So this is going to sound like a boring "personal finance" post instead of a tech post, but bear with me, because it's actually the most tech-relevant thing that happened to me all month.
Target confirmed on Thursday that somewhere around 40 million debit and credit card accounts got scooped up by malware sitting on their point-of-sale registers, and the window they're naming is Black Friday weekend through December 15th. I did the math on my own bank statement Friday night and yeah. I was in a Target in that window. Saturday, early December, sometime around 6pm, buying a space heater and a Nerf gun for my nephew and some wrapping paper, $86.42 on the debit card because I didn't feel like digging out a credit card at the register. Swiped it right at the terminal like a chump.
I'm not panicking exactly. Nothing weird has shown up on the account yet. But I've now spent two evenings this week doing the thing where you stare at every line item on your statement trying to remember if you actually bought a $4.99 thing from a gas station in Ohio (I did not go to Ohio) or if that's fraud starting to trickle in. Its a genuinely bad way to spend an evening in December when you also have actual holiday stuff to do.
The part that annoys me more than the breach itself
Malware on point-of-sale systems isn't new, and honestly with that much foot traffic during the biggest shopping weekend of the year, Target was always going to be a fat target (sorry, couldn't resist, I'll allow myself that one). What actually annoys me is that this whole mess is basically a symptom of the US still swiping magnetic stripes at the register in 2013 like its 1995. Chip-and-PIN has been standard in the UK and most of Europe for something like eight years at this point. My cousin in London has never once had to worry about this because her card physically cannot be cloned the way a stripe can. We keep talking about "someday" moving to chip cards here and then someday never comes because the banks and the retailers spend more time arguing about who eats the cost of new terminals than actually replacing them.
Anyway. Practical stuff, in case anyone reading this also shopped at a Target between Thanksgiving and the 15th:
- Check your statement daily, not weekly, for the next month or so
- Call your bank and ask specifically about getting a new card number issued, don't wait for them to flag something first
- If you used a debit card (not credit), watch your checking account balance too, since fraud there can actually drain money out rather than just running up a bill you can dispute
- Target's PR statement mentions they're working with the Secret Service, which tells you this isn't some small-time thing
I called my bank Friday afternoon and sat on hold for twenty-six minutes listening to a hold song that I'm pretty sure was the same four bars looped, before a very nice woman named Denise told me they'd overnight a new card and I'd need to update autopay on like six different accounts. Which, fine, that's the price of doing business I guess, but it's an annoying thing to be doing on December 20th when I have approximately zero free evenings left before the holiday starts.
I keep seeing people online say "just use cash," and sure, that works until you're the one holding a fistful of twenties at 11pm trying to find gifts and the store won't take an even amount and you get a pocket full of change. Cash isn't really a serious answer for how most of us actually shop now, it's just a thing people say to feel superior on message boards.
The bigger question, the one nobody's really answering yet because the investigation is what, three days old, is how long that malware was sitting there before anyone noticed, and whether this is really contained to Target or whether we're going to hear about three more retailers in January. I've got a bad feeling it's the latter. Either way, if you bought anything with plastic at a Target register this month, go look at your statement tonight instead of finishing this blog post.