bluefoxicy

On April 9, 2015, I placed an order with Total Cycling (Total Cycling | Road, MTB, Track ~ Wheels, Frames and Components) for a Tacx Galaxia T1100 roller. The order was paid for via Paypal, and deducted from my account.

As of today, the order page reports the following:

On April 16, I sent the following e-mail to Total Cycling:
on April 17, I followed up:

It is notable that the order before mine, to a Mr. Bernardo in New York, placed on 09 April 2015 17:46, using a Visa card with the last 4 digits "5378" as payment, to whom I have no acquaintance, has already been completed. The last order, accepted by Total Cycling on 11 April 2015 16:41, has already been completed as well.

Yes, folks, it's trivially easy to look at other orders on Total Cycling.

If there is any problem with your order, Total Cycling will charge you and proceed to send no communication. Ten days or two weeks later, they will initiate no contact, while holding your money and not shipping anything. If you contact Total Cycling, you will receive no response.

I have disputed the transaction with PayPal, who will contact Total Cycling on my behalf. I have noted in the dispute that I will reclaim the money in 3 days if I receive no contact, do not receive the item, and the item has not shipped; I have also informed them that if they ship the item anyway, or it appears here (including if their order page is erroneous and they simply choose not to communicate the fact), I will neither return the item (inconvenient) nor render payment. For obvious reasons, I have communicated these facts with the seller up-front, as choosing not to inconvenience myself with the hassle of taking the item to a Fedex location (taking vacation time off work to do so) would of course cause them monetary damages in the event that this lack of communication ends with me receiving an item not paid for. They will have, in total, a week from initial communications and two weeks from initial order to communicate about the delay in order before such consequences become possible.

You are advised to deal with Total Cycling at your own risk. You are also advised to use PayPal if doing so, as Total Cycling exposes the last 4 digits of your credit card number to any and all users on the Internet, along with your billing and shipping addresses, and so can be used with credit card databases or for verification with service providers who use the last 4 digits of the card as an identifier. This is why I haven't included full name, address, or zip code in the earlier information; although I'm sure you can figure out how to access that information on your own given five minutes examining the order history page.

ahsposo 

You realize they are in Britain, don't you?

You think they're gonna fly that trainer over here? I doubt it.

Rollfast

How in the world do you know about some other order, much less the last four of the CC? A brag box on the page?

You a double-naught spy?

bluefoxicy

Notably, I turned up order details for other orders they've shipped over here. Including credit card information.

It's trivially easy to make their ecommerce application show me a few hundred of the most recent orders. It appears to archive the rest. I recognized a common behavior of Web applications broken in that way, tried it, and found that, yes, it does that.

Yes, I've notified Visa, with instructions included. The merchant doesn't respond to me at all.