So the new debit card showed up yesterday. Same bank, new number, a little note tucked inside about "recent events" like they're being coy about it. We all know what recent events they mean.
If you somehow missed it between wrapping presents and pretending to like fruitcake: Target got hit. Malware sitting on their point-of-sale systems from Black Friday weekend through around December 15th, skimming card data as people swiped. Something like 40 million cards. I was in a Target on the actual 29th, buying a space heater and a bag of the discount Halloween candy they still had out for some reason, and I paid with the card that's now sitting in a drawer, useless, waiting for me to cut it up.
And then this week, Target confirmed the PIN data got taken too, not just the card numbers and expiration dates. They're saying it was encrypted and the key wasn't compromised, so debit PINs should be safe. Maybe I believe that, maybe I don't, but either way my bank didn't wait around to find out: they killed the card and mailed a new one without me even asking.
Here's the actual useful part of this post, because I don't just want to recap something you already read four other places this week.
What I'd actually do if you shopped at a Target between late November and mid-December:
Check your statement line by line, not just the total. I know that sounds obvious but I skim mine like everyone else. Small charges are the tell: fraudsters test a stolen number with something tiny, like a dollar or two at a gas station, before running up a real charge. If you see something you don't recognize even if it's for $1.12, call your bank same day.
Don't wait for a letter. Target's offering free credit monitoring but the sign-up process was a mess when I tried it Thursday night, the site kept timing out. If your bank already killed your card and reissued one, that's honestly the faster fix. Debit is worse than credit here too: with credit cards you're not out real money while a dispute gets sorted, with debit the cash actually leaves your account first and you're waiting on the bank to put it back.
Change any auto-pay or subscription tied to that card number now, not later. This is the part that actually ate my afternoon. Netflix, my gym, the storage unit I still pay for and barely use: all of it had the old number saved. New card, new sixteen digits, new expiration date, go update every single one or get hit with a declined-payment email in three weeks when you've forgotten this ever happened.
And here's my actual complaint, the part nobody's really saying out loud: this keeps happening because we're still swiping a magnetic stripe like it's 1995. Chip-and-PIN cards have been standard in Europe for something like a decade at this point. I remember my cousin in London laughing at me for handing over a card with no chip on it. The stripe just broadcasts your card data in plaintext to whatever's reading it, which is exactly why a piece of malware sitting on a POS terminal can hoover up millions of numbers in one go. A chip card generates a unique code per transaction, so even if someone's sniffing the register they don't get anything reusable. American banks have been dragging their feet on this for years because rolling out new terminals and cards costs money, and honestly I don't expect Target's breach alone to change that, but if it doesn't, nothing will.
I'll say this too: I'm annoyed at Target specifically less than I am at the whole system. This isn't the first retailer breach and it won't be the last one we hear about this year or next. My card getting cloned isn't really about Target being sloppy, it's about an entire payment infrastructure built on a technology that's decades past its expiration date, forgive the pun.
Anyway. New card's in the drawer, old one's getting scissored, and I've got about six auto-pay logins to go update before New Year's. If you shopped there over Thanksgiving weekend, go check your statement right now instead of finishing this post. It'll still be here.