Scam or Virus

[dinowuff]

O.K. Limited info, but maybe someone has seen this before.

CFO Just left my office. He claims that on his home PC........

"Whenever I try to make on line reservations, I enter my credit card information, click continue and then a little box pops up and asks me for my 'ATM' password" At which point I just cancel out of everything.

No other relevant info came from the conversation. I know the guy uses IE, Windows XP Home. AVG and Microsoft AntiSpyware with auto updates enabled. (This user pays attention in my training sessions)

So has anyone experienced anything like this before?

[morganlefay]

Well,

With the limited online transactions I do...I have never seen this...

Sounds very suspicious....but then again my credit card is not tied into my bank account.

There is no reason whatsoever ANYONE should know your ATM PIN.....

Its not asking for the security code...usually located on the back of the CC....????

MLF

[dinowuff]

Its not asking for the security code...usually located on the back of the CC....????

Nope, that was my first thought. What's really strange is that the same thing happens on different sites, so it has to be a client side thing, but spyware and av isn't throwing up any flags.

[foxyloxley]

Have you witnessed it yourself yet ?

It COULD be the 3 digit code on the back of the card that they require.
online transactions are starting to ask for extra details nowadays ..........

[edit]
although the box would be in the form from the start ........

has client contacted the card suppliers / site where it occured ?????

[morganlefay]

Well at least he cancels out the transaction.

Usually if I have any issues when doing an online transaction....I call direct and complete that way.

I think Foxy makes a good point also...about contacting the site\card company


MLF

[Katja]

Home computers in general tend to be as secure as the knowledge of the owner allows it. So a well-experienced owner/user of a home PC with plenty of security knowledge has a pretty well-fortified fortress... It sounds as if your CEO just has a sandcastle and someone stepped on it.

However, the good advise has already been given. Call the credit card company and/or the site owner. Furthermore, update the virusdefinitions on this computer and run a full virusscan to remove the 16 viruses and 12 worms this CEO probably has on his computer.

[gore]

Originally posted here by Katja
Furthermore, update the virusdefinitions on this computer and run a full virusscan to remove the 16 viruses and 12 worms this CEO probably has on his computer.

Opening post said it was on auto update, and that it's the CFO not the CEO.