In this Art Fennell Reports segment, personal security expert Robert Siciliano discusses a massive credit‑card identity‑theft operation that allegedly stole over $41 million from shoppers at retailers such as TJ Maxx, BJ’s Wholesale and Barnes & Noble. Siciliano explains how everyday card use creates exposure at the point‑of‑sale and how large, poorly secured databases are harvested by organized hacker groups that now prioritize profit over notoriety, moving roughly $50 billion of fraudulent activity each year. He describes the underground market where stolen card data (including name, address, and card numbers) is sold for $10‑$15 in IRC chat rooms, and why federal agencies struggle to shut it down. The conversation turns to the consumer’s burden: victims are often presumed guilty until they can prove otherwise, but most banks offer zero‑liability policies if disputes are filed within 60 days. Siciliano urges proactive steps—placing fraud alerts on credit reports, regularly monitoring statements, and investing in identity‑theft protection services (≈$10 /month or $99 /year)—as the only realistic defenses while the problem is expected to worsen before it improves.
Chapters
Coming up on Art Fennell Reports.
Scammed. We have an update on a massive credit card scam that may have affected you and you don't even know it. Hello everyone, I'm Art Fennell. Thanks as always for joining us for the report. We'll start this report today with a look at identity theft. Now we've been telling you yesterday about the 11 people who were indicted for pilfering millions of dollars from customers who used their credit cards at a handful of different retailers. Now, those stores included TJ Maxx, BJ's Wholesale, and Barnes Noble, which millions of people use every year. Now, even though this particular scam allegedly took in more than $41 million, security experts say that's just a blip on the radar screen. According to the research, identity theft and credit card scams is a multi-billion-dollar business, and for those who are in the know, That is big money, and it's your money. Joining me now to talk more about this is personal security and identity theft expert Robert Siciliano. Of course, millions of dollars scammed from our credit cards. This is a huge business. How vulnerable are we really?
We are very vulnerable, unfortunately. Really, anytime you ever hand your credit card to any store clerk, there's a possibility that card number can be compromised, whether it is the store clerk themselves, the waiter, waitress, or gas station attendant, or criminal hackers that are accessing these huge databases that have millions of credit cards on them. Those databases are only secure as the information security professionals that are responsible for keeping that data safe.
And is it more of a question of those types of databases, which is a, a, a, a crime that is taking place on a secondary level, or is it right there on the front line where people are handing over their credit cards and those numbers are being compromised right there.
It's really both. You know, what's happened over the past few years is criminal hackers have changed their motivation. Back in the day, they were seeking fame. Now they're seeking fortune. So they've changed their motivation, and they're going after elephants, they're going after big fish, and they're going after huge, huge databases that have millions and millions of credit cards on them. And they're doing this to a tune of about $50 billion a year lost every year.
We use our credit cards every day, and certainly— this in today's time, a lot of people don't even carry cash anymore because they simply use their credit card. Have we not become so sophisticated already that there are better protection measures out there for the American public?
Unfortunate fact is that the speed of the technology that we use every day has far surpassed the security necessary to infinitely keep these— this information safe. So the speed of technology is far faster than security is.
Alright, and so with the speed of technology and with us using it so much, are these numbers being sold? Has there been any evidence that people are taking these numbers and then selling it to others, or is it just hackers who are getting into the system?
It's a little bit of both. It's hackers getting into the system, and they're actually selling our information live on the internet in Internet Relay Chat rooms. Generally, a name, address, and credit card information is about $10 to $15.
And how can that be? I mean, if something is being sold in a chat room or over the internet, It seems as though federal agents would have an opportunity, certainly would be able to gain access to that and stop it.
They certainly do have access, but they don't have the ability to completely stop it. Remember, this is being done anonymously over the wild, wild web. And as a result, you have criminals in organized web mobs that are working in tandem all over the world, and so it's very difficult to track these hackers down.
I know people who've had their security card numbers, their credit card numbers, uh, compromised. It is a nightmare trying to rectify this problem. Has that gotten any easier for the consumer? Because it's basically like they're being victimized all over again when they complain and say, look, I didn't do this, but then you've got to go through a year or two just trying to prove it.
It is unfortunately one of those crimes where you are guilty until proven innocent, and many people spend hundreds of hours trying to clean up their good names. Most credit card and debit card and banks, they have zero liability policies that as long as you refute those unauthorized charges within a 60-day period of time, generally you're going to be in pretty good shape. But once they get your Social Security number and they start opening up new accounts under your name, then it can take years.
What do you see down the road? Do you see this getting any better? I mean, we know the problem is out there. It's been out there. This is not a new, uh, story that we're doing here, but it's an ongoing story.
It's an ongoing story that unfortunately is going to get a lot worse before it gets any better. It really does boil down right now to the consumer to protecting themselves by putting fraud alerts on their own credit reports so that anytime anybody tries to open up new credit under your name, you will be contacted prior to that new account being opened. Other than that, as far as credit card fraud goes where they are using your existing cards, you need to pay very close attention every single month, even every couple of weeks online to your statements, making sure that there aren't any unauthorized charges and refuting those charges within a 60-day period of time.
I know people who've used those fraud fraud alerts, those seem to be pretty effective.
They really are, as long as you do it every single 90 days, because they do expire, or you invest in companies that will provide you with an ongoing continuous fraud alert that doesn't expire.
Right, and those companies charge, for what it's worth, a nominal charge for that. Seems to be money well spent.
Generally it's about $10 a month or $99 a year, and that really is a good way to invest in your own personal security. Nowadays, not having some type of identity theft protection, in my opinion, is just They're responsible.
Alright, well Robert Siciliano, thank you very much for helping us to sound this alarm and to put people on the alert that it's still out there. No matter how often we talk about it, credit card theft is still very rampant in America. Thank you very much.
My pleasure.
Okay, so it can happen to anyone. If it happens to you, you could face years of lost money as we said. It also takes a lot of your time and energy and frustrations to try and restore your good name. So while there are no guarantees, you can take some precautions, like for example, being watchful of those so-called shoulder surfers. You know, the ones who stand behind you and look while you're trying to do your business, and they're standing close by, and then they will take your PIN number. Also, know exactly where your credit card receipts are. Some still show the full account number on them, so look at that very carefully. Also, the expiration dates, and store them away. And once you have reconciled your bill Shred them. Get rid of the evidence. Now, if you don't have one, try to build a shredder, buy a shredder, and you can get one and you can shred everything. Your old bank statements, your everyday bills, your pre-approved credit card offers that come in the mail, and we get those all the time. Get rid of that stuff. Shred it. Also, write clearly on all credit applications to be consistent and complete, and then fill in all credit and loan applications using your full name, your first, middle, and last name. Every bill that comes to your house should be exact— addressed exactly the same way. That'll help you if someone is trying to compromise your identity. And then keep a close eye on your credit accounts. That way you'll know if a bill is missing or if there has been an unauthorized purchase that you didn't make. And then don't forget to close out unused credit cards. Just cut 'em up and get rid of 'em because you can never be too safe.
