Police suspect that a card skimmer installed at a gas station in El Monte, CA is responsible for $10,000 in credit card fraud, says KNBC:"It looks like the victims were gassing up here and using the outside pump terminals, and their credit card information was compromised," El Monte police Detective Brian Glick said.

Police don't believe it was an inside job but that the fraud artists picked the station in the 4300 block North Santa Anita Avenue because of its high customer volume.

Fraudulent withdrawals, ranging from $400 to $1,500 per customer, were made in Las Vegas, Palms Springs and New York, police said. Police didn't find the device, but think that 45 credit/debit accounts with transactions from the same gas station is, uh, a bit of a coincidence.

Last Sunday's 60 minutes had a report by Lesley Stahl about the now-infamous TJX data breach.

The most interesting conversation was between Stahl and a representative from the National Retail Federation, who placed the blame for lax store security on the credit card companies:
"Is there growing tension between the two sides now?" Stahl asks Dave Hogan, who handles computer technology at the National Retail Federation.

"Lesley, absolutely, there's growing tension between the two sides," he replies.

Hogan says credit card companies should change how they do business. "If we could just force Visa and MasterCard to not require retailers to store credit card data, this issue would disappear overnight," he argues.

Hogan says card companies force retailers to store customer data in case there are charge disputes. He thinks the card companies should hold the data, not the stores.

"Honestly, we can eliminate this problem within a few days," Hogan says.

"If it's that easy, why hasn't it been done?" Stahl asks.

"I'm not too sure how vested the credit companies are as far as securing customers' data," Hogan says.

"And you're saying that the credit card companies are the one's who are not security conscious?" Stahl asks.

"In my humble opinion, no," Hogan replies.

He accuses the card companies of using this issue as a way to make money. Visa, for example, has started fining large chains that do not have up-to-date security $25,000 a month.

"If you do the math on it, this could be a windfall of $200 million annually for the credit card companies as far as a revenue stream," Hogan says.

Visa chose not to respond. Hmmmmm.

The report also had some interesting emails from inside TJX, proving that they did, in fact, know that their wireless encryption was out-of-date and easy to crack. If you're the paranoid-about-credit-type you might want to avoid watching this report. Those who enjoy watching Lesley Stahl learn about WEP and WPA while driving around in a van with a lovable nerd should head on over. She's so cute!

Ars Technica reports that "42 percent of adults in the UK feel that their trust in a brand would be greatly reduced by receiving a phishing e-mail claiming to be from that brand, according to an online survey conducted by research firm YouGov."

While this is certainly unfair, we can't help but feel that it's probably true. The endless stream of phishing emails claiming to be from Bank of America make us feel irritated with Bank of America even though we don't have an account there and know perfectly well that they aren't sending us phishing emails. Irrational? Certainly.

Anyway, here's the (obligatory) part of the post where we remind you not to click links in emails. Type them in yourself.

Commerce Bank isn't sure whether it accidentally gave out your SSN and account number, so its going to write you a letter to offer you some free credit report monitoring.

The hypothetical data breach may or may not be affecting a very small portion of the bank's 3 million customers. They're not sure.

From the Philadelphia Inquirer:
A bank spokesman said only a small portion of its three million customers are affected. However, officials cannot be certain if the information was actually shared at all.

Bank officials are sending out letters to customers that may be impacted. Those customers will also offered twelve months of free credit monitoring.
Apparently, security is such at the Home Depot that an employee can ID theft his imagination. According to Newsday, an employee of Home Depot was caught issuing cards to fake people and then using them at other stores.Darwin Munro, 41, of Jamaica, was arrested at 4:45 p.m. Thursday in Elmont and faces numerous charges including first-degree identity theft, falsifying business records, fraud and grand larceny.
Criminals beware. You can be charged with "first-degree id theft" even if the "person" you're "ID thefting" is Harvey the Rabbit.

According to new court papers, Visa and Mastercard are saying that the TJ Maxx security breach actually affected 94 million accounts—more than double the amount that TJ Maxx reported.

The new estimate is part of a lawsuit by the credit card companies against Fifth Third Bancorp and TJX (parent company of Marshalls and TJ Maxx, among others).

Visa says that their fraud related costs are in the neighborhood of $68 - $83 million, and will only go up as more thieves use the stolen data.

Damn.

A woman who worked at a Verizon store at the Green Acres Mall in Valley Stream, NY is accused of stealing the identities of more than 25 customers and using their personal information to obtain credit cards.

The worker has been charged with forgery, grand larce