The rep who paid her light bill with customers' credit cards.

Springtime 2014, Houston.

George and Alicia Woods were doing the thing every parent of a senior does that time of year: planning a graduation. If you've been through one, you know the season. There's a guest list that keeps growing, a party to feed, a hundred small errands that all end with someone saying "just put it on the card."

And somewhere in the middle of all that, the Woods looked at their bank account and stopped.

There were charges they didn't recognize, and not just one of them. About $800 worth of spending that neither of them had done was sitting in the middle of their statement like it belonged there.

Every one of us has had that half-second of doubt. Did my husband buy that? Did I? You squint at the merchant name and try to make it fit your life.

The Woods family couldn't make it fit. They called the bank. The bank agreed: this wasn't them.

So the question became the one that makes this a story. Their cards were in their wallets. Nobody had stolen a purse. Nobody had skimmed an ATM.

The case landed with Harris County's Financial Crimes Unit, the people whose whole job is following stolen money backwards. And stolen card numbers always point somewhere. Every fraudulent charge is a breadcrumb: a merchant, a timestamp, an address.

These breadcrumbs pointed somewhere almost funny. They didn't lead to a hacker forum or some server farm overseas.

They led to a Papa John's on Beltway 8.

The Woods family had ordered pizza. They'd called it in, like you do, and read their card number to the young woman who answered the phone. Her name was Jolene Weisheit. She was 20 years old. And as ABC13 reported when the story broke:

"She would steal customer's credit card numbers while taking orders over the phone."

Think about the mechanics of a phone order for a second. A stranger calls you, and to complete the transaction, they recite the exact sequence of digits that unlocks their money. They say it slowly and clearly, and they repeat any part you didn't catch.

The entire security model is that the person listening writes it down, uses it once, and forgets it.

Weisheit didn't forget it.

What did she do with the numbers? This is my favorite detail in the whole case, the one a crime writer couldn't improve.

She didn't sell them on the dark web. She didn't wire money to an offshore account. She used other people's credit cards for the most ordinary life admin you can imagine:

• She paid her State Farm insurance bill with a customer's card.
• She paid her light bill the same way.
• She booked hotel rooms along Interstate 10 on numbers customers had read to her between the toppings and the delivery address.

Detectives love this kind of criminal. A stolen card used at a random big-box store points at nobody. A stolen card that pays Jolene Weisheit's own insurance policy and Jolene Weisheit's own electric bill points at exactly one human being in the state of Texas. The charges were a signed confession.

By the time investigators finished counting, they'd identified dozens of victims. Detectives arrested her and charged her with fraud. The Woods got their story for the local news, and the rest of us got the moral:

Nobody hacked anything. No malware, no breach, no headline word for what happened. Customers said their card numbers out loud to a person whose job was to listen. That's it. That's the whole crime.

Five years later and a thousand miles east, the same story ran again with a different logo on the building.

Belk, the department store chain, runs a call center on Richlands Highway in Onslow County, North Carolina. In January 2019, customers who'd called in started finding fraudulent charges on their credit cards, enough of them that sheriff's deputies came out to the call center itself.

The trail ended at a 28 year old customer service rep named Kaliesha Hightower, who, in the sheriff's office's words, "was ordering items for herself on customer's credit cards."

She turned herself in. Deputies charged her with four counts each of:

• Obtaining property by false pretense.
• Identity theft.
• Using an illicit card.

The sheriff's office put out a phone number for any other customers who thought their card might be next. It was the same crime all over again: a rep, a headset, and other people's credit card numbers.

And if store call centers and pizza shops sound small-time, stay with me, because this last one finished in a federal courtroom in July 2026.

In 2022, Citibank hired a new employee in Jacksonville. She went to work in the fraud department. Let that sink in for a second: the fraud department, the team that exists to protect customers' card numbers.

And she'd gotten the job using a stolen identity. Fraud had infiltrated Citibank's fraud department.

