Another shinning moment for TFSORUCE..These guys are gonna find themselves out of business one day. its a shame that they are so...dishonest. I mean, maybe thats harsh, but no mention of it to there customers..thats pretty cowardly IMO.

TFS had another breech, they don't even deny it at this point. They just don't say nothing.
Lame!

 

Oh why do they continue to be foolish?!  
Sucks to be them at this point of time!

 

This is interesting. Chase just sent me a new card out of the blue. They said that they suspect my card may be of risk of fraud and to activate the new card and destroy my old one. The letter also said that they took measures in my behalf and to review any other transactions that may be questionable. Which there where none.

 

I sent them a message through their site about closing my account before it got hit, this was the response I got 3 days later. Yet my account is still open, albeit they took my card info off their website (the whole "I don't store it" is a bunch of bologna) and I got hit up for some charges on Sunday. So, in essence, I asked them to cancel my account after everyone else got hit earlier in the month, they didn't close it, and now I got a bunch of charges racked up against me.

Dear Matt,



We are extremely sorry for this situation having occurred in the first place.

We are in the process of removing your credit card information, from our credit card processor. Since TFSource does not store any card data on our site, this takes a little bit of time to remove but we are going through every request and removing the details as quickly as possible.

Rest assured we are investigating this matter, and have been focusing all of our efforts on this incident since first brought to our attention a week ago. In the past year and a half we have spent a large amount of time and effort upgrading the sites’ security, which has been a major focus for us. Regardless of this, it is a constant battle as we have seen recently security breaches at large institutions and reputable online sites such as BOA, LastPass and most recently the highly publicized event with Sony. We will continue to be vigilant and have already made more upgrades to our security, in addition to investing in a secure and heavily monitored server at rackspace (last year) as well as switching to a more secure format of storing card information on our processor.

Here are some facts about TFsource and our process for storing sensitive data:

1. We do not store any credit card information on TF Source. All credit card data is stored on authorize.net, our 3rd party processor.

2. None of our staff, nor anyone outside of our card processor can access any critical credit card details that are stored on our processor's site.



We understand your reluctance to continue going to the “Source” for adding to your Transformers collection. Of course, options to credit card payment include payment via PayPal or money order.



We certainly value your past patronage and assure you with all sincerity that we have upgraded security on our site and will continue to be vigilant in implementing security upgrades. This has been a terrible experience for us as well. It is one that we are doing our best to eliminate once and for all.



Respectfully,



Curt and TFsource staff

 

I have experience running a website (even if it is small) and it just boggles my mind that they still havent mailed/addressed this with their customers. I'm assuming there was no info on their front page as well.

 

I would imagine it was because of the following reasons:

1. Big time hacks are hitting a lot of big time companies right now
2. The company they are using for cc processing hasn't announced any sort of malicious activity
3. Worse, the company they are using for cc processing hasn't informed THEM (their customer... tfsource NOT tfsource customers) of malicious activity.

 

Makes sense but I stil unfriended TFSource on Facebook. I'm so done after having to replace a card twice on their site.

 

Except that #3 of my post did happen, and did happen in this thread. Honestly, I don't see a reason for this to go on any further.

 

And yet you still give them your business. That'll show them.

 

Yes that last of my business with them. I've let them know that too.

 

I want to be clear, I don't have anything personal against Curt or anyone else at the store. This is purely a business matter. From my point of view, they are responsible for protecting their customers, just like every other business. If it was their site that got hacked or if it was their processing company, that's the same damn thing to the customer, and they should realize that and respond to the situation the way they'd want to be responded to if it was their own credit card info that got stolen.

This is the same way I feel about TFW's sponsorship system. When a sponsor repeatedly abuses the fanbase/community, it should no longer be okay for the site as a whole to advertise for that sponsor as if to say, "Look, this is a good store! You should buy from them, because we endorse them!"

Deciding not to buy from a bad vendor is a good decision, and one of the only ways to make any difference. However, urging TFW to uphold the site's responsibility to the community is also a good thing. Whenever one of the sponsors screws up this royally (and multiple times in a row, I might add!), it also reflects badly on the site's reputation since they're accepting money/resources from that sponsor.

