UCT "flagged for security"

[David Brent]

Such a ridiculous request, no matter how reputable the company is. Next, UCT will ask you to snap you with your credit card info. You can choose to use any filter to your liking.

 

[AngiTN]

I've ordered from UT several times and trust them, the most recent order for 6 7-day park hoppers last week. I already got our tickets and linked to our MDE. (and for us, the savings was significant)

The first time I ordered from them I had to send a pic of my license a few years ago, and now as an established account I don't have to.

If it was a business that wasn't established or as respected as it is, then I would not have sent it. But I have not seen any shady business practices from UT reported anywhere. I can't comment on the request for a pic with the credit card b/c I don't understand that one and have not heard it before.

I would still attempt to talk to someone higher up in the company.

Yes

This practice is still completely unacceptable, I'm honestly glad I saw this as I was considering buying tickets from them. If their security system is so outdated, and their Tech team so unaware of current technology, then I don't feel confident of their ability to prevent hacking, theft and fraud on their own end. Do they know how to properly protect or remove those photographs they get? Are they smart enough not to link those photos with your other personal info? Incompetence is what scares me here. It's really not hard to evolve with the rest of the modern world and set up other security systems. I'm not tech savvy by any means but I'm jaded enough to know that a primarily online company should be. I try very hard to be proactive and cautious with my card info, but still had a theft situation on Black Friday this year. You can NEVER be too cautious these days and you always need to stay a step ahead of incredibly talented hackers.

Sorry you had this experience, it even sounds like maybe it WAS a security breech, it almost sounds like they don't know what's going on?? I would definitely try to contact a higher up in this company somehow, or write a letter. Don't want to see a good, honest company fail, but if they don't improve this they could be digging their own grave.

This has come up every so often, for years. I'm bad at searching but someone who is good at it could find it I'm sure
Thankfully, it happens very rarely and has not damaged their business.
And if they were going to have a breach it would be reported so fast it's not funny.
While I think their request is odd and they need something better to fix purchases that get flagged, the way they do it does work and they have been safe with the info.

 

[Jupiter&Wolfe]

Yes

This has come up every so often, for years. I'm bad at searching but someone who is good at it could find it I'm sure
Thankfully, it happens very rarely and has not damaged their business.
And if they were going to have a breach it would be reported so fast it's not funny.
While I think their request is odd and they need something better to fix purchases that get flagged, the way they do it does work and they have been safe with the info.

Yes I looked it up afterward. Pretty much the same as what most have been saying. They ask for the picture, someone is(understandably) uncomfortable with the request, and it ends with them calling the company and either not having to submit a picture or ultimately deciding they felt comfortable enough to send it.

Like I said, I have NO DOUBTS this company is honest and tries to do right by its customers. The great reviews speak for themselves and I almost felt comfortable buying from them.

But how do you know they have been safe with the info? They could TELL you they are being safe with the info, and they say that because they themselves genuinely believe they have been safe with the info. But if they are not technologically competent enough to know exactly what it means to be safe with my info, then I don't trust them. Not because they're TRYING to be dishonest. They just don't know any better. That's what a completely archaic practice like this tells me about this company.

And it only takes ONE security breach. And it just takes moments, and some random dude or group of dudes irreversibly has EVERY customer's info to do with as he pleases. This has been PROVEN in major hacks that made international news in recent years. Google major hacks such as Ashley Madison, Sony, and Target. Millions of dollars stolen within days or hours. Many people's reputations permanently destroyed(whether they deserved it or not ).

I'm not touching this company now that I know some of their procedures! But that is my personal opinion, No judgment on others!

 

[IrishNYC]

Yes I looked it up afterward. Pretty much the same as what most have been saying. They ask for the picture, someone is(understandably) uncomfortable with the request, and it ends with them calling the company and either not having to submit a picture or ultimately deciding they felt comfortable enough to send it.

Like I said, I have NO DOUBTS this company is honest and tries to do right by its customers. The great reviews speak for themselves and I almost felt comfortable buying from them.

But how do you know they have been safe with the info? They could TELL you they are being safe with the info, and they say that because they themselves genuinely believe they have been safe with the info. But if they are not technologically competent enough to know exactly what it means to be safe with my info, then I don't trust them. Not because they're TRYING to be dishonest. They just don't know any better. That's what a completely archaic practice like this tells me about this company.

And it only takes ONE security breach. And it just takes moments, and some random dude or group of dudes irreversibly has EVERY customer's info to do with as he pleases. This has been PROVEN in major hacks that made international news in recent years. Google major hacks such as Ashley Madison, Sony, and Target. Millions of dollars stolen within days or hours. Many people's reputations permanently destroyed(whether they deserved it or not ).

