I left them a voicemail a few years ago...never heard back. It's kind of their thing.

 

i had to borrow my father's card because i have a debit card and didn't have enough because of the outrageous shipping cost. i'll know by tomorrow if he got stung and i'll know for sure if it was the tcc figures. his card is brand new and drift and runabout are the only purchases that have been made on the card.

 

There's a couple of ways to rip card numbers.

1. The data channel. Intercept unencrypted messages being sent back and forth.

Example: Ever sit on a website and you see something that says "DO NOT HIT REFRESH" after you hit the [send order] button? The website is waiting for the card authorization to come back from the transaction service (3rd party)

The entire channel sending the messages to (can this person pay for this?) and from (either accepted or declined) had better be locked down.

2. Breach at the transaction service. The database holding the transaction numbers were broken into and decoded.

3. Card reader. (not applicable here)



My guess? Combination of 1 & 2. Whoever is doing the card processing must have gotten the attention of hackers. Hackers found large volumes of traffic coming in, traced it back to where it was coming from, and intercepted the messages being sent.

 

I noticed that when I log into the club store, do what I got to do , and then log out. I am still able to go view my store account information even though I am supposed to be logged out. I don't think that should be happening, is that a possible vulnerability that should be addressed by FunPub?

Also, I checked my CC and I don't have any unauthorized charges. So far so good. But I notice that I do have some excessive toy buying. DAMN!!!

 

To Pete or whomever: Will FunPub look at their customer service system and/or policies?
There are more issues than just stolen CC info over the last couple of years. I'm glad to have and be a member of the collectors club but the way things have been handled as of late is discouraging.

 

I'm out. I'm done with this kind of stuff. None of these toys or events are worth this kind of trouble, especially when the money would be going to people that obviously have no appreciation or respect for their customers. Some will disagree. I am sad for those people.

 

LOL Sideburn debacle all over again.... I know Pete has obligations to defend TFCC and all but fuck this is getting old!

The generic responses aren't cutting it anymore!

"This issue is isolated"
"Contact us"

Blah blah blah! How is it that the only 2 transactions I have EVER made with TFCC is plagued with problems!? Am I that unlucky to be in the isolated mob twice in a row??? COME ON!!!!

 

 

I've had nothing from other online retailers and that makes 80% of my shopping in a month. Ive had my card info snagged from sony and went and had a new card made up lasy year. Ive had my ID stolen 7 years ago from a former co worker. If I purchase ANYTHING off TFCC you can bet your ass I'll be in panic mode. I take these allegations very seriously and tend to not do business with a company till I know they have alternative modes of payment or can reassure me without a shred of doubt they have my info safe.
Which Pete that means get with the rest of the online world and start using PayPal.

 

I somewhat agree with you. I'm out also. It's not that I think the don't care or appreciate us. I just think they get overwhelmed and just don't reply to all of our inquries. I would imagine they get a LOT of stupid calls and emails just like any other business. But the fact that they can't/won't respond to everyone is discouraging. This latest event was the final straw for me. I am done with the club. I sold all my past exclusives and won't buy any more in the future (I'm a completist. If I can't have them all I don't want any).

 

Ordered mine on day one before they switch processors. No problems so far. I use my Paypal Mastercard for everything though, so maybe I'm still getting the benefit of the paypal protection.

 

Be careful with that assumption. Paypal only 100% protects buyers through eBay transactions. I found that out the hard way. I'm not saying they wouldn't protect you from fraud. But with Paypal I wouldn't roll the dice. They've screwed me before.

 

Again, I don't understand why PayPal isn't an option for paying. It gives another layer of protection when purchasing. I can use PayPal on the TRU website FFS.

 

I think we have contacted you, Pete.

 

Made a phone call and sent an email.

 

I took a look at the TFCC cart.

After a quick inspection, their checkout system is a boxed solution from Authorize.net. It's an off-the-shelf product that's slapped into websites to ease cart / user management from small businesses. Small shops can't afford massive IT departments, so products like the Authroize.Net checkout solution exist. It's a lucrative business. That's why Amazon ("Check Out with Amazon") and Google ("Wallet" or "G Checkout") want a piece of the action.

From Pete's point-of-view, he did everything by-the-book.
- used the software to create products
- used the software to create user cart sessions
- used the software to create user profiles
- paying for every authorized transaction

and now he's being blamed for all of this.

This looks like a failure on the Authorize.Net side of things. Either a problem with the boxed solution software or a problem with their datacenter.

 

I got the 1.00 testing charge from scan New York as well. Cancelled my card immediately. Before they could make any larger charges from my card.

 

We posted statements through various Social networks but I wanted to make sure, due to all the comments, that a statement was posted here as well...

Just to let everyone know, we upgraded our online security systems as we understand that credit card theft is a growing problem in the U.S. Online security is a serious business and Fun Publications takes it seriously. We have implemented an ongoing review process of these security systems so that as internet thieves become more sophisticated, so will our defense systems. If you have any concerns, please let us know. When you order from anyone on any kind of device, make sure that https starts the url. This means it is under a secure socket layer and is encrypted during transmission. Additionally all information in our database is encrypted under a 256K algorithm.

We have been following the talk regarding the fraud problems but we haven't confirmed how many, if any, were on our end. This upgrade was a precautionary measure. Fraud can come from many sources and it is difficult to determine with 100% certainty what happened in those cases. We are dedicated to solving any problems and will do whatever is necessary to make shopping with the Club a secure experience.

If you have any concerns, please do not hesitate to contact us 1-800-772-6673

 

Pete as a lot of people have already said if you really want to know, you should be sending out an email asking anyone who has had a problem to email.

If it's not a problem on your end you shouldn't get too many responses. But saying you have only had a few emails when you have only asked a few times in a 200 page thread and a vague online security message thats already far down the list of posts on your facebook page isn't going to reach everyone.

Most people dont regularly check their statements, by not letting everyone know they should check just in case people may not find charges for weeks if there is a problem.