Citibank cuts off some ATM cards after thefts

Bob Sullivan Technology correspondent • Profile • E-mail

Jacob Appelbaum thought he had done everything right. Before he traveled to Canada, he called his ATM/debit card issuer, Citibank, and told the bank to expect international transactions. But somehow, the San Francisco resident found himself in Toronto with no way to withdraw money from his Citibank checking account — and in the center of rumors about an extensive problem with Citibank debit cards and the ATM system.

When Appelbaum arrived in Canada last week and tried to withdraw currency from an ATM in Toronto, the machine told him his was an "ineligible account."  He called Citibank, which told him his account had been placed on hold for suspicion of fraud. A customer service agent refused to provide more details — or to unlock his card so he could get some local currency.

"I was infuriated," Appelbaum said.  "I had notified them I would be using it in Canada."

Appelbaum's account of what happened next, published on his personal blog, has created a firestorm of rumors about Citibank's ATM system. He says a Citibank customer service agent at first told him there was a major problem with Canada's ATM systems.

Citibank hasn't done much to quell the rumors, issuing only a vague statement Monday evening confirming a much less dramatic story. The statement indicated that the bank had detected "fraudulent ATM cash withdrawals on Citi-branded MasterCard credit and debit cards used in the UK, Russia and Canada." As a result, some debit cards had been shut off, said Citibank spokeswoman Elizabeth Fogarty.

Data leaks
A series of consumer accounts had been compromised during data leaks by third-party U.S. retailers, Fogarty said. She would not indicate which retailers were involved. Impacted accounts had been placed on a watch list.

NBC VIDEO Debit card fraud Some consumers who travel overseas are finding they can't get cash. MSNBC

It's customary for credit and debit card issuers to monitor accounts for fraud after credit card data is stolen from a merchant. Often, the accounts aren't canceled until there's evidence they are actively being used in fraud.

"To protect customer accounts that were affected, we placed a special transaction block in those three countries on PIN based transactions," Citibank said in its statement. "We are currently reissuing cards, as appropriate."

Fogarty wouldn't say how many consumers were on that list, saying only it involved a "small number of accounts." But she did say that it's unlikely consumers would find out unless they traveled to Canada, the United Kingdom or Russia. In other words, some Citibank customers are currently carrying cards that will be useless for withdrawing funds in some foreign countries, but like Appelbaum, consumers won't find out there's a problem until they travel.  Even calling ahead, like Appelbaum did, apparently won't head off trouble.

MORE FROM SECURITY

Security Section Front

After criticism, Facebook tweaks settings again Court reviews employer access to texts NYT: U.S., Russia open talks on cyberwar limits Red Tape: Holiday ‘cyberbegging’ grows on eBay Internet users lured to oppose health bills 5 things to know about Facebook’s new settings Facebook privacy revamp draws fire Facebook gives users more privacy controls Hacker to plead guilty in more store break-ins U.S. takes fight against hackers overseas Security Section Front   Add Security headlines to your news reader: