Fraud fears lead Michigan banks to reissue cards

15.11.2006
Fraud that may be related to a security breach at a Muskegon, Mich.-based gas station chain earlier this year has forced several banks and credit unions to recall potentially thousands of credit and debit cards in recent days.

One of the institutions affected is the Community Shores Bank, which last week asked about 550 of its members to destroy their debit and credit cards after the credit union noticed that several of its cards had been used in fraudulent transactions.

The fraud first began about Nov. 9 and started "rapidly increasing," said Sherri Campbell, vice president of deposit operations at the bank. In many cases, forged cards were used to conduct transactions in amounts that exceeded US$1,000 -- with some transactions reaching $2,000, she said.

"Most of the fraud we have seen is coming out of Georgia, Arizona and California," Campbell said. In some cases, forged cards were used to make purchases from as far away as Spain and France, she said. "We do know that [the perpetrators] are re-creating plastic, because these were all signature-based 'card present' transactions."

Although the bank has reissued cards in the past, it has never seen this level of fraudulent activity before.

Family Financial Credit Union, another Muskegon-based financial institution, has so far replaced nearly 1,000 debit and credit cards as a result of fraud concerns, the credit union's president, Thomas Curtis, said via e-mail today. He refused to provide any other information but confirmed the details of a report in The Muskegon Chronicle that said the bank was canceling the cards as a precautionary measure after some of its members had been victimized by fraud.

The Chronicle also quoted executives from the Community Schools Credit Union and Muskegon Commerce Bank who said they took similar actions after discovering fraudulent transactions involving cards issued by them. Representatives from the two banks did not respond to several requests for comment.

Campbell said it remains unclear where the information used to forge the banks' credit and debit cards was obtained.

But suspicions are centered on Wesco, a local gas station and convenience store chain with 51 locations in Michigan. In a note posted on the company's Web site, Wesco said that it is investigating the "possibility of credit card fraud associated with card use at our facilities."

According to the company, credit card transactions that occurred between July 25 and Sept. 7 may have been somehow compromised.

"The U.S. Attorney's office and the U.S. Secret Service have launched an investigation to understand the scope of the problem," the company said. It encouraged those who shopped at Wesco stores to verify transactions with their financial institutions and said that it is "cooperating fully" with federal authorities.

"Wesco will continue to work with federal authorities and credit card companies to identify and hold accountable those responsible for the fraud," the statement read.

Campbell said she has spoken with Visa USA's fraud team about the possibility of Wesco being a source of the compromise, but so far no one has been willing to make that link. "Nobody will admit to that yet," she said. "So its up to everybody to infer what they want."

In an e-mailed statement, Visa U.S.A. Inc. said it is working with Wesco to investigate a possible data compromise. "All Visa account information is being quickly collected and will be provided to the impacted card issuers as soon as possible so they can take steps to protect cardholders.

"It's important for consumer cardholders to know they are fully protected against fraudulent purchases with Visa's zero liability fraud protection policy," Visa said.

News of the card recall comes after a lull in such incidents this year. In February and March, a wave of debit card fraud worldwide prompted several major financial institutions -- including Bank of America, Citibank, Washington Mutual Bank and Wells Fargo Bank -- to block and reissue tens of thousands of debit cards.

The refusal at that time by major credit card associations and financial institutions to identify the source of the data compromise prompted questions about .