Credit card fears widen

Anne Marie Jean of Brockton wasn't scared away from shopping at A.J. Wright in Brockton this week, but since reports that credit and debit card numbers were stolen from its parent company, TJX Companies, she'll think twice about using anything but cash.

“I would be worried,” she said of using her card, even though she has done so in the past.

Local bankers are worried, too. Local banks and credit unions are reissuing thousands of cards to their customers who may have been affected, but the scope of the data theft is still unclear. Framingham-based TJX Companies, the parent company of U.S. stores T.J. Maxx, HomeGoods, Marshalls, A.J.Wright and Bob's Stores, reported Jan. 17 that computer hackers gained access to an undetermined number of credit card and debit card numbers in a security breach in December — possibly committed by a high-tech, international organized crime ring.

Hackers may have data associated with purchases made in 2003, and between May and December in 2006, according to a statement from the company.

The company has determined that transactions at Bob's Stores were not involved in the security breach, according to an advertisement in today's paper.

Last week, evidence of the stolen data began to appear on the bank statements of innocent consumers. According to news reports on TheBostonChannel.com, Paula O'Rourke, of Holbrook was a victim of credit card fraud in December after shopping at HomeGoods in Florida.

She believes the fraudulent purchases stem from the use of her card there.

Meanwhile, bank and credit union workers scrambled to protect their customers.

“We have a whole team of people working on this,” said Jim Blake, president and CEO of Brockton-based HarborOne Credit Union.

While the company is still investigating the records of Bob's Stores purchases, customers who made purchases at any of its other American stores may have had their credit card or debit card information stolen, said a TJX customer service representative.

While the card numbers weren't associated with names or addresses, some of them have been used to make fraudulent purchases in Florida, Georgia, Louisiana, and abroad in Hong Kong and Sweden.

“That says to me that this information has been sold,” said Blake. “These are not people operating out of a basement in a building. They are highly trained — some at U.S. universities — working for organized crime units around the world, mostly outside of the U.S.”

In addition to using the numbers to make purchases, thieves are also mining sources for data associated with those numbers to steal entire financial identities, Blake said.

“You could wake up one day with a $300,000 mortgage on a house in Florida, but no house,” he said.

To protect members of HarborOne Credit union, 9,000 new cards will be issued to some of its 97,000 members. Rather than wait for a report of fraudulent activity, the credit union will issue new cards to any account identified by Visa or Mastercard as associated with the TJX security breach, Blake said. The processing and replacement cards will cost the credit union $100,000, he added.

Security breaches occur on nearly a monthly basis, Blake said, but this is the largest to date.

Randolph Savings Bank will issue 1,500 new cards to its affected members, said Tom Trummey, senior vice president and chief operating officer. The compromised accounts represent a small percentage of the 12,000 cards issued by that bank, he said.

But Trummey himself had to get a new card, since he had used his Randolph Savings Bank debit card to holiday shop at area T.J.Maxx and Marshalls stores, and his account was compromised.

But he hasn't been scared away from making electronic purchases, he said. Neither was Andrea Beaumont of Taunton, who was shopping at T.J. Maxx in Taunton Friday. “I just figure I'll be lucky, I guess.”

Many consumers continue to try their luck, and rightly so, said John Hurst, president of the Retailers Association of Massachusetts. “People shouldn't feel they should pay for everything with cash. Making electronic purchases can be safer than carrying around a lot of cash, and you are protected,” he said.

Consumers are “held harmless” for fraudulent purchases, he said. “They're not going to charge you for criminal activity on your account. Report it immediately, and you'll be OK,” he said.

Some consumers forego the conscientious approach, but still aren't worried. Sarah Seavey, of Norton, was shopping with her card Friday at T.J. Maxx in Taunton, but she doesn't think the number would do thieves any good. “There no money in the account anyway,” she said.

Officials at Bristol County Savings Bank in Taunton declined to be interviewed for this story.