Credit Cards

Cracking down on data theft is kind of like squeezing a balloon: press down on a bulge in one area, and it'll only swell somewhere else.

So perhaps it's no surprise that today's Wall Street Journal reports the distressing statistic that, while brick-and-mortar merchants have been cracking down on data fraud at the checkout counter, criminals responded by attacking automatic teller machines, targeting not just bank-owned ATMs but the independently owned “cash kiosks” common in shopping malls, restaurants and other businesses.

(And that's not even counting the prevalence of hidden “skimmers” used to steal data from any ATM card swiped through them.)

Relatively easy

For a thief equipped with the right tools, it's relatively easy to steal debit card information and make counterfeit debit cards, which are then used to steal money from ATMs. The Journal said that according to FICO, the credit-scoring and analytics firm, the period spanning from January to April 9, 2015 saw more debit-card ATM attacks than any previous period in the past 20 years:

Debit-card compromises at ATMs located on bank property jumped 174% from Jan. 1 to April 9, compared with the same period last year, while successful attacks at nonbank machines soared by 317%, according to FICO. … The company declined to disclose the total number of such incidents, citing contractual restrictions with its customers.

ATM fraud has been growing overseas, too. Just last week, we reported the discovery of a new form of ATM fraud plaguing banks in Britain: thieves armed with nothing more than an iPod and a piece of plastic can spy on would-be ATM customers, steal their passcode and arrange for the machine to “eat” their cards – which are then retrieved and used to drain money from the account while the victim contacts bank personnel about their apparently faulty ATM. However, that form of fraud involves stealing and using legitimate ATM cards, not making counterfeit cards as reported by FICO.

It's important to remember that from an individual cardholder's perspective, debit card fraud is much worse than credit card fraud, because debit cards withdraw money directly from your savings accounts, whereas credit card purchases essentially borrow money from the credit card company.

This means that even if your debit-card fraudulent-charge complaint is ultimately settled in your favor, with the bank ultimately making full restitution to you – you still have to go without your money while the matter is being resolved.

If you do have a debit card, even if you're convinced that your account numbers are safe from thieves, you still need to check your account activity on a regular basis, whether you've used the card recently or not, so that if fraudulent withdrawals do occur, you can report them to your bank as soon as possible.

October 1 is an important date for businesses that accept credit cards. That's when a new rule takes effect, shifting the liability for fraudulent credit card purchases from the banks to the business making the sale, if it has not installed EMV chip card technology.

Unfortunately, a survey by Wells Fargo shows small businesses, by and large, are not only unprepared – they aren't aware of what's coming.

In its quarterly Small Business Index Survey, just 49% of small business owners who accept point-of-sale card payments today report being aware of the impending liability shift, when a card issuer or merchant that does not support EMV chip card technology will assume liability for any fraudulent point-of-sale card transactions.

Financial institutions have been sending their customers new EMV chip-enabled credit and debit cards. These cards are designed to protect against fraudulent transactions by encoding cardholder information within an encrypted microchip and data that changes with each transaction.

For the cards to work, merchants must convert to new card readers or add EMV capability to their existing magnetic stripe card reader payment terminals. That costs money.

Only 31% compliance

With only three months remaining before the deadline, Wells Fargo and Gallup, which conducted the survey, found that only 31% of small business owners said that their existing credit card processing system accepts chip-enabled cards.

When asked if they plan to upgrade their point-of-sale credit card terminals to accept EMV chip cards, just 29% said they would before the Oct. 1 deadline. Another 34% said they will at some point in the future after October. Twenty-one percent said they never plan to upgrade.

"While our industry has made great progress in the last year informing and preparing small business owners for the EMV liability shift, the survey findings show us that we have more work to do," said Debra Rossi, head of Wells Fargo Merchant Services.

The bank said it is trying to build awareness, prepare small businesses for the EMV liability shift, and encourage business owners to adopt EMV chip-card technology. It has been providing EMV-capable equipment to customers since 2012.

It said all new and re-issued Wells Fargo Business Credit Cards and Business Elite Cards provided to customers are chip-enabled.

Card issuers take the lead

In fact, card issuers have been well ahead of businesses in adopting the EMV technology. Visa and Mastercard announced last year that they had formed a “new cross-industry group focused on enhancing payment system security” to spearhead adoption of the new technology, which has been in use in Europe for years.

