February 11, 2006 8:47 PM PST

Web of intrigue widens in debit-card theft case

An investigation into thousands of compromised debit cards that was widely reported this week appears to involve two of the nation's largest retailers, according to multiple law enforcement and banking sources.

This week, two major banks joined a credit union in canceling a combined 200,000 accounts belonging to debit-card holders. In letters to affected customers, Bank of America and Washington Mutual said they were canceling debit cards because of a security breach at a "third-party" location. Officials from both banks and law enforcement agencies have refused to identify the location.

Sources now say that the case might involve two separate retail chains--one which has ackowledged a problem and another whose possible role is uncertain.

After receiving a call from CNET News.com about the investigation into the 200,000 canceled credit cards, a Wal-Mart media representative refused to answer questions but called attention to a statement released by the company on Dec. 2, 2005. In the statement, Wal-Mart acknowledged that credit cards used by some customers who bought gas at the company's Sam's Club stations between Sept. 21, 2005, and Oct. 2, 2005, were compromised. Many Sam's Clubs also accept debit cards.

There are more than 500 Sam's Clubs in the United States, according to information on Walmart.com, but it is unclear how many sell gas. The December statement also did not say whether the security breach was restricted to any region.

"The investigation began when the credit card issuers reported that some cardholders were reporting fraudulent charges on their statements," Wal-Mart said in its press release. "It is still in its preliminary stages, with no determination on how the data was improperly obtained."

Bentonville, Ark.-based Wal-Mart also said it had reported the case to the U.S. Attorney?s Office and the Secret Service.

But the trail doesn't end with Wal-Mart, said sources close to the investigation. As investigators began to look into the recent rash of unauthorized charges, they found that a large number of people whose debit cards were compromised had one thing in common: they previously had shopped at office-supply chain OfficeMax, said a banking source familiar with the case. Two law enforcement sources also said OfficeMax is part of the investigation but did not provide details.

None of the sources, who requested anonymity due to the ongoing investigation, knew for certain whether OfficeMax had suffered a security breach.

"We have not suffered any security breach to our knowledge," OfficeMax spokesman William Bonner said Friday.

According to one banking official close to the case, OfficeMax has been queried by at least one financial institution about the matter.

"This is why we don't reveal the names to the public," said the banking official who requested anonymity. "We're not sure which customers may have been ripped off in the Wal-Mart deal or whether OfficeMax was the problem."

The case is being investigated by the FBI and Secret Service, said FBI Special Agent John Cauthen, who works out of the bureau's Sacramento office. Cauthen declined to comment on Wal-Mart or OfficeMax.

Cauthen said Friday the FBI is working on a debit-card fraud case that was first reported by The Sacramento Bee last November. In that case, the Golden 1 Credit Union canceled about 1,500 debit cards after being alerted to possible fraud in the Sacramento area.

The credit union told customers that the fraud resulted in "counterfeit cards being made and used internationally." Golden 1 told the Bee that it closed accounts after discovering unauthorized withdrawals at ATMs in Great Britain, Russia and South Korea. Golden 1 also said that not all the debit cards cancelled had unauthorized withdrawals on them, but all were used at an unidentified Sacramento business in the fall of 2005.

Someone working for that merchant is suspected of pilfering account and personal identity numbers from the cards, the Bee reported.

See more CNET content tagged:
OfficeMax Inc., debit card, security breach, Wal-Mart Stores Inc., Bank of America Corp.

12 comments

Join the conversation!
Add your comment
Debit Cards Not Protected
Can anyone explain why you are not protected from fraudulent use of a VISA Debit card like you are from unauthorized charges on a VISA credit card, even if issued by the same bank?

We encountered this problem when, after my wife used a debit card for a charge that was supposed only to be $6.95 from Video Professor, they q
Posted by Transaction7 (30 comments )
Reply Link Flag
It depends on the bank issueing the card...
Federal law requires protection for Credit Cards; however the same protection is not required for debit cards. Debit cards with Visa and MasterCard logos came into popular use since the law was enacted. Despite this, some banks DO give debit cards the same protections as credit cards. My bank, a small local bank, will issue credit charge backs on my Visa debit card if I claim that the charge is fraudulent. Of course, it may have something to do with the fact that the card is tied directly to my overdraft protection account that is simply a revolving credit account (just like a credit card) that deposits only into my checking account if there are not enough funds in checking to handle the transaction.
Posted by Shoa_Creek (79 comments )
Link Flag
Debit Cards Not Protected
Can anyone explain why you are not protected from fraudulent use of a VISA Debit card like you are from unauthorized charges on a VISA credit card, even if issued by the same bank?

