9 ms·

Cards Stolen in Target Breach Flood Underground Markets

95 points by clarkm 13y ago

seiji 13y ago
Recent stolen credit card number story: Last week I got an email saying I made a $1,000 payment on my credit card. Except, I didn't. It wasn't bill pay time of the month. I brushed it off as a well formatted spam. An hour later, it still bothered me. I logged in to check. Yup, there was a $1,000 payment recorded as of 4am my local time the same day. WTF? Oh, look, there's also fraudulent charges showing up now. How odd. It turns out: my card didn't have enough free on the credit line for the losers to buy their xbox, so they called in and requested a $1,000 payment from my bank account on file. The credit card company happily issued it, my credit limit increased by $1,000, then the guy went out and bought his xbox. While I was on the phone explaining this to the credit card company, three more fraudulent charges showed up in pre-auth. Incompetents all around (except for whoever stole my credit card number). The whole "stolen credit card number" doesn't hurt very much (since all bad charges are covered), but what really is annoying is someone getting away with purchasing things fraudulently.
- kordless 13y ago
  Then pile on the fact that I've tried to use my AX legitimately to buy hardware over the last month and was denied 2 separate times because it 'seemed suspicious'. Really makes you wish for a more secure payment system which can be used for such transactions.
  - Jtsummers 13y ago
    I'm curious, my purchase history with my CC was generally local stores, groceries, gas, restaurants. Large purchases were rare, and then I finally bought some computer hardware (~1k purchase for the whole kit, all at once). BoA called me and confirmed it wasn't fraudulent, things went on. Then I moved and hadn't spent much in the new area (I use cash most of the time), when I finally decided to upgrade from my 13" CRT. Go into Best Buy, pay with the CC, again BoA called me and once the call was through the transaction cleared and I had my new TV. Does your CC company not call to confirm things? Were the purchases clearly out of line with your previous purchase history (by location, type or amount)?
  - NoPiece 13y ago
    Someone should come up with a two factor authentication system for CC purchases. I swipe my card, then the processor pings my phone for approval. It would be great for validating tip amounts as well.
- mikeash 13y ago
  This makes me curious. Will your $1000 limit increase stick, or be taken back?
  - seiji 13y ago
    Well, I had something like $240 free on the credit card, which wasn't enough for their xbox. They called in to issue a $1,000 payment from my bank account (on file for recurring monthly payments) to the card. The phone rep allowed it apparently. (They later said the person who called in knew my family info and passed all "security questions." I wish I could have gotten a recording of that call to see if I knew who it was.) Now, with $1,240 available on the card, they bought their xbox and other crap. As a mater of principle, I had them refund me the $1,000 I didn't authorize. They sent me a check a week later and re-adjusted all balances appropriately.
    - ams6110 13y ago
      I call BS I bet they didn't ask any security questions. I find that if you're calling to make a payment, they generally don't care who you are.
- ams6110 13y ago
  A good reason to NEVER link your bank account for payments on any other credit account. Also points out a security hole; normally credit card companies are a lot less concerned about verifying identity when someone wants to make a payment on an account. Here's an example of why they should.
  - refurb 13y ago
    This is actually a great point, even when it comes to paying non-credit card related bills. When you authorize a business to remove cash from your bank account using ACH, it's a "withdrawal first, ask questions later" arrangement. I remember seeing a news story about a gas company who had thought a customer damaged their gas meter. They replaced it, then deducted the $1000+ cost of replacement from the customers bank account. Since the customer authorized the ACH access, they were out of luck in getting the money back right away. If they hadn't linked their bank account, they would have gotten a bill and could have figure out an arrangement before handing over any cash!
    - comrade_ogilvy 13y ago
      Exactly. When you pre-authorize money to be removed from your account, the bank will happily believe every future charge from that party. From their point of view, your emptied bank account is your problem. In fact, some banks will not even give you an effective means of removing such authorization. You may literally need a new bank account to keep your account from being emptied in the future.
      - ams6110 13y ago
        There really is no such thing as "pre-authorized" from the bank's point of view. You never tell your bank "it's OK for Utility Company Foo to debit my checking account" You give the bank's routing number and your account number to the utility or whomever. That's all they need. That information, by the way, is present in clear text on every paper check you write. The bank doesn't pre-authorize anything, nor can they block anything short of closing your account and giving you a new account number. Your protection is that presenting a fradulent check (electronic or physical) is a crime.
- comrade_ogilvy 13y ago