 

Looks like my wife and I just got hit. My wife used her Visa Debit to buy me a Christmas present from TFSource. We have two transactions on her debit that total nearly $400 to online retailers that she didn't make. Bank cancelled the card and will be issuing a credit in due course. Like everyone else, I'm deeply disturbed that we have not all received some message from TFSource (the fact that it was their agent that held the card numbers means nothing to me, TFSource is responsible -- if not legally then certainly reputationally - - for the acts of their agent, full stop).

Rather than getting all legal on their asses, I'm going to hit them where it really hurts and not do business with them anymore. It's one thing to have a breach or breaches in security. It's a dangerous world and things happen. I can forgive a mistake so long as the company owns up to it. Frankly personal information like credit card numbers being compromised is part of the cost of doing business in an electronic society. There are always going to be some retailers that will do a better job than others at selecting their vendors and protecting information. However, to wait for an inordinate amount of time before notifying customers that there was a breach thereby putting us on notice that we should be vigilent is absolutely unacceptible. Moreover, reports from other customers on a fan website is not an acceptable substitute for communication from the source (no pun intended).

Finally, I give little credit to the argument that I could just use PayPal to buy from them in the future. That would be like rewarding them for their reckless behavior. I prefer to use credit cards directly with the retailer when possible (it's a personal habit of mine when making purchases from a retailer. I'm a little old fashioned in that I take comfort -- rightly or wrongly in today's society -- that if a retailer accepts cards directly they are a real business and will be there if there is a problem. I just don't fee the same way about a retailer that only accepts PayPal). This retailer gives us the option to use our credit cards directly (and even to store those numbers with their agent for future purchases). I should be able to take comfort that in providing the option to store and use our credit cards, they are obligating themselves to, at the very least, tell us if there is a problem. If they can't keep our information safe or have concerns about their ability to use the cards, then they should suspend taking credit cards and only accept PayPal. A consumer should NEVER be punished for selecting a payment option that a retailer makes available. The obligation is always on the retailer to be open with their customers, and I will not condone a retailer that doesn't take this obligation seriously.

The economic reality is that $400 that I could have used for Botcon just flew out of my account without warning from the actual retailer that was compromised. It's their obligation to tell us that there is a problem and any company that doesn't honor that obligation won't get my patronage. Simple as that.

 

Exactly. We are lucky that members talk about things like this, a lot. What about people who havent checked out this thread? They have no idea whats going on until they get hit. Tfsource may not be at fault (i can understand that the processor may have the breach) but they sure as hell dropped the ball when it comes to protecting their customers.

 

The simple fact is that TFSource was extremely close-lipped when this happened the first time. They did not say that they changed their processing service to a new one when the first breach occurred, and if they did not, then this time it is SQUARELY ON THEIR SHOULDERS. Of course, no one can force them to disclose the truth, and their reluctance to be transparent in these matters is yet another black mark against them.

I still cannot understand why the TFW staff have not made an announcement about this and publicly severed ties with TFSource.

 

i'm with you on that man

 

It's funny - I don't recall seeing threads like this concerning the other sponsors like Kapow, or Tempting Toys, etc. Go figure. Almost as if they don't HAVE these kinds of problems.

 

Exactly. One of these things is not like the other ones...so please, TFW, stop advertising for it and proclaiming to the world that we as a community endorse the place!

 

TFW most likely won't stop endorsing TFSource.

the only way they would, is if Curt and TFSource was deliberately defrauding the community

 

I know Curt said he is looking into the situation but is he really? I mean last time did they do anything at all? What's different about this time? I've already decided that 'll never buy from TF Source again, I'm not saying Curt is guilty of stealing our money but his lack of action is what has me concerned. From now on BBTS and HTS have all of my online TF business and Curt, he can take those tight lips of his and kiss my ass goodbye cuz he damn sure won't be getting another dime from me.

 

I'm sorry, but in this case poor decision-making and shoddy business practices are causing the same harm as defrauding the community...and that's even IF you give TFSource the benefit of the doubt on the shady way they've handled things, both now and in the past. If TFW keeps turning a blind eye to it and willingly lets it go on by continuing to endorse TFSource, then they are making themselves accomplices. It really is that simple.