VISA, MasterCard Warn of 'Massive' Breach At Credit Card Processor 164
concealment writes with news that VISA and MasterCard have been warning banks of an incident at a U.S. card processor that may have compromised as many as 10 million credit card numbers. From the article:
"Neither VISA nor MasterCard have said which U.S.-based processor was the source of the breach. But affected banks are now starting to analyze transaction data on the compromised cards, in hopes of finding a common point of purchase. Sources at two different major financial institutions said the transactions that most of the cards they analyzed seem to have in common are that they were used in parking garages in and around the New York City area."
According to the Wall Street Journal, the breached company is Global Payments Inc.
No Source? (Score:4, Insightful)
The article has no credible source. Is this Spam?
Re:No Source? (Score:5, Informative)
Krebs is all over it:
http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/
Re:No Source? (Score:5, Informative)
Re:No Source? (Score:5, Insightful)
Re: (Score:3)
Strange, my bank called me and told me that my credit card was possibly compromised back when Valve got hacked and then I got a new one two days later in the mail.
Perhaps you were just faster than they were, it does take time for them to contact people.
Re:No Source? (Score:4, Insightful)
Re: (Score:3, Informative)
You aren't on the hook for the fraudulent charges.
Unless they can prove you actually made them, they have to pay for the charges.
If it's all on them, why do they need to give you a detailed breakdown?
Re:No Source? (Score:5, Insightful)
Because all borrowers end up indirectly paying for the cost of fraud. As is the case with many forms of financial risk, a lender typically insures against identity theft and credit card fraud. The cost of that insurance is factored into their interest rate and fee calculations and is passed on to the borrower.
Granted, insurance doesn't completely absolve the insured of all responsibility, in as much as a driver with car insurance would not think to be totally careless about driving. Lending institutions still have an interest in preventing fraud despite being insured. The point is that when fraud increases, or if there's a catastrophic breach (as in this case, opposed to isolated small-scale instances of ID theft), the associated financial costs eventually reach the borrowers.
Re: (Score:2)
If you make a fraud complaint and your lender jacks the interest rate way up, move to a different provider.
They have to give you advance notice so you can agree to the new terms anyway.
Re:No Source? (Score:5, Insightful)
Your response indicates you have entirely failed to grasp the meaning of my previous post.
Government regulation of the credit card industry prevents a lender from penalizing a fraud victim in the manner that you describe. A penalty in the form of a higher interest rate may only be applied if the borrower fails to pay an outstanding balance in a timely manner. A late fee may also be assessed. This is legal because a borrower's failure to repay the incurred debt is a reflection of their poor creditworthiness relative to other borrowers who pay their balance on time. However, a victim of fraud may not have had anything to do with the theft of the information that precipitated that fraud, which is the case with this data breach.
In relation to my previous post, then, the cost of insuring against losses due to fraud is passed on IN AGGREGATE to the entire pool of borrowers in the form of higher interest rates and/or fees, just like the way in which they factor in other costs of doing business (such as worker salaries, marketing, customer service, and legal representation). Competition between lenders exerts pressure to keep the interest rate low, but if the overall rate of fraud increases across ALL lenders, then the overall financial risk of lending money in this manner has also increased, and therefore the interest rate must also increase to reflect this risk trend.
To be absolutely clear, I am not talking about a scenario in which an individual borrower reports fraudulent activity on their account, and the lender then decides to punish that borrower by increasing their interest rate. What I am talking about is the big picture, in which the cost of credit card fraud and ID theft is spread out over the entire pool of borrowers because the risk of fraud is one component of the risk of lending money, and the risk of lending is part of why interest exists. Granted, this is a gross simplification of the way things actually work (as I do not discuss the role of merchants in this process, for example), but the basic point remains valid: the cost of fraud is eventually paid by the borrower. Even the merchants purchase insurance for their business, and factor these costs in the pricing of the goods and services they sell to consumers. All of it eventually falls on the shoulders of the consumer, who pays for it in the form of higher prices or higher interest.
Re: (Score:2)
With credit cards, though, the cost of fraud is passed on to the merchant (apparently in an attempt to motivate them to improve their CC acceptance policies and procedures).
The actual cost is passed on to other customers of the defrauded merchants, NOT (as is commonly believed) to the pool of borrowers.
