I need some help. I’m hoping that some of y’all who understand this a little better than I do can shed some light on this situation. Today I got an email alert from my bank telling me that a “card not present” transaction occurred on my bank card. The amount was small, I knew that I hadn’t done it so a red flag was immediately raised. I then called my wife to see if she had bought something online and she hadn’t. I searched my little brain to see if I could remember anything that I did over the weekend that may account for the charge but nothing came up. Next I called the number that was listed by the transaction and got a couple of busy signals and then a “this is not a working number” message. I called my bank and told them what Ii suspected and had a temporary lock put on my card.

I continued to try and call the company that had made the charge and finally got through and they explained that the charge was a mistake and that it would be corrected. When I asked them how this mistake happened I was told that they were a marketing firm and one of their “partner” marketing firms had sent them a database with customer info and it had mistakenly gone to accounting for billing instead of going to the marketing department for marketing. Obviously my next question was “why does marketing info include credit card info?” Of course she didn’t know because she is only customer service. I had one more question that needed answering. “Who was the company that sent the database?” Of course I didn’t get an answer to that either. They have partnerships with over 150 other firms and it could have been any of them.

I decided not to press it at this time because I’m on a bus full of people who don’t need to know my business and surely don’t want to hear me get upset with this nice customer service rep. So I’ve decided to wait until a better time to discuss this with them.

My question is what reason is there for one company to send a database with card info to another company for marketing purposes? Does anyone out there know? I also have a slew of other questions. How was the database sent? Via email? Was the database encrypted? Are the companies involved PCI compliant? Wait, that doesn’t really matter does it? How about this, are the companies involved practicing good security? Scratch that one also. Obviously at least one of them isn’t doing such a hot job of it. What about the company that received the database? Who there now has access to my card info? What is that company doing to secure my data now?

AS I mentioned I’m not through with this. I want to know who the company is that sent the data. I want to know how and why this happened. I want to know why they still have my card info on file and what their retention policy is.  I want to know what they are doing to prevent this from happening again.  I also want to know about disclosure. What are they going to do to protect me? I guess I know the answer to that one already. If anything they will give me a free year of credit monitoring. Yeee Ha!

I guess I’ll make my temporary hold a permanent cancellation and cancel my wifes card as well. Considering that with all the breaches of late (including the new one that hasn’t been “officially” announced) the card is probably compromised anyway. :(