Good pictures
Ben Langhofer, a financial planner and single father of three in Wichita, Kansas, decided to start a side business. He created a handbook for his family, core values, a mission statement and a constitution. He wanted to help other families put their faith in a real book.
So Langhofer hired web developers two years ago and set up a website, customer relationship management system and payments. He inaugurated it on Father’s Day MyFamilyHandbook.com. He has had some success and has talked to large groups about bulk orders, but business has been quiet so far.
Langhofer knew something was wrong on Friday, August 11, when a woman from California called about a fraudulent charge. He checked his merchant account and saw nearly 800 transactions.
“My heart, it sank,” Langhofer told Ars on Thursday. He immediately contacted his payment vendor, Stripe, who said they told him Card checkA scheme where online card thieves use small payments from an account to test valid cards. Stripe said it would issue a full refund, Langhofer said. He went into his weekend knowing that his payment processor was aware of the problem.
Langhofer woke up early Monday morning to a flurry of missed calls.
He said his site attempted nearly 11,000 transactions, at $1 each, most of which were initiated by email addresses. Many of those include Ally Bank cards, Langhofer said. He used to make only two phone calls to the forwarded number listed on his online store, but now his phone won’t stop ringing.
“My dad always taught me to have a good name, so this hurts,” he said. “I don’t have big employers, but I have a big name in Wichita in this state, and now that my business is tied up in this, I don’t know what to do next.” In text messages before the Ars Technica interview, Langhofer said the ordeal “consumed my entire week and caused more panic than I can remember in a long time.”
FOR SALE: Debit cards, rarely used
Langhofer’s business appears to have been hit by a chain of frauds that have affected thousands of debit card customers over the past week. Most prominent among them are Alli Bank customers Tweeting and posting r/AllyBank subreddit Regarding card charges, some of them are not activated or used. They have reported (and Ars Technica has seen) phone support wait times of an hour or more.
There is an overwhelming feeling that something is happening, but the major parties have yet to confirm anything.
Ars Technica reached out to Ally Bank multiple times by phone and email for comment on this story. We’ve also contacted Shopify. We’ll update this post if we hear back.
Two of those wondering what’s going on are Stephen Fuchs and Kurt Grimes, a Chicago-area couple who spoke with Ars Technica and shared their papers. In March 2022 they opened a joint joint checking account. Both had debit cards linked to them, each with different numbers. Fuchs never activated his card. Until last week, Grimes had only used her card once and sent about $5 to someone through Apple Cash.
On August 10, a $15 charge from a quirky software site appeared on one of their cards, but went unnoticed. On Friday, August 12, Grimes received an SMS fraud alert from Ally, alerting her to charges of nearly $200 from two different Shopify stores. Grimes flagged the charges as fraud, and Ally (and Apple Pay) reported that the card was suspended. After waiting on the phone for Allie for nearly an hour on Saturday, August 13, Grimes declined the earlier $15 charge and saw a new card arrive with a new number.
