So I encountered some interesting fraud today and wanted to get some feedback on how it might have happened and advice on what to do next.
The Rocket Money app is the MVP in this story, as it notified me of a large transaction as suspicious less than an hour after it occurred.
A $600 Ubiquiti order that I had supposedly just placed.
As much as I'd like to, I did not order $600 of Ubiquiti stuff today at 4:13pm.
I checked my email, and sure enough, there was an order for an 8-port switch, made from MY Ubiquiti account, with MY primary card that I buy stuff like this with.
Except it was bound for an address I didn't recognize in Madisonville, TN.
I quickly logged into my Ubiquiti account and cancelled the order. Since the charge was still pending, it immediately disappeared and returned the funds to my account.
Crisis averted, but HOW DID THIS HAPPEN?
I reset passwords, logged off sessions, and did all the other things in the Ubiquiti app, but I have no saved payments in the Ubiquiti account - how did they hit my card then?
I keep looking and notice something else interesting - a Link verification code at 4:13pm - the same time as the Ubiquiti order. That answers the question of how my card was accessed.
This code went to my Google Voice number, so no SIM-swapping would have gave someone access to this code. They were somehow able to create the order without the code.
So now I'm going into Link (Stripe's consumer-facing app that makes it super easy to buy stuff) and deleting all my payment options. The only login option was passkey.
I also froze my card, since I'm still unable to figure out how someone was able to create this order in my Ubiquiti account via Link, with my card, but send it to a different address.
I started looking for breaches and this is writeup on compromised Stripe API keys from Hudson Rock my current best guess as to how this fraud happened: https://www.infostealers.com/article/analyzing-stripe-breach-confirmed-vendor-exposure-and-claims-of-20000-compromised-apis/
I currently have no other theories. What have I missed? Does this sound plausible? I'm not sure compromised Stripe APIs can explain the Link piece of the puzzle.
