Revolve Group says an unauthorized actor may have obtained payment-card numbers and expiration dates belonging to some customers who saved payment information in their online shopping accounts. Names and contact information may also have been obtained.
For customers, the immediate question is whether a saved card needs attention and how to respond if an unfamiliar charge appears. Federal consumer protections differ for credit and debit cards, and a credit freeze serves a different purpose from replacing a compromised card.
What Revolve disclosed
In its SEC filing dated October 29, Revolve says it discovered unauthorized access to certain systems, remediated the activity, notified federal law enforcement and brought in outside cybersecurity experts.
The filing describes automated access involving certain customers with saved payment details. It does not identify every shopper as affected, give a nationwide customer count or establish that exposed card details were subsequently used for fraudulent purchases.
A sample customer letter filed in Massachusetts names Revolve.com and FWRD.com and identifies the affected payment card by its last four digits. Those digits help a recipient match the notice to a card; the letter describes the information involved as the card number and expiration date, not just the last four.
Revolve says the incident did not interrupt customer service. That statement concerns its operations; it does not determine whether an individual cardholder needs to dispute a transaction.
Check the card account, including small charges
The Consumer Financial Protection Bureau advises reviewing account activity and reporting suspicious transactions promptly. Check unfamiliar merchant names and small amounts as well as large purchases. The agency warns that thieves sometimes test a small transaction before taking more, and fraudulent activity can appear months after information is stolen.
If an unauthorized charge appears, contact the issuer immediately about canceling and replacing the card. Keep the statement, correspondence and dates of calls. If the number changes, update legitimate automatic payments linked to the old card.
Credit cards: call, then protect your written-dispute rights
The CFPB says a consumer is not responsible for unauthorized charges when only the credit-card account number was stolen. If the physical card was lost or stolen too, potential liability can be up to $50.
Calling promptly starts the conversation, but the bureau's credit-card dispute guidance also calls for a written billing-error notice within 60 calendar days after the charge appeared on the statement to protect your rights. Ask the issuer where to send it and retain a copy.
The issuer generally has 30 days to acknowledge the written dispute unless it has already completed the required resolution procedures. A charge can still be disputed after it has been paid, although repayment may depend on the issuer's decision.
Debit cards: the reporting clock depends on what was stolen
For an unauthorized debit when you still have the physical card and neither the card, security code nor PIN was lost or stolen, CFPB guidance says to notify the bank immediately and, at the latest, within 60 days after it sends the statement showing the transaction. Waiting longer can expose you to additional losses.
Losing the physical debit card, security code or PIN creates a shorter clock. Reporting within two business days limits potential liability to no more than $50; delay after a lost card can raise it to as much as $500. These are liability limits under specified circumstances, not a reason to postpone a report.
A bank generally has ten business days to investigate an unauthorized transaction. If the investigation takes longer, ask what temporary credit applies and when you should expect its findings.
A credit freeze does not block use of an existing card
A credit freeze restricts access to your credit file and can help prevent someone from opening new credit accounts in your name. It does not prevent takeover of an existing account. Freezes are free, but you must contact Equifax, Experian and TransUnion separately to freeze all three reports.
Contact financial institutions through their official websites and phone numbers. The CFPB warns that scammers impersonate banks and government agencies after claiming to have found identity theft. A demand to move money to protect it is a scam. If someone has used your identity, IdentityTheft.gov provides a recovery plan based on what happened.
Watch the FTC's What To Do After a Data Breach video for general recovery guidance. Its examples cover several kinds of exposed information, beyond the card details described in Revolve's notice.
