Possible competitor hack

...maybe we've been hacked

[Jack_Hughes]

A customer received a phone call from somebody purporting to be from our company claiming that they could have saved the customer £20 on their purchase. I know it wasn't from anybody at the company so it must have been from a competitor.

The customer ordered via email. How could a competitor get hold of our emails? We have checked our servers and are sure that it hasn't been hacked (though we are going to check again).

Anybody seen anything like this before?

[anallawalla]

Could have been a simpler explanation - could this hoaxer (or an associate) have visited the customer for some other reason and noticed the purchase or was told about it?

Ash

[PCInk]

Anybody seen anything like this before?

Yes. The call would probably end along the lines of: "We can offer you the £20 refund, but we need your credit card number"

They get the customer details from binned receipts (don't put phone numbers of customers on there), cached copies of pages on public computers (disallow checkout page caching and only pass variable with the 'get' method) or from actually hacking in to computer systems. The last one is the harder option - probably one of the other methods has been used.

You should confirm with the customer that he has not given his card numbers to anyone.

The only other alternative is a competitor is attempting to undermine your business reputation.