Re: (Score:2)
Exactly. Cardholders, card issuers (mostly banks), merchant account issuers (mostly banks), processing gateways (Authorize, etc), and network operators (Visa, MC, Disc) never lose a dime on credit card fraud. All costs are born by the merchants who accept cards for goods and services. Not only are the disputed amounts forcibly taken from the merchant's bank account, an additional administrative/punitive fee of between $20 and $75 (depending on the merchant account issuer) is levied for EACH chargeback.
In
Re: (Score:2)
Sadly, it's worse. The costs get passed on to ALL consumers, even the ones who pay cash. The credit companies go to great lengths in their merchant contracts to make sure the costs don't fall exclusively on credit card users.
Naturally, they do that because then it would become apparent that the real costs of their carelessness are significant and might drive consumers back to cash and check.
Re: (Score:2)
Not entirely true. If Verified by Visa or Mastercard SecureCode is attempted, something called Liability Shift happens, where the liability you refer to is "shifted" off the merchant and placed squarely on the issuing bank. As a merchant, you're a moron if you aren't attempting 3DS on every transaction for that alone (so much so that my own provider makes 3DS mandatory on all transactions). Obviously, this only applies to card not present transactions.
Re: (Score:2)
Some countries are starting to wise up to that. Over here in NZ, our consumer protection agency (the Commerce Commission) overturned the clauses in the credit card merchant agreement preventing merchants from setting minimum transaction amounts or charging more to credit card customers. Signs saying "2.5% extra charge for credit cards" and "$30 minimum for Visa/Mastercard" are common, and becoming more common by the day.
Re: (Score:3)
I would also like to clarify that an individual cardholder may be subject to a change in their contract terms or revocation of cardholder privileges if repeated instances of fraud are reported, because this is an indicator that a cardholder may be doing something that is increasing their exposure to fraud. One fraud report, even if it is for a series of large amounts, isn't going to set off any alarms. But if, say, you had three reports in a six-month period, that would definitely look suspicious to the l
Re: (Score:2)
They definitely don't do that. What you're missing is what happens behind the scenes. When you call your bank, and say you don't recognize a charge, they:
1) (optional) submit an information retrieval request to the merchant. They merchant has a certain amount of time to respond (a couple of weeks usually). The merchant must provide all of the information they have for the order. If they fail to do this, your bank will nearly always go to step 2:
2) submit a reversal of the charge. This pulls the money from t
Re: (Score:2)
Because all borrowers end up indirectly paying for the cost of fraud. As is the case with many forms of financial risk, a lender typically insures against identity theft and credit card fraud. The cost of that insurance is factored into their interest rate and fee calculations and is passed on to the borrower.
Granted, insurance doesn't completely absolve the insured of all responsibility, in as much as a driver with car insurance would not think to be totally careless about driving. Lending institutions still have an interest in preventing fraud despite being insured. The point is that when fraud increases, or if there's a catastrophic breach (as in this case, opposed to isolated small-scale instances of ID theft), the associated financial costs eventually reach the borrowers.
That's a really basic problem with the system. Because they credit card industry can pass the costs on to their customers, they don't have any real incentive to fix the security problems. And the security problem is SEVERE. Anybody who gets your credit card number (including expiration date and "security code" which should be considered part of the card number) can make unauthorized charges. So at minimum, your credit card is exposed to every business you pay with that card -- for as long as that card i
Re: (Score:3)
Because you want to know who was lazy with your private information, so you can deal with that situation.
Re: (Score:2)
If it's all on them, why do they need to give you a detailed breakdown?
Because whoever screwed up deserves to suffer for it.
Re: (Score:2)
Re:No Source? (Score:5, Insightful)
100% agree. I just went through this a few weeks ago. VISA told my card issuer that there had been a breach. They actually sent me a new card, but didnt tell me until fraudulent use occured. This was before my new card arrived, which actually shortened the amount of time that I had no credit card. I wanted to know who had the breach, so I could avoid ever giving them business that wasnt cash based, but they would not tell me. That part pisses me off. There needs to be an awareness as to which vendors dont find it worth their time to protect me , so I can make a decision to not use them.
Re:No Source? (Score:4, Insightful)
And what makes you think it was the *business* that was hacked? Retailers obtain a merchant account and the merchant bank provides the processing equipment. That equipment talks to a credit card processor who handles the transactions and transfers and such.
