Citibank cuts off some ATM cards after thefts

Meanwhile, Appelbaum finds himself in a curious situation. His card has not been completely shut down; it's only blocked from PIN-based transactions. He can still make credit-card style purchases, called "signature-based debit" by the industry. But he can't use his PIN and get cash back from retailers when he shops, and he can't make ATM withdrawals.

Asked why a card suspected of cash withdrawal fraud could still be used for credit purchases, Fogarty said this: "We detected fraudulent ATM cash withdrawals on a small number of accounts affected by a third party breach in the US in 3 countries, which is why that functionality was blocked."

Being in a foreign country with no access to cash — and only a working credit card — is more of a hassle than it appears, Appelbaum said. Without cash, he couldn't get around until he purchased a monthly bus pass with his credit card. Using it cost him an extra $5 in fees.

Fogarty said Citibank will provide additional information about the situation later on Tuesday.

Speculation about the incident on Internet sites was rampant, with many writers trying to peg the Citibank incident to a specific data leak.

Purloined PIN codes?
Gartner analyst and fraud expert Avivah Litan noted that Citibank was clearly reacting to fraud involving stolen PIN codes — which hints at a more severe problem than stolen credit cards. Criminals with access to PIN codes can wreak far more havoc on consumer accounts.  Stolen PIN codes would allow a criminal to access a consumers' entire bank account.

Litan wondered why Citibank didn't inform all consumers who are impacted by the incident.

"What's frustrating for people is the feeling, 'I'd like to know if I'm in that lot,'" she said. Consumers face a bigger hassle getting refunds from debit card fraud than from credit card fraud. More important, credit card fraud liability is capped at $50.  Consumers who are hit by debit card fraud can lose the entire balance of their accounts, if they don't report the incident promptly.

For now, Appelbaum says Citibank is issuing a new debit card but won't send it to him in Toronto — instead, the card is being sent to his California home, where a friend will reroute it to him in Toronto.

MORE FROM SECURITY

Security Section Front

Check your junk mail: Might have a contract in it FTC warns of increase in Internet scams Man indicted in hacking of Palin's e-mail Tiny flash drives improve their security Fake YouTube pages used to spread viruses EU proposes more rights for Internet shoppers Gmail 'Mail Goggles' stymie drunk e-mailing Fraud plagues prepaid calling card market GPS 'spoofing' could threaten national security Chinese snoop on Skype, but are they alone? Security Section Front   Add Security headlines to your news reader: