Larry3215

My Feedback: (2)

(Mods - Im not sure where to post this so feel free to move as needed)

I sent a buddy of mine to purchace a charger from FMA a couple of weeks ago.

He has a special checking account he uses just for web purchases that he only keeps minimal $$ in.

A few days after his purchase from FMA, he started seeing charges show up from porn sites.

He closed the account and got the charges reversed - except for over draft charges of about $75.00 that he is still fighting over.

He tells me that after talking to FMA, they say they admitted the problem and have made changes in the way they handle account numbers/info on thier site and this shouldnt happen again.

He had to contact FMA. They DID NOT notify him of the card number thefts.

Some of the guys on WattFlyer suspect they are also victims of card number theft after purchaceing from FMA, but no one else has confirmed it yet.

http://www.wattflyer.com/forums/showthread.php?t=40991

Id suggest that anyone who has made a recent purchase from FMA check your accounts for unauthorized charges.

guver

My Feedback: (325)

Thanks for the heads up.

What's the best way to request that a web business delete info after purchase? or is it automatic?

Larry3215

My Feedback: (2)

I have no clue. I would have assumed it would be done automatically - especially in this day and age!

Call them I guess?

Larry3215

My Feedback: (2)

I should have posted a link to the web site to avoid any confusion.

http://fmadirect.com/

mrbigg

My Feedback: (21)

Ya gotta wonder if it was just some guy working there and not someone else scamming via the net. Surprised it don't happen more often.

NCBrit

You'd be surprised. PCI-DSS the credit card insustry's self regulation, doesn't have any requirements for the data to be deleted. In fact for small companies with low credit card volumes the rules are fairly relaxed.

frieshoo

My Feedback: (20)

It looks like they use networksolutions shopping cart.

The hacker would need access to the session information on the client side, or the stored database information.

My guess is the hacking is done at the local database level... someone with access, or someone hacking the server (without access).

Networksolutions encrypts at the browser level, across the net, and at the server. Really Really tough to hack.

There are no rules about storing credit card numbers on a database, some companies ask for you permission, some companies store without informing you.

Bill G

These things become pretty obvious after a while. I had an attemted hit from my card number being unsafely stored by that micro place, a while back. It was beyond dispute between the coincidences of us on the forum, which company had lost the info.

I don't know how this works, but it is possible that the encrypted info was never stolen. They may likely decript it and store it on their server, and lost it that way.

mikekomm

My Feedback: (9)

Just a heads up guys. Both Visa and Mastercard have very strict compliance standards for processing credit cards on line. There are a number of companies that perform scans of a providers website to determine vulnerabilities that can result in the theft of credit card numbers.

This is the type of company that I'm referring to:

http://securitymetrics.com/?gclid=CI...FSAUagod80EeZg

Compliance is mandatory.

Mike
www.CommonSenseRC.com

mike240se

I havent purchased from FMA in a couple months, but my credit card, one i rarely use and used on fma direct was used to run up transactions last week. i had no idea how it was stolen till now. they charged napster, netflix, delta airlines, usdpointsonline and some tools. all declined - bank of america rocks! only $20 went through. but delta? ***? gonna try to board the plane with stolen tickets?


this is so crazy, iam so mad, but i do feel bettr knowing how the card was stolen.

Red Scholefield

My Feedback: (9)

Statment from FMA Direrct 11-2-08

Statement from FMA Direct Management in response to posts on leading RC Online Forums.

During the last week of October, FMA received two inquiries within a matter of days about possible compromised credit cards. In both cases the customer informed us that they had used their card at multiple online sites and could not confirm which site(s) could have been compromised. We promptly notified the company who hosts our website about the possible compromise of our database. After extensive research on their end, our website host notified FMA that no breach could be detected. Nevertheless, as of November 1, 2008 the additional precautionary measures were implemented by FMA?s host:

1) Hardened all login passwords that could have presented an opportunity for such theft.
2) Added stronger encryption algorithms to any credit card transactions received on our partner's web hosting company?s servers.
3) Added additional security measures to further ensure credit card information is secure at our web hosting service.

Although our web provider still contends that no breach has been detected, FMA recognizes from the number of incidents reported on the forums, that a breach of the system may have occurred. As such, we are notifying FMA Direct customers who have purchased online to notify their credit card companies immediately about a possible breach. We assure you that we will remain vigilant moving forward with regard to any such attempts to compromise the trust between FMA Direct and our loyal customers. We apologize for the inconvenience this will cause.

retransit

My Feedback: (18)

You can add myself and a friend of mine to that list. We both have used FMA in the past. I was hit on two credit cards and my friend on one.
I sent emails to three companies we used but forgot about FMA.
There's nothing like being proactive. I'm being facetious in regard to FMA and its "warning".

Bob

djcmeeks

My Feedback: (11)

My identity was stolen on October 31st. I have purchased from FMA direct as well. The person had my credit card info, address, email address, and phone number. All information that could have been taken from transaction history. Obviousely we can't prove anything, but sure is a very large coincidence. For the past 3 weeks I have been dealing with having to call all of these random companies to cancel subscriptions that were created using my identity. Everything from purchases on Sears and Walmart.com to subscriptions to Columbia House DVD. What a PITA!

