Coles Prepaid MasterCards Compromised - June 2022 Promotion

Hi fellow OzBargain members,

I've found a few of my cards that have been compromised bought from this deal - 10% off $100 & $250 Mastercard Gift Cards ($4.50/$6.30 Activation Fee Applies) @ Coles
posted in June 2022

Exact same issue from this forum post just under a year ago but appears to be different merchants that are draining the balances this time
Last time round it was Google Play of some sort

Screenshots of unauthorised transactions as below:
Sample 1 - Healthy Land Massage
Sample 2 - Healthy Land Massage
Sample 3 - Pending Charge - serverblen
Since then, the third card has been blocked by the Incomm operator, and I've been asked to call back in a week for that particular card
The Incomm hotline operator also noted there were three transactions on the third card, a purchase and a refund (which doesn't show on the mybalancenow.com website)

When you card becomes blocked by Incomm, you will get the below message when you attempt to check your balance on the Mybalancenow website

The card details entered are invalid. Please contact Customer Care for assistance.

Most likely the third card affected for me is being tested before they put in through a large purchase

The company that issues the cards bought in the June 2022 promotion are different to the 2021 ones (Coles Financial Services)
This is by Incomm Payments

As per the back of the card, the Customer Service line can be reached via +61 (07) 5660 6022

If you are affected by this issue - contact them, and go through the phone menu to go to "Lost/Stolen" card menu and you'll be able to speak to an operator.
You'll then be asked for your details and given a dispute form (PDF) via email which you'll need to fill and send to a different email ([email protected])

Dispute process is supposed to take anywhere between 45 days and 90 days.

Hopefully by raising awareness, and by gathering more data for Incomm we can help catch these culprits and reach a speedy resolution for all those affected


Probable Cause
From the discussion in the previous attack, it's most likely a brute force attack.
Looks like they put in a small pending charge to test cards (most likely using a payment processor that doesn't have captcha protection), then they use the card instore that doesn't require CVV or PIN (notice how my two cards are above $200, even if I had set a PIN on them, this would not stop the payment because anything above $200 reverts back to Signature Required)

As per the previous Coles Gift card deal/issue
These Coles gift cards have got the same expiry dates 03/27 and leading first 8 digit numbers (at least for the $250s they do)


Suggestions
From the discussion in the previous attack and my own experience as an OzBargainer who delves in saving money via discounted eGift cards regularly..

1) Do not hoard these cards (or ANY eGift cards) in large amounts, only buy any gift cards (especially VISA/MC Prepaid cards) when you have expected bills to pay or planned expenditure
2) If you are exposed with a significant amount of balance, you can attempt to reduce your exposure by consuming the balance as fast as you can:
- These include prepaying your utility bills into credit (keep your physical cards in case unexpected credit refunds by some utility companies, so don't prepay too much into one account)
- Convert to other types of cards, that you can load into an account that has significantly higher security than the Visa/MC prepaid cards (Amazon, enable 2FA to login for example), WISH/Coles eGift cards if you have access to purchasing portals

Thanks for reading and hope not too many OzBargainers are affected.. however this time round so far I have had 3 cards affected out of a sample size of 20 cards which is much higher than last time.

Stay safe and happy saving!

Cheers
Cwongtech

Related Stores

Coles
Coles
MasterCard AU
MasterCard AU
Marketplace

Comments

  • +2

    My card was also hacked. It was the new $100 card purchased during the early August offer.
    8/21/22, 12:47 AM
    PENDING - SERVERBLEN* SERVERBLEN - O400266BAB15
    - $2.48
    ServerBlend | Five-Star Game Server Hosting.
    Used up the remainder immediately and the $2.48 was refunded a couple of days later. Very disappointing. They just introduced this card and it seems a major improvement regarding physical tampering but not these brute force attacks. Can a foolproof system not be devised? We need to ensure any lost funds are refunded in full otherwise future purchases will need to be considered very carefully.

    • +1

      They could make it at least somewhat more difficult to brute force by randomising the expiry date on the cards. Or you'd think they could disable use of the cards at facilities that don't verify CVV/PIN, who knows.

