SDE - payment issues? (excised from Who's Next announcement thread)

[SeeMoreDigital]

I repeat, I wasn't hacked on SDE I am just being cautious.

My apologies... So when you said...

I have had my primary purchase method hacked twice now (not on SDE) and I'm not going through that again if I can avoid it.

What is/was your "primary purchase method" ?

 

[2ManySpeaks]

My apologies... So when you said...

What is/was your "primary purchase method" ?

I use Pay Pal when I purchase new music.

 

[SeeMoreDigital]

I use Pay Pal when I purchase new music.

As far as I'm aware PayPal users have not been affected...

 

[skherbeck]

Placed my SDE order 2 days ago with my credit card because the site wouldn’t except PayPal (my usual form of payment to SDE). Over the weekend my card was hacked and fraudulent charges were made… related? I don’t know, but it is suspicious.

 

[SeeMoreDigital]

Placed my SDE order 2 days ago with my credit card because the site wouldn’t except PayPal (my usual form of payment to SDE)...

Eh!!! I've only ever used PayPal on the Shopify SDE shop site... Around forty times now!

 

[drh3b]

Placed my SDE order 2 days ago with my credit card because the site wouldn’t except PayPal (my usual form of payment to SDE). Over the weekend my card was hacked and fraudulent charges were made… related? I don’t know, but it is suspicious.

Make sure you have adblock turned off for SDE. I think on my last order with them, I had to go from using Chrome, where I couldn't get the Paypal button to work, to Microsoft Edge, where it did.

 

[2ManySpeaks]

As far as I'm aware PayPal users have not been affected...

I don't know how many different ways I can tell you that I was not hacked on SDE. I said I would not be ordering from them in the short term out of fear of being hacked. I've had it happen to me twice at different times in my life. If a site is potentially vulnerable I avoid that site until the issue is resolved. That's all I said. I was not reporting a problem I was having with them. I was concerned with their response to reports of some customer's card data becoming compromised after purchasing through them. Is that more clear? I hope so.

 

[SeeMoreDigital]

I don't know how many different ways I can tell you that I was not hacked on SDE. I said I would not be ordering from them in the short term out of fear of being hacked.

I heard what you said... And I said "As far as I'm aware PayPal users have not been affected".... So there's nothing to worry about!

 

[stoopid]

I don't want to discount anyone's experiences - I've had fraudulent charges on my CC before too - but I'd like to urge people to use a modicum of restraint in making accusations of the SDE shop being a victim of hacking or data breaches just because you've had a fraudulent charge on your card in the UK. Shopify is an enormous e-commerce platform that turns over billions of dollars a year, and SDE themselves do thousands of transactions a month. Transactions on platforms like this are secured with incredibly complex (I won't say unbreakable, because nothing is, but it's close enough) encryption algorithms and organized cybercriminal gangs these days are so smart they know they don't need to break in to Fort Knox to steal the gold any more, they can take your money via smaller and simpler methods like installing malware or a keystroke logger on your computer your mobile device, intercept data on insecure wifi networks, and a variety of other means.

I feel like if there was a systemic problem or vulnerability on their end you'd need a lot more than two hands to count all the complaints from angry customers, here and elsewhere. It could even be that card details were taken elsewhere (or simply guessed) and that the organized cyber-criminals are simply located in, or have accomplices in the UK that are helping them make charges using stolen details. In the last couple of years I had a fraudulent charge on my card from a non-profit charity in Indonesia despite only ever having used my card physically at my local grocery and drug store, and online via Amazon.

Don't forget that when you say something on a place like this on the internet it tends to live on indefinitely, and people are much more likely to listen to the initial story rather than a later-posted retraction. Take it from me, 5+ years later I'm still trying to set the record straight about my incorrect assertions that the Isley Bros. and O'Jays quad channel assignments were wronng. It would be a shame if SDE's long-germinating momentum in doing these physical surround releases was stalled or killed entirely by something that turns out to not be true at all.

That's a well reasoned post, though the counterpoint is this thread. It's not inconceivable there's malicious actors with access to SDE's internal network, webhost, or silently inserted themselves between SDE and Shopify. The chance of a compromised ordering/billing system seems more likely than many seemingly random credit card users, on the same website, on random days, having their accounts compromised 1-2 days after making their purchase on that website. Occam's Razor?

