Credit card info hacked again

[Midpack]

OP wasn't referring to Target, he was commenting on the Neiman Marcus CC data breach

Neiman Marcus confirms data breach, offers few details - The Washington Post

Whoops, thanks.

Do you think this can't happen to Costco?

Maybe, but how many other retailers have breached so much info for 70 million? I'll give the others the benefit of the doubt until they prove otherwise, instead of assuming they're all equally insecure. YMMV

And I am not making a recommendation for anyone else.

We shopped at Costco today, and already saved our membership cost vs Target. Frankly we're shocked. So the savings for the next 364 days are all gravy...

 

[savory]

The good news about credit and debit cards in the US is that the providers 'insure' them. While we take care they are not stolen, we are not responsible ( I think never responsible but not 100% sure) when they are. Consequently, as consumers we do not demand more secure methods than we have today. (Many of us actually might not even know more secure cards exist). The chip/pin technology used in many other countries is considered more secure. There is also technology for debit cards that has a dynamic security code that is generated directly on the card. The user with a push of a button creates a new security code each time the card is used. So, all your online purchases are protected if the card or number is stolen. I only mention this to make more people aware and perhaps to have more of us demanding that our banks and credit card companies begin to invest in these technologies in the USA. Those who travel outside of the US already know that many credit card purchases will be denied if your credit card does not have the chip. https://www.nidsecurity.com/microsite/mastercard/

 

[Midpack]

The good news about credit and debit cards in the US is that the providers 'insure' them. While we take care they are not stolen, we are not responsible ( I think never responsible but not 100% sure) when they are. Consequently, as consumers we do not demand more secure methods than we have today.

Who do you think pays then? Federal law conditionally limits the individual consumer liability to $50 and many banks waive that. But the merchant or bank sponsoring the credit card don't ultimately "eat" the costs, they spread those losses along among all of us. Fraud is just another operating expense, they budget for it with loss insurance and/or direct payments. Consumers may not pay directly, but we all pay for every dime of fraud together.

 

[ERD50]

Who do you think pays then? Federal law conditionally limits the individual consumer liability to $50 and many banks waive that. But the merchant or bank sponsoring the credit card don't ultimately "eat" the costs, they spread those losses along among all of us. Fraud is just another operating expense, they budget for it with loss insurance and/or direct payments. Consumers may not pay directly, but we all pay for every dime of fraud together.

True, and that aggravates me. CC companies just pass it along as a cost of doing business, we pay, and some bad guys just keep going at it and living large from our money. If they really fought them, and there were stiff penalties, maybe we'd all be better off?

But then I just found a couple of references that call out CC fraud as costing 6 basis points. Hmmm, 6 cents on $10,000 of purchases? OK, so just how much effort can they throw at that? The postal increase to mail my bill each month far outweighs the cost of fraud.

-ERD50

 

[MichaelB]

The good news about credit and debit cards in the US is that the providers 'insure' them. While we take care they are not stolen, we are not responsible ( I think never responsible but not 100% sure) when they are.

The regulations are different for credit and debit cards. Bogus credit card transactions are not your responsibility as long as you report them, although you are liable for up to $50. Unauthorized debit card transactions (and ATM) must be reported within 60 days. After that the financial institution has no liability, it is entirely your loss.

 

[Walt34]

But then I just found a couple of references that call out CC fraud as costing 6 basis points. Hmmm, 6 cents on $10,000 of purchases? OK, so just how much effort can they throw at that? The postal increase to mail my bill each month far outweighs the cost of fraud.

-ERD50

Exactly. This is old information (~14 years) but the eastern regional security manager for Visa said their fraud losses were one-half of one percent of their profits. Not gross, but profits. Their electric bill was bigger and that was why they had only one security guy for the eastern part of the country.

So from their business standpoint it is a minor issue.

 

[savory]

I appreciate the clarity about who pays for lost/stolen credit/debit cards. I understand that WE pay somewhere along the chain. And that was the point I was also trying to make. But, we do not pay the full amount or any (except for the personal disruption - where our cost is not included) for funds stolen as a result of fraud against OUR card. Consequently, that is a key reason in my opinion that we do not demand that safer (more difficult to perpetuate fraud) methods for our 'plastic' are implemented.

The USA is far behind most every other country in the world. This is from a 2011 Consumer Reports article.

"So why is the U.S. so far behind? It seems to come down to money. The losses for banks do not yet exceed the costs of a switch-over, although merchants say that’s because they usually shoulder much of the cost burden from fraud.

Most cards limit liability for consumers, but the disruption in time and loss of privacy can be considerable.