      I don't know why they keep selling these when they're so easily compromised, I've always stayed away from them after reading the issues on OzB.

  • +1

    didn't the OP get hacked as well last time he bought cards?

    lol what's so popular at healthy land massage for $208?

    • didn't the OP get hacked as well last time he bought cards?

      Cards that I owned, yes, these cards are different and I thought perhaps card usage security improvements were made.

      Evidently not.

      lol what's so popular at healthy land massage for $208?

      Poor security I suppose

    • Perhaps it may have been Healthy Hand Massage.

  • I just skimmed through but this doesn't apply to gift cards right?

    • bought from this deal - 10% off $100 & $250 Mastercard Gift Cards

      • I meant as in specialty gift cards that's used for certain store/s.

    • hacker will only try to hack something which is useful to them,

      like AUD.

      them skimming gift cards (especially those that cannot be used online) is highly unlikely. and I'd say very difficult too, unless they had actually tampered with a terminal where you made payment or something like that.

      But the gift cards that can be used online, are more prone to attack, BUT AGAIN, only stuff that the hackers will find useful, like bitcoin, straight cash, etc. never the less amazon gift card or something like that could be prime target too for such hackers

      As stated multiple times, THE KEY IS ONLY BUY WHAT YOU NEED.

  • Did both of the issues happen from cards purchased from Coles?

  • Good i haven't left any, unused. I used all of em.

  • -4

    So instead of 10% off you got more than you bargained for, ba dum tssss. I'll let myself out.

  • +4

    Thanks for the PSA OP and sorry to read your cards were hacked. Will definitely be buying less of these cards in the future!

  • Thanks for the warning. Couldn't check the balance on the coles mastercard website but used up 2 of my 3 $250 prepaid debit cards to purchase woolworths gift cards at 5% off without having any issue (Didn't bother doing anything with the 3rd). Guess I got lucky.

  • +1

    I got hacked too!! Healthy Land Massage for $208. Apparently the transaction took place in person in NSW (I'm located in WA). Went to use it at Costco but it didn't work. Logged in and found out that it got hacked.

    I've reported to Heritage Bank and hope to see my money again.

    • Sorry to hear that, the merchant details in the check balance page doesn't show NSW for me (or anywhere..)

      Did you need to fill out a dispute form with Incomm payments?

      • +2

        I called Heritage Bank and the details was given to me to fill in the form.

        • I was reading through your other post and can’t seem to see reference to what Heritage bank number was, could you please share?

        • Could you message me the forum they sent please?

  • 🎭 On side note also check if your emails have been pawned into regularly, I recently found out about androidlista.com, BREACH DATE September 3, 2021.

    • How do I check?

      • multiple ways

        easiest and dummies starter way is haveibeenpwned.com,

        next are stuff like
        avast, dashlane, AVG, etc. type of software's which auto detect any leak or some require you to click manually to see leaks.
        next level which you or any dummy dont need to know about it is dehashed

  • On the dispute form it says with 60 days. Is that legal?

  • +1

    Did people get their money back in previous hacks?

    • Yes but that was done by Coles Financial Services

      This one is by incomm payments

  • +3

    Hi one of my cards was hacked in late August by healthy massage .. i placed a post to make people aware… i ve since gotten my replacement card after calling heritage banks complaints team.. they r aware of these healthy massage transactions

    • +1

      I'll give Incomm dispute process another week or so before checking with Heritage Bank

      Thank you for sharing your experience! Highly appreciate it!

      • Just wondering if you heard anything yet? And how long has it been since you submitted the form.

        • +1

          Have not heard back anything from dispute team yet.

          I initiated first contact and submitted dispute form on 6th of September

          • @cwongtech: wow, so a month now. And i assume they still haven't had any communication with you?

            • @cloudy: No phone or email follow up/contact

              I'll follow up tomorrow (away from home at the moment)

              • +1

                @cwongtech: They are not helpful at follow up. The only thing I get is “is there anything else I can help you with”

                Below is the response I get from heritage bank

                Dear XXX,

                Reference No xxxxx

                Thank you for bringing your concerns to our attention and your time on the phone.

