Paid For Extension - Immediate Fraud on Credit Card

Question

Paid For Extension - Immediate Fraud on Credit Card

gitissues1981 opened this issue 10 months ago · comments

gitissues1981 commented 10 months ago

Hello,

I donated to this extension via the internal payment link, which said the processor used Stripe for transactions.

This was around the beginning of September. On the same day that the transaction was processed for AZAD Extension - immediately numerous Facebook Ads charges appeared on the card. Furthermore, there have been additional charges attempted through Payu Retail PG.

I have had to close that card out, and have it replaced. This is a major issue. The card was not used for any other online purchases, as it was a brand new card.

Thanks, -Mike

Philip Mulcahy · Answer 1 · Fri Sep 22 2023 17:57:37 GMT+0800 (China Standard Time)

Thank you for signing up AND reporting this issue! Let’s keep this issue open and prominent for a while to see if anyone else has experienced similar loss. If they have, I guess the next step is to contact Stripe. I’m looking at GitHub without being logged in today, so I cannot see your identity. It’d be useful if you could email ***@***.*** from the email you used with extpay/stripe - please include #240 in the subject line. That will spare you the additional risk of sharing details with the internet via GitHub. Only I have access to that gmail account. That email address will allow me to identify your stripe transaction, though the PII they share with me is totally minimal (a good thing). I very much doubt they’d allow me to make a complaint on your behalf, or share info with me without your permission (also a good thing). Some background: the popup you entered your details into is served by a business called ExtPay that provides a library that Azad links to to authenticate paid users. The extension code doesn’t see your identity or card details - it just checks with extpay to see if the logged-in user (whose ID is unknown to Azad) is “paid”. I wouldn’t trust my amateur code to be secure, and I don’t expect anyone else to either: that’s why the credit card handling is delegated to ExtPay and they in turn delegate to Stripe. Have you investigated any alternative routes your details could have been stolen via, such as 1) interception of your card details before delivery 2) your computer/phone/browser having been compromised with spyware (a surprising proportion of the world's devices are silently infected - the bad guys tend not to advertise their infiltrations) 3) other physical access to your card ? Yours, Philip

…

On 21 Sep 2023, at 15:20, gitissues1981 ***@***.***> wrote: Hello, I donated to this extension via the internal payment link, which said the processor used Stripe for transactions. This was around the beginning of September. On the same day that the transaction was processed for AZAD Extension - immediately numerous Facebook Ads charges appeared on the card. Furthermore, there have been additional charges attempted through Payu Retail PG. I have had to close that card out, and have it replaced. This is a major issue. The card was not used for any other online purchases, as it was a brand new card. Thanks, -Mike — Reply to this email directly, view it on GitHub <#240>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAMXOHC4XVNJLAZWMRUMHFTX3REMTANCNFSM6AAAAAA5BULB5I>. You are receiving this because you are subscribed to this thread.

Philip Mulcahy · Answer 2 · Tue Sep 26 2023 03:35:11 GMT+0800 (China Standard Time)

Unsurprisingly (but also luckily) there are no me-too posts yet, nor any updates, clarifications or other news from the bravely anonymous @gitissues1981, who seems likely to also be "GReviews" on the extension's review page:

I can confirm that they have not emailed with their stripe payment details for me to follow up with Stripe. Given their facility with disposable IDs, their likely argument that they didn't want to give me their email address doesn't hold much water.

I assume this is because of one or more of the following:

they're no longer so confident of my perfidy
they're fire-and-forget type keyboard warriors that are not interested in actually helping fix stuff
they've realised that they are only slightly anonymous, and that were I minded to pursue a libel case it would be trivial to unmask them

Philip Mulcahy · Answer 3 · Sun Oct 01 2023 02:40:59 GMT+0800 (China Standard Time)

guess what: still no response

Philip Mulcahy · Answer 4 · Fri Oct 06 2023 22:44:41 GMT+0800 (China Standard Time)

Closing this ticket, since user probably has figured out how half-cocked their accusation was, and are too embarrassed to apologise.

Everyone else - sorry I'm not great at PR - engaging with this clown was probably not a great use of my time or emotion.

orthoZ · Answer 5 · Tue Oct 10 2023 06:38:09 GMT+0800 (China Standard Time)

I tried to donate since I thought it was an excellent extension. The only payment alternatives were standard Visa, M/C, etc. I do not use my card directly on sites that I would not frequent; I use PayPal whenever possible. There was no PayPal option, although I checked and the JustGiving app does have one, but it is possibly an option that must be set up.

I contacted support and after numerous back and forths that just asked me standard stuff (clear cache, etc), despite supports assertion that the PayPal option was there, I just could not see it. I tried my desktop with multiple browsers (including a clean version of Opera that I keep for issues like this) and my phone, but no PayPal option is to be found. Other people using JustGiving for donations do have a PayPal option.

Is JustGiving setup correctly for PayPal for the Amazon extension?

