# Should I worry about this? (Possible identity/cc theft) **URL:** \ **Category:** In My Humble Opinion\ **Created:** [May 1, 2012, 1:18pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507 "2012-05-01T13:18:28Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![DZTaxes](https://avatars.discourse-cdn.com/v4/letter/d/c4cdca/32.png) [@DZTaxes](https://boards.straightdope.com/u/DZTaxes)\ **Post date:** [May 1, 2012, 3:06pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/21 "2012-05-01T15:06:15Z")
I got the email today. My laptop was once caught by a virus, which basically forced me to some website to but their “anti-virus” program. Of course, it was all a fraud. I got the laptop cleaned up, and tried to fight with the CC company to get my money back, but they said that since I had “purchased” something, they wouldn’t refund my money. Idiots. Anyway, i assume that all of his info is correct. The amount and address definitely is. I do wish there was some way to recoup my loss, though. I am obviously not going to deal with this guy. ---
**Author:** ![tdn](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@tdn](https://boards.straightdope.com/u/tdn)\ **Post date:** [May 1, 2012, 3:06pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/22 "2012-05-01T15:06:18Z")
> [@S10slayer](#): > > I just got this too, but already got a new credit card number in Feb. So the way I handled this is reported it to our police department and sent this mf a great picture of my nuts so fuck um all!! > > 😃 That was a stupid thing to do. You’ve compromised the security of your nuts! I’m not sure where you can go to get issued new ones… ---
**Author:** ![pltswk](https://avatars.discourse-cdn.com/v4/letter/p/7cd45c/32.png) [@pltswk](https://boards.straightdope.com/u/pltswk)\ **Post date:** [May 1, 2012, 3:21pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/23 "2012-05-01T15:21:41Z")
see below I just got this today and not sure how to handle this. Has anyone else recieved this email. Dear Mr. On 27 of Jul 2011 you had become a victim of activity, when you were purchased computer program that was supposed to cure your computer. This program was installed on your computer in order to gather your personal information. At present, the group of alleged perpetrators, which includes the management of Oneliya LLC (Moscow Russia), B&N Bank (Moscow, Russia) and Raiffeisen bank (Moscow, Russia) is being investigated by the appropriate authorities and several criminal actions has begun. Unfortunately, all your personal information that you had transmitted to the perpetrators has been compromised and is available to other criminally minded individuals. Here is your personal information that is available: Trnsaction date: 2011-07-27 12:30:41 Credit card number: My card Credit card expire year: 2013 Credit card month: 1 CVV: \*\*\* Paymnt amount: 69.95 Name: My name Street: my info ZIP: State: City: Email: my email Phone: my phone Country: US We urge you to immediately cancel the card above and request a replacement, due to the fact that your information has been compromised. Also, please enclose the copy of this letter with your complaint to the law enforcement. You can complain to the law enforcement agency via email. You have the right to receive a 49.95 dollar compensation and the reissue of the card should be free of charge to you. In the event you wish to receive the compensation please contact our legal department by writing to [support@gredine.com](mailto:support@gredine.com) Andre Shults CISSP, ISSAP, ISSMP, CSSLP ---
**Author:** ![Kimballkid](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Kimballkid](https://boards.straightdope.com/u/Kimballkid)\ **Post date:** [May 1, 2012, 3:24pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/24 "2012-05-01T15:24:52Z")
> [@tdn](#): > > Not that I can remember. I made a purchase through Orbitz from a library desktop, but that was in March, and for a lot more than $9.95. > [@tdn](#): > > For those of you who got this, how much do we have in common? > > Citizen’s Bank? > $9.95? > August 15th, 2011? According to what you put in the OP, the amount is $59.95 not $9.95. ---
**Author:** ![Kimballkid](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Kimballkid](https://boards.straightdope.com/u/Kimballkid)\ **Post date:** [May 1, 2012, 3:27pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/25 "2012-05-01T15:27:34Z")
> [@Quasimodem](#): > > Grammar/Syntax is wrong in several places (“when you were purchased”, for instance). That’s usually a dead giveaway to me. > > Quasi Not to mention the weird random dropping of letters (paymnt, trnsaction). ---