                As discussed, the Coles Mastercard is owned and operated by a company called Incomm. As the product owner, Incomm collect and manage your personal and transaction information. Heritage Bank is the card issuer, we act as a service provider to Incomm to carrying out the financial administration associated with the cards. As such, we do not have access to the account or transactional details for these cards.

                I have escalated your concerns with Incomm and they will contact you to discuss.

                If you are unhappy with the outcome provided, you may request an independent review with the Australian Financial Complaints Authority (AFCA):

                Telephone: 1800 931 678
                Email: [email protected]
                Online: www.afca.org.au
                Mail: GPO Box 3
                Melbourne VIC 3001

              • @cwongtech: Hey, can you give am update

  • +2

    Thanks for sharing OP and sorry this happened to you. I usually hoard these cards too if there are available in my area. Out of consciousness that these cards are prone to getting compromised, I use it right after purchase to prepay bills which won't earn me credit card points for peace of mind.

  • +2

    Thanks for posting ,still amazed this hasn't been on the news yet.

  • Thanks for the post OP.

    I also have a card used at healthy massage. I’ve called the number and given the form to dispute the charge, we’ll see how this goes I guess. But the customer service rep said I’ll only get a refund when they retrieve the funds.

    I’ve started to use all my cards at least somewhat to bring the funds remaining under $200, hopefully it helps reduce the risk.

    • resolved?

      • nope, i called them the other day and they just repeated they received my dispute and thats it.

        I'll be returned any monies they claw back… i have liittle hope

  • Can anyone explain how they're siphoning the money from a business?

  • +1

    I have one $100 MasterCard compromised with a charge on 30/8 by Boxo Noodle Bowl for $69.92. Google tells me that merchant is in USA..

  • +1

    Very concerning that people are having dodgy transactions taken from their cards

    I purchased about $7000 worth and thankfully don’t have many left, or have had any money taken from the ones I’ve used

  • Someone has been getting a lot of massages. My card got hacked too :(

  • does anyone else have trouble checking their balances? every time I try the site says error.

    • works on mobile for me, but not desktop - presume this is how cards can get hacked with automation software

    • Try an incognito/in-private tab, or other browser. I've had this issue, works fine in Chrome Incognito usually (on the laptop).

  • Got a call today from Coles MC (Inncom) representative. He asked for the "15.." number next to the bar code on the back of the card and confirmed my mailing address. He either gets these cases via Heritage Bank or the dispute packet submission to Inncom. He confirmed he hasnt seen my dispute packet (I did call Heritage Bank after sending mine off) so i suggest maybe trying both ways.

    He said one will be sent out tmr and I should get by middle of next week. He however said he has a 50% success rate with sending these out and its an Aust Post issue that he is also dealing with!!! Don't know what is going on but he said because of this and that he is very busy. He said if i dont get it by middle of next week to call and he will try to send it via another method

    • +1

      When did you submit the dispute packet?

      • +1

        Submitted dispute packet 29-Sep but then decided to follow up with call to Heritage Bank on 04-Oct after reading some comments here. Based on the conversation he’s looking at my case based on the call and not the dispute packet

        • Do you have any updates, please? I have a $250 card hacked by Healthy Land Massage for $208 on 19 Aug 2022. Should I call +61 (07) 5660 6022??

          • +2

            @PeterPP: I received the replacement card from a hand written envelope on the 25th-Oct. And yes, call that number as well as Heritage Bank (number is in the white pamphlet with each card. Sorry, I’ve thrown mine out)

            • +3

              @thriftee: Thank you so much thriftee !!!

              I check the pamphlet and found the number. I also post here to let everyone know the Heritage Bank number as well.

              Heritage Bank —- 1800 797 799

              • @PeterPP: I’m wondering if you called heritage? And what they said? I lodged my dispute with immcom, but it’s been a while

    • Does not sound like a very efficient process.

  • +2

    My mum has let me know she had a $250 card hacked by Healthy Land Massage for $218, transaction was made end of Aug. There was also another small transaction at Little Manila Rising, but that one seemed to have been reversed by the system the next day.

