I discovered a loophole that attackers are allegedly using to take over Macy’s accounts. In this guide, I’ll break down how the attack works, what makes it possible, and how to protect yourself.
.webp)
Quick disclaimer: This article is an educational breakdown of card fraud and scams, intended to help you understand the risks and protect yourself. I do not promote carding, unauthorized transactions, identity theft, or any illegal activity. Any examples shown are for awareness only and are not instructions for committing fraud.
What is Macy’s
It is a U.S. online store that sells a mixture of electronics, beauty products, clothes, and home goods.
Overview of the Whole Exploiting method
Before we deep dive into the tutorial, the exploiting method these guys use is “BYPASS FOR NUMBER NOT UPDATING.”
They edit the number as a work number, then log out and log back into the Macy’s account. They use a real burner phone/eSIM number.
Most VoIP numbers, like TextNow, don’t work. Otherwise, when the card arrives, the fraud Y/N messages won’t be delivered, and your card may be blocked.
Tools They Use
- A clean Chrome browser with a zero-fraud-score IP requirement. By that, I mean good proxies.
- Macy’s Account Logs (I used this platform “https://ghostmarket.myshoppex.io/” during this investigation; you can research it or get it from any spammer you know)
- Drop address to get the card shipped to
- USA eSIM or USA number you have access to
- Bombing Account for number and email
Important Notice Before Buying Macy’s Account
If you get an account that comes with AMEX store cards, it means the card can be used anywhere, but if you get Macy’s STORE CARDS, that card will only work or can only be used at Macy’s
How Macy’s Bypass Method Works
After setting up the system with all the accounts ready,
1. Log in to the account on macys.com and go to My Account, and you see something like this;
2. On the left, click “Macy’s Credit Card”
.webp)
3. Once the page loads, scroll down a bit to manage your card and click Update Credit Profile
4. Once there, click Contact Information
5. Update the phone number first to yours (The esim you are using)
6. Click on Agree
7. Then update the address to yours
8.After changing the number and address, Bomb both the number and email:
How To Finalize It
- There are boxes below Contact Information; it should show “Authorized Users”
- Click that, then click Add Authorized User
- Enter full info and the address you want to ship to (don’t use 1 address for multiple cards)
- It will send a code to your number
- Enter the code, and then the card will arrive within 7 days
Conclusion
If they block your account for security issues, it means your device or IP is flagged, which can result in the account being blocked/terminated. If that happens, it’s either you move on to the next one or get a replacement, depending on the shop’s terms and conditions.