I'm not touching this company now that I know some of their procedures! But that is my personal opinion, No judgment on others!

This is how I feel. They have glowing reviews, but I feel like I'm more tech savvy than they are when it comes to security.

As for the bolded part, while those have been huge security breeches, with a few exceptions, those breeches have been along the lines of hackers exposing a weakness, but not doing anything with the info. Its the kind of lazy security UCT is using that does lead to financial damages. One rogue thief gets a handful of these pictures, some insecure credit card info, enough other info, and next thing you know he's printed off fake credit cards, runs out and buys gift cards, and spends those before they can be traced.

When I worked in ecommerce our clients entered cc info and our company never even saw that info unless there was some kind of refund issued, because the charges were processed off-site through the credit card service. That sort of system limits actual access to the information that can be pieced together to create theft.

 

[Jupiter&Wolfe]

This is how I feel. They have glowing reviews, but I feel like I'm more tech savvy than they are when it comes to security.

As for the bolded part, while those have been huge security breeches, with a few exceptions, those breeches have been along the lines of hackers exposing a weakness, but not doing anything with the info. Its the kind of lazy security UCT is using that does lead to financial damages. One rogue thief gets a handful of these pictures, some insecure credit card info, enough other info, and next thing you know he's printed off fake credit cards, runs out and buys gift cards, and spends those before they can be traced.

When I worked in ecommerce our clients entered cc info and our company never even saw that info unless there was some kind of refund issued, because the charges were processed off-site through the credit card service. That sort of system limits actual access to the information that can be pieced together to create theft.

Good to know! Sounds like you may know a little bit more about that stuff then you do - like I said, I make no claims to be tech savvy! Though I was under the understanding that the major retailer hacks like Target and Home Depot did result in a lot of money being stolen.

But like you said, it's about poor security. I think if major companies like these can have weaknesses exposed, a small company like this is probably pretty vulnerable, right?

 

[lntx]

How much money could one possibly be saving to make it worthwhile to go along with such a stupid demand? I would not do business with this company for any reason. OP- were you able to get your refund? I hope you called your cc company and disputed the charge. Good luck! Let us know what happens!

 

[UnderCoverTourist]

Hi All,

So we understand the concerns and would like to shed some light onto this subject. E-Tickets are not the same as ordering physical items that are delivered to your home*.

*"Why do we do this? Unlike airlines, hotels or attractions, we can't verify your identity and/or payment details in person before providing your tickets or reservation. We work hard to responsibly and securely protect our customers and our company from fraud. Thank you from the Frog Family."

We deliver millions of tickets per year both via regular shipping (mail) and email. A relatively small number of transactions are flagged using scores of metrics (using our past experience with millions of $ of fraud and attempted fraud). Due to other companies security breaches over the past few years we have seen a massive uptick in attempted fraud on E-Tickets due to massive amount of stolen credit card numbers out there.

We do receive the credit card at time of order. For your protection we do not store the credit card number. We are also not asking for the full credit card number simply the last 4 digits. Upon releasing the order we delete the image. So it is not stored beyond releasing the order, it is just the last 4 digits.

Now of course we recognize this may not to be to everyones taste and we do have a regular mail option which when shipped to the billing address is almost never flagged!

Yes we want to avoid millions of dollars of fraud but it does truly protect you too. We have received dozens of messages of thanks from customers whose cards were not successfully used for fraud. The less lucrative the fraud is, the less attempts are made.

This has been very effective in reducing the successful fraud (which is costing millions of $ of losses within Theme Park E-Tickets alone) but if you are uncomfortable with the small risk of being flagged and still like our service please consider choosing the Mail to your home option. Right now, we are working with the credit card companies to add other layers of protection and adjust our fraud metric system to reduce the number of flags by 80% of an already limited number of people flagged. This issue is very unique to 'Theme Park E-Ticket' fraudulent attempts.

So in conclusion, we are not asking for your full card number, just the last 4 digits, we delete the image upon order release, the image is uploaded through our secure website. If you are still uncomfortable please consider choosing to have your tickets mailed to the address that matches the billing address for your card.

The flagged orders must meet many indicators of potential fraud, the number is low. The photo does help for many reasons and we do have the mail option.

We have reduced our fraud to 1/42th of the successful fraud of our competitors. It costs us more money to deliver tickets by mail, but if it gives more peace of mind then we are happy to do so! We all win if we stop this rampant fraud. If the fraudster placing the order is successful, they are willing to pay more for stolen credit cards (to the original thief). If they are willing to pay more to the original thief, it is more of an incentive for them and others to steal even more cards as they get paid more!