  I am ideologically opposed to ever letting money leaving my bank account, except under my close supervision with direct instructions on time and amount and to whom. That means nobody has a right to ask for money from my bank. I tell my bank whom to give money and how much. Not my credit card. Not my mortgage company. Definitely not my gym.* Nobody. Never. Therefore I never used debit cards. Wells Fargo kept sending me debit cards when my ATM card expired. I changed banks. I do not want any ambiguity about the balance in my bank. "But they promise me all kinds of protections!" That sounds nice, but there are two problems: First, you are giving up a wonderful kind of protection: the ability to walk away. If I disagree with my credit card company, I can pay what I deem correct and cancel my card. They can see me in court about the remaining balance, if they think they can win. I am whole. I still have my money in the bank account. It is approximately never going to be a problem, because the credit card companies understand the score. They have a strong incentive to play fair with an honest credit card holder. Second of all, the moment the bank/credit card company thinks something really fishy is going on, you are screwed. You know how you said you were wondering about those security questions and whether you would recognize the voice? Think carefully. If the bank suspects your nephew who stayed the weekend last month or a roommate or an ex-SO are directly involved, it all becomes your problem. The bank will not restore any funds to your account. The local police will laugh at you. And now you see the problem. The fact of your emptied bank account will not be changed, and those promises you were banking on are worthless. (Have money to hire a lawyer? That one is lose-lose.) * Private gyms love to get bill your bank account and be authorized for automatic payment. The thing most people do not realize is most banks consider this to be completely and totally your problem now. If you cancel your gym membership, and the gym makes a "mistake" and keeps billing you, the bank will not help you. In fact, some banks will tell you that your only recourse (from their POV) is to get a new bank account to protect yourself in the future. Those "mistakes"? Your problem.
  - dredmorbius 13y ago
    Most gyms will also happily give you a discount (often substantial) if you pay cash (or check) in advance. Typically a year, you might be able to talk them into 6 months. I frankly prefer not having to either deal with the automatic deduction or remembering to cut a check every month.
joshmlewis 13y ago
I had an interesting thing happen a few months ago. I kept having my credit card used for fraudulent charges, but they weren't buying TVs or electronics, just small purchases at Dollar General and gas stations in Texas. I was really confused. So I had the card cancelled and another issued, and there again it was being used in another state. This happened three times within a couple months. I have no idea how or why as I'm very careful purchasing things online and in person. I finally changed my PIN and it stopped. I don't know why or how they were using my card with my pin, but either by coincidence or luck that fixed it.
callmeed 13y ago
Personal anecdote and tips: I had my debit card skimmed at a local gas station in October. Within a couple hours, it was being used at stores in Los Angeles. I live a 3+ hour drive from LA so there's no way the skimmer/data was physically taken down there–the data had to have been transferred (cell?) to someone down there pretty quickly. My card was used at a restaurant and a few different stores, but several times per store. Total amount charged was about $2K. All purchases were < $100 and most purchases were for very even amounts at drug stores. Based on research, this is because buying gift cards is a favorite use of stolen cards. Gift cards can be turned into cash online for about 75-85 cents on the dollar. Chase was very good about freezing the card and crediting back all the fraudulent charges. TIPS: - Use cash or a gas card for gas OR at the very least, use a pump close to the cashier - Debit cards have a reputation for having less protection than credit cards. At least at Chase, this is no longer true. Chase has zero-liability for unauthorized debit card purchases [1] - Check your online banking often - Don't rely on your bank's automated fraud detection. Most alerts I've received from Chase have been false positives (legitimate purchases while traveling). [1] https://www.chase.com/checking/debit-cards https://www.chase.com/checking/debit-cards
- MartinCron 13y ago
  I've also had plenty of false positives, but my bank (Bank Of America) has caught multiple actual fraudulent charges. It's easy to hate on big banks and big data and the loss of privacy, but it's pretty cool when your bank calls you up and says "We don't think that was you buying skateboards and polo shirts in Eastern Europe."
  - comrade_ogilvy 13y ago
    I have had this happen a couple time. I got a call one Saturday morning asking about 3 recent charges, including a Men's Warehouse in Waikiki. My response: "You are calling me at my California home number. I WISH I were in Waikiki right now. How about you reverse everything today and send me a new card in the mail?"
    - MartinCron 13y ago
deleted 13y ago
[deleted]
nnnnni 13y ago
So... What's the best way to find out if your card was caught up in the breach?
- HillRat 13y ago
  Yeah, I used two cards and one of them already got smurfed (I put on block on the other one as a prophylactic measure). At this point, if you used a card at any Target in the affected time period, just assume your card has been sold and is going to get used. This is going to get macroeconomically expensive, I think.
- giant 13y ago
