Slashdot Log In
Card Processing Software May Store CC Info
Posted by
Zonk
on Sun Mar 19, 2006 08:29 AM
from the i'll-just-hang-onto-this dept.
from the i'll-just-hang-onto-this dept.
An anonymous reader writes "Visa has sent out a warning to customers stating that some card processing software may keep customer data even after a transaction is complete. The setup, two versions of a software made by Fujitsu Transaction Solutions, is used by such companies as Best Buy, OfficeMax, and Staples. It's unknown if any of these large retailers use the poorly-made versions of the software." From the article: "Visa's warning, which was first reported by The Wall Street Journal on Friday, has raised eyebrows in the financial and retail sectors. The software was flagged at a time when thousands of debit-card holders across the country have reported unauthorized withdrawals from their accounts. Bank of America, Washington Mutual and Citibank are among the financial institutions that have replaced more than 200,000 debit cards in the past two months ..."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
well that explains it (Score:4, Funny)
Re:well that explains it (Score:3, Interesting)
I've worked with various POS software/hardware as well as plenty of online ecommerce sites and I'm really stretching trying to think of at least one that didn't store CC information somewhere for much longer than the transaction lasted.
Sure, if someone was using a third-party card processor, that third-party usually stored the info instead (although most people would be shocked by the merchants who store this info when there really is no reason for them to do so, si
Re:well that explains it (Score:4, Informative)
Last time I read the VISA and MC guidelines, the only real requirement was that you are never supposed to store the VVC code for longer than you need to get the authorization. Everything else is fair game to store, subject to various security guidelines.
If you are still involved with card processing, you should read up on the latest guidelines. Basically, don't store the PAN or exipiration date unencrypted. And NEVER store the card verification code (CVV2, CVC2, or Amex's CID), track data, or PIN for debit transactions. It should be transmitted to the processor or authorizer and then deleted from memory.
This has been in effect for a couple years now, but only recently (post Card Systems) have the associations started to really crack down. Processors and authorization entities were the first to comply with the more stringent guidelines. Now that they are, for the most part CISP complaint, the next in the chain are merchants.
POS software should include authentication and logging, at minimum, pertaining to lookups of cardholder info. Even tighter controls on cardholder data access should be required.
Post-transaction events such as chargebacks and returns do require access to cardholder details, at least the PAN.
Parent
What are we supposed to use? (Score:5, Funny)
I raise chickens. Does Fry's accept barter? How many chickens for an iPod? Oh wait, I forgot about bird flu.
Re:What are we supposed to use? (Score:2, Funny)
Right now, corned beef is going for 70-90 cents/pound. Stock up now and go shopping when it's back up to 1.50 to 2 dollars/pound.
Remember kiddies. Buy low, barter high.
Grump
Implants (Score:2)
"Oh, and since we are tied into the federal governments national database, you can be assured you will be kept more safe. " " So sign up today"
Re:What are we supposed to use? (Score:3, Insightful)
Re:What are we supposed to use? (Score:5, Funny)
I'm sorry, but I see no reason for them to need to look at my viola to decide whether or not I'm eligible to return some clothing.
Parent
Re:What are we supposed to use? (Score:2, Interesting)
Imagine I put my credit card number on a piece of paper, put it in a sealed env
Re:What are we supposed to use? (Score:3)
I think this is only true during the first 30 days, though... but I'm not sure...
Re:What are we supposed to use? (Score:2)
if we look at the planet http://hypertextbook.com/facts/2001/DanielChen.sh t ml [hypertextbook.com]
and the People http://www.ibiblio.org/lunarbin/worldpop [ibiblio.org] we find that it's .02 km sq per person.
and thats weird...
Asleep at the switch? (Score:5, Interesting)
Re:Asleep at the switch? (Score:4, Interesting)
One time, I hadn't made it to the ATM recently enough and gave them my Visa number. The following time I ordered from them, I told them I wanted to pay cash. The delivery guy showed up with a credit card slip with my number on it. I called the restaurant and asked why they had stored my number without my permission. They shrugged it off and said they would remove it from their system.
