MO/TO payments on the internet are evil; be careful with card payments over the internet.
Why?
So you don't end up like me, when someone turned me into a literal ATM. 🏧
Yesterday evening, I went to drop off packages at the Zásilkovna depot in Brno, and on the way I stopped at Kaufland to pick up a few things.
I was just choosing melons when my phone started vibrating in my pocket, and quite intensely at that.
Notifications about payments from my account at Moneta Bank kept popping up on it.
I didn't understand it at all, because it was a large amount and it happened many times in a row.
So I immediately logged into online banking and discovered that a substantial sum was leaving my account and going somewhere—to California.
I was quite surprised because the limit for internet payments was set to CZK 400 per day (I have it set that way to prevent situations like this, since I often pay online, but still want payments such as Netflix or Patreon to go through).
So I blocked the card, although there wasn't much left in the account to take, and immediately called the bank after paying at the store to ask what it was supposed to mean.
At the bank, they simply forwarded the case to another department, and within an hour someone else called me.
We went through the payments together, and to my surprise, apparently this can happen.
That's because I had MO/TO payments activated, which I find completely incomprehensible: if someone has your card number, they can charge money without any security measures, up to the merchant's maximum payment limit, and the internet transaction limit is ignored.
And what is completely incomprehensible is that these transactions are enabled by default on EVERY card, with high limits.
I know this post is somewhat off-topic, but my advice is: check your MO/TO payment settings in your online banking and ideally disable them completely.
Just because you have internet payments blocked does not mean that someone cannot drain your account.
You don't need MO/TO payments for anything; they are merely a security risk.
The bank will return the money to me within 35 days, and it didn't put me in any existential danger, but it is certainly a lesson learned.
I looked at all my accounts and also asked a few people, and every single one of them had these payments enabled, with limits above CZK 100,000.
I quote from Moneta's website: “For the payment to go through, it is sufficient to provide sensitive card details, i.e. the card number, expiration date, and CVC/CVV code, without any further security measures. All MONETA Money Bank payment cards are set to active for MO/TO transactions when issued.”
That says it all. I don't understand how banks can leave this set up like that without informing anyone about it.
Maybe I am uneducated about this, but I always thought that simply blocking internet payments was enough, which is evidently not the case.
Take a look at how you have it set up and be careful.
I hope my experience helps you.
Have a good one.
