Spokesmen for the retailer and the largest U.S. card- issuing banks — JPMorgan Chase & Co., Bank of America Corp. and Citigroup Inc. — declined to comment yesterday on what types of suspected fraud, if any, have been seen. The firms have said they're taking steps to protect customers. Financial institutions often are first to detect hacks at retailers by tracing increased fraud tied to cards used at a common source.

Bank investigators have spotted card information being fenced on black market websites, according to the security blogger Brian Krebs, who first reported the breach. Criminals sometimes buy numbers, then manufacture fake cards they use to purchase gift cards and goods that can be resold.

Breaches can be especially burdensome for small banks as they cover fraud costs and reissue cards, said Viveca Ware, who handles regulatory policy at the Independent Community Bankers of America trade group in Washington.

"We're not happy that our institutions continue to incur costs related to breaches that they're not responsible for," she said. "We'd like to see a more efficient and timely restitution process."

--With assistance from Elizabeth Dexheimer and Matt Townsend in New York.