Well I am not sure what the you had planned with the following line:
ls $variable || grep -i / credit card
But I believe your if was almost there:
if grep -q "credit card" "$variable/*.tmp"
You need the '-q' unless you want all of what is found spewed to the output.
I am also curious as to when the input file changed so much??
I assume the crm.log is now the active input file? If so it greatly changes how this could have all been attacked, at least in my opinion.
Would you mind showing me what the expected output would be based on the crm.log you have included?