PHOENIX — Some Arizona residents were surprised this week to find someone attempting to use their banking information to make fraudulent charges at a computer repair shop in Alabama.
Allstar Computer Repair, located near the Alabama-Georgia borderline, claims its credit card processing company was recently hacked, resulting in thousands of fake charges being made thru the computer company.
"It was 560,000 people that had been charged under my business name," said Seth Morgan. "That's what the processing card company told me."
Morgan was alerted that someone was wrong when he got to his office and was bombarded by thousands of calls from people upset, accusing him of wanting to defraud them.
"My first step, to be honest with you, was just trying to answer phone calls because I didn't know how big this was," Morgan said.
Arizona residents report fraudulent charges
Several people from Arizona have been leaving comments on Allstar's websites, claiming their credit cards were used to make purchases with the company.
The charges ranged in value from $50 to $1,000, according to the online testimonies.
"I'm in Arizona and I have no idea how this could happen," one of the alleged victims wrote online after getting a $50 charge early Thursday morning.
Kathleen Quellen of Gilbert is one of the other possible victims of the alleged hacking incident. She said she was alerted Thursday morning to a $200 charge at the Alabama shop that was declined due to an incorrect expiration date.
The transaction looked suspicious to Quellen, considering it was made in the middle of the night and involved a business located more than 1,600 miles away.
"I have no ties to Alabama," she said.
She contacted Wells Fargo Bank and had a new debit card issued with a different number. But once the card was linked back to Quellen's Apple Pay account, another $200 charge was immediately made from the Alabama computer company.
"So they had something in that system; no matter what they did for my card, I was still getting that charge. But it declined again for the wrong expiration date," Quellen told 12News.
After Quellen did some searching online, she discovered she wasn't the only Arizonan who had their banking information used to make fraudulent charges in Alabama.
"I realized it was something bigger than that, than just me," Quellen said.
What could have happened
All the reported transactions happened in the early hours of Arizona time, ranging from 1 a.m. to 3 a.m.
"My guess is that a credit card processing system was breached," said Ken Colburn, a cybersecurity expert known as the Data Doctor.
Colburn believes hackers somehow obtained both credit and debit card numbers of thousands of customers, but they didn't have the expiration dates of those cards.
Criminals used what's called a Distributing Guessing Attack, where they use computers, or bots, to make fraudulent transactions, Colburn said.
"They’re literally putting millions and millions of transactions through a process server and within six seconds, they’ll know which one of those guesses was correct," he said. "All of us that got these alerts were guesses that were incorrect.”
Colburn's godmother was also targeted in Thursday's attack, he said. The crooks did not make way with any of her money.
All-Star Computer Repair was just a random business criminal used to test the data numbers they had, Colburn said.
As for Morgan, the expert said, he's just another hack victim.
“Half a million charges under my name? I’ve never seen anything like that in my life. It’s ridiculous, and it could happen to anyone," Morgan said.
Many of the other possible victims in Arizona reported having bank accounts with Wells Fargo, according to online declarations.
Wells Fargo issued the following statement about the incident:
“We are aware some customers may have seen declined transactions from a merchant attempting to process unauthorized payments earlier today. Our customers were protected by our fraud controls that are designed to prevent unauthorized transactions. No impacted customer will incur a loss.
As always, we encourage customers to review their transaction history and file a claim with us for any unauthorized activity. We ask customers to contact us with any questions.”
A California company with a similar name as the Alabama firm claims it had recently fallen victim to a "proxy scam." In a statement posted Thursday on its website, the California company encouraged anyone who had a fraudulent transaction charged to their account to file a complaint with the FBI.
Up to Speed
Catch up on the latest news and stories on our 12News YouTube playlist here.