What to do if your card was compromised and used… April 1, 2012
Posted by Chris Mark in Data Breach, Industry News, InfoSec & Privacy.Tags: Chris Mark, credit card theft, cybercrime, data breach, mastercard, visa, zero liability
add a comment
I have already read 5 different articles where experienced and well known security evangelists are discussing how their credit card data was exposed and how it exposed them to danger. Here are some things to understand about credit card theft and liability. First, credit card theft is NOT identity theft. Certainly, criminals can make fraudulent transactions but they cannot assume your identity to buy a boat, house, or get further credit.
Second, Under Federal law, consumers are limited to $50 for fraudulent credit card transactions. The major card brands (Visa, MC, Amex, JCB, Discover) all have “Zero” liability clauses. This means that if your card was used fraudulently…you have no liability for transaction that run over their networks. If it is a PIN based transaction (debit, for example) there are other considerations. You can read more on this post. “Signature or PIN? Credit or Debit?…the answers” If the Global Payments breach was limited to track 1 or track 2 data as reports indicate, then the PIN issue is not relevant.
Here is what you should do…
1) check your credit and debit card accounts. Debit cards can be processed as an ‘offline’ transaction which means they run over credit networks. The criminals can use them just like stolen credit cards. If you see unauthorized transactions take the next step.
2) call your issuing bank (bank listed on your card) and inform them of the fraudulent transactions. They will require you to complete an affidavit stating it was not your charge, etc. etc. If you have unauthorized charges on your bank account from the debit card being compromised, read the post here as it is a bit more complex from time to time. Understand that your bank will CANCEL the card and reissue a new card. Make sure you have taken steps to update your bills etc.
3) continue to monitor your accounts for fraudulent activity…that simple.
Hopefully this helps assuage some concerns
Global Issues Press Release Confirming Breach March 30, 2012
Posted by Chris Mark in InfoSec & Privacy, Laws and Leglslation.Tags: Chris Mark, credit card, cybercrime, cybersecurity, data breach, data security, Global Payments, mastercard, PCI DSS, visa
add a comment
Thank you to a person for pointing this out to me via LinkedIn. GlobalPayments, Inc. has issued a press release confirming it was their system that was compromised. You can read it here. They have disabled cutting and copying so here is a screenshot.
Wall Street Journal Reporting- Global Payments is Breached March 30, 2012
Posted by Chris Mark in Industry News, InfoSec & Privacy.Tags: credit card theft, cybersecurity, data breach, data compromise, Global Payments, InfoSec, mark consulting group, mastercard, PCI DSS, visa
1 comment so far
Updating my last story, the Wall Street Journal is now reporting that the “massive” data breach referenced earlier was Global Payments, Inc. USA Today is also reporting on the issue. According to sources, Dominican street gangs may be involved. Gartner’s Avivah Litan stated: “are seeing signs of this breach mushrooming. From what I hear, the breach involves a taxi and parking garage company in the New York City area, so if you’ve paid a NYC cab in the last few months with your credit or debit card – be sure to check your card statements for possible fraud.”
Visa Issued a statement: “Visa Inc. is aware of a potential data compromise incident at a third party entity affecting card account information from all major card brands. There has been no breach of Visa systems, including its core processing network VisaNet. Visa has provided payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring and, if needed, reissuing cards. … Every business that handles payment card information is expected to protect the security and privacy of their customers’ financial information by adhering to the highest data protection standards. “
MasterCard is: “concerned whenever there is any possibility that cardholders could be inconvenienced and we continue to both monitor this event and take steps to safeguard account information. If cardholders have any concerns about their individual accounts, they should contact their issuing financial institution.”
2012 – Another “Massive” Credit Card Breach March 30, 2012
Posted by Chris Mark in Industry News, InfoSec & Privacy.Tags: Chris Mark, data breach, fraud, InfoSec, mastercard, PCI DSS, security, visa
add a comment
According to Krebsonsecurity, the payment card industry has been wracked by yet another massive data breach. The story says that Visa and MasterCard are alerting companies to a US processor that was breached. This, according to reports, is a breach of Track1 and Track2 data. For those unfamiliar with credit cards, track1 and track 2 data is what is known as “magnetic stripe data” and is used to counterfeit cards as it contains the sensitive authentication data necessary for retail (card present) transactions. This is the most dangerous and valuable data to criminals.
As stated on the site: “In separate non-public alerts sent late last week, VISA and MasterCard began warning banks about specific cards that may have been compromised. The card associations stated that the breached credit card processor was compromised between Jan. 21, 2012 and Feb. 25, 2012.”
Global Security, Privacy, & Risk Management 