Getty Images
Ben Langhofer, a financial planner and single father of three in Wichita, Kansas, decided to start a side business. He had prepared a handbook for his family that contained core values, a mission statement, and a constitution. He wanted to help other families process their faith in a real book, a book they could hold and display.
So Langhofer hired web developers about two years ago and set up a website, customer relationship management system, and payment processing. On Father’s Day, he launched MyFamilyHandbook.com. He has had some modest success and has spoken to larger groups about bulk orders, but things have been largely quiet so far.
For example, Langhofer knew something was wrong on Friday, August 11, when a California woman called about a fraudulent charge. He checked his trading account and saw nearly 800 trades.
“My heart has sunk,” Langhofer told Ars on Thursday. He immediately contacted his payment vendor Stripe, who told him about card testing — a scheme where online card thieves use small amounts of an account to test for valid cards. Stripe said it would make a bulk refund, Langhofer said. Knowing that his payment processor was aware of the issue, he went about his weekend.
Langhofer woke up early Monday morning to a series of missed calls.
He said his site had attempted nearly 11,000 additional transactions, each for $1, most initiated by email addresses that are minutely different from each other. A lot of them related to Ally Bank cards, Langhofer said. He’d only called twice to the forwarded number listed on his online store, but now his phone kept ringing.
“My dad always taught me to have a good name, so this hurts,” he said. “I don’t have a great staff, but I have a great name in Wichita, in this state. Now my company is involved in this, and I have no idea what’s next.’ In text messages for an interview with Ars Technica, Langhofer said the ordeal “took up my entire week and caused more panic than I remember in a long time.”
For sale: debit card, barely used
Langhofer’s company appears to have been the victim of a chain of fraud that has affected thousands of debit card customers in the past week. The most prominent among them are customers of Ally Bank, which already tweet and posting in the r/AllyBank subreddit about card charges, some of which were never activated or used. They’ve reported (and Ars Technica has seen) wait times for phone support of up to an hour or more.
There is an overwhelming sense that something is going on, but for days the major parties had yet to confirm something.
(Update 4:56 pm: An Ally Bank spokesperson said in a statement: “Across the board, the financial services industry is experiencing an increase in debit card fraud caused by malicious parties.” The statement stated that unauthorized transactions reported within 60 days of a statement will result in a new card and refunded fees.
The statement added, “Call centers are experiencing longer than usual wait times due to nationwide staffing challenges coupled with an increase in call volume. This is not unique to Ally.”
Two of those wondering what’s going on are Stephen Fuchs and Curt Grimes, a Chicago couple who spoke to Ars Technica and shared their documentation. They opened their joint Ally checking account in March 2022. Both were linked to debit cards, each with a different number. Fuchs never activated his card. Until last week, Grimes had only used his card once to send about $5 to someone via Apple Cash.
On August 10, a $15 bill from a quirky software site appeared on one of their cards, but it went unnoticed. On Friday, August 12, Grimes received a text fraud alert from Ally, warning him about charges from two different Shopify stores nearing $200. Grimes flagged the charges as fraudulent, and Ally (and Apple Pay) reported that the card had been suspended. After waiting nearly an hour on the phone for Ally on Saturday, August 13, Grimes disputed the previous $15 charge and noticed in his Ally app that a new card with a new number was on the way.