**Author:** ![tdn](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@tdn](https://boards.straightdope.com/u/tdn)\ **Post date:** [May 1, 2012, 3:28pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/26 "2012-05-01T15:28:46Z")
> [@Kimballkid](#): > > According to what you put in the OP, the amount is $59.95 not $9.95. You’re right, I saw the 5 and thought it was a dollar sign. That’ll teach me to wear my glasses! ---
**Author:** ![RealityChuck](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/realitychuck/32/195_2.png) [@RealityChuck](https://boards.straightdope.com/u/RealityChuck)\ **Post date:** [May 1, 2012, 3:34pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/27 "2012-05-01T15:34:33Z")
Does the bank have your e-mail address? Mine doesn’t. The whole message stinks of phish. ---
**Author:** ![crack3d](https://avatars.discourse-cdn.com/v4/letter/c/35a633/32.png) [@crack3d](https://boards.straightdope.com/u/crack3d)\ **Post date:** [May 1, 2012, 3:36pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/28 "2012-05-01T15:36:19Z")
Oneliya LLC, aka “Gateline,” is a rogue credit card processor that has worked with fake AV vendors and pharmaceutical spam senders. They were indeed the subject of a law enforcement investigation in Russia related to cybercrime. > **[Gateline.net Was Key Rogue Pharma Processor – Krebs on Security](https://krebsonsecurity.com/2012/04/gateline-net-was-key-rogue-pharma-processor/)** > > It was mid November 2011. I was shivering on the upper deck of an aging cruise ship docked at the harbor in downtown Rotterdam. Inside, a big-band was jamming at a reception for attendees of the GovCert cybersecurity conference, where… ---
**Author:** ![crack3d](https://avatars.discourse-cdn.com/v4/letter/c/35a633/32.png) [@crack3d](https://boards.straightdope.com/u/crack3d)\ **Post date:** [May 1, 2012, 3:51pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/29 "2012-05-01T15:51:05Z")
> [@crack3d](#): > > Oneliya LLC, aka “Gateline,” is a rogue credit card processor that has worked with fake AV vendors and pharmaceutical spam senders. > > They were indeed the subject of a law enforcement investigation in Russia related to cybercrime. > > [Gateline.net Was Key Rogue Pharma Processor – Krebs on Security](http://krebsonsecurity.com/2012/04/gateline-net-was-key-rogue-pharma-processor/) I agree that this looks phishy, particularly given that this site is registered with Internet.bs, a registrar that has a history with pharmacy spammers. However, there is a decent chance that this is an alert being sent to a database of people who paid for fake antivirus software at some point in the past year. If this describes you, I wouldn’t worry about canceling the card: just dispute the charge. ---
**Author:** ![arseNal](https://avatars.discourse-cdn.com/v4/letter/a/ecae2f/32.png) [@arseNal](https://boards.straightdope.com/u/arseNal)\ **Post date:** [May 1, 2012, 4:16pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/30 "2012-05-01T16:16:16Z")
Wait, so you guys really did make this purchase of an antivirus software? ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [May 1, 2012, 4:45pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/31 "2012-05-01T16:45:33Z")
> [@crack3d](#): > > I agree that this looks phishy, particularly given that this site is registered with Internet.bs, a registrar that has a history with pharmacy spammers. However, there is a decent chance that this is an alert being sent to a database of people who paid for fake antivirus software at some point in the past year. If this describes you, I wouldn’t worry about canceling the card: just dispute the charge. Considering that an unknown person from a domain that doesn’t even have an active website and only registered the domain last week just sent out these people’s full credit card information in plain text E-mails? I would cancel the card. ---