  If you used your card at Target between Nov. 27 and Dec. 15, you were caught up in the breach.
- takeda64 13y ago
  Here: http://paulsparrows.files.wordpress.com/2011/06/ismycreditcardstolen4.png http://paulsparrows.files.wordpress.com/2011/06/ismycreditca... Your question reminded me of this and I see someone already responded. In any case you should get a new card if there was a chance you were affected.
terhechte 13y ago
I was just thinking whether I had ever bought anything at Target, and then remembered, yes, but that's 7 years ago, and I've gotten new credit cards since. But then I wondered which other online services I had used with my credit card, and it occurred to me how awesome it would be if I had one-time throw-away credit cards, that I could use for only one purchase at one retailer and then throw it away. Now, I know that gift cards work this way, and could theoretically be used in such a way, but they're usually locked to a specific retailer or one can't use them for online purchasing. Then I realised that, really with all the flack it is getting, Bitcoin is such a solution. Once the conversion from $ to BTC is done, there's no way to get your credit card data or anything. You're practically immune against any data theft at the place where you're purchasing. Now, of course the problem only shifted as you have to guard your private keys now, but that's more or less a question of tooling and usability of proper BTC clients (which hopefully come up in the future). I'd rather have the valuable information stored in an open source application used by millions with strong code review, than in a closed source web app where an intern wrote the code in php and forgot the salt or stored everything plaintext. This alone sounds to me like a pretty strong incentive.
- tpurves 13y ago
  See this announcement earlier this year from the major card networks: http://cardnotpresent.com/news/cnp-news-oct13/Amex,__MasterCard,_Visa_Propose_Tokenization_Standard_for_Digital_Commerce_-_Oct__3,_2013/ http://cardnotpresent.com/news/cnp-news-oct13/Amex,__MasterC...
- mikeyouse 13y ago
  Meh.. My Citi Card has one-time use codes with the benefit of the normal protections of having a credit card (insurance, fraud prevention, customer service, etc). This problem is solved for people that care to solve it. I'm not trying to shill for Citi, I'm actually dropping them for other BS, but I assume other cards have it as well. [1] - https://www.citibank.com/us/cards/gen-content/messages/van/index.htm https://www.citibank.com/us/cards/gen-content/messages/van/i...
  - wehadfun 13y ago
robomartin 13y ago
My wife shopped at Target twice, both times outside of the period given for the breach. I think we are still going to get the cards replaced just to err on the side of prudence. I find myself wondering how this might affect Target. I almost never shop there myself. My wife, on the other hand, might have shopped there once a month or once every couple of months. Yesterday she told me she is not going back. Ever. There have to be other people on the same boat. It'll be interesting if they ever release information on how exactly the breach was orchestrated. My biggest question is about all of that data moving about Target's distributed system without any encryption whatsoever. At least that's what it sounds like. The data capture had to be done at some central point in their infrastructure in order to affect some 1,800 stores. Again, all of that data from 1,800 stores got to a central repository of some sort completely unprotected? Why isn't that information stored and limited to the within the walls of each store? It'd sure limit the exposure, well, a factor of 2,000. Anything leaving the walls of a store needs to be encrypted. Perhaps someone with more experience in brick-and-mortar payment infrastructures of this kind can comment on this?
- Duhck 13y ago
  At the very least, I believe they are responsible for paying the credit card companies to replace the stolen cards. I can't find my source on this, but I do remember a few times that a retailer was held fiscally responsible for new card distribution.
- r00fus 13y ago
  People will go back. They may make promises, but then find justifications to soften their resolve. It happens every day. Target is just too large to really be impacted in the long run - however it's going to have a nice impact on their current holiday season.
- toast0 13y ago
  My guess is that they run all the stores through a centralized payment system. Encrypted in transit or not, the payment system needs the details in plain text to send to the payment processor. At or near the payment processing is where the information was likely copied. The information can't only stay within the store, because purchases from one Target may be returned at any Target, and they may look up receipts by credit card used. At Target's scale, it makes more sense to do a centralized lookup (or local + centralized), rather than a query to every store.
munger 13y ago
I bought something from Target in this window with a credit card (Wells Fargo). I called them up to proactively report it stolen - the problem is they will immediately deactivate your current card and it takes 7-10 business days for the new one to show up. It is not possible to get a 2nd card number without deactivating the first (to avoid a no-card for 2 weeks situation). Or you can have them overnight it to you for $16. Kind of annoying to pay $16 for a merchant error, or to not have your primary card for 2 weeks during the holiday season (and also the card you use to pay all service bills like cable tv, internet, city/trash/water etc). Ultimately I decided to do nothing and just keep a close eye on account activity until January when it is less inconvenient to wait for the new one.