The issue could very well be Shopify, but as a customer of that service with their reputation on the line I would expect SDE's responses to be a bit more concerned than what we're getting. SDE would need to be the entity to contact Shopify, since they are the paying customer and could gain access to Shopify's technical support. Maybe they fail to realize that, but again it's going to bite SDE as hard as Shopify if this continues happening. The only damage control has been "there's nothing to see here" which seems unreasonable considering the strong correlation established [this is why I mentioned SDE potentially gaslighting its customers if they know it's happening or why it's happened, and willfully won't admit wrong/responsibility due to the additional backlash that will create].

Until SDE makes something akin to a public announcement, this issue will continue to live on as speculation.

 

[Todd 987]

I’ve used PayPal at SDE numerous times and have never had an issue. I have been hacked on other sites. It’s not a pleasant experience.

 

[CymruQuad]

Placed my SDE order 2 days ago with my credit card because the site wouldn’t except PayPal (my usual form of payment to SDE). Over the weekend my card was hacked and fraudulent charges were made… related? I don’t know, but it is suspicious.

Oh dear yet "but it is suspicious". It is all very well for members to laud SDE for their endeavours when they have not been affected, I also am inclined to continue support but am reticent if this is not nipped in the bud and continues to be reported on the site. I do wonder how many other persons have been affected but are not members of this forum and do not know about this evidently growing problem thereon puzzled where the card hack has emanated. This appears to have affected both UK and USA purchases probably more so in the USA due to greater format popularity. Sort this out SDE for your own sake.

 

[CymruQuad]

Response from SDE:

"Thanks for the email .................... and totally understand your concerns.
We take these matters very seriously and when I first heard about this I reviewed our security and contacted our platform provider (Shopify) to investigate the matter.
I can assure you no issues were found and there were no data breaches from our platform-it has strong security measures in place for payment processing. No card details are held by us.
Outside our platform there are many potential reasons why a customer's credit card information may have been compromised.eg clicking on a suspicious link, entering information on an unsecured site , or using an unsecured Wifi in a hotel, shop,train , airport etc.
To address this situation effectively, I recommend you work with your bank to investigate where the unauthorized charges occurred. This may help identify any potential sources of the breach.
Hope this helps."

The fraudulent entries on the bank statement were "paypal*shopsd" which the bank clerk stated could be a shortened reference. Members can make of that what they will. Sophisticated bling ring on the go?

 

[DaveLaPorte53]

I reached out to their "contact" email regarding the possibility of an ongoing problem, and they thanked me and said they take security seriously but said "on the evidence submitted we have not found any evidence this has happened". Of course, I didn't submit any "evidence", I only informed them there appeared to be more than a coincidental amount of card problems reported here. So I replied and pointed them to this thread, and they responded "no evidence of any sort of data breach has been uncovered to date". It might still be worth dropping them a note.

try paying through a third party like PPal insulate your self and your accounts.

 

[Muppet69]

From what I’m reading it seems that mostly (from what I can gather) it’s orders done through inputting their credit cards separately/directly to the shop pay (shopify) side as the payment method. So if you use either PayPal or Apple Pay it seems to be safer as they generate a totally different credit card number that goes directly to Shop Pay so your real card number never gets seen by them, only PayPal or Apple Pay. So essentially you are paying those companies to pay for your orders and therefore it’s much safer. Correct?

 

[JediJoker]

From what I’m reading it seems that mostly (from what I can gather) it’s orders done through inputting their credit cards separately/directly to the shop pay (shopify) side as the payment method.

No. It's orders where credit card info is entered directly at the SDE webstore. Those using their global Shop Pay account are unaffected.

 

[Muppet69]

No. It's orders where credit card info is entered directly at the SDE webstore. Those using their global Shop Pay account are unaffected.

Yes that was what I was meaning to say, just didn’t word it correctly. That’s what I did with my order and was hacked.

 

[LuvMyQuad]

I wasn't hacked or anything. But I want to thank all you others for compelling me to check my finances more often.

 

[Sonik Wiz]

I wasn't hacked or anything. But I want to thank all you others for compelling me to check my finances more often.

Indeed. I purchased my copy a few days ago, as a guest, and using PayPal. Because of this thread I've checked my PP acct & associated charge card a couple of times. So far, so good.

 

[LuvMyQuad]

Indeed. I purchased my copy a few days ago, as a guest, and using PayPal. Because of this thread I've checked my PP acct & associated charge card a couple of times. So far, so good.

Same. For the Elton John. PayPal rules.

 

[skherbeck]

No. It's orders where credit card info is entered directly at the SDE webstore. Those using their global Shop Pay account are unaffected.

Yes, this is how I paid… but I was desperate for some Elton in surround.