DP: GC to the Container Store via MPX did not work.

Going to try again with REI since that one has worked for others. I will report back. :)

DP:
8/4 - MPX $100 Home Depot GC
8/8 - $100 airline credit posted

I used a bunch of Pathfinder pts for an air booing last week. The value came out to .8 cpp, which is pretty lousy.

And the portal wasn't showing X class fares on my carrier, even though they were available (I booked one of those for another person via another channel right after).

Got a voicemail from fraud department to 'verify recent activities' on my card. You know what these voicemails mean.

The background is that I got this card >3 years ago and never used it. It went directly into my credit card binder collection and I never took it out from there and never used it online. There was not a single statement generated in last 3 years.

And today fraud department told me that there was attempt of $39 charge on Amazon Merchant services and second for $100 VISA provisioning service.

Obviously they canceled card and sent replacement but anyone else got exposed?

My biggest question is - how one get their hand on the number which never was used?

Happens to me every few months. Having lots of cards increases the odds of fraud attempts. I assume credit card numbers follow a formula. Someone made an educated guess.

why aren't you using this card for the $100 annual credit?

There was no need... I specifically got it for overseas transactions but since that there were better options available for me.

Are you saying you've also hard fraud attempts on cards you've never, ever used? I find it highly improbable that someone could make a successful guess of random credit card details including name. It seems more likely to me that OPs card details got skimmed en route and the culprit as been sitting on the data for 3+ years, skimmed from his/her credit card binder collection, or through a security breach at PenFed (seems least likely of the 3).

If my information is correct, some internet online payment systems require only number and expiration date, name and even CCV is not required. With this setup, the only thing you need to do is to guess number and expiration date.

Here in Singapore about three years ago there was situation that someone made educated guess about local bank's credit card number schema, generated these number and hit thousands of people. My card was charged with about USD $9000 and VND Facebook credits (!). And that with the fact that I never used that card outside of Singapore and inside only used it with physical terminals, not online.

That number must live in a database somewhere, even if you have never put the card to work or linked it to anything, and that source data was compromised.

Even if people are highly diligent in protecting their card / account info its pretty hard to lock everything down when so much is outside the card holders control.

Could even have gotten hacked at the card printing location.

Well, I'm 0 for 2 with the MPX portal. I'm going to try one last time with Walmart. After that, 3 strikes and I'm done. (for the record, I've tried purchasing $100 gift cards to the container store and REI with no reimbursement).

May 2019: Purchase $50 MPX (UBER) x2
3 months later: $50 x 2 credits for travel fee