A credit card processor being breached means it affects MANY retailers at once. Boycotting one business over the breach may mean you're still vulnerable as your new go-to place can use the same processor.
For many businesses, there's nothing to breach - the information is temporairly stored on that terminal you use for the duration, and the only thing the retailer has is the tiny slip of paper they get at the end. Which is probably why credit card processors get attacked, rather than individual companies.
Even online companies do the same - that box you enter your information into may be temporarily hosted by the store, but the information is promptly forwarded to a credit card processor and forgotten by the store's server to reduce PCI requirements. Some make it obvious when they forward you to Google, Amazon or Paypal, or to a processor's site directly. Most don't, even though in the back end they're really proxying the processor's site.
Re: (Score:2)
nothing make me think for sure that a business was hacked. I would like to have had my question answered so I could know for certain what happened to my account.
Re: (Score:3)
And that is the reason PCI compliance is security theater. merchants can be as secure as possible, yet they are on the hook for the information once it passes out of their hands. The entities that could secure the process, Visa/Mastercard and the issuing banks, won't because they have nothing to lose because the merchants are responsible. Other than the TJ Max breach the large breaches have been third party ISOs who handle the credit card processing.
Now, now (Score:2)
Re: (Score:2)
exactly
Re:No Source? (Score:5, Interesting)
...I wanted to know who had the breach, so I could avoid ever giving them business that wasnt cash based, but they would not tell me. That part pisses me off. There needs to be an awareness as to which vendors dont find it worth their time to protect me , so I can make a decision to not use them.
I don't know if you can believe the story, but if the breach occured with a credit card processor and not the retailer. The Credit card processor is the retailer's vendor (e.g., the company that the retailer contracts with to process credit card batches). This vendor relationship is not unlike the company that the retailer buys paperclips from, or the company that processes their payroll. Credit card processing is a highly competitive industry. Some retailers will often switch processors every few years when competing companies offer promotions with lower merchant fees (the fees/percentage that they charge the retailer for processing a credit card transaction).
Even if you had been told what retailer the fraudulent charges were made at, since there are so many credit card processing companies, it's quite likely that the retailer didn't use the same processing company. Additionally, because of credit card merchant contracts, retailers are supposed to follow certain "merchant" rules (e..g, no minimum*** or maximum purchase amounts, no steering to different forms of payment, not allowed to require ID, etc, etc). So even if the retailer wanted to be more careful when trying to accept this apparently frauduant card transaction, they probably aren't allowed by contract to be as paranoid as you apparently want them to be...
So feel free to throw the baby out with the bath water, but it's might be just as likely that the retailer you want to disown actually helped the credit card company identify the fraudulent transaction before it appeared on your credit card statement. If that were the case, perhaps you should be thinking about thanking them, before you disown them?
*** As of part of the Dodd-Frank wall street reform act of 2010, retailers are now allowed by law to imposed a minimum transaction amount up to $10 (this law supercedes the language in the contracts in place with the credit card companies)
Re: (Score:3)
you are correct, it may have been a processor and not the front end business. Even just that on its own would be good information to know, but that would undermine faith in the system, so VISA has a vested interest in not revealing that kind of info. I have worked in several PCI businesses, which have kept customer information on site, and which VISA performs regualtory checks on. The certification process is a bit of a smokescreen, and knowing that, I would really have liked to know if it was that type of
Re: (Score:2)
It is all a shell game propping up fake security.
Of course it is a shell game (that is what "money" is).
The only thing that give "money" any value at all is the belief that you can exchange it for something you value at some time in the future. Credit cards just like "money" in that respect, you get something of value today from the retailer and they hope to get some value out of that credit card transaction they made with you some time in the future. If you don't trust money will have any value in the future (or say a particular credit card transaction
Re: (Score:2, Informative)
So feel free to throw the baby out with the bath water, but it's might be just as likely that the retailer you want to disown actually helped the credit card company identify the fraudulent transaction before it appeared on your credit card statement.
As an online merchant, I can tell you from experience that this is highly unlikely. When fraud was committed through my site, I used to proactively contact card issuers to let them know that their customer's card details had been stolen and were being used to commit fraud. Just about every one of them was dumbfounded by a merchant calling them to report fraud. There had even been a couple of cardholders that called to inquire about the transaction on their card, and every one I asked said that their card
Re: (Score:2)
This right here is why "the market" is insufficient protection for consumer rights. We need a law requiring credit card companies to disclose businesses that compromise data.