- jisaacks 13y ago
  I also have Wells Fargo. Whenever I have lost a card in the past (It used to actually happen a lot - I usually left them in ATMs). They would do what you said, only I could go in to any WF location and get a temp card until my new one arrived in the mail. If I was not near any WF location and I explained the situation, they would ALWAYS overnight it for free.
- clauretano 13y ago
  Very inconvenient. I wish more banks had the feature of Simple[1][2] where from the mobile app, you can lock and unlock your card at will. They emailed customers proactively regarding the Target breach and suggested that if you are really worried, you can leave your card in a locked state and then unlock it only when you need to swipe it. Since they by default send a push notification on every transaction, it'd be overkill as long as you respond quickly in the even of an unauthorized one. [1]http://www.simple.com http://www.simple.com [2]simple is fantastic for a whole host of reasons. Check them out. I'm not affiliated in any way, but have been using them as my primary bank since early on in their beta.
quaffapint 13y ago
Ironically we only used Targets Red debit card. Can only be used at target and has a pin. Of all our cards that was the 'best' one we could have used in this case. We just changed the pin, even though no pins were taken.
- webXL 13y ago
  We use that exclusively there, too. 5% off is a no brainer for how much we shop there.
thechut 13y ago
I got a notification from simple last night that said they would be sending me a new card because I shopped at Target, but that my old would still work until the new one was activated. Great service and I didn't even have to do anything. Cheers simple!
- deleted 13y ago
  [deleted]
CoachRufus87 13y ago
So is it worth replacing my debit card and updating numerous automated payments that bill it, or just closely monitor my banking activity (like I already do)?
- ansible 13y ago
  I just checked my CC account, and found a transaction at Target in that time period. I checked my other transactions, and everything was OK. However, I decided to cancel the card anyway and get it re-issued, just to be safe. I have other cards I can use, so it is not inconvenience. I feel I dodged some trouble.
- cdcarter 13y ago
  I bank with BoA and just before the breech was announced, I received an email saying that my card may have been involved in an unspecified data leak, and that a new card was in the mail. So, at least BoA is being proactive.
guan 13y ago
From the screenshot in that article, it looks like Target stored not just the credit card number, but also expiration date and full magnetic track information, including CVV1. Why in the world would they do that? I would lose a lot of sleep over if I had to store just name and card number, but at least I could see some use for that. For example, you could look up a customer’s past purchases for returns or warranty claims. Why did Target want to store the expiration date, so the card could be used on online stores that don’t check CVV2, and the magnetic track info with CVV1 so the cards can be cloned?
- NoPiece 13y ago
  That's a good question. If the thieves didn't have the CVV1, it should have been a lot harder for them use the stolen cards. I would have thought the "no store" rules should apply to both CVV1 and CVV2 to help ensure that presence of a legitimate card. -- Edit: if early reports are accurate, and the credit card data was stolen via malware on the POS machines as the cards were swiped, then it would make sense that they would capture every possible piece of data, including CVV1.
- elwell 13y ago
  You don't need the CVV unless you're in the UK (or somewhere that requires it). I've made plenty of online cc forms for US based companies that did not have include it (that doesn't sound very good now that I write it out).
  - guan 13y ago
    CVV1 is the code that is embedded in the magnetic track and allows you to swipe the card. CVV2 is printed on the back and used in many, but as you correctly point out not all, online stores.
PhantomGremlin 13y ago
Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card, KrebsOnSecurity has learned. No fucking way (pardon my French)! I haven't seen anyone comment on this yet, but doesn't this seem incredible? I.e. I don't believe it. Am I to accept that transfers of $20,000,000 to $100,000,000 ($20 to $100 times a batch of 1 million) are occuring in payment for these cards. Bullshit. I just don't believe it. This theft is now widely known. So no way that someone is going to plunk down $100,000,000 just to get a small portion of this info. Again, bullshit. IMO. It just doesn't make sense.
- unreal37 13y ago
  I think what they mean is that you can buy 100 stolen cards for $2000. And they guarantee that those 100 are still good numbers because they check them right after selling them. No one is buying them in the millions. But plenty would buy 10, 20, 50 good stolen card numbers.
tokenadult 13y ago
As I mentioned in a pair of comments in an earlier thread,[1][2] I live so close to the local Super Target (walking distance), that we end up shopping there even though we like other stores better. But from now on, we will pay only in cash, and if that limits our purchases at Target, well that's too bad for Target. [1] https://news.ycombinator.com/item?id=6934787 https://news.ycombinator.com/item?id=6934787 [2] https://news.ycombinator.com/item?id=6936175 https://news.ycombinator.com/item?id=6936175

