We have a Citi Mas­ter­Card that was one of the (appar­ently) hun­dreds of thou­sands whose secu­rity was com­pro­mised in the recent Heart­land Secu­rity Breach.

I’d heard the news about the breach, but the first sign I had that we were involved was when I tried to use the card for an online pur­chase. No email, no phone call, noth­ing from Citi regard­ing the prob­lem. When the trans­ac­tion failed three or four times I knew it wasn’t the ven­dor website’s fault, so I checked my Citi account online. There I saw a bright red warn­ing that my account had been shut down because of risk of compromise.

When I called (this was back on Feb­ru­ary 20^th or so, I think) to com­plain about the lack of notice, the cus­tomer ser­vice rep­re­sen­ta­tive explained that Citi had no time or resources to notify all the card­hold­ers, espe­cially given the scale of the pos­si­ble breach, but had rather acted to place all the pos­si­bly com­pro­mised accounts on hold as soon as they could. I was told they had issued new cards with new account num­bers, at no charge to any of us, and that the new card would be here shortly.

Well, we got the new card, and we acti­vated it and set up online access.

Inter­est­ing thing we dis­cover, which (aside from the gen­eral lack of cov­er­age of the Heart­land fiasco in the press and blo­gos­phere) is why I’m both­er­ing to write this: a strange charge we didn’t rec­og­nize, with code TOTAL SEC BALANCE TRANSFR-ITEMIZED. The amount charged ($99) was the same as the new charges that had accrued on the old account before the trans­fer, but “99” is one of those num­bers that makes you won­der about inten­tional design. In any case, this clearly implied we had either been double-​​charged, or charged an extra and unau­tho­rized $99 fee.

So I got back on the phone and called cus­tomer ser­vice just now, and spoke with Jim. He explained to me that TOTAL SEC BALANCE TRANSFR-ITEMIZED was a “sys­tem mes­sage”, which rep­re­sented (as it seemed) the sum of items booked to the old closed account just before the new one was set up. He explained it was an “account­ing quirk in their sys­tem”, and that it would dis­ap­pear at the begin­ning of the next billing cycle. Mer­chants had autho­rized $99 worth of charges right before the account was closed and bal­ances were trans­ferred, and the mys­te­ri­ous line item indi­cated the tran­si­tion from “autho­riza­tion” to actual charge. Jim explained that gen­er­ally this tran­si­tion removes the autho­riza­tion charge from the billing sys­tem, but because the account changed in the interim period, the charge accrued on the new account but the autho­riza­tion couldn’t be removed from the old one (or some­thing like that). He pointed out (very help­fully) that if my card had been mis­placed or stolen, the same dynam­ics would have kicked in there, too, and the same sort of trans­ac­tions would have happened.

This got me think­ing. It may be ephemeral, a “quirk of the sys­tem”, but nonethe­less on the books and until the autho­riza­tion is cleared I owe an extra $99 to Citi. It’s mere coin­ci­dence of tim­ing that our account came to $99. But it seems highly likely (given the several-​​days typ­i­cal delay between autho­riza­tion and charge in many mer­chants’ trans­ac­tions) that any reg­u­lar card­holder might have one or more trans­ac­tions span­ning a period like this.

So here we have hun­dreds of thou­sands, or mil­lions of credit card accounts, all com­pro­mised and all syn­chro­nously being trans­ferred to new accounts. What frac­tion of those had inter­rupted trans­ac­tions span­ning the syn­chro­nized trans­fer, result­ing in these TOTAL SEC BALANCE TRANSFR-ITEMIZED “sys­tem messages”?

The num­bers are hard for me to even esti­mate with the infor­ma­tion I have on hand (though Jim did allow it was “really a lot” of cards). Seems big.

The thing I have to won­der about is: just at this cru­cial junc­ture in the finan­cial cri­sis, when the com­pany is under the clos­est scrutiny in decades and the stock is suf­fer­ing from mas­sive loss of investor faith, Citi has double-​​booked a siz­able Accounts Receiv­able sum.

And prob­a­bly not just Citi.…