It does cost cardholders time to clear up fraudulent orders and many people work for or own retail businesses that are victims of fraud. The cost of fraud is passed onto us as consumers in the form of higher prices, time to clear up issues and a 'it takes a village' to not reward people who attempt to cheat and steal rather than working!

We hope this insight helps and we can deliver via mail too.

Thank You

Undercover Tourist

 

[adisneyaunt]

Thx UCT for posting the rationale behind the request for pix.
Makes sense ... not sure I'd Not have tix mailed tho... seems like an easier transaction overall.

 

[Maistre Gracey]

Hi All,

So we understand the concerns and would like to shed some light onto this subject. E-Tickets are not the same as ordering physical items that are delivered to your home*.

*"Why do we do this? Unlike airlines, hotels or attractions, we can't verify your identity and/or payment details in person before providing your tickets or reservation. We work hard to responsibly and securely protect our customers and our company from fraud. Thank you from the Frog Family."

We deliver millions of tickets per year both via regular shipping (mail) and email. A relatively small number of transactions are flagged using scores or metrics (using our past experience with millions of $ of fraud and attempted fraud). Due to other companies security breaches over the past few years we have seen a massive uptick in attempted fraud on E-Tickets due to massive amount of stolen credit card numbers out there.

We do receive the credit card at time of order. For your protection we do not store the credit card number. We are also not asking for the full credit card number simply the last 4 digits. Upon releasing the order we delete the image. So it is not stored beyond releasing the order, it is just the last 4 digits.

Now of course we recognize this may not to be to everyones taste and we do have a regular mail option which when shipped to the billing address is almost never flagged!

"Using your phone, please take a selfie photo and show the credit card used to make the purchase. Please cover all but the name and last 4 digits of your credit card. This will allow us to verify you're a real person with a real credit card, just like a transaction in a retail store!"


Yes we want to avoid millions of dollars of fraud but it does truly protect you too. We have received dozens of messages of thanks from customers whose cards were not successfully used for fraud. The less lucrative the fraud is, the less attempts are made.

This has been very effective in reducing the successful fraud (which is costing millions of $ of losses within Theme Park E-Tickets alone) but if you are uncomfortable with the small risk of being flagged and still like our service please consider choosing the Mail to your home option. Right now, we are working with the credit card companies to add other layers of protection and adjust our fraud metric system to reduce the number of flags by a massive 80%. This issue is very unique to 'Theme Park E-Ticket' fraudulent attempts.

So in conclusion, we are not asking for your full card number, just the last 4 digits, we delete the image upon order release, the image is uploaded through our secure website. If you are still uncomfortable please consider choosing to have your tickets mailed to the address that matches the billing address for your card.

We have reduced our fraud to 1/42th of the successful fraud of our competitors. It costs us more money to deliver tickets by mail, but if it gives more peace of mind then we are happy to do so! We all win if we stop this rampant fraud.

We hope this insight helps and we can deliver via mail too.

Thank You

Undercover Tourist

It's weird. It doesn't protect the card holder. The card holder is not responsible for fraudulent charges.

There were reports of you not accepting a picture of the card. You want the persons pic also. I find that creepy.

MG

 

[mckennarose]

Thank you for clarifying, UT. We have been, and will continue to be customers.

 

[Jennasis]

As a small business owner myself, this sounds all kinds of odd. No. I'll just buy my tickets elsewhere for a few dollars more and a LOT less hassle.

 

[wilkeliza]

I still don't see how a picture prevents fraud. Again people who are using fraud card numbers have just as much ability to print a fake card and take a photo.

 

[Cadaverous Pallor]

I would call them over the phone.

If they refused to take my credit card over the phone and demanded a selfie, I'd take my business elsewhere.

As rational as the post by UCT, it's still weird.

 

[perditax]

I still don't see how a picture prevents fraud. Again people who are using fraud card numbers have just as much ability to print a fake card and take a photo.

Maybe less willing to provide a picture of their own face when they know they're committing a crime?

I work in a fraud-heavy industry (online gaming) and we have similar procedures.

 

[wilkeliza]

Maybe less willing to provide a picture of their own face when they know they're committing a crime?

I work in a fraud-heavy industry (online gaming) and we have similar procedures.

Nothing says they have to use their own face. As someone posted earlier photoshop it pretty easy for something like this. A photo holding a card doesn't do much for security.

