If a malicious website steals my credit card info, what happens? Let's say I submit my credit card information to a website to purchase something. They give me a message saying the item will be delivered soon, and I don't notice anything wrong. Later I find out that my credit card is being used for unauthorized purchases. I believe my bank protects me against unauthorized use if I notify them. But: Will the bank take a loss? What happens to the malicious website and its owners? (Will it be hard to prove that the website is guilty?) What happens to the other shops where unauthorized purchases were made with the stolen credit card information? Do they take a loss too? If this depends a lot in jurisdiction, just give an overall idea or choose your favourite jurisdiction. If you happen to know how it would be in Brazil, please provide that too (but it is ok if you don't).
Being as general as possible - refund policies are governed by bank and scheme policies, and so aren't necessarily the domain of law. There may be jurisdiction-specific regulations that limit your liability as a consumer, but there's not usually a legal requirement. This is almost certainly wholly governed by your credit card terms of use.¹ You can report this to your local authorities, but without proof of a crime, it's unlikely to be actionable. The website isn't necessarily to blame, either - if your computer or your connection to the website was somehow compromised, then your details may have been obtained in that way, and the website could have had nothing to do with it. Again, this is almost certainly wholly governed by their scheme agreement.¹ 1. Some off-topic information here, which may or may not be accurate, and which you should not seek clarification for here (check Money SE instead, and first check whether it is on-topic there) - generally, bank policies will refund you for fraudulent transactions below a certain quantity or value. In this case, the bank tends to take a loss and chargeback rights are not exercised. In other cases, the bank will require the merchant to prove that the authorised cardholder did in fact authorise the transaction. The level of proof is governed by the way in which the transaction was conducted and verified at the time of purchase - whether the CVV2 code was verified, whether address verification was completed, whether 3D verification was completed. If the merchant is unable to prove, according to the scheme guidelines, the transaction will be charged back to their account.
Hypothetically speaking, if a program doesn't come with a EULA, does that mean someone in possession of it (who isn't the owner) would be breaking the law if they used it? If the copy on the stick was lawfully made with permission of the copyright holder, then you can lawfully use the software. Someone who lawfully comes into possession of a lawfully made copy of the software (that was not a backup) has the right to use that software in the ordinary way. For example if someone found a USB stick lying on the ground and it had software on it but no EULA, could they use the software? Maybe, but it would be hard for them to know whether they could or not. It might be a backup. It might be an unlawful copy. There was a case where a person found a CD in the trash that was clearly an original. The package had a shrink wrap agreement, but he found the CD without the package. The court held that he had every right to use the software on the CD (since it was a lawfully-made copy and not a backup) and was not bound by the EULA (since he hadn't opened the package). But he was very fortunate in being able to demonstrate these facts.
The facts you describe are very likely an infringing derivative work which would provide a basis for a lawsuit against the person operating the website. But, nothing is certain, and these determinations are highly fact specific. It is highly unlikely that the government would enforce a violation of copyright alleged in these circumstances criminally.
