Once again, I'm looking for advice on how to handle a situation.
I have identified a merchant that I'm sure has an employee skimming debit cards. I've tied 18 customers to this merchant and 15 of these customers have had debit card fraud on their account. We closed out the other 3 customer cards as a precaution.
We have charged off close to $8,000 in losses due to this debit card fraud.
We are a midsize community bank with less than 10 branches.
The merchant is a well known national company.
I filed a police report back in August. The police contacted me in September for additional information and I never heard back from them. I contacted the police again in October for an update. The case has been assigned to a detective, however the detective indicated she is playing phone tag with the manager of the store.
I also filed a SAR.
This may be the first debit card skimming situation in my city and I'm not sure the police know what steps to take.
Any advice on next steps?
Do I contact loss prevention at other banks in the area in an effort to band together to get them to file police reports too? I'm positive someone at this merchant is skimming and I know other banks in the area have to be taking losses too.
Do I go above the detective's head? I'm not big on this idea because I do have a good relationship with this police department and I don't want to ruin it.
I've contacted my operations department to find out how to notify VISA on this.

I had a similar situation earlier this year, and I notified both the local police and the Secret Service (since the withdrawals were happening in another part of the country).

Contacting other banks in your area is a good step to take. That way, if they haven't identified the point of comprimise yet based on the fraud that they have experienced, they will be able to do so and report it accordingly.

For notifing Visa, you will want to complete a Common Point of Purchase report for these transactions. Whoever in your area has access to Visa should be able to help you with this.

Ditto JacFSB's post. You're situation is identical to one I recently went through. Visa is your best bet, complete the common point of purchase spreadsheet (available at visaonline.com) and contact Visa Fraud control. And have every other bank in your area do the same. Mine took awhile, but the situation was resolved (it wasn't an employee of the merchant, but the merchant was using software that they did not upgrade to the latest security and they were being hacked.) We lost over 9k, and we only have 1 branch. Until it got resolved, I lowered the limits on anyone who went to that merchant.

Over the last 5 days we have seen some fraudulent debit card transactions that all originated in Mexico. I am trying to find a common link between the effected customers and all I am coming up with is several major retailers. Would you mind sending me a pm with any info you might have? Is anyone else experiencing this?

We had a situation where fraudulent charges were being initiated on multiple accounts... all from someplace quite aways from from where we are... we were able to stop all charges originating from this particular source via software... generally, I think that can be done.

Not sure it will help in your cases, but it might be something to look in to.

Itnever ends,

Did you ever get reimbursed through the merchant or Visa's Account Data Compromise Recovery. We had the exact same situation happen. We actually tipped off Visa Fraud to the merchant who was not using the correct software. The losses that we were aware of were over $100,000. We were promised restitution through Visa through the ADCR, but have not received anything. Has anyone received any money back from Visa's ADCR? Visa is a joke when it comes to helping banks out. Any thoughts to suing the merchant, especially if you know who they are?

BSA guy CRCM,

We just received the CAMS alert from Visa not that long ago, I haven't looked into the ADCR rules lately and I need to do that. I know our lossess were small in comparison to other banks (we're a de novo) and I know other banks in the area are well over 100k each. So frustrating, it would be nice to sue him, but being a de novo, we're not in a good position to do that.

I'd also be interested in hearing if anyone has collected through ADCR.

Not all CAMS will qualify for ADCR reimbursement as one of the big requirements is that the total alert must have impacted at least 10,000 accounts. Visa will post which CAMS do or do not qualify on Visaonline.com and there is an updated list as of Nov 16. Reimbursement runs approx 9 months after the alert and three payouts have been made thus far in August, October and November. I have found the letter notification not to be very effective, so I always contact my Visa Rep around the time of payout and she will provide our Visa Billing Statement which itemizes the recoveries.

We have received some $$$ from ADCR, but with anything it is a drop in the bucket compared to actual losses.

Unless the merchant has gone public admitting to the breach, suing the merchant and proving they were the responsible entity storing full mag data and the resulting theft of data through a hack will be very difficult. The associations will not confirm the name of the merchant or share the results of their forensic investigation to either confirm or deny an intrusion which will place the burden on you to prove it which could be more costly than your actual loss from skimming.

Thanks C_Groat. I appreciate your insight. I hadn't had the time to look into the ADCR, so your information was very helpful. Also, your thoughts on sueing the merchant, I hadn't thought about all the issues you brought up.

we haven't see much money back on ours either, as C_Groat said drop in the bucket... as for suing the merchant, i noticed an attempt at a class action against the TJMaxx people failed even though it was public knowledge they were compromised.

Just because the class action certification failed does not mean that individual banks won't succeed if they decide to pursue a case.

did everybody get their Acceptance of Alternative Recovery Offer? seems like we are getting a little more than originally thought. We were given a settlement offer to not pursue any further action on this issue. the settlement was a lot better than what we were originally reimbursed...

We were pretty pleased with ours as well. Not full reimbursemnet of course, but it helped at year end. I know it is difficult to know who the merchant is in some compromises, but in my previous post, there was no doubt who it was. The FBI confirmed it when they contacted me about the situation. Visa did absolutely nothing to help us or the other banks to retreive their losses, even when we were the ones that tipped them off. You think they would have had a gift card laying around somewhere that they could have sent our way