I_FLY_CL

My Feedback: (1)

My card got hit on Nov. 13.
I also made a purchase from FMA (Cell Pro) in last two months.

TC

MikeL

My Feedback: (3)

I think I'm done ordering online from FMA Direct. I've placed a few orders from them over the years. It's not so much that they've apparently had a problem, but how it appears they've handled it. I got the e-mail from them this morning saying that they had kinda maybe sorta had a problem. It gets wishy-washy about that - - maybe it was some other site. Then it states that they've made three changes, and made them on November 1st. So they knew about their kinda maybe sorta problem over three weeks ago, and didn't notify their customers until someone made a forum post? That's not how I deal with problems. That's crossing your fingers and hoping it goes away.

Their "precautionary" measures (if the problem has already happened, how is it a precaution??) state that they're improving their passwords and improving encryption. How about NOT keeping our credit card information on file?

I've sent FMA an e-mail asking that they unsubscribe me from their mailing list and remove any information they have about me from their databases. I do not want their problem to become my problem.

Red Scholefield

My Feedback: (9)

Has anyone posted here that FMA was the ONLY place they had placed an order over this time period?

rwithey

My Feedback: (3)

Me too - I started getting charges the second week of November on a card I used on the FMA web site. That card hasn't been used since September and was used on the FMA web site in July. Since the FMA order the card was only used 4 times in local stores by myself. My first hint I had a problem was when I started getting phone calls on my cell phone asking about the Porshe I was selling on autotrader.com. I have never had a Porsche! The person placing the add obviously had my cell phone number. Looking at my statements for the card - FMA was the ONLY online order AND I used my cell phone number as my contact number when ordering! I am now 100% certain my information was taken from the FMA order. The confusing part - the theives don't seem to be gaining anything -
They placed an add to sell a car using my phone number - how did they expect to get any money?
They signed me up for computergenious.com trial educational CDROM - but it shipped to me, I received it. If I don't cancel I get billed another $80 - they did not get anything.
I also had a $10 charger to Blockbuster.com and a charge to Napster that I never saw. My card company told me of them when closing the account.

So - DEFINATELY contact your credit card company of you ordered from FMA at all. Like I said my order was in July - but false charges did not start until October.
BTW - I am always very carefull when I order online - I NEVER had a problem like this before and I spend many many hundreds online each year.

SO IT CAN HAPPEN TO YOU TOO!

frieshoo

My Feedback: (20)

I'm not sure this is limited to FMA Direct.

In most cases, the online site (FMA Direct) does not see the CC numbers. The order placed through the Network Solutions shopping cart, the card is processed either by Network Solutions or a third party, and the funds a placed into a separate account for the online site.

In most cases, the CC information is saved on a server at the card processing site (Network Solutions or third party).

Network Solutions has thousands (if not millions) of shopping carts on the web... Maybe this is more widespread.

MikeL

My Feedback: (3)

People who are smart enough to glean information from supposedly secure databases probably don't use the credit cards and information themselves. It's sold to other parties.

retransit

My Feedback: (18)

My friend and I were told by our credit card companies that Epoch.com was the middle man in the fraud that involved us.

Bob

MrMulligan

My Feedback: (314)

I got a call yesterday from a Napster like company telling me I was being charged for software. I called them and wasn't very nice about it. The first call was a recording ending with a phone number. I called the Credit card company, Visa, and they had three charges that day totaling $8 and change. The last time I had used the card was two weeks ago to buy gasoline. It's the only card I use online. Anyway, the card was cancelled and a new one is being issued. A few minutes ago I received a call from a research company about a charge and I told them all about the stolen numbers. They weren't happy. I had bought a Cellpro 10 and later a programming kit from FMA this summer. At our club meeting last night, I warned the membership and one other guy had been hit.

joediamond

My credit card was hit with two fraudulent charges from www.kenya-airlines.com on 10/28. My mothers card was also hit with fraudulent charges a couple of days later. I have been a customer of FMA Direct and my mother had also purchased a gift for me from them as well. As far as we can tell FMA is the only company that both our cards have in common as far as credit purchases.

I received FMA's warning a few days ago. For us it came a bit too late, the charges on my card totaled $1700 and hers $1500. Everything has since been taken care of but perhaps if the warning had been issued earlier the fraud attempts could have been denied.

jvino

I just had my card closed due to fraudulent charges two days ago. I purchased a cell pro 10s in the last 2 months or so. Definitely a pattern showing up here!!

A. J. Clark

I was hit on 11-5-08. Got a call from an online store to confirm an order to be shipped to a different address.
Told the guy it wasn't mine. Then called the card company. Think I got it stop before things got to complicated.
Only have used the card a couple different places in the past years. One being FMA but that was 1 1/2 years ago.
Also got there alert email yesterday.

rcufhf

I ordered from FMA and I also found fraudulent charges on my VISA account - one was from an gaming arcade place, but I couldn't find out the city. Luckily I saw the charges the next morning and immediatly cancelled the account. Two charges went through already and three posted as 1 dollar and never posted to the full amount. I had to cover $200 but all charges were reversed later. Also got an automated call from VISA in the morning. Just got the email from FMA today - 2 weeks too late. I also called another site I ordered from, but they told me customer service cannot see card numbers. Didn't think of FMA, since the purchase was some time back. Glad I found out what web site compromised my data - now I want to know what else they know?!