I posted the other day about a counterfeited card. We now have 3 debit cards, that appear to be counterfeited, I know it doesn't sound like much but we're a small institution, only about 400 cards and we're looking at over $4,000 in losses in 3 days. I'm lost as to what (if anything) I can do to figure out where the car data was compromised. Short of reviewing the customer history to see if they have visited the same merchant, do I contact my host processor, card processor, card production vendor? Do I call the police? Any guidance would be greatly appreciated.

My first guess is that your customers were phished, so I'd start by asking them directly if they had received any emails asking them to update their credit card information.

If phishing isn't to blame, start looking for skimming. See if you can identify a common point of comprimise among your customers.

BTW- are the fraudulent transactions taking place locally, or out of the area/overseas.

do you have any software with your vendor such as "Falcon" to monitor fraud? Are they Visa/MC debit cards? Do you check CVV?

As JacFSB says, where are they happening, my guess is out of area or country? Seeing you have such a small card base I might suggest you look for initial small transactions..usually under a dollar..that is a sign of other things to happen...it is the bad guy checking to see if it works before larger transactions...I would suggest you start with doing this and contacting you host processor to see what protections that they have that you might not be using.

Thanks JacFSB and Bobw for the suggestions, We hadn't specifically asked them about phishing, my first thought was skimming. The first 2 were out of the country, one in Mexico and the other in Canada, this newest one was in another part of the state. We started reviewing our cardholder reports today for anything that was out of the area, haven't found anything else at this point. We do have a risk alert program with our vendor, that's how we caught all of these, so that's working. But I need to check about CVV.

Also, do I need to submit a fraud advice to Visa? It's probably pointless to attempt to charge these back since the merchant only has to provide a signed sales receipt?

Thanks for your input.

Since these are purchases, and not ATM withdrawals, it may be worth a shot to charge them back.

Can you tell from your system how these purchases were processed? Were the cards swiped, or keyed in?

if you have to check on CVV, and being a small institution you probably aren't verifying it. You didn't say if you were Visa or Mastercard. I know Visa sends out a CAMS alert anytime a merchant gets compromised, a lot of counterfeit activity can be traced to those cards so you may look into that.

We're Visa and we haven't received any CAMS alerts yet, but maybe we will. The transactions all show that the cards were swiped.

how do you handle your Cams? Do you always hot card every card? If not, make sure they aren't on an old one. That happened to me a couple of months ago. what a mess.

Well, we're actually a de novo bank, so we haven't had any CAMS alerts yet, we haven't even been open a year, that's what makes these lossess so significant to us. Good suggestion about making sure they aren't on an old one, I don't want to run into that problem. Since we're still small, I think we'll probably hotcard anything on the CAMS alert, when we get one.

CAMS alerts come weeks, sometimes months after a event..you really cannot rely on them and should not, you need your own safety measures. I don't think this is a charge back canidate, you will end up losing or it will be rejected and all you will lose is time.

Sorry to hear this is happening to you.

If it was me I would definatly do a chargeback as "unauthorized". If they stick then your not out the money, if they don't stick then at least you get to see what name is on the card, if it was totally changed, if the bank name is the same etc. I am such a snoop I like knowing what happened even if I land up taking the loss, I would also need to be able to tell senior Mgmt for sure that they are counterfeits and here is my proof.

I had this exact situation within the past year. I would definately contact Visa Fraud with your situation. Look for a common point of purchase with all of your fraud customers. It might by easier than you think to pinpoint the merchant. Visa also has software to detect this if you provide them with the information. You may also be able to retrieve some of your losses if you had registered for the Account Data Compromise Recovery Process through Visa. If you are receiving CAMs alerts, the enrollment process is very easy.
We created a risk matrix on making the decision to hot card a customer or not after CAMs alerts. Luckily, we have a great software tool through Metavante that catches most Visa fraud upfront, so the risk in not hot carding is small in most cases.

The customers may have been in different places when the fraud starting showing up BUT they may have a common interaction months prior to when that activity started.

At the very least, request the sales receipts and see what you get.

BSA Guy, would you be willing to share the matrix

if you have such a small card-holder base, maybe you can restrict foreign (international) transactions. i think you probably have to or at least should notify your card-holders that their card will only be valid in certain countries and can be expanded by request. i'm not sure if there is a charge or what it may be.