95 points by clarkm 13y ago

seiji 13y ago

Recent stolen credit card number story: Last week I got an email saying I made a $1,000 payment on my credit card. Except, I didn't. It wasn't bill pay time of the month. I brushed it off as a well formatted spam. An hour later, it still bothered me. I logged in to check. Yup, there was a $1,000 payment recorded as of 4am my local time the same day. WTF? Oh, look, there's also fraudulent charges showing up now. How odd. It turns out: my card didn't have enough free on the credit line for the losers to buy their xbox, so they called in and requested a $1,000 payment from my bank account on file. The credit card company happily issued it, my credit limit increased by $1,000, then the guy went out and bought his xbox. While I was on the phone explaining this to the credit card company, three more fraudulent charges showed up in pre-auth. Incompetents all around (except for whoever stole my credit card number). The whole "stolen credit card number" doesn't hurt very much (since all bad charges are covered), but what really is annoying is someone getting away with purchasing things fraudulently.

kordless 13y ago
Then pile on the fact that I've tried to use my AX legitimately to buy hardware over the last month and was denied 2 separate times because it 'seemed suspicious'. Really makes you wish for a more secure payment system which can be used for such transactions.
- Jtsummers 13y ago
  I'm curious, my purchase history with my CC was generally local stores, groceries, gas, restaurants. Large purchases were rare, and then I finally bought some computer hardware (~1k purchase for the whole kit, all at once). BoA called me and confirmed it wasn't fraudulent, things went on. Then I moved and hadn't spent much in the new area (I use cash most of the time), when I finally decided to upgrade from my 13" CRT. Go into Best Buy, pay with the CC, again BoA called me and once the call was through the transaction cleared and I had my new TV. Does your CC company not call to confirm things? Were the purchases clearly out of line with your previous purchase history (by location, type or amount)?
- NoPiece 13y ago
  Someone should come up with a two factor authentication system for CC purchases. I swipe my card, then the processor pings my phone for approval. It would be great for validating tip amounts as well.
mikeash 13y ago
This makes me curious. Will your $1000 limit increase stick, or be taken back?
- seiji 13y ago
  Well, I had something like $240 free on the credit card, which wasn't enough for their xbox. They called in to issue a $1,000 payment from my bank account (on file for recurring monthly payments) to the card. The phone rep allowed it apparently. (They later said the person who called in knew my family info and passed all "security questions." I wish I could have gotten a recording of that call to see if I knew who it was.) Now, with $1,240 available on the card, they bought their xbox and other crap. As a mater of principle, I had them refund me the $1,000 I didn't authorize. They sent me a check a week later and re-adjusted all balances appropriately.
  - ams6110 13y ago
    I call BS I bet they didn't ask any security questions. I find that if you're calling to make a payment, they generally don't care who you are.
ams6110 13y ago
A good reason to NEVER link your bank account for payments on any other credit account. Also points out a security hole; normally credit card companies are a lot less concerned about verifying identity when someone wants to make a payment on an account. Here's an example of why they should.
- refurb 13y ago
  This is actually a great point, even when it comes to paying non-credit card related bills. When you authorize a business to remove cash from your bank account using ACH, it's a "withdrawal first, ask questions later" arrangement. I remember seeing a news story about a gas company who had thought a customer damaged their gas meter. They replaced it, then deducted the $1000+ cost of replacement from the customers bank account. Since the customer authorized the ACH access, they were out of luck in getting the money back right away. If they hadn't linked their bank account, they would have gotten a bill and could have figure out an arrangement before handing over any cash!
  - comrade_ogilvy 13y ago
    Exactly. When you pre-authorize money to be removed from your account, the bank will happily believe every future charge from that party. From their point of view, your emptied bank account is your problem. In fact, some banks will not even give you an effective means of removing such authorization. You may literally need a new bank account to keep your account from being emptied in the future.
    - ams6110 13y ago
      There really is no such thing as "pre-authorized" from the bank's point of view. You never tell your bank "it's OK for Utility Company Foo to debit my checking account" You give the bank's routing number and your account number to the utility or whomever. That's all they need. That information, by the way, is present in clear text on every paper check you write. The bank doesn't pre-authorize anything, nor can they block anything short of closing your account and giving you a new account number. Your protection is that presenting a fradulent check (electronic or physical) is a crime.
comrade_ogilvy 13y ago
I am ideologically opposed to ever letting money leaving my bank account, except under my close supervision with direct instructions on time and amount and to whom. That means nobody has a right to ask for money from my bank. I tell my bank whom to give money and how much. Not my credit card. Not my mortgage company. Definitely not my gym.* Nobody. Never. Therefore I never used debit cards. Wells Fargo kept sending me debit cards when my ATM card expired. I changed banks. I do not want any ambiguity about the balance in my bank. "But they promise me all kinds of protections!" That sounds nice, but there are two problems: First, you are giving up a wonderful kind of protection: the ability to walk away. If I disagree with my credit card company, I can pay what I deem correct and cancel my card. They can see me in court about the remaining balance, if they think they can win. I am whole. I still have my money in the bank account. It is approximately never going to be a problem, because the credit card companies understand the score. They have a strong incentive to play fair with an honest credit card holder. Second of all, the moment the bank/credit card company thinks something really fishy is going on, you are screwed. You know how you said you were wondering about those security questions and whether you would recognize the voice? Think carefully. If the bank suspects your nephew who stayed the weekend last month or a roommate or an ex-SO are directly involved, it all becomes your problem. The bank will not restore any funds to your account. The local police will laugh at you. And now you see the problem. The fact of your emptied bank account will not be changed, and those promises you were banking on are worthless. (Have money to hire a lawyer? That one is lose-lose.) * Private gyms love to get bill your bank account and be authorized for automatic payment. The thing most people do not realize is most banks consider this to be completely and totally your problem now. If you cancel your gym membership, and the gym makes a "mistake" and keeps billing you, the bank will not help you. In fact, some banks will tell you that your only recourse (from their POV) is to get a new bank account to protect yourself in the future. Those "mistakes"? Your problem.
- dredmorbius 13y ago
  Most gyms will also happily give you a discount (often substantial) if you pay cash (or check) in advance. Typically a year, you might be able to talk them into 6 months. I frankly prefer not having to either deal with the automatic deduction or remembering to cut a check every month.