Despite the split between businesses that intend to upgrade their payment terminals to accept EMV chip cards and those that don’t, small business owners seem to agree on one thing: when consumers buy something, they told the Wells Fargo survey takers, they prefer customers pay with cash or a check.

Why are there so few chip-enabled card readers at retailers around the country? It depends on who you ask. The nation's retailers say they've done their jobs – it's the credit card companies that have dropped the ball.

The National Retail Federation (NRF) points to a survey that found 48% of retailers have implemented the new EMV chip card system, or are expected to within weeks. A total of 86% said they expected to be EMV compliant by the end of 2016.

But the NRF said the survey also found that 57% of the retailers who had not yet implemented the new system had installed the card readers, but were waiting for certification by the credit card industry. About 60% said they had been waiting for six months or longer.

NRF says those numbers are in sharp contract to the statistics issued by the banking industry, which it says has tried to shift blame for the slow start to retailers. The survey, NRF says, found retailers are eager to begin using the chip card system since it protects them from liability connected to fraud.

Certification process

The certification process for the chip card system checks out a number of important functions to ensure the new technology is working properly. It can be a complicated process because the system must check out across multiple card platforms, including MasterCard, Visa, American Express, and Discover.

The size of the retailer can also complicate things. Big retailers with more point of sale positions take a lot more time.

Hundreds of tests may be required and the process might take two weeks or eight months. The cost to the retailer might be as little as a few hundred dollars or could run into the tens of thousands of dollars.

Visa says it's helping

Visa, meanwhile, recently announced steps it said could help speed up the implementation of the chip card technology. It said it has streamlined testing requirements, made the certification process simpler, and made commitments to improve the technology. It also said it is changing its policy to help limit exposure to counterfeit fraud liability for merchants who are not yet chip-ready.

While retailers might feel frustration at the pace, Visa maintains that progress has been “significant,” with over 300 million chip cards in the hands of consumers and 1.2 million retail locations now equipped to accept them.

But the NRF said it is disappointed the credit card industry has not provided enough personnel to make sure certification happens in a timely manner. In the meantime, it says consumers are confused as to whether they continue to swipe their cards or begin “dipping.”

Carrying a lot of cash is dangerous. Criminals may take it and so may the cops, who increasingly view having a lot of cash as evidence of wrongdoing. But now, police have added a new twist -- they've started using a scanner that lets them swipe the money right off prepaid cards.  

The device is called an ERAD -- Electronic Recovery and Access to Data machine, and Oklahoma's state police began using 16 of them last month. Hundreds of other police departments around the country are also using the device but haven't fessed up to it. 

It's all pretty simple. If a state trooper or other police officer suspects you are tied to some type of crime, he can scan your prepaid cards and seize the money on them. No formal charges, no trial, no due process.

It's an extension of a long-standing practice of shaking down anyone police think is suspicious. All too often, as the Washington Post demonstrated in a Pulitzer Prize-winning investigation a few years ago, all you need to do to look suspicious is have a lot of money.

"Different factors"

The police, of course, say the process is completely straightforward.

"We're gonna look for different factors in the way that you're acting,” Oklahoma Highway Patrol Lt. John Vincent said, according to a Washington Post report. “We're gonna look for if there's a difference in your story. If there's some way that we can prove that you're falsifying information to us about your business."

Of course, when Lt. Vincent says police will "prove" you're falsifying information it doesn't mean they'll prove it in court, where you can confront the witnesses and challenge the evidence. And that's what has critics upset.

State Sen. Kyle Loveless (R-Oklahoma City) said he will introduce legislation in the next session of the state legislature that will require a conviction in a court of law before anyone's assets are seized.

"If I had to err on the side of one side versus the other, I would err on the side of the Constitution,” Loveless said. “And I think that's what we need to do."

Loveless said there have been too many documented cases of abuse in Oklahoma to allow police to continue treating citizens as criminals without benefit of trial.

"We've seen single mom's stuff be taken, a cancer survivor his drugs taken, we saw a Christian band being taken. We've seen innocent people's stuff being taken. We've seen where the money goes and how it's been misspent," Loveless told a local television station.

Where it goes

As for what happens to the money seized with ERAD, 7.7% of it goes to the ERAD Group, a Texas-based company. The rest? Oklahoma Watch, an investigative journalism organization, says records show that in one recent year, 70% of all forfeiture amounts were used to fund salaries for law enforcement. 