  • +2

    I have the same issue too… a $250 card hacked by Healthy Land Massage for $208 on 19 Aug 2022. I will call next Monday.

  • +2

    Thanks for putting all this info together cwongtech. Can confirm the $100 and $250 cards all have same first 8 numbers.

    I have been hacked also on a $250 card from this promotion but seems to be fake restaurants instead:

    Transactions
    9/8/22, 11:03 AM
    BAO NOODLE SOUP INC - O200281AC555
    - $16.33
    9/1/22, 11:06 PM
    ONE PIECE RAMEN - O50028395AB1
    - $95.75
    8/31/22, 11:05 PM
    BOXO NOODLE BOWL - O100145CA08F
    - $137.92

    This is pretty disheartening. Too much potential hassle for what it's worth imo.

    • I haven't heard back yet from the dispute team (Incomm) (I had 2 affected by healthyland massage)

      The ones with small pending transactions (which eventually dropped off) have supposedly been blocked and replacements sent out (2 cards), but still no sign of them in my mail..

      • +1

        chances are they will be already spent when you receive them …

      • +1

        OK, just went to check my 3 remaining cards and another was compromised with the $208 healthy land charge.

        I've received the the dispute form but it mentioned that you need to raise the dispute within 60 days of spending which I fell just past. I don't know how they expect this on a gift card that the purchaser will not know until they try to use it and the card having almost a 5 year expiry date from purchase…

      • Could you please pm me the forum they sent. I have to chase up now

  • +1

    just realised one of my card also compromised on the 3/11 for $143, HC* HC_CHARGE - O30028B77BAE and according to the customer support this merchant is in the US. banking system really need to upgrade and invest in Cyber security

    • is this from the same batch, or the latest promotion we had?

      • The recent promotion

        • I've just tried using one of mine from the October 2022 promo and it's been hit with multiple HC* HC_CHARGE transactions as well. Did you get a resolution as yet?

  • +1

    I got a email from AustraliaDisputes. Which I was sus by the name, but it had my dispute details. Said they’ve finalised my dispute and approved my claim and I’ll get a new card sent in 15-20 business days :s

    See how it goes I suppose

    • +1

      Same, just got an email from [email protected]

      One of my tickets had two cards compromised, only given the result of one card, will need to follow up for the other.

      • Hey cwong, I’m wondering if you got your replacements yet? I haven’t and it’s been ages…:s

        • I haven't either :\

  • I have $100 card which has a healthy massage transaction from august. I will be calling and filing a claim now. Is it too late? Have you got your money back?

    • I am planning on going to AFCA if this fails. AFCA will help right?

      • 12/28/22, 11:17 AM VNG GAMES

        First time I've had a $250 card drained. Surely just recieving our money back is not enough. We need to take further action.

        • First time I've had a $250 card drained. Surely just recieving our money back is not enough. We need to take further action.

          Try the [email protected] email

          We're at the mercy of the dispenser unfortunately, only they'll take action when it costs them too much resources to issue out replacements..

    • I will be calling and filing a claim now. Is it too late? Have you got your money back?

      Try everything:
      - Call Heritage Bank - Heritage Bank —- 1800 797 799Thanks to PeterPP
      [email protected]

      Have you got your money back?

      No sign of replacement cards yet..

      • +1

        I got my replacement just before Xmas. Happy happy

        • I got 2 replacements in the mail today, from Incomm Australia (which was confirmed by email) by Domestic Letter with Tracking
          These were the two that were disputed for HealthyLand Massage

          There are still 2 cards to be replaced, these are the ones that were cancelled over the phone after cards being put on hold due to unrecognised authorisation holds with "SERVERLBEN" (from memory).

          The authorisations later dropped off and my details were obtained over the phone, I believe the replacement for these have not been sent out

          • @cwongtech: Good to know you’ve got some back, hope the rest comes soon

            • @cloudy: Sent an email to [email protected]

              They've acknowledged it and will be checking on it

              That email appears to be quite responsive for American hours (11pm Syd time)

              • +3

                @cwongtech: I send an email with no auto reply, waiting

                $100 coles master gc purchased on 31/12/2022 has been spend on Tiktok by hacker

                the security of these prepaid card is hopeless

                • @ggfatty: I had the same situation.

