Fubon Credit Card Fraudulently Charged—Suspicion of Personal Data Leak at MOMO Shopping Site

Around seven o’clock on Friday evening, while I was enjoying dinner, the phone rang in the restaurant space that seemed overly quiet because of the COVID-19 pandemic. A call from the number “0987436113” appeared on the screen, disturbing the leisurely weekend time.

Just as I usually deal with marketing calls, this time I also pressed mute directly, letting the other party slowly listen to my specially chosen Rene Liu, whose captivating voice can draw people into memories of the past.

But another habit of mine is that if the other party doesn’t give up and calls a second time, then the call is probably really important—and this number indeed called again right away.

I have to admit, this thoughtful review-and-notify move by Fubon Bank moved me.

On the other end was a risk management staff member from Fubon Bank, asking whether I had used a certain credit card on the Apple official website in the United Kingdom, “Apple UK”, to make a purchase of as much as 40,000 yuan.

Mind-blown—it seems I’ve been the victim of card fraud. This is quite a rare first experience for me after years of online shopping.

It turned out that a certain card’s number, expiry date, and verification code had all leaked. The hacker probably expects me to send him a latest-model Apple iPhone 13 Pro.

I replied with a light laugh: what kind of idiot hacker would set his sights on a pauper? My credit limit isn’t even 40,000, let alone 30,000—a business titanium card with only a 20,000 limit would surely leave that idiot hacker dumbfounded too.

Although the villain failed this time, the fact that the card number leaked is established, and Fubon customer service directly helped replace the card. I also checked on my own whether other banks showed signs of abnormal use. It seems it will take a while to confirm whether any data has been fraudulently used again.

What’s the connection between credit card fraud and the personal data leak at MOMO Shopping?

While communicating with the Fubon Bank staff, I also asked them to inform the online information security department at MOMO Shopping, asking them to check whether the system showed any traces left by hackers.

Why did I immediately suspect that the online shopping system had perhaps been hacked to steal data, causing a personal data leak?

The reason is simple: this credit card is a co-branded card, the “MOMO Fubon Card”. I applied for it back then precisely because of the online shopping rewards, and I only use it when spending at M.

This co-branded card isn’t even in my everyday wallet; I’ve always kept it in a small box deep in my bookshelf. Since the card number data was registered in the MOMO system database long ago, I don’t need to enter a verification code for small online payments normally—only for large purchases do I need to dig it out and look, and I often forget where it’s hidden.

In short, the card number and verification code are very hard to leak anywhere else, unless Fubon Bank’s own database was breached (though that would seem even more serious, wouldn’t it?).

Of course, after all, getting this co-branded card was also a matter from a year ago when the pandemic first began, so it’s not entirely certain whether I can use “absolutely” to prove that I never bought anything on other online shopping platforms (definitely not in physical stores). At least, looking at the past six months of spending records, they are all M-site purchase details, so for now their platform remains the biggest suspect.