You have not tested "the market." You have tested "the market with regulation." If you had tested "the market," then you could take your business elsewhere to someone who tells you what you need to know.
Re: (Score:2)
Re: (Score:2)
You assume switching credit cards and shutting down an old account is easy and consequence free.
No, I don't assume that.
Closing a credit card account impacts your credit
You assume a monopolistic credit rating system..
You assume switching from them won't impact your ability to do business with companies that only accept one or the other
No, I don't.
With nothing to require them to disclose, what real pressure is there for them to disclose? Why should they when it could cost them business to do so?
My entire thesis is that you are more likely to get this when there are true competitors, because they will happily slit each other's throats.
If the market as a whole did not care that a company killed puppies, should we allow that company to continue to do so?
Yes.
There's no reason to suspect that in this mythical "the market" you refer to, there would be someone who does tell you what you need to no.
There's certainly more reason to suspect it in that system than in the one we have now.
There is no "market" that is pure and free of all regulation.
That's like saying, in 1600s England, "There is no 'freedom of religion' that is pure and free of a state church."
Re: (Score:2)
"This right here is why an unregulated market is insufficient protection for consumer rights"
Fixed that for you. What people don't get is that an unregulated market is not necessarily a free market. In a perfect world a security breach, or breaches, would be punished by people fleeing the vendor and finding a more secure alternative. But without disclosure requirements the consumer or contractor does not have enough information to make a market decision. Therefore, free market conditions do not exist and fr
Re:No Source? (Score:5, Funny)
Re: (Score:2)
He can find $5 parking; There are several places where you can park for 10 minutes for around that price.
Re: (Score:2)
In Hoboken, you can park for $5. There's no way you can park for 10 minutes in Manhattan for $5.
Re: (Score:2, Insightful)
Use Hypberbole Much? (Score:3)
What would you do if you knew whose system was compromised? Tie up the courts with lawsuits? Head over in a mob and smash their front windows? What are you going to do if their initial suspect turns out not to be at fault? File more suits? Form more mobs?
What a silly assumption. I can't speak for the poster, but as one who agrees with him 100%, I'll tell you what I would do:
STOP GIVING THE COMPROMISED VENDOR MY CREDIT CARD NUMBER
If it's a parking garage I use, I'd start paying the bill in cash, with receip
Re:No Source? (Score:5, Informative)
One of these perhaps
https://www.networkworld.com/news/2012/033012-visa-mastercard-breach-257824.html [networkworld.com]
http://www.cnbc.com/id/46904168 [cnbc.com]
https://www.google.com/news?ned=us&q=VISA%2C%20MasterCard%20Breach&btnG=Search+News [google.com]
Re: (Score:1)
http://online.wsj.com/article/SB10001424052702303816504577313411294908868.html
Re:No Source? (Score:5, Interesting)
It seems like all of the links pertaining to this story point back to the Krebs blog as the source for the information. Yet, Krebs provides no 3rd party verification to the story other than a 'source'
Shit like this is how rumors get started. Can anyone verify with a statement from Visa/MC, a bank, etc? I'm not saying it isn't true, but even the WSJ article is referencing the Krebs blog.
Re:No Source? (Score:4, Informative)
From the link, Global Pay seems to be the processor, and it appears that only 26,094 VISA cards were affected. It did not mention how many MasterCard cards were affected. While that is a lot, it is nowhere near the 10 million speculated.
Re: (Score:2)
Re:No Source? (Score:4, Insightful)
Credible sources are still fallible.
Re: (Score:2)
That doesn't mean they're presumed wrong.
Re: (Score:2)
Nor should they be presumed correct.
Re: (Score:2)
Nor should they be presumed correct.
Well if you're not familiar with the source, then no. If the source is a known expert in the field who is broadly respected, then it is reasonable to give them some presumption of cluefulness.
Re: (Score:2)
Re: (Score:3)
Why is this labelled "Funny?" There's no link in the submission, and clicking on the submitter's name goes to some site that has no story about this either. Talk about editor fail.
Re: (Score:2)
Seems like there's plenty of sources, and it looks like they're updating it with more as they roll in.
