What Comerica Debit and Credit Card¹ Customers Need to Know About the Home Depot Breach

As you may have seen in the news recently, Home Depot has reported a security breach impacting some 56 million credit and debit cards of customers who shopped in their stores between April and early September, 2014. On September 18, Home Depot indicated that malware, which was present on its payment systems between April and September, has been eliminated from its networks.

Comerica works hard to protect the security of our clients and your information and we continue to do so in the wake of this incident. While we believe the impact to our customer accounts has been limited, we are taking every precaution to ensure your financial safety.

As part of our ongoing commitment to our clients, we wanted to ease any concerns you might have as a result of this situation. We will continue to provide updates as we receive more information, but to get up to speed, please reference the details we’ve provided below.

In the meantime, you should feel comfortable using your Comerica Cards –  Credit¹, ATM and Check Cards, and the prepaid Convenience Cards² and Independence Cards² – as usual but, as always, be sure to regularly review your account activity and report any suspicious activity. There is no need to contact us unless you notice irregular or fraudulent activity on your account. Those customers who have been impacted will be notified directly.

What you need to know:

1. First and most importantly, as a Comerica client, you have zero liability³ for any fraudulent purchases made to your Comerica credit or debit account. Our Zero Liability policy³ applies in this instance and anytime unauthorized purchases are made on your account.
2. Comerica is committed to the security of our customers and will continue acute monitoring of customer account activity for irregularities. Those accounts that may have been impacted by the Home Depot breach will be monitored with particular scrutiny as we work to identify any customers at risk.
3. If we believe your card is at risk, we will let you know. Over the next several days or weeks, Comerica will continue the process of identifying cards that have been compromised.
4. Comerica will begin replacing those cards that have been compromised and are now determined to be at risk.
5. Customers who shopped at Home Depot online or internationally were not impacted.

What you need to do:

• Continue using your Comerica credit, debit and prepaid cards with confidence.
• As always, monitor your accounts on a regular basis for any suspicious or fraudulent activity.
• You do not need to contact us unless you notice unusual purchases or fraudulent activity on your account. We will contact you if we determine you are at risk.
• You do not need to change your PIN (for a debit card), unless contacted by Comerica and instructed to do so.
• You do not need to replace your card, unless contacted by Comerica and instructed to do so.
• We are analyzing lists of potentially affected cards and will alert any affected clients if their card will be closed and replaced.

Who to Contact if you detect fraudulent activity on your account:

If you notice any purchases on your Comerica account that you did not authorize, promptly call the appropriate number as indicated below to report suspicious activity:

• Check Card or ATM Card: 800-572-6620
• Credit Card: 866-486-1015
• Convenience Card: 855-745-4473
• Independence Card: 855-675-7857
• Commercial Card and Workplace Card: 800-759-9610

For additional details, please see the Frequently Asked Questions (FAQ’s) below. For more information on protecting yourself from fraud, please visit our Fraud Awareness Page in the Comerica Knowledge Center at comerica.com/welcome.

Q: Media reports are stating that Home Depot experienced a security breach. Can you provide more specifics?

A: Yes, Home Depot has informed us that it experienced unauthorized access to its payment systems.

• Although certain cards and accounts may have been compromised, that does NOT mean that your card information was stolen:
  1. NOT all cards used at Home Depot in the specified time period were compromised.
  2. It is possible that your card was NOT compromised.
  3. If your account data was taken, that does NOT necessarily mean that fraud has occurred on your account.
• Please be assured that we are actively monitoring the activity on your account to protect you from fraud. You will be contacted if we detect any activity that requires you to take any action.
• In addition, please review your account information both online and in your monthly statement and call us back immediately if you see any suspicious activity (800-572-6620).
• Please note that all Comerica credit and debit cards are protected by our Zero Liability³ policy. So, in the rare event that fraud does occur, you pay nothing for unauthorized purchases on your account if you report them to Comerica promptly.

Q: Can you tell me if my card information was stolen in this incident or has been used fraudulently?

A: Unfortunately, not.

• Although some cards may have been compromised by this incident, it does not mean data related to your account was taken, or that fraud has occurred on your account.
• Please be assured that we are actively monitoring the activity on your account and continuing to work to protect you from fraud.
• As always, please monitor your account carefully both online and in your monthly statement and call us back immediately if you see any suspicious activity (800-572-6620).
• All Comerica credit and debit cards are protected with the Zero Liability³ policy. This means that in the rare event fraud does occur, you pay nothing for unauthorized purchases on your account.

Q: I recently noticed fraud on my account. Is this fraud related to the recent incident?

A: At this time, it is unclear whether any fraud on your account is related to the incident in question.

• It is important to know that regardless of where the fraud occurred, you are protected by Comerica’s Zero Liability³ policy.
• Have you already reported fraud on your account? If not, please contact one of the numbers indicated below:

Check Card or ATM Card: 800-572-6620
Credit Card: 866-486-1015
Convenience Card: 855-745-4473
Commercial Card and Workplace Card: 800-759-9610

Q: How did this happen?

A: Home Depot has confirmed its awareness of unauthorized access to payment card data across many of its U.S. and Canadian stores, impacting about 56 million payment cards. Home Depot said the criminals involved in this cyber-attack used custom-built malware on its systems.

• This may have impacted certain guests making credit and debit card purchases between April and early September, 2014.
• Please review your account activity carefully and on an ongoing basis, as well as your monthly and/or online statement. Call us immediately if you see any suspicious activity (800-572-6620).
• While fraud resulting from data compromises is rare, it’s important to understand that you’re protected with Comerica's Zero Liability³ policy.