Philip Mulcahy · Answer 6 · Tue Oct 10 2023 08:24:25 GMT+0800 (China Standard Time)

JustGiving knows nothing about azad that you cannot see in the human targeted text: there were no hidden settings of any technical nature that I can remember. All they know are my credentials, who to give the proceeds to and the blurb I wrote.Sent from my phoneOn 9 Oct 2023, at 23:38, orthoZ ***@***.***> wrote: I tried to donate since I thought it was an excellent extension. The only payment alternatives were standard Visa, M/C, etc. I do not use my card directly on sites that I would not frequent; I use PayPal whenever possible. There was no PayPal option, although I checked and the JustGiving app does have one, but it is possibly an option that must be set up. I contacted support and after numerous back and forths that just asked me standard stuff (clear cache, etc), despite supports assertion that the PayPal option was there, I just could not see it. I tried my desktop with multiple browsers (including a clean version of Opera that I keep for issues like this) and my phone, but no PayPal option is to be found. Other people using JustGiving for donations do have a PayPal option. Is JustGiving setup correctly for PayPal for the Amazon extension? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you modified the open/close state.Message ID: ***@***.***>

orthoZ · Answer 7 · Tue Oct 10 2023 09:45:55 GMT+0800 (China Standard Time)

Good Evening Philip, Thanks for the note. Just know that I cannot donate other than by using the standard credit card options. I have tried multiple browsers on a desktop PC and on my Samsung Android phone (with and without cookies, and with clean caches). Mark From: Philip Mulcahy ***@***.***> Sent: Monday, October 9, 2023 5:25 PM To: philipmulcahy/azad ***@***.***> Cc: orthoZ ***@***.***>; Comment ***@***.***> Subject: Re: [philipmulcahy/azad] Paid For Extension - Immediate Fraud on Credit Card (Issue #240) JustGiving knows nothing about azad that you cannot see in the human targeted text: there were no hidden settings of any technical nature that I can remember. All they know are my credentials, who to give the proceeds to and the blurb I wrote.Sent from my phoneOn 9 Oct 2023, at 23:38, orthoZ ***@***.***> wrote: I tried to donate since I thought it was an excellent extension. The only payment alternatives were standard Visa, M/C, etc. I do not use my card directly on sites that I would not frequent; I use PayPal whenever possible. There was no PayPal option, although I checked and the JustGiving app does have one, but it is possibly an option that must be set up. I contacted support and after numerous back and forths that just asked me standard stuff (clear cache, etc), despite supports assertion that the PayPal option was there, I just could not see it. I tried my desktop with multiple browsers (including a clean version of Opera that I keep for issues like this) and my phone, but no PayPal option is to be found. Other people using JustGiving for donations do have a PayPal option. Is JustGiving setup correctly for PayPal for the Amazon extension? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you modified the open/close state.Message ID: ***@***.***> — Reply to this email directly, view it on GitHub <#240 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AI4B3XOMVAMOOGVN3QBAF3TX6SIUHAVCNFSM6AAAAAA5BULB5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONJUGEYDSNZQGU> . You are receiving this because you commented.Message ID: ***@***.***>

orthoZ · Answer 8 · Tue Oct 10 2023 10:51:05 GMT+0800 (China Standard Time)

Good Evening Again, Here is the problem. Of the five currencies offered by JustGiving only payment with British Pounds gives the various payment options, including PayPal and Google Pay. All others only offer standard credit cards. You may be missing donations with that kind of implementation. Mark From: ***@***.*** ***@***.***> Sent: Monday, October 9, 2023 6:46 PM To: ***@***.***' ***@***.***> Subject: RE: [philipmulcahy/azad] Paid For Extension - Immediate Fraud on Credit Card (Issue #240) Good Evening Philip, Thanks for the note. Just know that I cannot donate other than by using the standard credit card options. I have tried multiple browsers on a desktop PC and on my Samsung Android phone (with and without cookies, and with clean caches). Mark From: Philip Mulcahy ***@***.*** ***@***.***> > Sent: Monday, October 9, 2023 5:25 PM To: philipmulcahy/azad ***@***.*** ***@***.***> > Cc: orthoZ ***@***.*** ***@***.***> >; Comment ***@***.*** ***@***.***> > Subject: Re: [philipmulcahy/azad] Paid For Extension - Immediate Fraud on Credit Card (Issue #240) JustGiving knows nothing about azad that you cannot see in the human targeted text: there were no hidden settings of any technical nature that I can remember. All they know are my credentials, who to give the proceeds to and the blurb I wrote.Sent from my phoneOn 9 Oct 2023, at 23:38, orthoZ ***@***.*** <mailto:***@***.***> > wrote: I tried to donate since I thought it was an excellent extension. The only payment alternatives were standard Visa, M/C, etc. I do not use my card directly on sites that I would not frequent; I use PayPal whenever possible. There was no PayPal option, although I checked and the JustGiving app does have one, but it is possibly an option that must be set up. I contacted support and after numerous back and forths that just asked me standard stuff (clear cache, etc), despite supports assertion that the PayPal option was there, I just could not see it. I tried my desktop with multiple browsers (including a clean version of Opera that I keep for issues like this) and my phone, but no PayPal option is to be found. Other people using JustGiving for donations do have a PayPal option. Is JustGiving setup correctly for PayPal for the Amazon extension? —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you modified the open/close state.Message ID: ***@***.*** <mailto:***@***.***> > — Reply to this email directly, view it on GitHub <#240 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AI4B3XOMVAMOOGVN3QBAF3TX6SIUHAVCNFSM6AAAAAA5BULB5KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONJUGEYDSNZQGU> . You are receiving this because you commented.Message ID: ***@***.*** ***@***.***> >