On February 3rd at 6:54 pm an email was sent to me saying I requested password help for my Sam’s Club account.  No, I didn’t make that request.  Just two minutes later another email went out confirming ‘my’ purchase of two cameras from Sam’s Club to be sent to Chicago.  I live in Dallas.

I was fortunate enough to see these emails only an hour after the transaction happened.  I immediately went to my Sam’s account, but the password had been changed.  I then checked my bank account online and saw a transaction in the amount of $1,293.67 from Sam’s Club.  It was too late to reach them (I tried), but I did reach someone at my bank’s 24 hour line for stolen cards.  The transaction was immediately put on hold.

Of course, my card had to be cancelled, which means I have to notify everyone who has that number for a recurring payment.  Plus I couldn’t  access those funds from my bank account until the matter was resolved. 

The next morning I called Sam’s Club to cancel that card and stop the shipment of the two cameras.  It took 5 calls to get to the right person.  But Julie in Chicago didn’t get the two cameras.

This is identity theft. I don’t know exactly how it happened, but I believe it was a professional hit. The delivery address may just be a place where stolen goods are shipped.  Electronics and cameras are great for that.  The ‘forgot password’ email would give the thief an opportunity to use a program (called a packet sniffer) that tracks and reads specific emails just to get password information. It wasn’t casting about for whatever might bite, but after a specific, accessible target to access the account and place an order.  It’s possible that initially only my Sam’s account was compromised, and ordered from Sam’s using my card on file.  However both accounts were compromised in the end and had to be cancelled.

I asked a lot of questions about Internet safety and banking and online accounts. I’m fortunate that my husband Mike is extremely knowledgeable about Internet technology and what can and can’t be done to compromise email.

The person I spoke with at Sam’s told me almost no one calls to stop a stolen order from shipping.  My taking this action made it easy for Sam’s to void the charge to my bank account, and the funds were released back to me sooner than they might have been.  Catching the transaction so soon made the entire unfortunate and inconvenient situation much less painful and easier to resolve.

I’ll still order online at secure sites, and I’ll continue to check my email and monitor my online bank accounts, especially when my intuition tells me to check things at odd hours like it did February 3rd.