave of fraudulent charges. Here they are for anyone who wants a reference:

1. I have online banking enabled at every bank I use. Whenever I need to, I can immediately check my credit-card activity and whether anything is wrong with my accounts.
2. I have text alerts enabled for every credit card, with no minimum amount. That is why I saw the notifications the moment the fraudulent charges began.
3. I use fixed cards and accounts for online shopping and digital purchases. Their defining feature is that they have low credit limits and very little money in them—usually only my basic monthly spending budget. Even if fraud occurs and I cannot stop it in time, the potential loss should at least be limited. In practice, the first two habits usually help me catch the problem before it reaches this point.
4. Any larger amount of money that I am not investing is generally locked in a time deposit, so even a debit card cannot reach a large sum.

While writing this article, I suddenly received an email saying that someone had changed my PayPal password. That made me more suspicious of this lead, but I still could not confirm where the fraudulent charges originated.

At the time, I guessed that perhaps there was no PayPal balance and the person then used my credit card. I could not know what they actually thought.

I was so angry that I closed the PayPal account for the time being. If I need it again someday, I will deal with that then.

While closing the account, I noticed an attempt to use my PayPal account through Steam to buy a Blizzard game. So the charge beginning with B may have been Blizzard.

If the PayPal account had contained a balance as well as a linked card, I might have needed to deal with a PayPal refund after resolving the bank side too. That would have been extremely troublesome.

In short, my personal conclusion was to avoid PayPal whenever possible. If you truly need it, think very carefully before keeping a credit card linked to the account—seriously, remember that.