We’re falling behind the rest of the world in fraud protection, and I’m afraid American consumers are getting the short end of the stick,” says Richard Oliver, executive vice president of the Federal Reserve Bank of Atlanta and director of the Fed’s Retail Payments Risk Forum, a group that focuses on better ways to detect and reduce fraud. "

I think we are in basic agreement that this type of fraud is not good for any of us and there are costs, direct financial and personal time, for all of us. My hope is we try to influence businesses to implement proven anti-fraud methods used in many countries so we can reduce these costs and the personal aggravation that is caused when we are the victim of this type of theft. Let your financial institutions know you are ready to have the safest methods in the world introduced for our debit/credit cards. Perhaps they will respond.

 

[Coffee Mavin]

Any store that can use your credit/debit card to look up a prior purchase for you has all your info stored in their databases & is subject to being hacked into.

What I don't understand is if they took CC information, why it would lead to identity theft. How would they get SS# or any of the other information. I'm assuming they only got the credit card info.

What bothers me most it that it took some time for Target to realize the information was being compromised on an on-going basis AND they didn't understand what in total had been accessed. This is grossly incompetent on their part.

I had been willing to pay a little more to shop at Target for the cleaner & easier environment than WMart. I guess they are all idiots, so might as well get my stuff cheaper.

MidPack - I shop Costco also, but wouldn't call it a substitute for Target. Costco doesn't carry near the range of items that a department store does. I think it's Costco & Fred Meyer or Walmart for me from now on!

 

[MichaelB]

I appreciate the clarity about who pays for lost/stolen credit/debit cards. I understand that WE pay somewhere along the chain. And that was the point I was also trying to make. But, we do not pay the full amount or any (except for the personal disruption - where our cost is not included) for funds stolen as a result of fraud against OUR card. Consequently, that is a key reason in my opinion that we do not demand that safer (more difficult to perpetuate fraud) methods for our 'plastic' are implemented.

Are you referring to your personal situation or the US household in general? For US households, see my earlier post. If debit card fraud is not reported within 60 days you will probably lose everything.

 

[ERD50]

Correction:

...
But then I just found a couple of references that call out CC fraud as costing 6 basis points. Hmmm, 6 cents on $10,000 of purchases? OK, so just how much effort can they throw at that? The postal increase to mail my bill each month far outweighs the cost of fraud.

-ERD50

Arghhh, mixed my decimal points. 6 basis points would be 6 cents on $100, not $10,000. Still a small amount, if you charge $10,000 in a year, $6 is going toward fraud.

IMO, still cheap compared to the cost of using cash, esp after rewards are considered (2% gross).

-ERD50

 

[meierlde]

Arghhh, mixed my decimal points. 6 basis points would be 6 cents on $100, not $10,000. Still a small amount, if you charge $10,000 in a year, $6 is going toward fraud.

IMO, still cheap compared to the cost of using cash, esp after rewards are considered (2% gross).

-ERD50

In many of these discussions we forget that cash does cost stores. To start with it has to be counted (twice) a secure place to store it provided, change has to be gotten from banks. Then for a smaller business there is the chance of being robbed. Add the cost of armored car transport from the larger store to the bank etc. About the only statistic I have heard on this is that when the navy went to a cashless system on aircraft carriers it saved about 6 ftes.

 

[Midpack]

MidPack - I shop Costco also, but wouldn't call it a substitute for Target. Costco doesn't carry near the range of items that a department store does. I think it's Costco & Fred Meyer or Walmart for me from now on!

Agreed. Where my weekly grocery/household shopping was Target (first) & the local grocery store chain, now it's going to be Costco (first) & the local grocery store. No chain can touch the produce at our local grocery, so I shop the bargain location first and get all I can off my list, knowing I'll be able to get all the rest at the (second stop) grocery store. Hopefully that will still work for us...

I rarely bought meats at Target, but the meats at Costco looked like they might be a decent choice (where quantities don't put us off).

 

[Midpack]

True, and that aggravates me. CC companies just pass it along as a cost of doing business, we pay, and some bad guys just keep going at it and living large from our money. If they really fought them, and there were stiff penalties, maybe we'd all be better off?

But then I just found a couple of references that call out CC fraud as costing 6 basis points. Hmmm, 6 cents on $100 of purchases? OK, so just how much effort can they throw at that? The postal increase to mail my bill each month far outweighs the cost of fraud.

While it's aggravating and it does happen, we and/or media often let emotion completely overtake perspective. Your 6 basis points shows how uncommon it is, it's just a blip in the overall, even if devastating to those it happens to. The same phenomena as folks who are terrified of sharks and plane crashes - yet most of us get in our cars every day which is far more dangerous in terms of probability. And some even routinely operate cars under the influence. But sharks, plane crashes, etc. are the news more often.