Oklahoma law currently allows police and prosecutors to keep the money they take from citizens, even those who are never convicted or indicted, so those victimized by modern-day highway robbers basically have no recourse.

The Post's series caused a stir when it was published, but progress in cleaning up the practice has been slow. New Mexico, Montana and New Hampshire recently passed laws requiring a conviction before property can be forfeited, although the Post says New Mexico police routinely ignore the law.

The ERAD devices, by the way, can strip money off prepaid cards, but they can also decipher quite a bit of information from the magnetic strips on credit and debit cards, information police could conceivably use to track down and swipe additional assets.

ERAD claims its devices are an invaluable tool in fighting money laundering. 

"Each year, there are about $120 billion dollars moved to Mexico, Iran, Colombia, China as well as others as a result of illicit activity in the US," ERAD says on its website. "Prepaid debit cards are becoming the preferred process to move funds for pick up in these countries."

No right to privacy

ERAD CEO T. Jack Williams claimed recently at a conference that American citizens have no right to privacy when it comes to magnetic encoding on their cards, Oklahoma Watch reported.

“Prepaid cards are cash, they are not bank accounts,” Williams said. He claimed that prepaid cards are not protected by the Bank Secrecy Act and are not protected by the Constitution's Fourth Amendment protections against unreasonable search and seizure.

Brady Henderson, legal director for ACLU Oklahoma, says that's debatable and predicted Oklahoma's Department of Public Safety will find itself facing legal challenges to warrantless search and seizures using ERAD.

The situation is not unique to Oklahoma. The ERAD devices are in use around the country by "hundreds" of police agencies, Williams said, although he refused to give an exact number or name any of the police departments using the devices. 

JPMorgan Chase will pay $100 million to settle allegations that it committed debt-collection abuses against tens of thousands of its credit card holders, California Attorney General Kamala D. Harris announced today.

The settlement specifically addresses debt collection wrongdoing that includes collecting incorrect amounts, selling bad credit card debt, and running a debt collection mill that involved illegally “robo-signing” thousands of court documents and improperly obtaining default judgments against military servicemembers.

As part of the settlement, Chase will pay $50 million in restitution to consumers nationwide, including an estimated $10 million to California consumers, and significant restitution to servicemembers in California, some of whom were on active duty when Chase obtained illegal default judgments against them. 

Chase will also pay $50 million in penalties and other payments to California, through the Office of the Attorney General. The judgment includes injunctive terms that fundamentally change Chase’s credit card debt-collection practices to prevent similar misconduct in the future, and is subject to court approval.

“Abusive and illegal debt collection practices will not be tolerated in California,” Harris said. “This settlement provides real relief to tens of thousands of Californians, including servicemembers, and prevents JPMorgan Chase from continuing  these deceptive and illegal debt collection practices.”

Robosigners

Between 2009 and 2013, Chase filed more than 125,000 credit card collection lawsuits against California consumers relying on illegally robo-signed sworn documents and provided an additional 30,000 robo-signed sworn statements in support of lawsuits filed against California consumers by third-party debt-collectors, Harris said. 

Chase also made systematic calculation errors regarding the amounts owed, and sold “zombie debts” to third-party debt-collectors that included accounts that were inaccurate, settled, discharged in bankruptcy, not owed, or otherwise not collectable, she said.

The Attorney General’s investigation and litigation further revealed that Chase sent letters to consumers that contained illegal threats and were signed by attorneys who did not review the accuracy of the information, determine if litigation was appropriate, or intend to follow through on some of the threats made.

Chase also filed false declarations regarding military service and improperly obtained default judgments against servicemembers on active duty, in violation of the Servicemembers Civil Relief Act and the California Military and Veterans Code.

Travelers beware: it looks like hackers managed once again to steal credit or debit card data from the hotel franchise firm White Lodging Services Corporation, specifically a handful of Marriott properties which White Lodging owns.

Security blogger Brian Krebs said that multiple financial institutions have noticed a pattern of fraudulent charges on cards which appear to share one trait in common: all had been used at a White Lodging-owned Marriott. (White Lodging, meanwhile, says it is investigating, but has found no sign of a new breach.)