Article: (Score:2, Insightful)
http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/
Really, no fucking article? (Score:5, Informative)
And slashdot gets increasingly pathetic. Well, if anyone cares to RTFA:
http://online.wsj.com/article/SB10001424052702303816504577313411294908868.html [wsj.com]
Not a whole lot of info from any source, Krebs seems to be the best though:
http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/#more-14393 [krebsonsecurity.com]
No Link! (Score:1)
No source, no reference, no ability to verify, no fine article to read, NO STORY.
I'm going to assume it's made up while I use my Mastercard to pay for parking my expensive car in New York City.
Shameless? (Score:2)
Sketchy source is sketchy (Score:4, Informative)
That said, a window of 21 Jan to 25 Feb...that's quite a big window...
Let's hope (Score:5, Funny)
It had nothing to do with idiots like these: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants [serverfault.com]
Re:Let's hope (Score:4, Funny)
It had nothing to do with idiots like these: http://serverfault.com/questions/293217/our-security-auditor-is-an-idiot-how-do-i-give-him-the-information-he-wants [serverfault.com]
Good read... From the story:
PCI SSC have responded and are investigating him and the company. Our software has now moved on[...]
Phew!
[...]to PayPal so we know it's safe,
ah FUCK
Re: (Score:2)
I enjoyed that read; thanks for the link.
Guys like that auditor are wonderful data breaches.
It's probably for the best his company wasn't disclosed; with competence like that (and the data he's collecting), a hack would be simple and the consequences dire.
Thankfully! (Score:5, Funny)
Oh wait.
Fuck.
Re:Thankfully! (Score:5, Informative)
What do you expect when the parties that can best improve security (banks, VISA, Mastercard) have made sure that merchants (who can do very little about security) carry most of the liability from security failures?
Banks, VISA, and Mastercard make tons of money from transaction fees, so they want to make transactions as easy as possible. They don't have to pay much for security breaches, so they are willing to sacrifice security for more transactions and more fees.
If a buyer goes into a store with a stolen card, there is practically nothing a merchant can do to detect the fraud and stop the buyer from walking out the door with merchandise. Who pays for the fraud? The merchant.
Until banks are on the hook for this fraud, nothing will change.
Re: (Score:3)
What do you expect when the parties that can best improve security (banks, VISA, Mastercard) have made sure that merchants (who can do very little about security) carry most of the liability from security failures?
Banks, VISA, and Mastercard make tons of money from transaction fees, so they want to make transactions as easy as possible. They don't have to pay much for security breaches, so they are willing to sacrifice security for more transactions and more fees.
If a buyer goes into a store with a stolen card, there is practically nothing a merchant can do to detect the fraud and stop the buyer from walking out the door with merchandise. Who pays for the fraud? The merchant.
Until banks are on the hook for this fraud, nothing will change.
Never mind that the merchant can utter the words "can I see your ID?" and then, in one brilliant move, authenticate AND authorize the user of said card... But how many do that?
On the other hand, pretty much any card can be used in debit/PIN mode but it affects how the transaction is processed and how much it will cost the merchant (why, exactly?) so thanks to the banks, there is a "Stigma" against using debit mode (and when its used against credit cards it often appears as a cash advance) and the merchants
Re: (Score:3, Informative)
Never mind that the merchant can utter the words "can I see your ID?" and then, in one brilliant move, authenticate AND authorize the user of said card...
Actually, Visa prohibits merchants from asking to see your ID. Lots of stores do it anyway, but it's a breach of their Terms of Service.
Re: (Score:3)
Re: (Score:2)
In which case the merchant is required to refuse to accept the card until the customer signs it.
Re: (Score:2)
Not if the signature is missing on the back of the card.
Almost no one ever checks the signature. A few years back I'd routinely ask the person accepting the credit card who their favorite president was and then sign that name for the credit card charge. I must have done this at least a hundred times and not once did anyone even check the back of the card or even the name I used on the signature against the name on the card.
Re:Thankfully! (Score:4, Informative)
Re: (Score:2)
It's a double-edged sword. Someone skimmed my credit card several months ago and my number went on a shopping spree at some retailers in my area. The merchants visited all had self-service terminals so the card would never have to be handed to the merchant. This way the criminal can just take a random card, reprogram it and not even bother with making sure that the name, bank, card number, etc. actually reflect what's on the stripe. Yes, having your average sales person look at a card doesn't guarantee
Re: (Score:2, Informative)
Merchants are not allowed to refuse credit card purchases because of ID. For example my wife can use my credit card, even though my name is on it. Visa wants to make sure that purchasing is as easy and frictionless as possible. The amount lost to fraud is miniscule compared to the profits made.
