From the article the original debit card #, exp date and cvv could have been stolen online or via physical card skim. Online via database hack (this is a serio

From the article the original debit card #, exp date and cvv could have been stolen online or via physical card skim. Online via database hack (this is a serious PCI-DSS violation if the perpetrator has the encryption keys or the system storing the info isn't protecting the data), could have been stored in her browser cache and someone sneaked a peak at starbucks when she went to the bathroom. Or a physical card skim which typically happens from skimming devices appended to gas station and atm card readers, or a server at a restaurant quickly skims the card data while taking your card away to pay for the meal. Either way they got the card #. I don't think it's feasible to completely prevent card info from being compromised, too many possibilities for human error on behalf of the cardholder or merchants/processors trying to protect the data, which face a seemingly never ending list of people willing to steal card info for a quick buck. Part of what makes thefts like this hard to track down is the fact that there are numerous parties and systems involved in the transaction. There's starbucks website, and I'm sure they use and outsourced provider to manage their stored value accounts, who in turn uses an outsourced payment provided to process the credit/debit card payments, who plugs into MC or Visa rails to hit the cardholder's bank. In my mind all of these parties are at fault for not catching this, but I admit it's easier said than done when processing billions of electronic transactions every day. The easiest way to prevent identify this type of fraud would have landed on her bank's shoulders. First recognizing the initial test txn in Ohio was questionable, and then they should have had a velocity trigger on the same account # being used at the same merchant numerous times. Starbucks (and their partners) should have a similar velocity trigger looking for repeat purchases from the same card# within a certain time frame regardless of dollar amount. In the end the crooks learn the fraud rules, adjust their practices, and the good guys have to play catchup while trying not to prevent good transactions from getting stopped. Maybe the best way to protect yourself as a consumer is to routinely (daily, twice a week, etc) review the purchases made on your accounts. It's clear you can't depend on the companies making money off your spending (i.e. electronic payment providers and your bank) as they get paid when you spend more, and they'll only go so far to protect you before the ROI isn't there.