**Author:** ![noodles2](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@noodles2](https://boards.straightdope.com/u/noodles2)\ **Post date:** [May 1, 2012, 4:54pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/32 "2012-05-01T16:54:27Z")
I did make the mistake of purchasing this fraudulent antivirus software online last year. As soon as our credit card statement showed up showing the origin of the charge was Moscow, we canceled the card. We haven’t had any more problems. I did check on [gredine.com](http://gredine.com) and found that the server is located in The Netherlands. If you google “who is [gredine.com](http://gredine.com)?” you’ll find that information. I think we will just leave well enough alone and NOT contact their legal department for a “refund”. It is really hard to tell who the good guys are these days! ---
**Author:** ![noodles2](https://avatars.discourse-cdn.com/v4/letter/n/85f322/32.png) [@noodles2](https://boards.straightdope.com/u/noodles2)\ **Post date:** [May 1, 2012, 4:57pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/33 "2012-05-01T16:57:28Z")
P.S. The info I found is at [http://www.ip-adress.com/whois/gredine.com](http://www.ip-adress.com/whois/gredine.com) ---
**Author:** ![Bootis](https://avatars.discourse-cdn.com/v4/letter/b/e8c25b/32.png) [@Bootis](https://boards.straightdope.com/u/Bootis)\ **Post date:** [May 1, 2012, 5:06pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/34 "2012-05-01T17:06:25Z")
I don’t think it is bad advice to say, if anybody, legitimate or not, ever sends you an unsolicited email that includes your full credit card number,(and especially if it includes your cvv code, expiration date and address) you should immediately cancel the card. Whether the sender is fishy or not is already irrelevant at that point. ---
**Author:** ![MysteryFellow63427](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@MysteryFellow63427](https://boards.straightdope.com/u/MysteryFellow63427)\ **Post date:** [May 1, 2012, 5:29pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/35 "2012-05-01T17:29:23Z")
Here’s another good rule of thumb: **Never, ever reply to unsolicited contact** , be it via email or via phone. If you’re not 110% certain that the info you’re getting is from your company, don’t reply, and DO NOT UNDER ANY CIRCUMSTANCES click on links in the mail. Instead, go to your company’s website by directly typing in the address, or call them up directly on the phone to their main 1-800 number. ---
**Author:** ![tdn](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@tdn](https://boards.straightdope.com/u/tdn)\ **Post date:** [May 1, 2012, 5:29pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/36 "2012-05-01T17:29:40Z")
Not that it’s any great comfort, but these are not coming with CVV codes listed. ---
**Author:** ![Rachellelogram](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rachellelogram/32/8689_2.png) [@Rachellelogram](https://boards.straightdope.com/u/Rachellelogram)\ **Post date:** [May 1, 2012, 5:55pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/37 "2012-05-01T17:55:32Z")
Am I the only one who thinks it sounds like the sender, shady though his credentials may be, is doing a public service? I’d MUCH rather know that scammers have my credit card number than remain ignorant of it. I mean, who knows? Maybe this guy used to work for a shady company, quit, and stole the database and is alerting people whose information was stolen. Like a former mafia goon turning over on his employer, you know? ---
**Author:** ![FairyChatMom](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fairychatmom/32/22080_2.png) [@FairyChatMom](https://boards.straightdope.com/u/FairyChatMom)\ **Post date:** [May 1, 2012, 5:56pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/38 "2012-05-01T17:56:28Z")
I find it interesting that everyone else who has received this same email just joined today… ---
**Author:** ![tdn](https://avatars.discourse-cdn.com/v4/letter/t/94ad74/32.png) [@tdn](https://boards.straightdope.com/u/tdn)\ **Post date:** [May 1, 2012, 6:16pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/39 "2012-05-01T18:16:06Z")
> [@FairyChatMom](#): > > I find it interesting that everyone else who has received this same email just joined today… Maybe they googled some keywords in my OP. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [May 1, 2012, 6:32pm UTC](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507/40 "2012-05-01T18:32:11Z")
Yeah, it was the second thread that popped up on Google when I searched on the domain name. [Previous page](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507.md?page=1) [Next page](https://boards.straightdope.com/t/should-i-worry-about-this-possible-identity-cc-theft/620507.md?page=3)