Consumer complaint received 2023-02-22
Product: Credit card or prepaid card — General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement — Card was charged for something you did not purchase with the card
Company: JPMORGAN CHASE & CO. (NY)

On XX/XX/XXXX, I received a fraud alert on my Chase Sapphire Reserve card for a transaction made at XXXX XXXX XXXX for {$83.00}. I did not make such a transaction. 

I called Chase customer service that day at XXXX XXXX  to review the transactions made and identified two other fraudulent transactions. At the time, Chase reassured me that I would not be responsible for those fraudulent transactions. A new card was mailed to me with a different card number, and I promptly stopped using my old card. 

On XX/XX/XXXX at XXXX XXXX, I received a phone call from Chase. During that call, Chase claimed that I was present during those two transactions and would be responsible for paying them. In a subsequent notice sent later that day, Chase claimed the reason was " You received benefit from this transaction. '' During the phone call, which was recorded by Chase, I was asked to confirm that I still had the physical card. Chase used this as evidence that I, or someone in proximity to me, had used the card in person. 

The timeline of the transactions communicated to me is : - # XXXX XX/XX/XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX 1 transaction is the last legitimate transaction I made with my credit card. 

The # 4 transaction is what Chase declined and alerted me to.

The # 2 and # 3 transactions are the ones I flagged as fraudulent after review, but Chase is now claiming responsibility for them.

Chase informed me that they were able to reach this conclusion because : 1. Chase 's backend data record indicates that the XXXX chip was used in those transactions. 
2. The sequence number produced by the chip is in strict increments. 
3. I confirmed that the card is still in my possession. 
4. 

By claiming " You received benefit from this transaction, '' Chase made an accusation that I am involved in defrauding Chase for a total of {$67.00} from the two transactions.

I would like to assert that the card never left my wallet, and I was physically at home at XXXX XXXX on XXXX. I would like to challenge Chase 's logic in reaching this conclusion and accusing my character.

Chase claimed that the transaction data record is proof of in-person usage.

How are these data collected and stored?

What kind of XXXX  device is used for these transactions? Are the XXXX  devices compromised with malware or intentionally modified by the owner? Is there any payment processing partner involved? Are the data all properly encrypted during transit? How is Chase protecting customers ' transaction data? Who has access to transaction data after they are collected by Chase? Are they immutable after the collection?

Chase claimed that the sequence number increments recorded are proof that the transactions were done in exact sequence in person. They are referring to the Application Transaction Counter ( ATC ) in the Card IC. The mere increment of the sequence does not rule out the possibility of a cloned card. In a paper published by XXXX ( [ XXXX : XXXX ] ( https : XXXX ) ), the authors demonstrated protocol-level weakness on pre-play attacks for XXXX XXXX cards that attackers with compromised ATM and XXXX  devices can pre-record cryptograms and use them later. This would cover my case here exactly, as I have not been using the card since XX/XX/XXXX, and I was not able to use my card afterward once I reported the fraud. 

Chase 's own fraud detection algorithm flagged transaction # 4. I fully cooperated with their initial and subsequent reviews in a timely manner to report fraudulent transactions. How can Chase claim and advertise XXXX XXXX XXXX when they are now trying to put responsibility on transactions I reported to them? Chase accused my character, claiming I received benefit from the two transactions, {$67.00} in total. I have spent close to {$50000.00} on the card over XXXX alone and have paid them in full every month since opening the account in XXXX. There is simply no reason for me to attempt to defraud Chase. 

Overall I believe Chases logic in fraud detection is flawed, its overall attitude toward Customer is bad.