another added risk of 3rd party processing.

Biggy · 06-19-2005

This has been pretty big news - been on top of the WSJ for a while, plus its been spoken about on both CNBC and FoxNews. I think this will turn into a much bigger risk for 3rd party processors in the future...

http://online.wsj.com/article/0,,SB1119040...e_whats_news_us

"MasterCard International Inc. has begun notifying member banks of a security breach which could expose more than 40 million cards of all brands to fraud, the credit-card company said Friday. The breach involves about 13.9 million MasterCard-branded cards.

The compromised data included names, banks and account numbers -- not addresses or Social Security numbers, said MasterCard spokeswoman Sharon Gamsin. Such data could be used to steal funds but not identities.

MasterCard traced the breach to Atlanta-based CardSystems Solutions Inc., a third-party processor of payment card data, which processes transactions on behalf of financial institutions and merchants. MasterCard said CardSystems has already taken steps to improve the security of its system. (Read the statement.)

CardSystems operations center in Tucson, Ariz., was hit by a computer virus that captured customer data for the purpose of fraud, said Ms. Gamsin.

Reached on his cell phone, CardSystems' chief financial officer, Michael A. Brady, said: "We were absolutely blindsided by a press release by the association."

He refused to answer any questions and referred calls to the company's chief executive, John M. Perry, and its senior vice president of marketing, Bill N. Reeves. A message left for Messrs. Perry and Reeves at the company's Atlanta offices was not immediately returned.

MasterCard has begun notifying customer banks of specific card accounts that may be vulnerable to compromise, so that those banks can take steps to prevent against fraud.

Under federal law, credit card holders are liable for no more than $50 of unauthorized charges, and many card issuers including MasterCard will even waive the $50.

CardSystems processes less than 0.5% of American Express's domestic transactions, said company spokeswoman Judy Tenzer. She said a small number of its cardholders were affected, though she did not have an exact figure.

"We are aware of the situation, we're closely monitoring it and we do have an investigation under way," Ms. Tenzer said.

Discover Financial Services Inc. said it was aware of the situation and would not say whether any of its cards were involved. Visa USA and a large issuer of cards, MBNA Corp., did not immediately calls seeking comment.

It was the latest in a series of security breaches affecting valuable consumer data at major financial institutions and data brokers in an increasingly database-driven world.

The breach appears to be the largest yet involving financial data, said David Sobel, general counsel at the Electronic Privacy Information Center.

"The steady stream of these disclosures shows the pressing need for regulation of the industry both in terms of limitation in the amount of personal information that companies collect and also liability when these kinds of disclosures occur," Mr. Sobel said."

*KK* · 06-20-2005

Actually without the addresses, every third party processor I know of will decline those cards on AVS failure.

Those with their own merchant account running MOD-10 or something totally basic without any decent fraud scrubbing, on the other hand, well, that could be a problem.

06-19-2005	#1
Biggy Members Join Date: Jul 2003 Posts: 768	This has been pretty big news - been on top of the WSJ for a while, plus its been spoken about on both CNBC and FoxNews. I think this will turn into a much bigger risk for 3rd party processors in the future... http://online.wsj.com/article/0,,SB1119040...e_whats_news_us "MasterCard International Inc. has begun notifying member banks of a security breach which could expose more than 40 million cards of all brands to fraud, the credit-card company said Friday. The breach involves about 13.9 million MasterCard-branded cards. The compromised data included names, banks and account numbers -- not addresses or Social Security numbers, said MasterCard spokeswoman Sharon Gamsin. Such data could be used to steal funds but not identities. MasterCard traced the breach to Atlanta-based CardSystems Solutions Inc., a third-party processor of payment card data, which processes transactions on behalf of financial institutions and merchants. MasterCard said CardSystems has already taken steps to improve the security of its system. (Read the statement.) CardSystems operations center in Tucson, Ariz., was hit by a computer virus that captured customer data for the purpose of fraud, said Ms. Gamsin. Reached on his cell phone, CardSystems' chief financial officer, Michael A. Brady, said: "We were absolutely blindsided by a press release by the association." He refused to answer any questions and referred calls to the company's chief executive, John M. Perry, and its senior vice president of marketing, Bill N. Reeves. A message left for Messrs. Perry and Reeves at the company's Atlanta offices was not immediately returned. MasterCard has begun notifying customer banks of specific card accounts that may be vulnerable to compromise, so that those banks can take steps to prevent against fraud. Under federal law, credit card holders are liable for no more than $50 of unauthorized charges, and many card issuers including MasterCard will even waive the $50. CardSystems processes less than 0.5% of American Express's domestic transactions, said company spokeswoman Judy Tenzer. She said a small number of its cardholders were affected, though she did not have an exact figure. "We are aware of the situation, we're closely monitoring it and we do have an investigation under way," Ms. Tenzer said. Discover Financial Services Inc. said it was aware of the situation and would not say whether any of its cards were involved. Visa USA and a large issuer of cards, MBNA Corp., did not immediately calls seeking comment. It was the latest in a series of security breaches affecting valuable consumer data at major financial institutions and data brokers in an increasingly database-driven world. The breach appears to be the largest yet involving financial data, said David Sobel, general counsel at the Electronic Privacy Information Center. "The steady stream of these disclosures shows the pressing need for regulation of the industry both in terms of limitation in the amount of personal information that companies collect and also liability when these kinds of disclosures occur," Mr. Sobel said." __________________ Create a solid TGP presence for your site(s). ICQ: 110850739

06-20-2005	#2
KK Members Respin bullshit press Your Comments Are Welcomed Join Date: Nov 2002 Posts: 2,581	Actually without the addresses, every third party processor I know of will decline those cards on AVS failure. Those with their own merchant account running MOD-10 or something totally basic without any decent fraud scrubbing, on the other hand, well, that could be a problem.