joshmlewis 13y ago

I had an interesting thing happen a few months ago. I kept having my credit card used for fraudulent charges, but they weren't buying TVs or electronics, just small purchases at Dollar General and gas stations in Texas. I was really confused. So I had the card cancelled and another issued, and there again it was being used in another state. This happened three times within a couple months. I have no idea how or why as I'm very careful purchasing things online and in person. I finally changed my PIN and it stopped. I don't know why or how they were using my card with my pin, but either by coincidence or luck that fixed it.

callmeed 13y ago

Personal anecdote and tips: I had my debit card skimmed at a local gas station in October. Within a couple hours, it was being used at stores in Los Angeles. I live a 3+ hour drive from LA so there's no way the skimmer/data was physically taken down there–the data had to have been transferred (cell?) to someone down there pretty quickly. My card was used at a restaurant and a few different stores, but several times per store. Total amount charged was about $2K. All purchases were < $100 and most purchases were for very even amounts at drug stores. Based on research, this is because buying gift cards is a favorite use of stolen cards. Gift cards can be turned into cash online for about 75-85 cents on the dollar. Chase was very good about freezing the card and crediting back all the fraudulent charges. TIPS: - Use cash or a gas card for gas OR at the very least, use a pump close to the cashier - Debit cards have a reputation for having less protection than credit cards. At least at Chase, this is no longer true. Chase has zero-liability for unauthorized debit card purchases [1] - Check your online banking often - Don't rely on your bank's automated fraud detection. Most alerts I've received from Chase have been false positives (legitimate purchases while traveling). [1] https://www.chase.com/checking/debit-cards https://www.chase.com/checking/debit-cards

MartinCron 13y ago
I've also had plenty of false positives, but my bank (Bank Of America) has caught multiple actual fraudulent charges. It's easy to hate on big banks and big data and the loss of privacy, but it's pretty cool when your bank calls you up and says "We don't think that was you buying skateboards and polo shirts in Eastern Europe."
- comrade_ogilvy 13y ago
  I have had this happen a couple time. I got a call one Saturday morning asking about 3 recent charges, including a Men's Warehouse in Waikiki. My response: "You are calling me at my California home number. I WISH I were in Waikiki right now. How about you reverse everything today and send me a new card in the mail?"
  - MartinCron 13y ago

deleted 13y ago

[deleted]

nnnnni 13y ago

So... What's the best way to find out if your card was caught up in the breach?