If confirmed, this security breach would be the second one to be discovered at White Lodging properties in a little over a year. In January 2014, information came to light suggesting that hackers had managed to lift customer information from various White Lodging properties throughout most of 2013 – not just White Lodging-owned Marriotts, but certain hotels under the names Hilton, Sheraton and Westin, as well.

Now, 13 months later, Krebs' sources in financial institutions are once again seeing evidence of security breaches at many of the same White Lodging-owned hotel properties hit before:

Banking sources say the cards that were compromised in this most recent incident look like they were stolen from many of the same White Lodging locations implicated in the 2014 breach, including hotels in Austin, Texas, Bedford Park, Ill., Denver, Indianapolis, and Louisville, Kentucky.  Those same sources said the compromises appear once again to be tied to hacked cash registers at food and beverage establishments within the White Lodging run hotels. The legitimate hotel transactions that predated fraudulent card charges elsewhere range from mid-September 2014 to January 2015.

Contacted about the findings, Marriott spokesman Jeff Flaherty said all of the properties cited by the banks as source of card fraud are run by White Lodging.

So if you've stayed at a White Lodging-run Marriott hotel in the past few months – or if you merely had a drink in the hotel bar or dined in the hotel restaurant – keep an extra-sharp eye out for indications that the card you used for payment has been compromised.

“All it takes is a single insider at a company … to set an identity theft ring in motion.” That comment from Manhattan District Attorney Cyrus Vance illustrates how easy it is to have your identity stolen — or how impossible it is to avoid it.

Vance's office announced today that it had indicted five people on a total of 394 counts, for allegedly belonging to an identity theft ring that stole the identities of patients at a Manhattan dental office, and used them to fraudulently buy Apple gift cards which in turn were used to buy Apple merchandise.

According to the indictment, Annie Vuong spent six months in 2012 working as a receptionist in a dentists' office. During that time, she allegedly copied the personal identifying information of more than 250 patients, including their names, brithdays, addresses, and Social Security numbers.

Vuong then allegedly emailed the information to Devin Bazile, a former sales associate at Apple, who allegedly used the data to apply for and receive “instant credit.” The indictment also claims that three additional employees from Apple stores helped take part in the scheme.

Common scheme

In all, the group is accused of buying more than $700,000 worth of fraudulent Apple gift cards.

“Using stolen information to purchase Apple products is one of the most common schemes employed by cybercrime and identity theft rings today,” Vance said. “We see in case after case how all it takes is single insider at a company – in this instance, allegedly, a receptionist in a dentists’ office – to set an identity theft ring in motion, which then tries to monetize the stolen information by purchasing Apple goods for resale or personal use.”

Coincidentally, District Attorney Vance's office made the announcement less than one day after the Anthem insurance company admitted that hackers had successfully breached a database holding the personal information of 80 million current and former Anthem customers.

Of course, the Anthem breach impacts exponentially more people than does this small identity-theft ring which allegedly targeted a relative handful of dental patients in Manhattan. (Statistically, there's a good chance at least one of those patients had medical coverage through Anthem, too, because rare indeed is the modern American who only needs to worry about one level of identity theft.)

But those 80 million Anthem customers and couple hundred Manhattan dentists' patients have this in common: their personal information made it into the hands of thieves, yet there was nothing those customers could've done to prevent it. A chain is only as strong as its weakest link, and your personal information is only as secure as the least-secure company that has it.

Oenophiles be warned: hackers have apparently breached security and managed to steal customer payment-card data from Missing Link Networks, Inc., a card processor and point-of-sale (POS) vendor serving a number of wineries primarily in northern California.

The hackers were able to steal information about payment card transactions during the month of April 2015.

Security expert Brian Krebs first investigated such claims earlier this week, when one of his sources at an unnamed Sonoma winery told him that the winery's POS processor, provided by Missing Link, had been breached. Today, Missing Link CEO and founder Paul Thienes released a statement confirming the problem:

Beginning on May 27, 2015, we began notifying our winery customers that eCellar Systems, our consumer-direct sales platform, had been breached during the month of April, 2015 by an unknown intruder. To that end, each of our winery clients will be sending out notice of this event to their customers and it is likely that individual consumers may receive a similar notice from multiple wineries.

