mycomicshop.com - bizarre e-mail to "verify" information ??

[Bat-Man]

I bought a book from mycomicshop.com recently and it was nothing I would consider "high value", it was a couple hundred hundred dollars comic book (generally in the world of comics I would not consider that even close to high dollar value) and got this e-mail from mycomicshop:

 

"Hello,

 

Thank you for your order.

 

Due to instances in the past where a younger family member will get ahold of their parents credit card, and place a high dollar order that ends up being cancelled or returned because the purchase was not authorized, all high dollar orders are flagged until the customer contacts us to verify they made the purchase. If you will contact our offices so that we may speak with you to make sure you did indeed place the order and verify your information, we will be happy to proceed with the order.

 

Your order has been placed on hold for 1 week pending your reply. If we do not hear from you within said week we will assume you wish your order to be cancelled and do so.

 

Thanks for using mycomicshop.com"

 

 

 

 

I already purchased the comic with my credit card when I got this e-mail the following business day asking that I contact them within a week or they would cancel my order...

 

Long story short I was required to call in and after being put on hold for a spell, the lady demanded I "verify" myself by giving them the password to my account to "verify I was the one who placed the order."

 

 

This made me extremely uncomfortable to give out the password to my account, and I do not understand how giving them the password to my account verifies anything - my question is what if someone where to just make a fake account?? Kind of a silly and un-necessarily annoying process for me to call them to give them my password.

 

 

I've been buying comics from various dealers throughout the years on the internet and from virtually every popular dealer, in some cases spending thousands of dollars but have never had quite a bizarre e-mail or phone call.

 

 

Did anyone else ever get this?

[Doohickamabob]

I bought a book from mycomicshop.com recently and it was nothing I would consider "high value", it was a couple hundred hundred dollars comic book (generally in the world of comics I would not consider that even close to high dollar value) and got this e-mail from mycomicshop:

 

Did you buy a Mickey Mouse comic? Because it sounds like the seller is running a Mickey Mouse operation.

[Bat-Man]

I bought a book from mycomicshop.com recently and it was nothing I would consider "high value", it was a couple hundred hundred dollars comic book (generally in the world of comics I would not consider that even close to high dollar value) and got this e-mail from mycomicshop:

 

Did you buy a Mickey Mouse comic? Because it sounds like the seller is running a Mickey Mouse operation.

 

 

 

No to the first, but a nod yes for the second question.

[Hibou]

That does sound strange, especially since you said you already purchased it with a credit card.

 

So essentially if you purchase a high price book from them you have to appease them with a Q&A, secret handshake and hula dance around a full moon?

 

Weird.

 

For the record, I liked MCS...

[Bat-Man]

That does sound strange, especially since you said you already purchased it with a credit card.

 

So essentially if you purchase a high price book from them you have to appease them with a Q&A, secret handshake and hula dance around a full moon?

 

Weird.

 

For the record, I liked MCS...

 

It really was, and also considering I've purchased from them in the past from them via their website and also on eBay.

 

And I do too, always been nice working with them, only this once was it a little off to me.

 

That's why I'm curious if anyone else has had this...

[This is water]

Yeah, something seems fishy. I don't think any online marketplace ever asks you for your password. And they tell you not to give it away. So I don't know what is up with MCS.

 

 

[Junkdrawer]

Often times when something bad happens to someone or some company such as the situation with the kid making the purchase (which may have happened). They don't want this to happen again. It's unfortunate for subsequent buyers to get caught up in the new efforts to combat this happening again (ever been to an airport lately) Perhaps some are okay with it, perhaps they have yet to come up with the perfect checkout process and need to look into it, but babies are still getting pat down at the airport.

[asteroid-comix]

Think the guy that runs it monitors the boards pretty regularly and chimes in on threads like this about his business.

 

So...

 

[nomatophobia-migration]

I have credit on there from trading in some books. I wonder if I would get the same treatment using store credit. Intresting. I wonder what the $$$ threshold is.

[unmovedmover]

If they have access to your password to 'verify' it, I'd avoid them just based on their poor account security.

[Doohickamabob]

Think the guy that runs it monitors the boards pretty regularly and chimes in on threads like this about his business.