The next time I ordered from them, the same thing happened. I told them I was complaining to Visa, since I had specifically requested that they not retain my card number. They tried to make some excuse, but it hasn't happened since.
This is exactly why I NEVER use a debit card, but will regularly use credit cards. If these guys are storing credit card numbers as a matter of practice, I don't want them to have my debit card number. Credit card agreements have built-in liability protection if the number is stolen. Debit cards leave the account holder dealing with missing money at least until things are sorted out, if not permanently.
-JMP
Parent
Re:Asleep at the switch? (Score:3)
Debit cards have the same protection as credit cards when used as credit cards. The only time you're using it as a debit card is when you have to enter your PIN.
Re:Asleep at the switch? (Score:3, Informative)
That's what the banks say, but it's not often born out by experience.
Remember, that visa debit card is attached to your checking account. If someone takes money they're not supposed to, you can end up bouncing checks and getting into all kinds of other trouble. You have to fight to get your money back, and bank does not have to respond immediately - and can even deny your claim.
If you just use a credit card and someone gets you
Re:Asleep at the switch? (Score:3)
Re:Asleep at the switch? (Score:2)
Re:Asleep at the switch? (Score:2, Insightful)
This is why cash won't die... (Score:4, Insightful)
Re:This is why cash won't die... (Score:2, Insightful)
Cash will be attacked for being connected with untraceable transactions relating to drugs, terrorism and tax evasion. The same people who now say `what's
Re:This is why cash won't die... (Score:2)
I can well imagine a "only terrorists and criminals need to use cash" campaign, though.
Re:This is why cash won't die... (Score:2)
Having said that, I wouldn't bet that cold, hard cash will disappear any time too soon. It's quick and easy to use for informal transactions, doesn't require any equipment to transfer, and doesn't have any float to worry about.
Re:This is why cash won't die... (Score:2)
The only way to keep your card secure... (Score:3, Funny)
It's widespread... (Score:5, Interesting)
The need to retain customer confidence in the card-processing system means that the interesting question of who would be liable in the case of a mass theft is unlikely to be tested in court - even if it were useful to do so (a lot of mailorder businesses are not cash rich and neither are the software companies that supply them).
This risk will persist until there is some sort of two-factor authentication on all card transactions.
Re:It's widespread... (Score:2)
It woludn't matter if the second factor is a computed function of the transaction number and transaction value using a large encryption key that's assigned to the credit card by the bank. The credit card would be a little usb stick that stored a processor and a key. When you bought something, you'd stick the key into a usb port, the stick would show you the transaction amount, you'd push a button allowing the proc
HomeDepot in Canada (Score:4, Interesting)
I purchased some bathroom renovation supplies at HomeDepot in Toronto a few weeks ago. When I was complete, I brought back the parts that I had not used. When I returned them to the customer service desk, the lady scanned the barcode at the bottom of the receipt, and then tossed the valves into the "restock" bins. When I attempted to hand her my credit card to refund the transaction, she looked at me and said "We don't need that..."
I looked at her, and asked how she had my credit card information, and how it was going to be credited to my account. She stated that they store all transaction information specifically so they can speed up the refund process.
I asked to speak to the manager to complain about this, but after waiting for 10 minutes for him to show up, my wife got the better of me, and we had to go...
Gut feeling says this should be against industry best practice, and potentially against Canadian banking and privacy laws, but IANAL.