Anytime you hear about a single hacking incident affecting many different businesses (such as wineries) rather than a single company, that usually indicates a POS rather than a database breach. Rather than break into a company's database to steal whatever information might be in its computer files, the hackers will somehow manage to plant malware on the point-of-sale systems that handle electronic payments, and can then steal whatever information is used to conduct further transactions on the affected systems.

Think of it as the business-payment-systems equivalent of keylogging malware on a regular computer: it can't read your previously saved files, but it does read and record everything you type from the point of infection onward.

Regarding the POS breach at Missing Link Networks, Thienes went on to say that the hackers “gained access to customer names, credit/debit card numbers, the related billing addresses, and any dates of birth in our system during the window of April 1st through 30th this year,” but “did not have access to any driver license numbers, Social Security numbers, CVV verification numbers, or PIN numbers (data which we would typically not collect anyway).”

The FBI has joined the discussion of the new EMV, or chip cards that are replacing credit and debit cards in the U.S.

“While EMV cards offer enhanced security, the FBI is warning law enforcement, merchants, and the general public that these cards can still be targeted by fraudsters,” the Bureau said in a public service announcement.

The EMV cards replace the traditional magnetic strip on the back with a small chip that holds encrypted data. It allows merchants to verify a card’s authenticity, providing the cardholder greater security and making the EMV card less vulnerable to hacking while the data is transmitted from the point of sale (PoS) to the issuing bank.

But the FBI says that may not be enough. It says EMV cards can be counterfeited using stolen card data obtained from the black market.

Prefers a PIN system

The FBI says the best defense is for consumers to use a PIN instead of a signature when making purchases.

“Merchants are encouraged to require consumers to enter their PIN for each transaction, in order to verify their identity,” the FBI said. “If a consumer uses a signature, merchants should ask to also see a government-issued photo identification card to verify the cardholder’s identity.”

This was music to retailers' ears, since they delivered an almost identical warning to Congress this week.

“What the FBI is saying is what the rest of the world already sees as common sense,” Mallory Duncan, National Retail Federation vice-president said. “It’s the right thing to do, and we hope the banks are listening.”

Leaving the back door open

Not using all of the card's potential security features, says Duncan, is like locking the front door but leaving the back door wide open.

“Retailers have long-argued that PINs are essential to providing cardholders with the security that they deserve,” said Brian Dodge, executive vice president of the Retail Industry Leaders Association (RILA), another retail industry trade group. “The FBI’s alert should be a wake-up call to the banks and card networks that continue to stand in the way of making PIN authentication the standard in the U.S. just as it has been around the world for years.”

The retailers complain that virtually all of the chip cards being issued in the United States are chip-and-signature rather than chip-and-PIN, leaving consumers without the option to use a PIN. By contrast, EMV cards used in 80 countries around the world for 20 years or more are routinely chip-and-PIN.

“They’re encouraging consumers to use PIN and they’re encouraging merchants to request PIN – the only thing missing is to encourage the banks to issue PIN cards,” Duncan said.

If you’re the proud owner of a chip-enabled credit card, you’ve probably noticed that not every card reader accepts the new technology. Despite having a slot for the new chip cards, many terminals still instruct customers to swipe the magnetic strip instead of dipping the chip.

Only about 17% of retail locations are currently equipped to accept chip cards. In other words, just one in five checkout lines are equipped with an activated chip card reader. 

So why is it that so many terminals are EMV compatible but haven’t yet been enabled to accept chip cards?

Wait-and-see approach

According to payments consultant Allen Weinberg, it’s because many retailers (particularly the larger ones) are taking a “wait-and-see” approach on enabling the chip card transactions. It seems they’d rather leave the task of teaching customers how to use the chip cards to other merhants.

“They see [chip cards] as just slowing down lines and chose to wait until consumers learned what to do -- and do it quickly -- at someone else’s store,” Weinberg wrote.

Weinberg notes that small businesses are another factor in the slow incorporation of EMV cards. Many of them aren’t even equipped with a chip-card enabled terminal yet.

Why? Weinberg says that like larger businesses, small business aren’t in a hurry to teach their community how to use the cards. They also either don’t think they’re at significant risk of fraud or simply weren’t aware the shift to chip cards was coming.

Cost might also be a factor for small businesses. Chip card readers and installation can cost anywhere from a few hundred dollars to thousands of dollars per terminal, as we reported. The industry average is around $2,000.

