Target said Thursday it has fixed the problem that allowed credit and debit card information on as many as 40 million accounts to be stolen. The retailer said credit card holders can continue to shop at its stores and advises customers to check their statements carefully for unauthorized charges.
The accounts are those of customers who swiped their cards at stores in the U.S. between November 27th and December 15th.
The company determined the hackers accessed data including customer names, credit and debit card numbers, card expiration dates and three-digit credit card security codes. The data breach affected in-store customers only, not online customers.
Here's what to do if you think you might be a victim.
Should I cancel my credit or debit card and get a new number?
The safest answer is yes. While banks are monitoring all the stolen cards carefully, and under federal regulations and company policy you will be able to get your money back or zap unauthorized charges, fighting them can be a hassle.
"If it was my debit card, I would probably cancel it," said Avivah Litan, a fraud analyst at technology research company Gartner. "I don't like anyone going into my bank account." Even temporary fraudulent charges on a debit account can lead to unexpected fees and bounced checks, requiring even more work to untangle.
Could this lead to identity theft? How can I protect myself?
Conceivably, yes, though not right away and the odds are longer. Data thieves can resell their plunder on the global black market. It can be recombined with other public and stolen data to piece together parts of your identity to open up credit cards, cellphones and even take out a home loan in your name.
For maximum protection, you can contact one of the three credit reporting agencies and put a security freeze on your credit report. That means no one can access your credit information without your prior written authorization. It can also mean a hold-up for you when trying to apply for a job, mortgage, or if you like to get a discount by opening an in-store credit card. A less drastic approach is a fraud alert, which will let the agencies know to give requests for your credit report information more scrutiny without outright stopping it. That also can lead to some delays.
How can I contact the credit reporting agencies?
There's three of them. Contact Equifax.com or (800) 525-6285 , experian.com or (888) 397-3742, and transunion.com or (800) 680-7289.
How can I get a free copy of my credit report?
You can get one free copy from each of the credit reporting agencies once a year at annualcreditreport.com. Some folks like to request their report from just one agency every four months, cycling through the agencies to stretch out the monitoring.
When should I check my card for suspicious charges? Every week? Every month?
"I would monitor my statement very carefully," said Litan. Check now, then at least once a month. Even if the numbers aren't used right away, the numbers can get resold through private online forums and chatrooms. Fraud might not show up until months from now.
That doesn't mean your credit card is ticking bomb. "It's not like you're going to eat the fraud; the bank is going to reverse the fraud right away," said Litan. Cards in these types of breaches also go on a "gray list" and get extra scrutiny when charges comes through.
"They've got pretty good fraud detection systems," said Litan. "As the consumer, it's just very inconvenient and awful."
What should I do to protect myself going forward?
Keep an eye on all your statements. If you swipe your debit card at checkout, always make sure to do it as "credit" rather than "debit." Though no reports indicate PINs were stolen during this breach, if they were, a thief could clone your debit card onto a new piece of plastic and turn your bank account into his own personal piggy bank from any ATM in the world. When swiped as credit, debit cards are also protected under more robust rules that give shoppers longer to report unauthorized charges and lower maximum amounts for which customers can be on the hook.
What are the chances my card will get used by a thief?
From 1 in 100 to 1 in 500. "They steal a lot more of these cards than they can use," said Litan. On average, about 5 percent get used by the thieves. With a breach this size, that's still up to 2 million cards.
Is it safer to shop online next time?
Snoops can also target your computer with keystroke loggers, lure you to phishing sites, or intercept transactions. The only way to absolutely avoid credit card or debit theft is to pay in cash, in person. But carrying around a wad of holiday shopping cash carries its own risks, of course.