While traveling abroad and catching up on my email, on June 7 I saw multiple emails from Lowe’s:
“June 6, 2:20 pm: Thanks for your order [#1]”
June 6, 7:13 pm: Your [#1] order is ready for pickup”
“June 6, 7:13 pm: Successful pickup of order [#1]”
“June 7, 12:29 pm: Thanks for your order [#2]”
According to Lowe’s, I’d placed and picked up the first order while 7000 miles away. That was a problem.
The first (completed) order was placed (and picked up) in High Point, NC. The second order was placed in Kernersville, NC. Both far away, even were I in Durham, and not Germany. The first order included the name of the person who picked up the order (I mean, their identify might be falsified, but criminals aren’t always the smartest). Since the second order remained open, I called Kernersville PD. My call was routed to an officer who called me back. From him I learned that, because my home residence was Durham, I needed to call Durham PD first. They would then route the information to Kernersville. I agreed to call Durham PD, but pointed out potentially imminent crime. The officer agreed, and headed to Lowe’s. I called Durham PD.
The typical process when you call the non-urgent number is that the officer calls you back. Yet, after repeated tries on the part of Durham PD, I had to give up. While I could call dispatch, they required the officer call me back directly, and the officer’s calls wouldn’t come through to my Google Voice #. When I explained that I was in Germany, and provided my German phone #, I was told that they had problems calling out of country. Then not getting any calls back, I tabled that conversation for my return to the US.
Kernersville PD called back to say they had visited Lowe’s. The order had already been tagged for fraud, and not picked up. They asked for, and I forwarded, the emails from Lowe’s.
While I knew what would happen, I next called my credit card company. They, unsurprisingly, canceled my card. As I’ve written about previously, that meant, of the three credit cards I’d brought to Europe, I then had only one card left I could use to withdraw cash. Swell. With that, I tabled the problem to await my return to the US.
Thursday (the day after my flight brought me back from Germany to Durham) I called Durham PD. Given my call issues previosuly, when they offered to dispatch an officer to my house, I accepted. He arrived promptly, listened to my story, gave me his card, and said he’d follow up. That afternoon, he left a voicemail: “Hey, this is officer [x] with Durham Police Department calling you back the report that I did for you this morning report xx-xxxxx. So it turns out it’s not in our jurisdiction and we won’t be investigating it at this time. I still made a note and gave the report to my supervisor. So instead I’m going to give you the event number. Okay? So the event number for this is going to be yy-yyyyyy. Okay. Have a good evening. ”
Wait. So Kernerville PD can’t do anything without a police report from Durham PD, and Durham PD claims it’s not in their jurisdiction? So I called Kernersville PD to explain. And was told that Durham PD was clearly wrong, and that they would call Durham PD and straighten things out. Kernersville PD called back to say there was still a report number for them to act on. Durham now otherwise out of the picture, I called High Point PD (where the actual crime of the pickup had occurred).
High Point PD said I would need to talk to Durham PD first. I told them that I had already spoken with Durham PD, but that Durham PD had said it wasn’t in their jurisdiction. High Point PD said they would call Durham PD and straighten them out.
Then Durham PD called, and, after a conversation, said they would call High Point PD and straighten _them_ out. Durham PD gave me an explanation of the difference of if I had lost my card (because then the crime would be where I lost the card) versus me still having the card, meaning the card # had been stolen through some on-line account. Both police departments telling they would call the other to straighten them out.
My understanding gets a little muddled here, if only because I’d been on a lot of calls, with three different police departments, not to mention jet-lagged from the flight. High Point PD dispatched an officer to Lowe’s, who spoke with the manager, but wasn’t sure which employee had handled the transaction. Their “Loss Prevention” employee wasn’t in that day, so they couldn’t get access to the video immediately. I understood that when High Point PD had the video they would send it to me (where presumably I would hand it to Durham PD?).
That’s about where it stands. I don’t expect anyone to do anything, because they’re all pointing fingers at each other. And that’s with all the various components having occurred in one state. I can only imagine the debate were it a Lowe’s in VA instead of the stores being in NC. If you wonder why identity theft is so successful?
Along the way one question arose – how exactly had someone gotten their hands on my credit card number? As some of my friends know, I do weird things with email. Whenever I give my email address to, well, anyone (or at least any business), I give them a custom email address. So for Lowe’s I would provide Lowe’s@[ricksdomain], Ebay I would provide “ebay@[ricksdomain]”, so when I receive mail I have additional validation that the sender is who they say they are, or that my email address for that vendor has been lost or stolen when I receive email from somewhere else.
This trick once led to an extended discussion with an international bank. At the time I was network architect for a global company. When I found one of my email addresses being used fraudulently, I worked my way through the bank’s service desk to senior IT people who hadn’t sold my address – their customer information had been compromised!
Yet all of the emails associated with those Lowe’s transactions weren’t to Lowe’s@[ricksdomain]. Instead, they were for some web site that no longer responded, leaving me to wonder exactly why I had provided my credit card number in the past. When I returned home I did a deeper dive on my email history, and tracked down my usage of that email address to a purchase I made on-line in January of 2023 from a Facebook ad. That ad was, itself, fraudulent. At the time, after a month or so of wrangling with the “vendor” who claimed it had been shipped and delivered, I reported the charge as fraudulent. But I made a mistake. I hadn’t canceled the card. That card information remained out there, to then be used fraudulently by someone 15 months later. A lesson learned there – if you have a fraudulent transaction, even if you resolve it with the credit card company, have the card reissued.
And of course, once someone used that email address with Lowe’s, Lowe’s created an account in my name. Then Lowe’s started sending me advertising to that account. An account I can get into, because I can reset the password and the password comes to my email address. I called Lowe’s to cancel that account (without canceling my actual Lowe’s account). They were understanding, and said they canceled my account. Yet I still kept receiving email. I called back, and went through the entire process AGAIN. Yet that account still exists. I’m still getting mail to it. Lowe’s tells me now there’s no actual way to delete an account.
So we have crime that the police departments disavow. An account in my name with the vendor that I can’t cancel. Kudos at least to Kernersville & High Point PD, who not only dispatched an officer, but were also the only ones to ask for the emails. The only evidence I have that someone bothered to check at all.