Re:HomeDepot in Canada (Score:3, Insightful)
What happens is this: at the end of the day, the store (often from the store, but sometimes it's done from the corporate office) and the credit provider perform a process called Settlement, where they compare a log of the credit card transactions for the day. The retailer does not g
Re:HomeDepot in Canada (Score:3, Insightful)
And anybody who RTFA noted that the issue concerned DEBIT cards. You don't worry much about getting your credit card stolen, because the liability is limited. Debit cards are a whole 'nother story, and the problem here is that some debit-card software had been storing the PIN number as well as the card number... so anybody who got the numbers could go to an ATM and em
Re:HomeDepot in Canada (Score:4, Insightful)
The problem, as I see it, is vendors that store all customer information, in a single logical location, long term. For instance, after a purchase is valiated, which online takes 30 seconds, my adress and CVVC should be delinked from my cc number. Keep the CC number in a transaction log, but get rid of the CVC and only keep the address in a ship log. I know this is not going to happen, as it is complicated, but it should help protect us. I am with you though. We need laws that makes bad practice a liability on the vendors, banks, and device providers that utilize it.
Parent
Could this just be a PR/Power Grab ploy? (Score:3, Interesting)
Seems like something went wrong, they still don't know what or how (other then the possible OfficeMax connection), but they are using this opportunity to claim that it has something to do with devices not sanctioned by CC compaines.
Look like this has a high probablity of being spin.
Another similar issue (Score:4, Interesting)
BofA vulnerability asssesment? (Score:2)
I have a BofA account, and the associated debit card. When I first received it, I was a bit miffed that it came with a 6-digit PIN, but now I've gotten used to it and I wish my other card issuers offered the option to select a PIN longer than 4 digits.
That said, this is the first I've heard anything about BofA debit cards being pilfered and replaced.
Victim here - lessons learned (Score:5, Interesting)
Lessons learned. Use your debit card as a credit card - the laws concerning credit fraud are more clear cut. Ask your bank to not to use your savings as overdraft protection. Only keep enough money in checking for what you know is coming in the short term, isolate the rest in the saving account. Check your account frequently (a friend has his balance emailed to him daily - not a bad idea). Check your credit history every four months (one free per year per credit agency - https://www.annualcreditreport.com/ [annualcreditreport.com] ).
If fraud happens. Call bank/Visa/MC/whoever and get a block on your card. Call one of the credit agencies and put a fraud alert on your credit record. Call the local police and file a report. If you are like I was and can't do anything until Monday, move what is left into your savings account that are going to isolate after reading this.
A good resource is: http://www.consumer.gov/idtheft/ [consumer.gov]
Re:Victim here - lessons learned (Score:2)
I don't understand why some banks are really using lame security to appeal to 99% of the population. Are the any banks accepting customers givem them say a public PGP key to send them their data electronically? Why can't more of the banks use finger-print I.D. or even put a
Fujitsu & Tokyo Stock Exchange (Score:2)
Never use Debit at a store... (Score:2, Interesting)
What is needed is the finantial version of HIPPA (Score:3, Insightful)
Essentialy it would mandate things like "any device or software that holds on to any finantial data after it is no longer required to process whatever transaction the data was given for is illegal" and "All devices storing or transporting or moving finantial data must use encryption" (for example, any US website taking banking details, finantial details or credit card details must use SSL or similar to encrypt the data as it goes over the internet) as well as requiring (for example) banks to do more to make it harder for phishing sites to fool users into plugging in their password (there are certainly solutions out there so its not like its not possible for the banks to do it, they just dont because it would cost too much to fix it).
Also this law should have bigger penalties for companies who dont protect this data and it gets copied as a result (much like how there are penatlies if medical data is copied)
Re:What is needed is the finantial version of HIPP (Score:5, Insightful)
Banks already have that - it's the Gramm-Leach-Bliley act and purportedly is meant to protect customer financial privacy.
I think that the gist of the article, though, is that the merchants are not under the same regulatory burden - and that is where the weak link in the chain is at the moment.
Parent
Libertarian experiment (Score:2)
It's going to be interesting to see how this free-market equivalent of legislation works out.
In the future... (Score:2)
I think the only other form of transaction will be cash.
Old, but maybe not common news (Score:2)
Nothing to be alarmed about as long as you trust the merchant.
Chip H.
