More on debit cards

My USA Today column this week goes a bit more in depth into what’s going on in the world of debit-card theft.

Here’s the sticking point: The transaction processor should discard the card information and PIN block after the purchase. But not all do. They might keep it for hours, days, or longer.
If someone was able to get hold of that database as well as the decryption key (which could, foolishly, be stored on the same system), he could crack the keys’ encryption and create working counterfeit cards.

Someone was doing just that.