Re: (Score:2)
pretty much any card can be used in debit/PIN mode but it affects how the transaction is processed and how much it will cost the merchant (why, exactly?) so thanks to the banks, there is a "Stigma" against using debit mode
Nope. There is a difference in prices, but debit is way way cheaper. Some stores have a cash/debit discount for this reason. In supermarkets, debit is often the default. A lot of POS systems if you just swipe the card without pressing credit/debit and the card supports debit it will go straight to asking for the PIN number.
Restaurants are the only places that often don't accept debit, and that is because the banks offer special deals to restaurants where the cheapest price structure doesn't even include deb
Re: (Score:2)
What do you expect when the parties that can best improve security (banks, VISA, Mastercard) have made sure that merchants (who can do very little about security) carry most of the liability from security failures?
Banks, VISA, and Mastercard make tons of money from transaction fees, so they want to make transactions as easy as possible. They don't have to pay much for security breaches, so they are willing to sacrifice security for more transactions and more fees.
If a buyer goes into a store with a stolen card, there is practically nothing a merchant can do to detect the fraud and stop the buyer from walking out the door with merchandise. Who pays for the fraud? The merchant.
Until banks are on the hook for this fraud, nothing will change.
Every time the Banks expose something like this I wish they would be punished. Punishment discourages repeats of behavior. Force they to have an audit or their system architecture, procedures, processes and who has access to what and then perform these audits on a regular basis.
Re: (Score:2)
The problem is the banks don't expose themselves to anything they lay security almost 100% at the feet of the merchant. The only institutions who could create a secure system, the issuing banks and the Visa/Mastercard cartel, won't because they can blame the merchants. If they can't blame the merchants they can blame the ISO's or third party processors. Every card transaction that is swiped hits the merchants POS, then goes out on a network like Buypas and is handled by the third party processing company,
Re: (Score:3)
Luckily, nobody would be stupid enough to build a money transfer system where the user ID and the authentication secret are identical, so this breach should be no big deal.
Reason #568 for the US to move to EMV. If this had happened in Europe or Canada, the card data would have been encrypted before getting sent to Global Payments, so using the info to clone cards would not have been possible.
Re: (Score:2)
Essentially the same thing, but offer awesome protection when transacting online at the cost of some functionality and convenience (no auto renewals, no credit card payments over the phone, things like Amazon 1-click ordering not possible)
I think you mean: 'encourage users to enter confidential information into random web sites and cause many people to abort their purchase and go somewhere else'.
These crappy things are one of the main reasons why I keep my Amex card.
Re: (Score:2)
That's a little pointless. If the merchant accepts a transaction where 3DS authentication failed, then they are back on the hook for the fraud. Only if 3DS is unsupported or succeeds does the merchant get liability shift (where the issuing bank takes the hit for fraud instead of the merchant).
Here's a source link (Score:1)
My boss just sent me a link to an article about this. However, it's a Fox News link, so I feel sort of dirty even clicking on it and even more so for posting it. Please don't mod me down, since it's the only link I can find.
http://www.foxnews.com/us/2012/03/30/visa-mastercard-warn-massive-security-breach-report-says/ [foxnews.com]
Re: (Score:3)
Criminal (Score:2)
They should have to tell us who the processor is, by law.
It’s not clear how many cards were breached in the processor attack, but a sampling from one corner of the industry provides some perspective. On Wednesday, PSCU — a provider of online financial services to credit unions — said it alerted 482 credit unions that appear to have had cards impacted by the breach, and that a total of 56,455 member VISA and MasterCard accounts were compromised. PSCU said fraudulent activity had been detected on a relatively small number of those cards — 876 accounts — and that the activity was geographically dispersed.
https://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/#more-14393 [krebsonsecurity.com]
Re: (Score:2)
It's Global Payments, Inc. Will have more info on it shortly!
