Someone I know was stolen a few hundreds dollars from a savings account. Looking at the history, she saw transactions like Uber rides and video games purchases she did not do. This account is used strictly for investing and is only accessed from her iPad. The only access card is in a drawer in her home and has never been used in a terminal. I know you can use hacked terminals to clone cards and steal PINs but my understanding is you need to actually swipe the card somewhere for this to happen. Appart from an internal data leak at the bank, is there any other possible explanation?
In theory, you only actually need the routing number and account number to issue a transaction (note that this is most of how transactions with cheques work).
If there's a card, there's also another set of numbers you can use, namely the card number and expiration date (and usually the cardholder name and possibly the CVV, this is how most online transactions work). You may not even need the PIN for the card here either, as a lot of banks will let you make 'credit' charges on a debit card (and most ATM cards anymore are debit cards too).
This then comes down to how those numbers may have gotten out, and there are five possibilities I can think of here:
- An attack on the investment firm the account is used with. Statistically not very likely IMO, but still theoretically possible.
- A phishing attack on the account holder. In most cases, people will not willingly tell you if they've had this happen, so you may need to dig a bit to get them to tell you if this is the case.
- An attack on the bank the account is with. Less likely even than an attack on the investment firm, but still a remote possiblity.
- A rogue employee at either the investment firm or bank.
- A relative or friend who has visited the victim recently.