Identity thieves can buy bank account details lawfully from ebay, craigslist, etc...

Anyone has the ability to purchase used ATM's from another individual with no regulation whatsoever. Most of the time these ATM's still contain all of the users bank info for at least the past 6 months. The short story is that for as little as $500 a person can lawfully purchase thousands of credit/debit numbers, personal info, bank account numbers & pins for thousands of users.
http://realtysecurity.com/blog/2009/11/17/i-bought-an-atm-off-craigslist-for-750-w1000-ccs-on-it-yup/

Payroll cards subject of largest ATM heist,..EVER

NetworkWorld has an article detailing the database breach of RBSWorldPay (one of the largest payroll debit card issuers) & the extremely well co-ordinated effort of a "small army" of people spanning multiple countries that, within 30min, stole approximately 9 million dollars.

Not even Hollywood could dream this one up........

In addition to the theft, 1.5 million people may have had their personal data stolen along w/ 1.1 million social security numbers being breached.

copy & paste this if the link above does not work.
http://www.networkworld.com/community/node/38366