We encountered this problem when, after my wife used a debit card for a charge that was supposed only to be $6.95 from Video Professor, they q
Posted by Transaction7 (30 comments )
Reply Link Flag
It depends on the bank issueing the card...
Federal law requires protection for Credit Cards; however the same protection is not required for debit cards. Debit cards with Visa and MasterCard logos came into popular use since the law was enacted. Despite this, some banks DO give debit cards the same protections as credit cards. My bank, a small local bank, will issue credit charge backs on my Visa debit card if I claim that the charge is fraudulent. Of course, it may have something to do with the fact that the card is tied directly to my overdraft protection account that is simply a revolving credit account (just like a credit card) that deposits only into my checking account if there are not enough funds in checking to handle the transaction.
Posted by Shoa_Creek (79 comments )
Link Flag
Get an Amercian Express card
Get an American Express charge card. The annual fee is well worth the protection you get.
American Express has an outstanding track record of protecting its card holders from fraudulent charges.
I have received nothing but outstanding, quick and excellent service from them at many occasions.

I am not affiliated with AMEX in any way, just a very satisfied customer.

Alexander Riedel
Posted by AlexRiedel (24 comments )
Reply Link Flag
$Cash, $Cash, $Cash
I use cash for any purchase under $100, including buying gas and stationary, and boy am I glad I do. The onerous for these breaches always seems to be on the cardholder. So much for the "convenience" factor of plastic.
Posted by Stating (869 comments )
Link Flag
Get an Amercian Express card
Get an American Express charge card. The annual fee is well worth the protection you get.
American Express has an outstanding track record of protecting its card holders from fraudulent charges.
I have received nothing but outstanding, quick and excellent service from them at many occasions.

I am not affiliated with AMEX in any way, just a very satisfied customer.

Alexander Riedel
Posted by AlexRiedel (24 comments )
Reply Link Flag
$Cash, $Cash, $Cash
I use cash for any purchase under $100, including buying gas and stationary, and boy am I glad I do. The onerous for these breaches always seems to be on the cardholder. So much for the "convenience" factor of plastic.
Posted by Stating (869 comments )
Link Flag
No protection!
This tale shows, there is no protection to any customer, of any corporation, as they are too cheap, to provide any halfway decent security, on a voluntary basis, in the profits first customer last age!

Security and corporate data regulations are required, with FTA, fining a minimum USD$100,000-00 per individual incident reported and USD$1 million if unreported!, in addition all those affected are to be paid a minimum of USD$10,000-00 each! as an incentive to do better!

Until such time legal penalties apply,to both corporations and their shareholders inclusive, they will only pay lip service to data security, and have no incentive to change!
Posted by heystoopid (691 comments )
Reply Link Flag
No protection!
This tale shows, there is no protection to any customer, of any corporation, as they are too cheap, to provide any halfway decent security, on a voluntary basis, in the profits first customer last age!

Security and corporate data regulations are required, with FTA, fining a minimum USD$100,000-00 per individual incident reported and USD$1 million if unreported!, in addition all those affected are to be paid a minimum of USD$10,000-00 each! as an incentive to do better!

Until such time legal penalties apply,to both corporations and their shareholders inclusive, they will only pay lip service to data security, and have no incentive to change!
Posted by heystoopid (691 comments )
Reply Link Flag
Well....something is going on online as well. My Online banking was breached???? B of A blocked my online banking account this morning and when I called ...made up excuses that didn't make sense. I had to create a new online name and password...and now I am back up. But they are not owning what happended. So what did happen B OF A???
Posted by wilemore (1 comment )
Reply Link Flag
Check out VIRGIN MOBILE's auto top-up feature. they were able to get 13 charges to go through on my B of A debit card. Each charge was only $4.99 each so I guess B of A and Virgin Mobile had a deal worked out. I couldn't even buy a pack of gum the same weekend with their debit card AND THEN>>>> the bank charged $34 for each "overdraft". That's $442 they wanted, needless to say I disagreed and they closed my account putting a black mark on my banking history. NOW TELL me who is stealing from who!!!! VIRGIN MOBILE should have a class action lawsuit and be heavily fined along with B of A for this theft from customers. BANKS are nothing but immunized from prosecution theifs. Oh, by the way my son service a private jet that flew 4 GM executives from CA to Burlington VT last week for the paltry sum of $68,000 (What ever happened to first class, coach or business) PLEASE SEND MY BAILOUT TO ME NOW 500 million should do me nicely! Thanks UNCLE SAM
Posted by APWROBEL (1 comment )
Reply Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.