Late this
month, MasterCard International confirmed that up to 40 million credit card
numbers may have been stolen in what is widely regarded as one of the largest
security data breaches to date, mostly because of the mind-boggling number of
details accessible to hackers.
The breach
occurred at CardSystems Solutions, of Tucson, Arizona, a third-party processor of
payment data, according to a MasterCard statement. With about 14 million
MasterCards, 20 million Visa cards and the remainder belonging to other brands
– including American Express and Discover card – this fraud has demonstrated
the power of the internet and the interconnectedness of global commerce.
In a move to reassure customers, Australian banks started
releasing details of the fraud – first detected more than 6 months ago – which
they'd previously been keeping from the public eye. By using sophisticated
analysis and pattern matching processes, along with 24 hour, 7 day a week
real-time monitoring operations, banks have been able to minimise the risk this
kind of flaw poses to customers.
On two recent trips to South East Asia,
Internetrix staff – when purchasing products or paying bills on our company
Visa card – received almost instant phone calls from the Bankwest credit card
monitoring team. Calling through directly onto our mobile phones, the
monitoring team were responding to the transactions almost in real time,
impressing our card holders with the speed and quality of the service, even on
weekends.
It is this kind of tracking that alerted National Australia
Bank to a pattern of fraud emanating our of the US, leading the Federal
Treasurer, Peter Costello, to claim in Parliament that the NAB was the first
bank in the world to uncover the fraud.
From this analysis, Australian banks contacted around 2000
customers whose cards may have been at risk, issuing them with new cards.
The security breach occurred after a hacker was able to
successful implant a Trojan virus within the CardSystems Solutions offices.
This 'backdoor' access allowed him/her to access the millions of card details
over an extended period. Law enforcement authorities are conducting an
investigation, however, the 'simple' means of the security breach – a user just
installed a program that shouldn't have, rather than the more exciting and
fictional methods Hollywood uses to demonstrate the 'dramatic' world of hacking
– underscores the importance of following basic security procedures.
Credit cards, which find their security through matching the
signature of the card holder to the person using it, have long been criticised
for their flaws in online transactions, where the retailer is unable to sight
the card directly. While real-time processing and validation of available funds
and account numbers has gone part of the way, retailers are still at the front
line of bearing the risk for fraudulent transactions. However, the
international ubiquity and standardisation of the credit card schemes, combined
with a lack of suitable alternatives with a PIN or other form of electronic
validation, means we're likely to be stuck with this sub-standard method of
conducting online commerce for some time to come.
If you've got any further questions about your potential
exposure in this massive security breach, contact your issuing bank today for
more specific information.