HillRat 13y ago
Yeah, I used two cards and one of them already got smurfed (I put on block on the other one as a prophylactic measure). At this point, if you used a card at any Target in the affected time period, just assume your card has been sold and is going to get used. This is going to get macroeconomically expensive, I think.
giant 13y ago
If you used your card at Target between Nov. 27 and Dec. 15, you were caught up in the breach.
takeda64 13y ago
Here: http://paulsparrows.files.wordpress.com/2011/06/ismycreditcardstolen4.png http://paulsparrows.files.wordpress.com/2011/06/ismycreditca... Your question reminded me of this and I see someone already responded. In any case you should get a new card if there was a chance you were affected.

terhechte 13y ago

I was just thinking whether I had ever bought anything at Target, and then remembered, yes, but that's 7 years ago, and I've gotten new credit cards since. But then I wondered which other online services I had used with my credit card, and it occurred to me how awesome it would be if I had one-time throw-away credit cards, that I could use for only one purchase at one retailer and then throw it away. Now, I know that gift cards work this way, and could theoretically be used in such a way, but they're usually locked to a specific retailer or one can't use them for online purchasing. Then I realised that, really with all the flack it is getting, Bitcoin is such a solution. Once the conversion from $ to BTC is done, there's no way to get your credit card data or anything. You're practically immune against any data theft at the place where you're purchasing. Now, of course the problem only shifted as you have to guard your private keys now, but that's more or less a question of tooling and usability of proper BTC clients (which hopefully come up in the future). I'd rather have the valuable information stored in an open source application used by millions with strong code review, than in a closed source web app where an intern wrote the code in php and forgot the salt or stored everything plaintext. This alone sounds to me like a pretty strong incentive.

tpurves 13y ago
See this announcement earlier this year from the major card networks: http://cardnotpresent.com/news/cnp-news-oct13/Amex,__MasterCard,_Visa_Propose_Tokenization_Standard_for_Digital_Commerce_-_Oct__3,_2013/ http://cardnotpresent.com/news/cnp-news-oct13/Amex,__MasterC...
mikeyouse 13y ago
Meh.. My Citi Card has one-time use codes with the benefit of the normal protections of having a credit card (insurance, fraud prevention, customer service, etc). This problem is solved for people that care to solve it. I'm not trying to shill for Citi, I'm actually dropping them for other BS, but I assume other cards have it as well. [1] - https://www.citibank.com/us/cards/gen-content/messages/van/index.htm https://www.citibank.com/us/cards/gen-content/messages/van/i...
- wehadfun 13y ago

robomartin 13y ago

My wife shopped at Target twice, both times outside of the period given for the breach. I think we are still going to get the cards replaced just to err on the side of prudence. I find myself wondering how this might affect Target. I almost never shop there myself. My wife, on the other hand, might have shopped there once a month or once every couple of months. Yesterday she told me she is not going back. Ever. There have to be other people on the same boat. It'll be interesting if they ever release information on how exactly the breach was orchestrated. My biggest question is about all of that data moving about Target's distributed system without any encryption whatsoever. At least that's what it sounds like. The data capture had to be done at some central point in their infrastructure in order to affect some 1,800 stores. Again, all of that data from 1,800 stores got to a central repository of some sort completely unprotected? Why isn't that information stored and limited to the within the walls of each store? It'd sure limit the exposure, well, a factor of 2,000. Anything leaving the walls of a store needs to be encrypted. Perhaps someone with more experience in brick-and-mortar payment infrastructures of this kind can comment on this?

Duhck 13y ago
At the very least, I believe they are responsible for paying the credit card companies to replace the stolen cards. I can't find my source on this, but I do remember a few times that a retailer was held fiscally responsible for new card distribution.
r00fus 13y ago
People will go back. They may make promises, but then find justifications to soften their resolve. It happens every day. Target is just too large to really be impacted in the long run - however it's going to have a nice impact on their current holiday season.
toast0 13y ago
My guess is that they run all the stores through a centralized payment system. Encrypted in transit or not, the payment system needs the details in plain text to send to the payment processor. At or near the payment processing is where the information was likely copied. The information can't only stay within the store, because purchases from one Target may be returned at any Target, and they may look up receipts by credit card used. At Target's scale, it makes more sense to do a centralized lookup (or local + centralized), rather than a query to every store.

munger 13y ago

I bought something from Target in this window with a credit card (Wells Fargo). I called them up to proactively report it stolen - the problem is they will immediately deactivate your current card and it takes 7-10 business days for the new one to show up. It is not possible to get a 2nd card number without deactivating the first (to avoid a no-card for 2 weeks situation). Or you can have them overnight it to you for $16. Kind of annoying to pay $16 for a merchant error, or to not have your primary card for 2 weeks during the holiday season (and also the card you use to pay all service bills like cable tv, internet, city/trash/water etc). Ultimately I decided to do nothing and just keep a close eye on account activity until January when it is less inconvenient to wait for the new one.