One device that makes all this possible... (Score:3, Informative)
And why again (Score:2)
Free hint to Visa regarding Captain Zapps first axiom of software projects:
Cheap, within scope, within time: Pick one!
Credit Card Processing Company Employee Here... (Score:4, Informative)
Many highly-moderated posts here are confusing the facts, or saying how they think the system should work.
The merchant SHOULD keep track of the credit card number. They can't print the card number on receipts they give to their customers, but the card number is sometimes the only customer identification they have. If a chargeback or retrieval request comes through, the mechant needs to be able to find information about a specific sale, and they usually find that using the card number.
Someone reported that a business issued a credit to their card without requiring their card number again. This, too, is normal. Even if the merchant didn't store the credit card number, they would only have to call their credit card processing company (like the company I work for), identify themselves properly, give them the day of the original sale and the amount, and WE would tell them your card number and expiration date so they could process the credit. (You would have been wasting that manager's time, if you did talk to them.)
Visa and Mastercard regulations prohibit merchants from storing the CVV2/CVC2 number (that's the 3 digit number printed on the papery stripe on the back of your card), or any of the 'secret' information encoded on the magnetic stripe of the card. Everything else they can store, AS LONG AS THEY COMPLY WITH SECURITY REQUIREMENTS. http://usa.visa.com/business/accepting_visa/ops_r
If there's a security breach, the government's intervention is not required. Processing regulations already demand fines for noncompliance. If a merchant's security is penetrated and they lose a bunch of customer details, they'll have to pay a fine and have their security audited to Visa/Mastercard's satisfaction. These fines scale according to the size of the merchant and their annual transaction volume. The largest merchants (like those many of you are talking about) could face huge fines in the hundreds-of-thousands-of-dollars range, if they're noncompliant and they stay that way for any length of time.
If a merchant is using your card information in a way they shouldn't (for example, assuming you'll put your sale on a card you used last time) that's a customer service issue. If they actually charge your card unauthorized, make them give the money back. If they don't credit your account within 30 days, contact your issuing bank. Chargeback reason "Fraudulent Transaction - No Cardholder Authorization." They aren't actually breaking any rules by using a stored card number, but that's still a pretty dumb thing to do if you want happy customers.
OK, now back on topic. Pin-based debit information, like full magnetic stripe info and ESPECIALLY any information about the pin number challenge/response, should NEVER be stored by any merchant. (They can store the card number, debit network ID, various transaction reference numbers, etc.) If someone's software is doing that, merchants should stop using that software. Maybe Visa/Mastercard should release a bulletin to its member organizations, for its merchants, warning them that if they're using this software they need to stop. (Looks suspiciously like something which inspired the original article, doesn't it?) If merchants fail to switch to other, compliant software versions, they deserve the fines and sanctions they'll incur.
(How can Visa and Mastercard levy fines, if they're not the government? Contract law. Visa and Mastercard require contracts with processing companies, like the one I work for. When we sign on a new merchant, they must sign a merchant processing agreement, which binds them to Visa/Mastercard's regulations, and with that binds them to any fines they might incur.)
Now let's get the discussion back on track. No more of this "businesses are storing my credit card number and I don't like it!" stuff.
Re:Isn't what amazon.com does ? (Score:2, Insightful)
I think I can clarify... The problem isn't that they store the information, it's that unlike Amazon, they do it without your knowledge or consent. Also, because these vendors were unaware that this information was being stored by their systems, no security procedures are in place to prevent unscrupulous employees (or others)
Re:Isn't what amazon.com does ? (Score:2)
Re:Isn't what amazon.com does ? (Score:2)
Obviously you could brute-fo
Re:Why software not paper? (Score:2, Informative)
This is to avoid fraud, the printout only serves the purpose of identifying the proper card with the proper sequence number, amount, date and signature.
Some cheaper, less used systems WILL however print out the complete number. I would personally find another method of payment if you know place X does that, but if you have to use a credit card, don't thr
Re:SSN in USA (Score:2)
To use your SSN for what?