Citizens Bank Debit card security worries me

A few weeks ago (on December 9th), I was reviewing my Citizens Bank checking account history online when I saw two transactions that didn't belong to me.  They were debit card (MasterCard) charges from an online grocery store in another state, halfway across the country.  They were posted on 11/27 and 11/28 for about $260 and $11 respectively.  I'm going to be vague about the amounts and the identity of the online grocery.   The online grocery made an honest mistake and did everything they could to rectify the matter with in a day.

I immediately called the 800 number on the back of the debit card.  The customer service rep told me that I needed to file a fraud report.  We could do it over the phone, but since it would need to be notarized, it would be faster to go a local branch office and file the report there.  I then asked to have my debit cards reissued to prevent any additional transactions from going through.

The next day, I went to local branch of Citizens Bank and filled out the fraud report.  I was told that I would get a provisional credit for the amount that was taken out within 10 business days.  It would take 45 days for the fraud report to be processed.

On 12/17, my replacement debit card arrived in the mail.  There was no sign of my wife's debit card.  I called the 800 number again and I was told that only my card was reissued.  I explained why I needed both cards reissued and they said they would do a rush order on my wife's debit card and they would waive the rush order fee. 

On 12/20, my wife's card came in and I went online to verify that we were not being charged the additional fee.  I saw that fee had been applied and immediately afterwards a credit for the fee had been applied.   Then I saw another charge from the same online grocery store, dated on 12/18 for around another $250.  I called the 800 number and I was told that I would have to file a second fraud report.  Since it was in the evening, this would have to wait until the next day.

Since the fraud department at Citizens Bank was not acting fast enough, I decided to start my own investigation.  I found the home page for the grocery outfit and called their customer service number.  I left message that several fraudulent charges had been placed on my wife's debit card and I requested that someone from that company to call me.

A few hours later, I received a call from "Dan" (not his real name), the owner of the company.  He had received the message and wanted to make sure that his company had not charged the wrong person.  I gave him enough information to prove that he had indeed charged my wife's card for three separate amounts.  After some research on his part, we determined that the transactions occurred when his customer transposed two digits of his credit card number when he had placed the order.  The two subsequent charges occurred because the number had been stored in the grocer's system.

I had several conversations with the owner and the directory of finances for this company and they said that they were changing their credit card processing to apply additional checks to accidental or fraudulent use.  They immediately credited back the three transactions to my wife's canceled debit card number.  As of this date 12/28, they have not been contacted by Citizens Bank or Mastercard about these transactions

The next day (12/21), I went to the local Citizens Bank and explained what happened again.  They apologized for the problems with 800 department and called the fraud department while I was filling out the second fraud report.  They told me that the second report would be attached to the first report and I would get the provisional credit to my account that day.  The person at the fraud department had some of the more critical details wrong.  This did not leave me with a warm and fuzzy feeling.  The money was posted back to my account later that day.

I now check that account every day to see if any odd transactions will be posted.  On 12/26, the money returned by the grocery was posted to my account.  Now I had too much money in the account.  I called the local branch and they will reverse the transaction for the provisional credit.

Here's the part that really bugs me.   None of this should have happened.  The grocer should have validated the credit card number.  The name didn't match.  The shipping address didn't match.  And they didn't require the 3 digit Card Security Code from the back of the debit card.  Any of those checks would blocked the transaction from going through.  That was the first failure.

The next point of failure was when the credit card transaction was submitted.  My wife and I had used our debits on the same day the first transaction went through.  Mastercard or Citizens Bank should flagged the grocery transaction as suspicious and called me to verify the transaction.  We have never used our debit cards online and have never set foot in the state where the order was placed and shipped.

The last point of failure was with the customer service department at Citizens Bank that handles the debit cards.  When I made the first request to have the cards reissued, both cards should have been immediately reissued.  I had no way of knowing from my account history of which debit card number had been used, I wanted them both reset.

Right now my concern is that there is nothing in place with MasterCard or Citizens Bank to prevent something like this from happening again.