Liability shift

Now that we’re on the other side of the liability shift -- when credit card fraud became the responsibility of retailers instead of banks if they didn’t have their chip card systems running -- Weinberg says it won’t take much for merchants to “get religion,” as he puts it, and upgrade their systems. It’ll only take one instance of fraud or chargeback from people abusing the liability shift to motivate them to upgrade their terminals.

Terry Crowley, CEO of TranSend, a company that makes software to help merchants and their equipment work with the EMV standard, says there’s an invisible hand at work that is about to accelerate the incorporation of EMV cards.

“If you use a chip card at a point of sale that says swipe -- and you later say that wasn’t me -- there’s very little a merchant can do to dispute that charge,” Crowley tells Brian Krebs, adding that the "friendly" fraud is inevitable. “When people are made aware that if I swipe and I have a chip card, that lunch can be free if I’m a bad consumer.”

After this invisible hand takes hold, the U.S. will be able to jump on the chip card bandwagon with the rest of the world.

Wells Fargo says it is eliminating sales goals as it works to recover consumer confidence after it was ordered to pay nearly $200 million because its employees opened more than two million unauthorized deposit and credit card accounts.

“Our objective has always been and continues to be to meet our customers’ financial needs and drive customer satisfaction,” said CEO John Stumpf in a press release. “We are eliminating product sales goals because we want to make certain our customers have full confidence that our retail bankers are always focused on the best interests of customers.”

That may not be enough to satisfy critics, however. U.S. Senators Claire McCaskill (D-MO) and Susan Collins (R-ME) are pressing the Consumer Financial Protection Bureau for more information about the fraud, which they say may have hit seniors especially hard.

The Senate Banking Committee’s Republican majority, meanwhile, has scheduled a hearing for Sept. 20, at which it wants to grill Stumpf. Democrats on the committee had earlier called for a hearing on the giant fraud.

“We should accept nothing less than a full and transparent explanation of what went wrong, who is responsible, how to fix it, and how to prevent such fraud in the future,” the Democratic senators said earlier on Monday. Wells Fargo executives are briefing regulators this week, explaining the bank's attempts to curtail illicit activity by its employees. 

Vulnerable seniors

McCaskill and Collins are emphasizing the vulnerability of seniors to financial fraud.

“As Wells Fargo begins the long process of identifying and making restitution to the consumers who were defrauded, I want to ensure that seniors -- who are often the targets of fraud and who also can be harder to find and make whole – are adequately protected,” the senators said in a letter to CFPB Director Richard Cordray.

“I have concerns about the impact this activity has had on our nation’s senior population, especially those who do not conduct their financial business on the Internet," McCaskill and Collins said in their letter. "According to Pew Research Center, just 56 percent of adults over age 65 use the Internet."

McCaskill also asked if CFPB had worked with other branches of government to pursue civil or criminal penalties against the employees engaged in fraud. Bank employees have largely put the blame for the fraudulent transactions on bank management.

"When I worked at Wells Fargo, I faced the threat of being fired if I didn't meet their unreasonable sales quotes every day, and it's high time that Wells Fargo pays for preying on consumers' financial livelihoods," Khalid Taha, a former employee, said in a statement to Bloomberg.

Some Wells Fargo customers have complained of similar allegedly fraudulent practices.

"Twice when I was dealing with WF I had over $7500.00 stolen from my account," said Sharon of Halethorpe, Md., in a recent ConsumerAffairs review. "I believe that it was someone who was working there. What they did to me was use a forged check, that would have that check number coming up soon, take a picture of it and withdrawal the cash. Some of the checks didn't even have a signature or who it was made out to."

The CFPB said that Wells Fargo employees applied for approximately 565,000 credit cards and 1.5 million deposit accounts that may not have been authorized by consumers—sometimes illegally transferring money into those accounts in order to make them active. This sometimes resulted in overdraft or late fee charges for affected consumers. Wells Fargo was ordered to pay $185 million in fines to various entities, including a $100 million fine to the CFPB.

Southern and Midwestern shoppers beware: it looks like Fred's Super Dollar, a discount pharmacy and general merchandise retailer, is the latest business to lose customer payment-card data after hackers planted malware on the point-of-sale (POS) systems used in checkout lanes at Fred's locations.