Another example, you may have noticed a thread a few days ago railing against dishonest financial dealings. I'm NOT defending the practice at all, but it appears you're quite a bit more likely to be taken for money by a family member on average. Which case are most articles about?

 

[Chuckanut]

At least three times last year I received a notice that my information had been taken by criminals who broke into a computer system of an outfit I did business with.

Costs aside, how many such thefts of a person's personal data should one tolerate?

Is the cost of these thefts low because the public is not compensated for the extra work they do to prevent or undo the damage?

What value does a person's privacy have? Should the cost of losing that privacy be added to the costs paid by banks and merchants?

We need to discuss these things as a society, IMHO.

 

[Chuckanut]

We'll see if this is true:


Report: More Holiday Credit Card Breaches To Be Revealed

 

[Rustward]

Here is an interactive graphic about data breaches.

World's Biggest Data Breaches & Hacks | Information Is Beautiful

And these are only the largest.

 

[Chuckanut]

Here is a NYT article on the Krebs behind Krebs on Security. Good reading for nerds and people interesting in security. Probably boring to others.

From the article:

In the following weeks, Mr. Krebs discovered breaches at Neiman Marcus; Michaels, the arts and crafts retailer; and White Lodging, which manages franchises for major hotel chains like Hilton, Marriott and Starwood Hotels.

http://www.nytimes.com/2014/02/17/t...webs-underbelly.html?hpw&rref=technology&_r=0

 

[Chuckanut]

and again, and again, and again..............

This break-in lasted about one year. Sad.

Krebs on Security has posted a new item.

Computer hard drive maker LaCie has acknowledged that a hacker break-in at its
online store exposed credit card numbers and contact information on customers
for the better part of the past year. The disclosure comes almost a month after
the breach was first disclosed by KrebsOnSecurity.

Hardware Giant LaCie Acknowledges Year-Long Credit Card Breach — Krebs on Security

 

[Turboslacker]

I got caught up in the Target debacle. Chase closed my existing Cc and issued a new one. Okay I will deal with the inconvenience.

Now, just 3 months later having a new Chase card and today there were fraudulent charges with my CC number at a different State waaaaaay far away from my location. Seriously? Only 3 months and fraud use; as in someone obtained the number and printed on a fake CC that quickly. Oh ya, it was used for cheap purchases at a 7-Eleven store and McDonalds. Very interesting not just how much more fraud is happening, but how quickly it is being applied. Heck, a few more issuances of new credit card numbers and I won't be surprised to start seeing the very first charges being fraudulent...before I even use it at a merchant.

I'm forecasting that credit cards will be a novelty from the past within only a few years from now. Companies and consumers will demand something far more secure and reliable.

 

[savory]

I got caught up in the Target debacle. Chase closed my existing Cc and issued a new one. Okay I will deal with the inconvenience.

Now, just 3 months later having a new Chase card and today there were fraudulent charges with my CC number at a different State waaaaaay far away from my location. Seriously? Only 3 months and fraud use; as in someone obtained the number and printed on a fake CC that quickly. Oh ya, it was used for cheap purchases at a 7-Eleven store and McDonalds. Very interesting not just how much more fraud is happening, but how quickly it is being applied. Heck, a few more issuances of new credit card numbers and I won't be surprised to start seeing the very first charges being fraudulent...before I even use it at a merchant.

I'm forecasting that credit cards will be a novelty from the past within only a few years from now. Companies and consumers will demand something far more secure and reliable.

Sorry about this Turboslacker. There is a more secure credit card approach available and is being used everywhere outside of the USA. Credit cards issued in Europe for example come with a pin. Without the pin, the card will not be accepted. It also has a chip that makes it more difficult to duplicate. I would like to encourage you to make a stink with your CC company and the retailers. This is old technology that is available today, just not here.

 

[Turboslacker]

Sorry about this Turboslacker. There is a more secure credit card approach available and is being used everywhere outside of the USA. Credit cards issued in Europe for example come with a pin. Without the pin, the card will not be accepted. It also has a chip that makes it more difficult to duplicate. I would like to encourage you to make a stink with your CC company and the retailers. This is old technology that is available today, just not here.

Ya good call. Sounds much like my ATM debit card but I have hedged away from using it for all my transactions like I so a CC. Had a bad experience one time when debit cards first came out in the mid 90's. Never again.

It's interesting how the alternatives have become too slow or not accepted at certain merchants, like checks and cash.