Re:Criminal (Score:4, Informative)
Not the first time MC & V (Score:1)
Have used sketchy processors.
http://www.redorbit.com/news/technology/180626/security_breach_costs_atlanta_based_credit_card_processor_two_huge/ [redorbit.com]
http://www.usatoday.com/money/perfi/credit/2009-01-20-heartland-credit-card-security-breach_N.htm [usatoday.com]
Credit Card Fraud generates profits for banks (Score:3, Informative)
because each time when there is a chargeback, the bank will take back the money from the merchant + $25 per transaction as a penalty. They have no incentives to make the system more secure.
Re: (Score:2, Informative)
$25 is overstating it (at least in my experience) but yeah, you don't get the % back you had to pay to take the transaction in the first place, and if you get too many you get dropped by the processor or penalized with a higher % charge.
Keep in mind that the banks don't want merchants doing any kind of ID checks or anything that makes it harder to use the card (how could they have ads where the guy who pulls out his checkbook causes the whole line of people to crash into each other?)
Re: (Score:3)
$15-$50 is the typical range for a chargeback fee. I would say $25 is about average.
I blame price gouging by New York parking garages (Score:2)
I blame price gouging by New York parking garages:
"most of the cards they analyzed seem to have in common are that they were used in parking garages in and around the New York City area"
When prices get so outrageous that a large group in the city joins forces to steal the funds to cover them, you know that price gouging has gotten way out of hand.
Re: (Score:2)
Re: (Score:2)
My comment was meant as a joke. It was so ridiculous that I don't see how anyone could take it seriously.
Re: (Score:2)
They also say "10 million accounts". I have a hard time seeing how 10 million different people parked in NYC in a one month period (21 Jan to 25 Feb).
Yep. Too big a number. Dwarfs the number of metered parking spots in the city, which is 62,000 according to this page: http://www.parking.org/media/overview-of-the-us-parking-industry.aspx [parking.org]
Congestion pricing studies from a few years ago talked about 800,000 cars per day entering Manhattan. http://wirednewyork.com/forum/showthread.php?t=6044 [wirednewyork.com] But most of those would be the same account over and over. And the number of cars entering the other boroughs would presumably be lower than that. Certainly there is les
Parking Garages? (Score:3)
They have milllions of accounts and all they can think to do is pay for parking? Sounds like the time my checking account got hijacked. I think what irritated me more than anything was that they went to the trouble of making a card then used it to buy a bunch of lame stuff at Kmart. I mean, if you're stealing people's money at least do something interesting with it.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
Sounds like the time my checking account got hijacked. I think what irritated me more than anything was that they went to the trouble of making a card then used it to buy a bunch of lame stuff at Kmart. I mean, if you're stealing people's money at least do something interesting with it.
Similar thing happened to me with a credit card. Hundreds of dollars spent buying from lame gift websites. Some of the merchandise was ultimately delivered to me and it was 3 terrible souvenir-grade T-shirts (two were identical). The kind of crap some kid would give to their grandparent for their birthday ("funny" golf theme, IIRC). I almost thought that they did it on purpose as a gag, but that would mean that they only stole the card with the intent of confusing me with idiotic purchases (actually, I
Re: (Score:2)
I certainly hope so. Oh, wait. Parking is actually about all they could pay for with my Mastercard right now.
"150 million identities stolen from IRS" (Score:2)
I'm foreign and I just realised I was affected (Score:2)
I'm Brazilian and a few weeks ago I was contacted by my bank regarding some very odd charges which seemed fraudulent - these transactions were made on New York parking garages (something like, NYC DOT Parking). The cancelled the credit card, cancelled the charges and sent me a new one.
I visited New York in July 2011 so I was thinking that maybe they stole my credit card details back then and kept the info until they finally decided to use it for fraudulent purchases. It seemed like a long shot, but it was t
Re: (Score:2)
the activity was geographically dispersed
http://majorgeeks.com/story.php?id=34000 [majorgeeks.com]
Re:Hahah. (Score:4, Funny)
Suck it, Tri-State Area!
Re: (Score:3)
no one seems to be hating visa/mastercard for letting 10 million cards be compromised.
Uhm... Because it wasn't Visa and Mastercard who let it happen?
A payment processor used by some parking garages let it happen; that this company happens to process Visa and Mastercard payments is inconsequential to that fact.
Re: (Score:2)
1. It wasn't VISA/MC who suffered the leak.
2. It's the merchant who pays, not the customers (directly, at least)