Debit card fraud leaves Ally Bank customers and small shops in shock

Enlarge / Ally debit card owners report fraudulent charges at a steady rate over the past week. Getty Images

Ben Langhofer, a financial planner and single father of three in Wichita, Kansas, decided to start a side business. He had made a manual for his family, setting out core values, a mission statement and a constitution. He wanted to help other families put their beliefs into a real book they could hold and display.

So Langhofer hired web developers about two years ago and set up a website, customer relationship management system, and payment processing. On Father's Day, he launched MyFamilyHandbook.com. He's had modest success and has spoken with larger groups about bulk orders, but business has been pretty quiet so far.

That's how Langhofer knew something was wrong on Friday, August 11, when a California woman called in on a fraudulent charge. He checked his merchant account and saw almost 800 transactions.

Enlarge / One of thousands of charges sent from Langhofer's site earlier this week, as seen in a customer's Ally Bank app.

“My heart, it sank,” Langhofer told Ars on Thursday. He immediately contacted his payment provider Stripe, who he said told him about card testing, a system in which online card thieves use a tiny fee from an account to test valid cards. Stripe said it would issue a bulk refund, Langhofer said. Knowing that his payment processor was aware of the problem, he spent his weekend.

Langhofer woke up early Monday morning to an avalanche of missed calls.

He said his site attempted almost 11,000 additional transactions, each for $1, most initiated by email addresses that were very different from each other. Many of them involved Ally Bank cards, Langhofer said. He had only received two phone calls to the forwarded number listed in his online store, but now his phone kept ringing.

“My dad always taught me to have a good name, so it hurts,” he said. "I don't have a big staff, but I have a big name in Wichita, in this state. Now my business is tied to this, and I have no idea what's next." In text messages ahead of an Ars Technica interview, Langhofer said the ordeal "consumed my entire week and caused more panic than I can remember having had in a long time."

For sale: debit cards, very little used

Something's up with @Ally - fraud tweets giant spike yesterday. Has there been a data breach? cc @briankrebs @zackwhittaker @ericgeller @campuscodi @lorenzofb @lhautala @a_greenberg @nakashimae @Joseph_Marks_ @AllyCare