URGENT WORLDPAY FRAUD Dept., number required?

[Lucan Unlordly]

In the last hour I've identified what could be a major problem.
On logging in to our Worldpay Account to see the money transfer details being processed for payment this coming week I would normally see an amount pending and an amount already cleared.
Tonight I see a small sum of a few hundred pounds pending and instead of cleared funds a minus of nearly £20k to be taken from funds held!

I've called Worldpay and for the first time in over 10 years have failed to pass the necessary security protocols, my bank account details apparently no longer match? I've called back, different operator and same response, tried a UK landline number and auto system doesn't recognise either.

The operator cannot progress the conversation, cannot put me through to a supervisor and cannot give me a number to call to sort this problem out. Bloody ridiculous state of affairs.
Has anybody had this problem, got a number for their fraud department?

 

[Lucan Unlordly]

UPDATE: 4th time of trying I got through the security giving exactly the same details as previously

I'm awaiting a call back regarding the -£20k and am told it may be due to a refund I'd allegedly but haven't processed. I expect it to be sorted but a worrying example for companies with significant turnover for whom a £20k shortfall may go under the radar.

 

[ctrlbrk]

@Lucan Unlordly any idea how this might have come about, e.g. weak password, fishing, etc.?

 

[alamest]

That does sound odd. Normally WordPay (and similar processors) will have a dedicated fraud team, but they don’t always give out a direct phone number unless there’s an active investigation.

A couple of things I’d be checking straight away:

• Were the payments card-present or online?
• Any chance the login/email/password has been compromised recently?
• Did the transactions all come from the same IP/location?

If they’re seeing “pending then reversed” activity, it could be automated fraud testing rather than a full breach, but it’s still concerning that support can’t escalate properly.

Out of curiosity, have you asked them to lock the merchant account completely until it’s reviewed, rather than just blocking individual transactions? Sometimes forcing that step gets you through to someone senior quicker.

Also worth changing all account credentials and enabling any extra verification they offer, even temporarily, until you get a clear answer from them.

 

[Lucan Unlordly]

@Lucan Unlordly any idea how this might have come about, e.g. weak password, fishing, etc.?

No, not a clue. We've had some sporadic attempts to process cards with 5p payments and Worldpay sent a new Installation ID, putting it down to cloned cards, bulk attempts to compromise the system which they weren't unduly concerned about.

 

[Lucan Unlordly]

A couple of things I’d be checking straight away:

• Were the payments card-present or online?
• Any chance the login/email/password has been compromised recently?
• Did the transactions all come from the same IP/location?

There is no payment record in the usual place, no IP etc., where transactions include the date, customers details and amount paid but clicking on the Financial Status tab, then the Transfer Summary and the offending sum then the option to show all payments, highlighted in red with the note alongside 'No transaction ID for this payment' which is in excess of *£21k. My guess is that the payment didn't go through but that it was refunded by Worldpay automatically or is a human error?
*99.99% of the payments received are for the same relatively small amount, for an annual subscription. All are paid online.

Out of curiosity, have you asked them to lock the merchant account completely until it’s reviewed, rather than just blocking individual transactions?

No. I was happy to get through to somebody who took a positive view but they hadn't the authority to do more until tomorrow.

Also worth changing all account credentials and enabling any extra verification they offer, even temporarily, until you get a clear answer from them.

I don't think it's as big an issue as I first thought and is looking like human error. I'm winging it I know but there are no funds in the account to access.

 

[Lucan Unlordly]

UPDATE: Just had a call from Worldpay.

No, not a clue. We've had some sporadic attempts to process cards with 5p payments and Worldpay sent a new Installation ID, putting it down to cloned cards, bulk attempts to compromise the system which they weren't unduly concerned about.

Re my earlier post above. The usual advice is to issue a refund for irregular orders to prevent chargebacks should owners of stolen cards make a claim.

The £21k relates to charges levied against us following 50,000 fraudulent attempts to compromise the system back in December. These I believe were all made on a single day when we were informed of an issue by Worldpay and changed the installation ID.

We could not see the fraudulent attempts and we cannot run historical sales reports for that day due to the size which overwhelms Worldpay's system.

This is definitely an issue with Worldpay's systems. I'm told it will be sorted in my favour but could take up to 15 days, although it's been marked as urgent.

 

[Lucan Unlordly]

UPDATE: Sorted - refund coming through. CAPTCHA and changes to account should stop any future 'card testing' activity.

I'm taking a closer look at previous invoices to see if I've had any less obvious smaller charges made on the account.

 

[Paul Kelly ICHYB]

With WorldPay and other merchant account providers, you should always check invoices!

Also, you should regularly negotiate your charges.