That GDPR Disclaimer is no protection in some jurisdictions: the applicable laws to that situation in germany for example don't care about the GDPR: Cold calling, mailing, or e-mailing private people to advertise services all is handled by the same law: Without the consent it is expressly illegal under §7 of the law against unfair competition (Gesetz gegen unlauteren Wettbewerb UWG) and such cases are rather Slam-Dunk if the origin can be made out. The punishment can be a 300.000 € fine. The fact that to email someone you need their e-mail address and that e-mail addresses and private addresses are by default considered personally identifiable information is making it worse for the advertizer: Without either an exception (there is none available to cold-emailing) or special allowance of the person the data belongs to, you violate §4 of the federal data protection law (Bundesdatenschutzgesetzes BDSG) just by handling their e-mail address. That's a separate crime from the UWG one, adding up to another 300.000 € fine under §43 BDSG - or even up to 2 years in prison under §44 BDSG! Oh, and if the email does not contain a proper sender's address, that's another chance for a huge fine under the UWG... So, GDPR is your least trouble, if you violate the marketing laws of a country, or their own data privacy laws. A disclaimer means nothing as the act of sending the mail, even to an unintended addressee, is what is illegal and the law as written does not give a damn about 'I didn't want to advertise to that person' when in fact you sent them unwanted advertisements. Oh, and the very repository you suggest? It would violate the very same §4 BDSG and be illegal for processing private data if it was not actively asked to do that by the end user. As a result, that database is useless: It does kick back all people not in its database. Its database is incomplete because only few people give their address to that database as people not aware of the database never add their data on their own. So it regularly violates §4 BDSG with every German citizen's e-mail address it gets and kicks back, and claiming those addresses would be OK, it throws the company trying to check the database under the bus because they rely on data that is impossible to be reliable. tl;dr Don't do cold-(e)-mail marketing. You throw yourself into boiling oil with a lit torch in hand. further reading Other laws banning such behavior I had listed here, and I quote myself: The US has the CAN-SPAM-Act, which illegalizes sending unsocialised advertisements. You may NOT send a mail if any of the following is true: it has no opt-out the email was gained by 'harvesting' contains a header not matching the text contains less than one sentence the adressee does not have any relation to you In fact, you are liable for a 5-digit fine per infringing e-mail in the US. The FTC itself suggests to never buy e-mail lists - as E-mail harvesting or generating any possible e-mail adress itself is illegal.
Yup, it's illegal. You want something, they have something you want. They let you have the thing provided that you do certain things, otherwise they won't give it to you. So providing a credit card is material to the contract. You know that the credit card number is false, you are representing that it is true, the card is a material fact, you intend to get them to allow you in using this false representation, they don't know it is false and they rightfully rely on your truthfulness. They have been harmed by your false representation (maybe: it would cost you a lot in attorney fees to try to challenge on this point). This is fraud.
Assuming here that this is without the permission of the current account-holder. As discussed above, from a tort law angle there would be some confusion as to who owned the password in the first place. However, under US Federal Criminal Law, such action is explicitly criminalized: Title 18 USC§ 1030(a)(6)(A) [Computer Fraud and Abuse Act] provides that: (6) [Whoever] knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— (A) such trafficking affects interstate or foreign commerce; or (B) such computer is used by or for the Government of the United States; ... shall be punished as provided in subsection (c) of this section. Subsection C then sets a punishment for such a crime at a fine and/or imprisonment for up to 1 year. Repeat offenses (this applies to any past offense under any part of the CFAA, not just password trafficking) have a maximum sentence of 10 years.
The COVID restrictions are new enough that there are few court decisions on how to interpret them. There are frequent requests for court injunctions seeking temporary relief. Some pass, some are denied. The website might accuse locations listed there of breaking the restrictions. Making such an accusation in public sounds like a very bad idea, especially if there is no solid documentation. But the aggrieved party would be any location falsely listed. The site may or may not be hosted in Germany. If it is not, it becomes a really interesting question which law applies. You might inform the authorities, but beyond that, forget it.
Canadian law defines "theft" thus: Every one commits theft who fraudulently and without colour of right takes, or fraudulently and without colour of right converts to his use or to the use of another person, anything, whether animate or inanimate, with intent (to deprive the owner, pledge as security, mess it up) In this case, you accepted what seemed to be an offer of a free pizza, so if you took and consumed the pizza you did so with a colorable claim of right and without fraud. Perhaps you misunderstood, but it is not a crime to misunderstand another person's intent. They could sue you for the cost of the pizza (assuming that you took it and did not pay), in which case the question would be whether whatever they said to you could reasonably be interpreted as an offer of a free pizza (if not, pay for the pizza). As an advertising stunt, this would not be unusual. However, if they fix the pizza but then demand money before handing over the pizza, you now know that you have no right to the pizza (if you abscond with the pizza in that circumstance, it would be theft). You may of course pay for the pizza, but you can also not pay and not take the pizza. Again, they could sue you, and in this case your defense would be that there was no contract (no agreement). An important question would be how reasonable it is to believe that you were offered a free pizza. People are offered "free" steak dinners all the time (at the cost of sitting through a sales pitch), so that is a reasonable belief. If a Lexus yacht salesman appears to be offering you a free $5M yacht, it is not reasonable to think that this is an ordinary advertising stunt, if you're not a celebrity.