Identity theft is significant enough that Banks must address it


This statistic is surprisingly high – 2004, 3% of US households hit by identitiy theft. Identity theft hit 3.6 million in U.S. | InfoWorld | News | 2006-03-31 | By Robert McMillan, IDG News Service About 3 percent of all households in the U.S., totaling an estimated 3.6 million families, were hit by some sort of ID theft during the first six months of 2004, according to DOJ data set to be released Sunday. Relevance to Bankwatch: As the most significant aggregator of customers’ information, banks must (continue) to take this issue seriously, and make efforts to support their customers.  For … Continue reading Identity theft is significant enough that Banks must address it

Secret Service make arrests in the Citi ATM fraud


 This article makes it more clear why everything was kept quite quiet on this investigation, as arrests are now being made.  In fact the breadth of the problem is more than we knew earlier, with other merchants involved.

"Some of these arrest were linked to recent nationwide compromises of debit-card customer information and PINs involving a number of retailers and debit card issuers,"

 What is intriguiing, is that the investigation began on something else, and landed on the "Citi" thing as part of that broader investigation.

Operation Rolling Stone, which originally did not focus on the epidemic of debit-card fraud, has at least exposed some new leads, Cherry said.

Here is the detail, thanks to SecurityFocus. 

Relevance to Bankwatch:

 Stated quite eloquently in the article: "Moreover, the companies that are the source of the breaches should acknowledge the incidents and take responsibility". 

 _________________________________________________

Robert Lemos, SecurityFocus 2006-03-31

The U.S. Secret Service arrested seven people across the nation this week as part of an ongoing investigation that has turned up links to the massive debit-card breaches that have worried banks and consumers.

The investigation, dubbed Operation Rolling Stone, has resulted in 21 arrests in the last three months and involves local, state and international law enforcement. The online uncover operation targets Internet criminal groups that "threaten our financial infrastructure," Jonathan Cherry, spokesman for the U.S. Secret Service, told SecurityFocus.

Continue reading “Secret Service make arrests in the Citi ATM fraud”

Banks have to deal with significant ambiguity relative to security


 The criminals are always one step ahead.  Banks continually come out with safety suggestions, and on is to never link to a banking site, always type in the URL.  In this example the criminals are able to spoof that, by hacking the ISP that hosted the Banks site, and redirecting legitimate customers to a fake site, where they (the criminals) gathered the customers usernames and passwords.

Banks Hit With New Spoofing Attacks – Yahoo! News

Thu Mar 30, 11:00 AM ETThree Florida banks have had their Web sites compromised by hackers in an attack that security experts are calling the first of its type.

.. attackers were able to hack servers run by the Internet service provider that hosted the three banks' Web sites. They then redirected traffic from the legitimate Web sites to a bogus server, designed to resemble the banking sites,

… Users were then asked to enter credit card numbers, PINs, and other types of sensitive information

Continue reading “Banks have to deal with significant ambiguity relative to security”

Banks aiming to alleviate online banking fears


Good article at silicon.com on two-factor authentication. All Banks are underway with something in this space at the moment, but the article correctly asks, whether this will be adequate. Of course the answer is no, it will not be adequate. Its essential as the next step but additional steps will be required.

Banks aiming to alleviate online banking fears – Financial Services – Breaking Business and Technology News at silicon.com

Barclays recently announced it is stepping up its fight against fraudsters by using technology to check that each customer's spending behaviour matches his or her profile.

First, lets look at what Banks' are using:

Continue reading “Banks aiming to alleviate online banking fears”

Visa warns of PoS software bug


Courtesy of Finextra, Visa takes action, following the March 6th, 2006 pin fraud.  It was earlier reputed to be OfficeMax, however we note the recent news references are to an “unspecified merchant”.  Only two weeks later – I suppose that’s fast enough? Anyhow, I presume this is the last on the Citi ATM fraud.  However its not the last time we will hear of this issue, and I would rather see Visa (is MasterCard there ??) make a statement about the other software applications used be merchants. Finextra: Visa warns of PoS software bug Visa USA is warning that two … Continue reading Visa warns of PoS software bug

Lower limits are not the answer to fraud


Barclays are following the normal pattern of mitigating risk through reduction in transaction limits.  This is inconvenient to customers and drives up costs, by insisting on manual intervention for “above limit” transactions. And of course, the limit doesn’t solve the fraud .. it just forces the bad guys to be even more creative at being high volume, low cost operators, functioning within the lower limits. Finextra: Barclays limits online funds transfers to fight phishing fraud Barclays has lowered its online transfer limit from £2000 to £1000 to protect customers from fraud. Relevance to Bankwatch:In order to compete effectively, and be … Continue reading Lower limits are not the answer to fraud

Fujitsu Transaction Solutions software may have stored PIN and customer information


This story indicates that Fujitsu software may be part of the problem with the Citibank ATM fraud last month. Visa warns software may store customer data | CNET News.com A popular software that retailers use to control debit-card transactions may inadvertently store sensitive customer information, including PIN codes, says Visa. Relevance to Bankwatch: Banks have to worry about information as much (more) than they do about money. Banks need Chief Information Officers, and corporate principles to govern storage, and use of information.  This includes specific rules surrounding authentication, and authorisation of services. These principles must be applied to third parties … Continue reading Fujitsu Transaction Solutions software may have stored PIN and customer information

Banks set up text, email fraud alerts for customers


Customer loyalty has been established by face to face relationship in the past.  With the advent of internet, and pervasiveness of electronic theft, and multiplicity of payment methods nowadays customers want greater attention paid to their spending patterns and many want control over unusual amounts, or significant changes in their accounts. Enter automated alerts, customised to the their preferences, that provide the assurance of confirming customers activity, and importantly notifiying them immediately of anything that was not them. Banks set up text, email fraud alerts for customers – Financial Services – Breaking Business and Technology News at silicon.com The threat … Continue reading Banks set up text, email fraud alerts for customers

Consumers becoming less uncomfortable With Online Banking


Significant drop of 10% in consumers “extremely concerned” with security of online banking. There is evidence that online tenure mitigates security concerns. The concern will never disappear any more than worry about air crashes, but familiarity will ensure customer participation. Consumer Internet Barometer – Economics – The Conference Board Nearly 52 percent of online consumers are extremely concerned about security when banking online, but the level has fallen from 62 percent in 2004.At the other end of the anxiety barometer is the filing of federal taxes online. Only 43 percent of web surfers feel the same degree of apprehension about … Continue reading Consumers becoming less uncomfortable With Online Banking

Lessons to Learn From Citi Data Breach


The blame is being placed firmly on the merchant here, (originally indicated to be OfficeMax, but now unspecified?). This explanation seems all too simple, but perhaps it is that simple.

Lessons to Learn From Citi Data Breach

Yet experts say two important points to keep in mind when examining this situation are
1) the breach occurred at a third party, not the bank, and
2) this incident is not about PIN technology itself, but the way the data was stored.

In order for this to be the case, the merchant would have to be storing:
a) PIN
b) complete replica of the mag strip data

I still suspect there is more to it, in what is clearly an inside job.

However, if that is all there is to it, then ….

Relevance to Bankwatch:

  • Banks have to be accountable for the data that is shared with
    private networks, and merchants; its unacceptable to blame all the links in the chain, because there are so many.
  • Customers will (rightly) look to the issuing bank to protect their information
  • Technology allows for sufficient data sharing to complete a transaction, without sharing all the customers authentication
    credentials (e.g. public key encryption). Anything short of that is technological laziness

Continue reading “Lessons to Learn From Citi Data Breach”