12/13/2017 in Hong Kong, I realize that what I thought was the PIN for debit card is not the PIN for the debit card.

I call Chase to get the debit card PIN. I make the call from my hotel room.

I give Chase debit-card services all identifying information for my debit card, including mother’s maiden name.

Chase debit-card services tells me they can’t send me my debit card number because my address has recently changed. This is odd because I haven’t changed my address recently. Debit-card services tell me that the address change came from the credit-card department, and begin to connect me.

I establish with the credit-card department that the “address change” was a switch from ZIP+4 to ZIP+6.

In this telephone call, which began with a call about my debit card, nobody says or inputs my credit card number.

For the six months before this I had had no contact with the bank about either card, and experienced no fraud.

The next day, December 14, 2017, there are three fraudulent charges to my credit card:

• $11,873.10 to MUSIC FOR BETTER LIFE in Switzerland (Tel. 41 79 954 8882—a cellular number)
• $72.50 to Omega Travel Ltd. in Great Britain (Tel. 0198685029)
• $1,763.44 to Omega Travel Ltd.

When my credit card stops working, I call Chase. At first I am unable to access my account because my mother’s maiden name has been changed.

Eventually I convince them that I am me, and learn that someone has accessed my account using my mother’s maiden name, and changed my mother’s maiden name. This required knowledge of a) my personal information; b) my credit-card number; and c) Chase’s internal procedures.

Who stole my identity, how do we know, and (for extra credit) why will Chase do nothing about it?