[TIP] Automatic updates to digital wallets!

[Metanis]

Caught this article this morning. It seems that fraudulent use of your credit card can be hard to stop because they automatically update your card number in some digital wallets. Which sort of seems to defeat the purpose of getting a new card number issued!

Did you hear about the Visa Account Updater?

Let me just scream

germanoddities.substack.com

The link seems to be somewhat unreliable so here is the text:

In December, I drove to Pennsylvania. I had to use the toll road that was unmanned at the time. There was no way for me to pay, so I was expecting a letter in the mail at some point later per the sign that they had put up. They clearly screen license plates and this is how they get the address.

So, when in February, I got a text message about toll violations hit my phone - - You see where this is going, right? - - I stupidly gave out my credit card number. And… within an instant regretted it. How could I think they would be able to contact me directly? I had been driving a company car. They would have contacted my company and my company would have contacted me.

I immediately closed my card and requested a new one. I am financially savvy after all. So I thought.

For about two months, absolutely nothing happened. So, I thought I did the correct thing.

Then, three fraudulent charges hit.

Three times Home Depot in Florida. Since I clearly do not live in Florida and had no reason to go to Home Depot, I called the Chase Fraud Department. They, without hesitation, removed the charges and … issued a new card.

I had barely received the new card, when another fraudulent charge hit. A store I had never even heard of. All on the new card.

So, I called again. This time, I had a guy on the phone who explained that someone had put my credit card in a digital wallet and was accessing it that way. I asked him to remove all digital wallet links which he did.

“How could he use my credit card number? I just got a new one.”

“Oh that is a visa service where they automatically update and link to the new account, so that subscription and digital wallets can continue.”

WTF!

I did a little bit more research. Here is what a simple internet search told me: “Visa Account Updater (VAU) is a service offered by Visa that allows issuers to advise mechants of changes to a cardholder's details. This service minimises the occurrence of outdated card information for a cardholder that could lead to declined transactions.” You can read more details here.

Yes, it seems to be a common practice all credit cards and the majority of banks are engaging in. So Visa and Chase are not the exception.

And here is what Grok had to say on the topic:

“The Visa Account Updater (VAU) program, designed to automatically update cardholder information for merchants to ensure seamless recurring payments, has drawn several criticisms based on available information. Below are the most commonly reported complaints:

1. Lack of Consumer Awareness and Transparency: Many cardholders are unaware of the VAU program, as banks often enroll them automatically without clear notification. This leads to surprise charges on new cards when consumers expect services to stop after a card expires or is replaced. For example, a case highlighted a couple being unexpectedly charged for a Sirius satellite radio subscription on a new card, leading to frustration due to lack of prior knowledge about the program.
2. Difficulty Opting Out: Opting out of VAU is often challenging. Some banks, particularly major ones like Bank of America, reportedly make it difficult or impossible to opt out, requiring consumers to close accounts entirely to stop automatic updates. Smaller institutions like credit unions may offer opt-out options, but the process is inconsistent and not widely publicized, leaving consumers feeling they lack control over their financial information.
3. Potential for Unauthorized Charges: Consumers and commentators have raised concerns about merchants continuing to charge cards after consumers believe a subscription has ended, especially in cases of fraud. For instance, a Reddit user reported fraudulent charges reappearing on a replacement card due to VAU, as the program updated merchants with the new card details, undermining efforts to stop unauthorized transactions.
4. Data Privacy and Security Concerns: The transmission of sensitive card information raises privacy worries. Some consumers fear unauthorized sharing of their data, and a developer critique highlighted that the VAU Developer API uses Basic Authentication, which is considered insecure, potentially exposing cardholder data to interception.
5. Merchant Enrollment Inconsistencies: Not all merchants participate in VAU, and there’s no public list of enrolled merchants, making it a “guessing game” for cardholders who must manually update non-participating merchants. This inconsistency adds inconvenience, as consumers may face unexpected service interruptions or need to contact merchants directly.
6. Costs for Merchants: Merchants face setup fees, transaction fees, and integration costs, which can be a barrier for smaller businesses. These costs, while beneficial for maintaining revenue, are seen as an additional financial burden, and some argue the program primarily benefits Visa through fees while adding complexity for merchants.
7. Potential for Misuse by Merchants: There are concerns that less scrupulous merchants could exploit VAU to continue charging for subscriptions consumers thought were canceled, especially if cardholders are unaware of the program. This has been described as a potential “scam” vector, particularly affecting vulnerable groups like the elderly.

These complaints reflect a mix of consumer frustration over control and transparency, technical concerns about security, and merchant grievances about costs. However, the program’s benefits, like reducing declined transactions and improving convenience, are also acknowledged, creating a complex balance between utility and user concerns.”

And this is exact issue I have been facing. Of course I researched how I can opt out of the program. Like most people I do not want my account information to be transferred without my knowledge and I would rather update all people that I do business with manually. That should be my right. I mean, who would not want the control?

My bank essentially told me there is nothing they can do on their side. It was actually worse, the service personnel at Chase Bank claimed to not know what I was talking about and tried to tell me that I was either searching stupid things on the internet or that I had nothing to worry about as the fraudulent charge was already removed. Every single one of the people on the phone pretended they had not heard about the Visa Account Updater, a program that apparently merchants can buy into and that is advertised on the Visa site.

So I called Visa.

First call, I was transferred 3 time talking to (again) a few people that never had heard of the program. Until… the third one said; “You will have to call Visa.”

“But that is what I just did.”

The Visa folks had back-transferred me to Chase. By this time I was not just angry, I was fuming.

I called Visa again.

Something in their line up changed. I could not longer get the same connection and after entering my credit card info…

… I was directly referred back to Chase. I simply could not get through to any Visa employee and only ended at Chase. I think I am banned or blacklisted now.

There was no other number to call.

My conclusion at this state is that Chase just like Bank of America is earning a lot of money by cooperating with Visa and other credit card companies. They have no interest in helping the consumer. If I had not been through this fraudulent activity on my card, I would have never known that this was going on.

So, my advice to everyone here is that you check your credit cards carefully. Chase allows me to see if they are linked to digital wallet. If you do not recognize these links, have them deleted. Be careful who you are sharing your credit card information with. Maybe it is better to use a temporary credit card number that some credit companies offer.

I am now debating if I need to switch banks. I truly want to.

Thoughts?

 

[britechguy]

Thoughts?

Unfortunately, I doubt that any change of bank would result in any "big picture" change. As you've already learned, banks may be card issuers, but it's the parent card brand, e.g., Visa, MasterCard, Discover, Amex, etc., that dictate the terms under which they are issued, and what the "default choices" are.

I've never figured out how I have never been hit by a single fraudulent charge on any card, while my partner seems to be hit by these constantly, and he's changed card numbers more times than I can count. He definitely does not use digital wallets, and some of the charges have been from places as far flung as Brazil. He's certainly no more careless in how he handles his physical card, or online transactions, than I am.

Much mystery is involved.