                  $100 coles master gc purchased on 30/12/2022 and the hacker spend on Tiktok too.

          • @cwongtech:

            There are still 2 cards to be replaced, these are the ones that were cancelled over the phone after cards being put on hold due to unrecognised authorisation holds with "SERVERLBEN" (from memory).

            These have now been replaced after follow up

  • I have recently discovered another 4x $250 gift cards compromised, 2 were used at Tiktok, and 1 was streaming services and 1 was VNG games. Everyone should check their cards..

  • I've also had a $250 gift card compromised. Already spent $150 of it in Dec 2022 and had $100 credit left. Then on 21st Jan, there were 2 unauthorised transactions $2.21 and $88.33 for TikTok. Have never used TikTok in any way, shape or form before!

  • I've also had a $250 gift card compromised. $240 on TikTok on 17/01/2023
    Have never used TikTok in any way, shape or form before too

  • I’ve been very lucky by the sounds of this thread.

    I’ve purchased about $10,000 of the $250 Cards and haven’t had any problems with any of them

    • Good for you, it is only of 60 cards having this issue, just i did not use it in time.

    • i guess if you use them all the day u buy them you'll be ok. I had mine for 3 months then got hacked.

  • Just found this. I have a friend give us a 100$ gift card on October 2022. I just opened the pack and tried using it last week only to find it only had 35$. The website does not give the balance but the phone line said there were 4 transactions before. This is shocking.

    Lesson learnt use the Giftcards Immediately after purchase as they activate only when they been bought.

  • If anyone has issue with their Coles Gift Mastercards, then check your card numbers as MyBalanceNow site currently has this message at their Help/Contact Us page:

    For card numbers beginning with 510982, please call:
    +61 (07) 5660 6022

    There is a similar message for Visa cards too.

    Sure, I'll be calling them in due course.

    Cards bought during current offer.

  • Bought $250 card on 17/4/23 was hacked on 25/4/23 to pay ATO, not happy.

    • +1

      Sorry to hear. Hope you are refunded soon. The hackers are quick. Have to spend almost straightaway.

      • Unfortunately, the ATO has a limit on how many payments you can pay within a 12 hour period. Maybe they are worried about money laundering :)

    • +1

      Are you sure it was hacked? Maybe it was declined because you reached the 12hrs limit?

    • +1

      Out of all the things they could pay with a hacked card, they chose the ATO?

      Probably one of the dumbest things I've heard…

      Just dying to get caught.

    • +1

      Just to let everyone know the card was not hacked.

      On 26/4/23 I paid ATO it there was a message " Your payment was declined. Please contact your financial institution."

      I proceeded to check the card balance 25/4/23 10.15 am pending - card payment fee ATO .50 and pending - ATO payment $249.50.
      It was Anzac day I was at work in a meeting so I just assumed the card was hacked.

      Today I checked my ATO account, ATO has received 3 x 249.50 ie 2 valid payment and one declined/hacked payment.

      I am still not quite sure what happened, I made the payment on the 26/4 but pending on 25/4, this does not make sense.

      • +1

        Time zone difference

        • It is UK time. You can compare the activation time(at Coles) difference.

  • +1

    One of the cards I bought got hacked, submitted a case to [email protected] on 5 Feb 23, and didn't hear back from them until today 2 May 23. So almost 3 months for them to resolve my case. They said they will send me a replacement card. When I asked them what was taking so long, they said that they have to give the merchant who's transaction I'm disputing 45 days to respond, not sure what happens for the other 1.5 months.

    • Seems like they would rather refund losses than allow people to lock their card either online or even when you are already on the phone with them. This is something they used to do. Should be easier now that they are having the promotion in one or 2 states at a time. One operator told me I could lock my card online when I asked her to confirm she came back telling me that this was only possible in the US.

      • +1

        Guess there's now too many people wanting to lock. Would have been great if we have access to access to lock ourselves. I use keep some around for online shopping, but don't bother anymore after getting hacked.

Login or Join to leave a comment