Security expert Brian Krebs reports that he contacted the company last week, after “about a pattern of fraud on customer cards indicating that Fred’s was the latest victim” of malware planted on POS systems.

Fred's Inc. responded in a formal statement on Friday, admitting that:

Fred’s Inc. recently became aware of a potential data security incident and immediately launched an internal investigation to determine the scope of the issue. We retained Mandiant, a leading independent forensics firm, to examine our data security systems.

We want to assure our customers that protecting their information is one of our top priorities and we are taking this potential incident very seriously. Until this investigation is completed, it will be difficult to determine with certainty the scope or nature of any potential incident, but we will continue to work vigilantly to address any potential issues that may affect our customers.

Scope unknown

So far, that's the only information available: Fred's had a security breach, and hired investigators to look into it. The scope of the breach has not yet been determined: how long ago did the hackers plant the malware? How long were the hackers then able to monitor any transactions on those infected POS systems? And how many Fred's locations were affected?

Krebs' sources are “unclear” on that last bit, but said “the pattern of fraudulent charges traced back to Fred’s stores across the company’s footprint in the Midwest and south, including Alabama, Arkansas, Georgia, Indiana, Kentucky, Louisiana, Mississippi, Tennessee and Texas.”

So if you are or have been a Fred's shopper in any of those states, and paid with a card rather than in cash, check your card statement extra-closely to see if you can spot any fraudulent charges.

Bad news for fans of zoos – it looks like hackers managed to breach the payment card point-of-sale (POS) systems operated by Service Systems Associates, which serves restaurants and gift shops at zoos and other cultural centers across the country.

Security expert Brian Krebs reports that his sources in the banking industry have detected a pattern of fraudulent charges on payment cards sharing a common point of purchase: all had been used at a zoo gift shop with a Service Systems Associates POS.

SSA confirmed the problem in a written statement. “The violation occurred in the point of sale systems located in the gift shops of several of our clients. This means that if a guest used a credit or debit card in the gift shop at one of our partner facilities between March 23 and June 25, 2015, the information on that card may have been compromised.”

Cities affected by breach

The company did not name the exact locations affected by the hacking, but Krebs' sources think the breach hit facilities in at least two dozen cities across the nation (list alphabetized by state):

Birmingham, Alabama
Tucson, Arizona
Fresno, Palm Desert, Sacramento, and San Francisco, California
Colorado Springs, Colorado
Miami, Florida
Honolulu, Hawaii
Boise, Idaho
Fort Wayne, Indiana
Louisville, Kentucky
Baltimore, Maryland
Battle Creek, Michigan
Apple Valley, Minnesota
Cincinnati, Ohio
Tulsa, Oklahoma
Pittsburgh, Pennsylvania
Columbia, South Carolina
Dallas, El Paso, and Houston, Texas
Nashville, Tennessee
Salt Lake City, Utah

If you visited a zoo in one of those cities between March 23 and June 25 of this year, and used your card to pay, check your balance more carefully than usual to see if you can spot any fraudulent charges.

It was announced with much fanfare last year that the exclusive deal between American Express and Costco would end on March 31, 2016, when the Citi Visa would become the only credit card accepted by Costco.

There is, however, the little matter of $1 billion.

That's the estimated size of the portfolio of loans outstanding to 51 million holders of the co-branded Amex/Costco credit card. In a statement today, just 32 days away from the announced transition date, American Express said it has concluded negotiations with Citi, which will acquire the portfolio for about $1 billion.

"The sale is expected to close June 2016, at which time all eligible Costco American Express Card cobranded accounts will be transferred to Citi. Additional details will be provided to Card Members in advance of the partnership end date," American Express said in a statement.

If that sounds to you like the March 31 date has slipped, you're probably right. Here's how Citi put it: "The transaction is expected to close in mid-2016 at which time Citi will begin issuing Costco credit cards."

Costco has not troubled itself to issue any public guidance to its members, but Citi says it will issue new Citi Visas to all eligible holders of Amex Costco cards in "mid-2016."

"We are immensely pleased to have entered into an agreement to acquire the Costco portfolio and look forward to a long-term partnership with Costco and the opportunity to deliver value, convenience and seamless service to their 51 million loyal members across the country," said Jud Linville, Chief Executive Officer, Citi Cards.

Linville said Citi is "working with Costco to provide a new value proposition to its members."