Forum Moderators: buckworks

Message Too Old, No Replies

Hackers gain info to 5.6 million credit cards

System break-in

         

jimbo_mac

1:27 pm on Feb 19, 2003 (gmt 0)

10+ Year Member



Looks like a hacker/hackers went to town with this one.

- Visa - Approx 3.4 mill.
- MasterCard 2.2 mill.
- American Express (declined to comment)

Neither Visa nor MasterCard would identify the company that was hacked, nor would they provide information on how the theft occurred, citing security concerns.

Visa and MasterCard, like other credit card companies, use third party companies to manage credit card transactions between merchants and the financial institutions that issue the credit cards.

Those companies transfer money to a merchant's account and manage any transaction fees, according to a Visa spokesman.

[idg.net...]

korkus2000

1:43 pm on Feb 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



This always hurts ecommerce.

Receptional Andy

3:23 pm on Feb 19, 2003 (gmt 0)



There are much wider and more important issues involved here - they KNOW that 8 million (latest figure) accounts have been compromised, but they say this:

"We have notified our member financial institutions of the accounts involved, so that they may monitor each account for fraud and/or reissue cards as appropriate," MasterCard said in a statement.

So, your card number might have been stolen but it is YOUR responsibility to not be a victim of fruad, even though Mastercard VISA etc might already know about it, and it was their poor security that let the numbers be stolen in the first place.

And this says nothing of the substantial revenue that the credit card companies would make as a result of chargebacks if the numbers ARE used for fraud, and the painful effects on merchants on and offline who will suffer once again if the cards are ever used fraudulently.

I am shocked and disgusted at the irresponsbility of the credit card companies, who should be forced to reissue every single card that has been affected, I don't care about the costs and logistics involved for them - except that they will always charge it onto us in the end...

gsx

4:54 pm on Feb 19, 2003 (gmt 0)

10+ Year Member



...they wont replace the cards to the customers!

1) It costs them money to replace all those cards.
2) Every fraud transaction, they make a profit on (card percentage, chargeback fees etc...)

Receptional Andy

5:03 pm on Feb 19, 2003 (gmt 0)



>...they wont replace the cards to the customers!<

I'm well aware of this, but as consumers/merchants surely there is something we can do force them to act resposnibly over this issue?

Their actions appear to me to be negligent to a most extreme level, and at the very least highly irresponsible - and it's our money they're talking about here.
Their stance is, we'll let them use your credit card fraudulently, and THEN we'll do something about it, or if you're a merchant, we will let the fraudsters use stolen cards and then charge YOU for not doing anything about it.

Are they serious?

redzone

5:04 pm on Feb 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



It really shouldn't be the financial responsibility of the individual credit card companies. It should be the responsibility of the "Processor" who allowed their security system to be compromised.

What happens though is the "trickle down" expense flow.
If the credit card companies force the processor to bear the expense of re-issueing cards, they will just end up charging the credit card company (Like they don't make enough money already... LOL).. Then the CC company will pass on future costs to "us" the cardholder.

Either way we get "screwed", but in reality the financial responsibility should rest on the shoulders of the processor that allowed their system to be hacked.

rcjordan

5:08 pm on Feb 19, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Back when realnames got hacked the bank I use shut down and reissued all credit cards that might have been compromised.

Receptional Andy

5:10 pm on Feb 19, 2003 (gmt 0)



> the financial responsibility should rest on the shoulders of the processor that allowed their system to be hacked.<

I kind of agree, but also not. If you want a merchant account, then you have to go through a whole series of vetting procedures before you get the account. The credit card companies concerned approved the processor in this case, and so they are at least indirectly responsible.

Either way, there is no justification for them washing their hands of this issue and just sitting on 8 million compromised accounts without informing merchants or consumers - this is 1% of all credit cards in the US we're talking about here, not a handful of numbers.

I know the costs will eventually be put back onto us whatever we do, but I just can't take their attitude that its OUR problem.

How about this example:

I am an online merchant, and I process a credit card that later turns out to be one of those affected. VISA KNOW that the card has been compromised, but they still send me a charcgeback. If they had told me the affected card details, I could have refused the transaction. Are they not liable for not telling me this information, when they could have done? Are they not (morally if nothing else) responsible for the chargeback in the scenario above?