jisaacks 13y ago
I also have Wells Fargo. Whenever I have lost a card in the past (It used to actually happen a lot - I usually left them in ATMs). They would do what you said, only I could go in to any WF location and get a temp card until my new one arrived in the mail. If I was not near any WF location and I explained the situation, they would ALWAYS overnight it for free.
clauretano 13y ago
Very inconvenient. I wish more banks had the feature of Simple[1][2] where from the mobile app, you can lock and unlock your card at will. They emailed customers proactively regarding the Target breach and suggested that if you are really worried, you can leave your card in a locked state and then unlock it only when you need to swipe it. Since they by default send a push notification on every transaction, it'd be overkill as long as you respond quickly in the even of an unauthorized one. [1]http://www.simple.com http://www.simple.com [2]simple is fantastic for a whole host of reasons. Check them out. I'm not affiliated in any way, but have been using them as my primary bank since early on in their beta.

quaffapint 13y ago

Ironically we only used Targets Red debit card. Can only be used at target and has a pin. Of all our cards that was the 'best' one we could have used in this case. We just changed the pin, even though no pins were taken.

webXL 13y ago
We use that exclusively there, too. 5% off is a no brainer for how much we shop there.

thechut 13y ago

I got a notification from simple last night that said they would be sending me a new card because I shopped at Target, but that my old would still work until the new one was activated. Great service and I didn't even have to do anything. Cheers simple!

deleted 13y ago
[deleted]

CoachRufus87 13y ago

So is it worth replacing my debit card and updating numerous automated payments that bill it, or just closely monitor my banking activity (like I already do)?

ansible 13y ago
I just checked my CC account, and found a transaction at Target in that time period. I checked my other transactions, and everything was OK. However, I decided to cancel the card anyway and get it re-issued, just to be safe. I have other cards I can use, so it is not inconvenience. I feel I dodged some trouble.
cdcarter 13y ago
I bank with BoA and just before the breech was announced, I received an email saying that my card may have been involved in an unspecified data leak, and that a new card was in the mail. So, at least BoA is being proactive.

guan 13y ago

From the screenshot in that article, it looks like Target stored not just the credit card number, but also expiration date and full magnetic track information, including CVV1. Why in the world would they do that? I would lose a lot of sleep over if I had to store just name and card number, but at least I could see some use for that. For example, you could look up a customer’s past purchases for returns or warranty claims. Why did Target want to store the expiration date, so the card could be used on online stores that don’t check CVV2, and the magnetic track info with CVV1 so the cards can be cloned?

NoPiece 13y ago
That's a good question. If the thieves didn't have the CVV1, it should have been a lot harder for them use the stolen cards. I would have thought the "no store" rules should apply to both CVV1 and CVV2 to help ensure that presence of a legitimate card. -- Edit: if early reports are accurate, and the credit card data was stolen via malware on the POS machines as the cards were swiped, then it would make sense that they would capture every possible piece of data, including CVV1.
elwell 13y ago
You don't need the CVV unless you're in the UK (or somewhere that requires it). I've made plenty of online cc forms for US based companies that did not have include it (that doesn't sound very good now that I write it out).
- guan 13y ago
  CVV1 is the code that is embedded in the magnetic track and allows you to swipe the card. CVV2 is printed on the back and used in many, but as you correctly point out not all, online stores.

PhantomGremlin 13y ago

Credit and debit card accounts stolen in a recent data breach at retail giant Target have been flooding underground black markets in recent weeks, selling in batches of one million cards and going for anywhere from $20 to more than $100 per card, KrebsOnSecurity has learned. No fucking way (pardon my French)! I haven't seen anyone comment on this yet, but doesn't this seem incredible? I.e. I don't believe it. Am I to accept that transfers of $20,000,000 to $100,000,000 ($20 to $100 times a batch of 1 million) are occuring in payment for these cards. Bullshit. I just don't believe it. This theft is now widely known. So no way that someone is going to plunk down $100,000,000 just to get a small portion of this info. Again, bullshit. IMO. It just doesn't make sense.

unreal37 13y ago
I think what they mean is that you can buy 100 stolen cards for $2000. And they guarantee that those 100 are still good numbers because they check them right after selling them. No one is buying them in the millions. But plenty would buy 10, 20, 50 good stolen card numbers.

tokenadult 13y ago

As I mentioned in a pair of comments in an earlier thread,[1][2] I live so close to the local Super Target (walking distance), that we end up shopping there even though we like other stores better. But from now on, we will pay only in cash, and if that limits our purchases at Target, well that's too bad for Target. [1] https://news.ycombinator.com/item?id=6934787 https://news.ycombinator.com/item?id=6934787 [2] https://news.ycombinator.com/item?id=6936175 https://news.ycombinator.com/item?id=6936175