 

If that's the case, then I meant "Mickey Mouse" in a good way!

 

I would have suspected some sort of phishing scam, but the Original Poster says he called in to the business directly.

[Dr1970-migration]

I bought a book from mycomicshop.com recently and it was nothing I would consider "high value", it was a couple hundred hundred dollars comic book (generally in the world of comics I would not consider that even close to high dollar value) and got this e-mail from mycomicshop:

 

Did you buy a Mickey Mouse comic? Because it sounds like the seller is running a Mickey Mouse operation.

 

They're bigger AND better than Mile High :shrug:

[3319comics]

I just bought from them a few eeks ago and was not emailed anything. I would ask the lady for her totell you what you ordered and on what day to verify who they are....

[Brodie91]

I just bought a book that was a couple of hundred dollars from them, and didnt get any email from them to verify my account.

[Scrooge]

I bought a book from mycomicshop.com recently and it was nothing I would consider "high value", it was a couple hundred hundred dollars comic book (generally in the world of comics I would not consider that even close to high dollar value)

 

How myopic the board is. The VAST majority of comic book sales is for well under $ hundreds ...

[mycomicshop]

It is an attempt by our order processing staff to be really vigilant about preventing credit card fraud. However, I agree that the communication needs to be changed (shouldn't be asking for the password, for one thing). I also think they're being overly careful in that some orders that shouldn't require any additional scrutiny are being handled in this manner.

 

I actually brought this topic up in a staff meeting we had on Tuesday--not this specific order, but this topic. It was agreed that we'd dial this back some. I'll review this further and make sure we're following through, and check on any needed changes to our communication.

 

Conan Saunders

Lead Developer & Consignment Director

mycomicshop

512-240-2802

conan@mycomicshop.com

[Annihilus]

Does the staff of mycomicshop.com actually have access to customer passwords? (That is what I am assuming if they are asking for the password from the customer to compare it to what is on file). If so, that is a HUGE no-no in the e-commerce world. Those should be encrypted 100% of the time and not accessible by anyone. If a customer forgets their password, then a 'Re-set Password' utility can get them a new one.

[mycomicshop]

Does the staff of mycomicshop.com actually have access to customer passwords? (That is what I am assuming if they are asking for the password from the customer to compare it to what is on file). If so, that is a HUGE no-no in the e-commerce world. Those should be encrypted 100% of the time and not accessible by anyone. If a customer forgets their password, then a 'Re-set Password' utility can get them a new one.

 

We're in the process of switching to only storing hashes of passwords. I believe that change should be finished in the next few days. It can be slightly more inconvenient for customers, in that if you forget your password you have to do a password reset rather than having your password sent to you, but it's a change worth making.

 

On the topic of security: all payment information is stored offsite through our payment gateway--no payment information is saved on our servers. All logins take place over HTTPS. We are PCI compliant and our servers are subject to random security scans and audits.

[OldGuy]

the lady demanded I "verify" myself by giving them the password to my account to "verify I was the one who placed the order."

 

 

While I have no way of knowing how intelligent "the lady" is, she was obviously not thinking when she asked you to verify your order by providing your password. If you didn't know your password you couldn't have placed the order to begin with. Providing your password does nothing to prove the legitimacy of your order after the fact.

 

 

[CKB]

the lady demanded I "verify" myself by giving them the password to my account to "verify I was the one who placed the order."

 

 

While I have no way of knowing how intelligent "the lady" is, she was obviously not thinking when she asked you to verify your order by providing your password. If you didn't know your password you couldn't have placed the order to begin with. Providing your password does nothing to prove the legitimacy of your order after the fact.

 

 

I recently ordered a $200 printer from an online outfit. They called me about 4 days later and starting asking me questions...to verify my CC number and address and such. The they ask me where I work. I'm like, "WTF is going on?". I'm like this '.' close to cancelling my order when she says she wants something other than my Yahoo email address.

 

Anyway I give her another address was told just to respond to the email they were about to send. I get this email and it's from the "Loss Prevention Specialist". In that light this MCS experience is not too shocking.

 

The thing with the password is shocking. That's like out of 1996ish.