 

[perditax]

Nothing says they have to use their own face. As someone posted earlier photoshop it pretty easy for something like this. A photo holding a card doesn't do much for security.

The people doing serious credit card fraud have lots of numbers to burn through. They don't have time to bother with constructing a fake credit card photo and doing a convincing photoshop job. They just move on to the next number.

 

[wilkeliza]

The people doing serious credit card fraud have lots of numbers to burn through. They don't have time to bother with constructing a fake credit card photo and doing a convincing photoshop job. They just move on to the next number.

I also can't imagine serious cc fraud will do a non-refundable 120 purchases either. Even if they are running the card to check it the amount isn't going to be that high.

 

[A State Of Autumn]

I got skimmed in Europe last year for thousands of dollars of train tickets in countries we didn't travel to. Honestly if a company asked me to do this I would happily send them a selfie of myself and my card. They then have some proof should the transaction be disputed and I know that they're protecting me by doing so.

I understand it's an odd request but as I learnt last year tickets are a very popular thing for criminals to purchase, they're not physical so generally won't be repossessed and they can be used before the person even knows there is something wrong with their card or accounts.

 

[anorman]

I thought it was weird but having dealt with this company several times in the past I sent the selfie as requested but the card was partially obscuring my face and was of such bad quality it couldn't possibly have been used for anything other than this. I did speak to a representative of UT prior to sending this and they explained the security concerns.

Within two weeks I received my park tickets in the mail delivered to my home address. I have had no issues with the credit card I used. I would happily use UT again in the future.

 

[babyruth]

Hi All,

So we understand the concerns and would like to shed some light onto this subject. E-Tickets are not the same as ordering physical items that are delivered to your home*.

*"Why do we do this? Unlike airlines, hotels or attractions, we can't verify your identity and/or payment details in person before providing your tickets or reservation. We work hard to responsibly and securely protect our customers and our company from fraud. Thank you from the Frog Family."

We deliver millions of tickets per year both via regular shipping (mail) and email. A relatively small number of transactions are flagged using scores of metrics (using our past experience with millions of $ of fraud and attempted fraud). Due to other companies security breaches over the past few years we have seen a massive uptick in attempted fraud on E-Tickets due to massive amount of stolen credit card numbers out there.

We do receive the credit card at time of order. For your protection we do not store the credit card number. We are also not asking for the full credit card number simply the last 4 digits. Upon releasing the order we delete the image. So it is not stored beyond releasing the order, it is just the last 4 digits.

Now of course we recognize this may not to be to everyones taste and we do have a regular mail option which when shipped to the billing address is almost never flagged!

Yes we want to avoid millions of dollars of fraud but it does truly protect you too. We have received dozens of messages of thanks from customers whose cards were not successfully used for fraud. The less lucrative the fraud is, the less attempts are made.

This has been very effective in reducing the successful fraud (which is costing millions of $ of losses within Theme Park E-Tickets alone) but if you are uncomfortable with the small risk of being flagged and still like our service please consider choosing the Mail to your home option. Right now, we are working with the credit card companies to add other layers of protection and adjust our fraud metric system to reduce the number of flags by 80% of an already limited number of people flagged. This issue is very unique to 'Theme Park E-Ticket' fraudulent attempts.

So in conclusion, we are not asking for your full card number, just the last 4 digits, we delete the image upon order release, the image is uploaded through our secure website. If you are still uncomfortable please consider choosing to have your tickets mailed to the address that matches the billing address for your card.

The flagged orders must meet many indicators of potential fraud, the number is low. The photo does help for many reasons and we do have the mail option.

We have reduced our fraud to 1/42th of the successful fraud of our competitors. It costs us more money to deliver tickets by mail, but if it gives more peace of mind then we are happy to do so! We all win if we stop this rampant fraud. If the fraudster placing the order is successful, they are willing to pay more for stolen credit cards (to the original thief). If they are willing to pay more to the original thief, it is more of an incentive for them and others to steal even more cards as they get paid more!

It does cost cardholders time to clear up fraudulent orders and many people work for or own retail businesses that are victims of fraud. The cost of fraud is passed onto us as consumers in the form of higher prices, time to clear up issues and a 'it takes a village' to not reward people who attempt to cheat and steal rather than working!

We hope this insight helps and we can deliver via mail too.

Thank You

Undercover Tourist

BS because I was having the Disney tickets mailed. Nobody, not one single person over email chat or phone mentioned the mail order which is probably because I was already having them mailed! Additionally, according to the person I spoke to it was ONE TINY INDICATOR of the internet address I was using coming from RI instead of MA not "many indicators of potential fraud." So no this excuse does not help.