Q: How many cards were involved in the incident?

A: Home Depot has confirmed the breach, indicating that about 56 million payment cards were exposed in the data breach at its U.S. and Canadian stores.

Q: Is it safe to shop at Home Depot?

A: Consumers should feel safe using their Comerica cards anywhere.

Q: Has the security breach been fixed?

A: Home Depot has indicated that malware, which was present on Home Depot's payment systems between April and September, has been eliminated from its U.S. and Canadian networks.

Q: What part of my information was stolen?

A: At this time, Home Depot has not provided any information on this topic.

• It’s important to note, though, that although your information may have been compromised, it does not necessarily mean fraud has occurred or will occur on your account.
• We are actively monitoring the activity on your account and working to protect you from fraud.
• In the event any fraud occurs on your card, all Comerica credit and debit cards are protected with Comerica’s Zero Liability³ policy, which means you pay nothing for fraudulent activity on your account.
• Please continue to monitor your account and notify us immediately if you notice any charges to your account that you don’t recognize (800-572-6620).

Q: What is the likelihood that I may become a victim of identity theft as a result of this incident?

A: We do not have any related information at this time.  At this time, Home Depot has not confirmed the compromise of any personally identifying information.

• Please continue to monitor your account for any fraudulent charges.
• Additionally, it’s always a good idea to regularly check your credit report for inaccurate information. In fact, you’re entitled to one free copy of your credit report every year at www.annualcreditreport.com or by calling 1(877) 322–8228.

Q: If I become a victim of identity theft, how will you help to restore my good name?

A: In the unlikely event you become a victim of identity theft:

• Comerica works with the consumer network group, ITAC Intersections, to assist identity theft victims.
• If you call Comerica to report identity theft, our customer service representative will put you in contact with ITAC.

Q: What are you doing to protect my personal account information, especially in this case?

A: Comerica offers consumers multiple layers of security protection against fraud, including our Zero Liability³ policy, the cardholders’ ultimate protection. With Zero Liability, consumers are not responsible for any unauthorized purchases made on their Comerica cards, as long as such charges are reported promptly to Comerica.

Q: What can I do to ensure this doesn’t happen to me again?

A: We employ the latest systems and technology to monitor and prevent card fraud. Merchants also take the necessary precautions to protect your card information. However, there are some practical steps you can take to help protect your card information:

• Shop with merchants you know. If a deal seems too good to be true, it probably is.
• Check your account statement promptly and immediately report any transactions you don’t recognize.
• Guard your card – don’t use it as collateral or give out your card number to someone over the phone, unless you initiated the call for a purchase.
• Check your credit report at least annually to ensure its accuracy.

Q: What should I do if I experience fraud on my account?

A: Please monitor your account on an ongoing basis – both online and on your monthly statement – and contact us immediately if you see unauthorized transactions (800-572-6620).

Q: Are there any other tips you can provide to reduce my chances of becoming a victim to card fraud?

A: Yes. There are several actions you can take to protect your personal information. These tips are also available at www.visa.com.

DO...

• Shred all personal and financial information such as bills, bank statements, ATM receipts, and credit card offers before you throw it away.
• Keep your personal documentation (e.g., birth certificate, Social Security card, etc.) and your bank and credit card records in a secure place.
• Call the post office immediately if you are not receiving your mail. To get the personal information needed to use your identity, a thief can forge your signature and have your mail forwarded.
• Be aware of your surroundings when entering your Personal Identification Number (PIN) at an ATM.

Disclosures:

1 Elan Financial Services, Inc. is the creditor and issuer of these credit cards offered by Comerica, pursuant to a license from Visa U.S.A. Inc. Comerica Bank and its affiliates are not affiliated with Elan Financial Services. Certain conditions and exclusions apply. Details of coverages are provided in the Terms and Conditions.

2 The Comerica Convenience Card and Comerica Independence Card are offered through Elan Financial Services, Inc. pursuant to a license from Visa U.S.A. Inc.

3 Visa’s Zero Liability Policy protects you against liability in the event of fraud when using your Check Card for signature or PIN purchases. Visa’s Zero Liability Policy does not apply to some commercial card transactions, ATM transactions or PIN transactions not processed by Visa. However, Comerica provides additional protections for fraudulent signature or PIN purchases with your Check Card or ATM Card (ATM transactions are not covered). For a complete disclosure of limitations regarding unauthorized transactions, see your Business and Personal Deposit Account Contract. For Consumer and Small Business credit cards you are protected by Visa Zero Liability. Covers U.S. issued cards only. Does not apply to ATM transactions or PIN transactions not processed by Visa. You must immediately report any unauthorized use. Other conditions apply. Visit Visa.com for additional details.

Comerica Commercial Cards and Comerica Workplace Cards are issued pursuant to a license by MasterCard® International Incorporated. For a complete disclosure of limitations regarding unauthorized transactions, Workplace Card cardholders should refer to their Terms of Use or Cardholder Instructions. Zero Liability does not apply to Commercial Cards. Comerica Commercial Card customers may avoid liability for unauthorized transactions by complying with the timely notification requirements outlined in their Card Agreement and/or Card Terms (Comerica Card Solutions Terms or Comerica Treasury Management Services Master Agreement for Corporate Card, Multi-Card, Purchasing Card, Fleet Card, and Commercial Card). Comerica Commercial Card and Workplace Card customers should call 800-759-9610 to report unauthorized transactions.