Her real name was Lexus Lewis. For six months, from November 2022 through April 2023, prosecutors say she did one thing with her seat inside the bank:

She "used her position to access customers' credit card numbers."

She didn't need a skimmer on a gas pump or a phishing email. The numbers came to her, all day, as part of the job. And just like the rep in Houston, what she spent them on is the tell:

• Jewelry and furniture, bought with customers' card numbers.
• Rent, travel, and living expenses, hers and other people's.
• Other people's rent in exchange for cash, which is how a stolen card number becomes clean money.

It ran for six months. When law enforcement finally confronted her, she admitted to her conduct.

On July 6, 2026, Lewis stood in a federal courtroom and pleaded guilty to wire fraud and aggravated identity theft. She agreed to hand back $463,619. She faces up to 20 years in federal prison, plus a mandatory two more, when the judge sentences her.

This story moved from a pizza counter in Houston, to a department store call center in the North Carolina pines, to a fraud department at one of the biggest banks in America. Those jobs have exactly one thing in common, and it's the thing that matters: the person in the seat can reach the card numbers.

Weisheit had to catch them as they flew by. Lewis could pull them up on a screen. The decade and the scale changed, but the open door stayed the same.

Here's why I know these stories cold, and why I read every one of them I can find.

I used to be the CEO of a company that took five thousand calls a week. We sold by phone. About one in five of those calls turned into an order. Which means thousands of times a week, a customer read a credit card number to one of my reps, digit by digit, exactly like the Woods family read theirs to the wrong person at a pizza shop.

We ran our phones on Zendesk Talk, and we recorded every call so we had the history and could train on them. Here's the thing about Zendesk Talk, though: out of the box, it doesn't redact credit card numbers from those recordings. It doesn't give you transcripts either. It just records, faithfully, everything your customers say.

More than once I woke up at night in a cold sweat about it.

It wasn't because my reps were bad people. They were great people. So were most of the coworkers of every insider in every case above. The problem was never the people. The problem was the math.

Because here's what I knew, lying awake at 2am: every one of those card numbers was also sitting in our call recordings. Every number was recorded, stored, and replayable.

The math

A rep having the worst month of their life, the month where the light bill wins, wouldn't even need to catch a number live like Weisheit did, or sit at a screen full of them like Lewis did. They could pull up any call, from any shift, and just listen, slowly and clearly, as many times as they needed.

If your team takes card payments over Zendesk Talk, that archive is sitting in your tickets right now, one click from every agent on every shift.

The card networks know this, which is why PCI rules flatly prohibit storing security codes after a transaction, and why their guidance says that where technology exists to keep card data out of recordings, you should turn it on.

I didn't need a rulebook. I pictured the version of this story with our name in it:

• The news segment, where the anchor says our company the way the reporter in Houston said "Papa John's."
• The state attorney general's office, on the phone, with questions.
• The letter to every customer we had, starting with "We take your privacy seriously."

What I wanted was simple: I wanted the numbers to not be there at all. If there's no card number in the recording, there's no story. Weisheit would have had nothing to write down, and Lewis would have had nothing worth pulling up.

The fix was CallTutor. Here is everything it does, in the order it happens:

1. Listens to each Zendesk Talk call after it ends, and transcribes it.
2. Finds the credit card numbers and bleeps them out of the audio and the transcript.
3. Posts the clean copy back to the ticket, a few minutes after hangup.
4. Deletes the unredacted original. There is no number left to replay.

Agents change nothing about how they take calls. Most of them never know it's there.

Redacting the recordings made me feel so much better that I bought the company behind it, and then rebuilt the whole service from scratch. That's not a figure of speech. I'm Doug, I run CallTutor, and the reason it costs $9 per Talk agent with no contract is that I priced it for the version of me who was lying awake at 2am.

Below is what a call looks like after CallTutor is done with it. The customer reads their card number. The recording keeps everything except the part worth stealing.