Six years ago, I had my computer compromised by a remote access trojan. The hacker accessed my machine while I was asleep, used Chrome password manager extraction tools to get my Facebook password, then credential-stuffed it into Amazon[0] to buy as many PSN cards as they could before Chase's fraud detection tripped and started texting me for verification, which woke me up.
You would think that fixing this would be simple: revoke the PSN cards and reverse the credit card transactions. Turns out, they don't do that. At all. Amazon insisted that they wouldn't do shit without a bank chargeback. I of course had already started that process with Chase. About a month later, I get a call from Chase saying they need to "move the transactions to the new account"[1], which sounds like a stupid technical thing, so sure, whatever. A few weeks later I get a letter in the mail saying the dispute was closed because "it was a dispute with the merchant" - no explanation what that means. They give a phone number to call that goes to voicemail - I called at least five times and never got a call back, and all $400 worth of fraudulent transactions were right back on my statement.
I gave up trying to fight shit because I don't want to sue my bank, nor do I want to fight Dread Pirate Bezos. I'm not suicidal[2]. However, it did teach me two things that have stuck with me:
- Amazon has a blanket opt-out with the credit card companies and issuing banks. I don't know how, it could be as simple as "don't waste time investigating likely false accusations of fraud", but they are able to win[3] chargebacks with credit card companies using explanations that look like someone just picked the first option on the form that denies the dispute.
- PlayStation Network cards are apparently as immutable and uncensorable as Bitcoin[4]. If you want to do crimes, do them with PlayStation.
[0] Yes, I was reusing passwords. Yes, I did change every password I had over the next few days. Yes, I completely wiped the machine and reinstalled everything. No, I don't think I should have been liable for fraud because of any of this.
[1] They had sent me a new card and card number at this point.
[2] I'm pretty sure the "slow and horrible" option in the suicide booths involves burying yourself in legal fees.
[3] Keep in mind that not-monopolistic merchants almost never win chargebacks or disputes.
[4] For an extra layer of irony, a few days prior, I'd written a long screed at a Bitcoin fanatic on Reddit about how credit card chargebacks are a feature, not a bug, and that immutable transactions are a design defect.