Feeds

Debit card fraud underscores legal loopholes

Three secret data leaks to blame

The essential guide to IT transformation

Two weeks ago, Visa and Mastercard warned banks of the most recent incident - a breach of an ATM network, according to financial industry insiders. The incident has led to warnings on a similar number of accounts as the Sam's Club incident, said ACU's Swofford, suggesting that the total number of accounts involved in the breach could number in the millions.

Representatives at Visa and Mastercard International refused to comment on the issue. However, Citibank released a statement confirming the ATM network breach, but not naming the company responsible for the network.

In the most recent incident, Visa has said that payment software manufactured by Fujitsi Transaction Solutions has flaws that could put customers information at risk, according to a Friday article in the Wall Street Journal.

Despite the recent epidemic of debit and credit card fraud and last year's titanic breach at CardSystems Solutions, Congress is considering a bill that will let more companies escape taking responsibility for fraud, consumer advocates charge.

The bill, known as H.R. 3997 or the "Financial Data Protection Act of 2005", would let companies decide when a data breach is significant enough to merit warning their customers. The House Financial Services Committee approved the legislation on Friday.

"It is ironic that after a year in which over 55m Americans' identities were put at risk through preventable data breaches, the House Financial Services Committee would repeal state laws that have protected consumers from identity theft," Susanna Montezemolo, policy analyst with Consumers Union, the nonprofit publisher of Consumer Reports magazine, said in a statement following the vote.

The federal legislation would supersede the laws passed by states with significantly weaker protection against identity theft. At least 11 states have stronger notification language than the H.R. 3997 and another eight have stronger rules allowing consumers to freeze their credit accounts to prevent fraudulent use, Montezemolo said.

The key flaws in the bill highlighted by consumer advocates include a requirement of a police report verifying an incident of identity fraud before the victim can place a security freeze on their account and so-called trigger language, which allows the company that suffered a breach to make the decision over whether the incident merits disclosure.

"Having trigger language is ridiculous," said the Privacy Rights Clearinghouse's Givens. "If this bill passes and the trigger language remains intact, there will be few, if any, disclosures about data breaches."

H.R. 3997 will next be considered by the full House of Representatives.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.