@Remedios wrote:
For cards that haven't been part of the breach, it's usually card number generator.
That is what it had to be in my case. I have never used that PenFed Debit Card (not sure I even activated it), and it never left my desk. The funny thing for me was that I got an automated call from “PenFed” about fraud, that I ignored and then immediately called their number on their website. The agent said that was a great practice. :-)
