Feeds

Debit card fraud underscores legal loopholes

Three secret data leaks to blame

Choosing a cloud hosting partner with confidence

Two weeks ago, Visa and Mastercard warned banks of the most recent incident - a breach of an ATM network, according to financial industry insiders. The incident has led to warnings on a similar number of accounts as the Sam's Club incident, said ACU's Swofford, suggesting that the total number of accounts involved in the breach could number in the millions.

Representatives at Visa and Mastercard International refused to comment on the issue. However, Citibank released a statement confirming the ATM network breach, but not naming the company responsible for the network.

In the most recent incident, Visa has said that payment software manufactured by Fujitsi Transaction Solutions has flaws that could put customers information at risk, according to a Friday article in the Wall Street Journal.

Despite the recent epidemic of debit and credit card fraud and last year's titanic breach at CardSystems Solutions, Congress is considering a bill that will let more companies escape taking responsibility for fraud, consumer advocates charge.

The bill, known as H.R. 3997 or the "Financial Data Protection Act of 2005", would let companies decide when a data breach is significant enough to merit warning their customers. The House Financial Services Committee approved the legislation on Friday.

"It is ironic that after a year in which over 55m Americans' identities were put at risk through preventable data breaches, the House Financial Services Committee would repeal state laws that have protected consumers from identity theft," Susanna Montezemolo, policy analyst with Consumers Union, the nonprofit publisher of Consumer Reports magazine, said in a statement following the vote.

The federal legislation would supersede the laws passed by states with significantly weaker protection against identity theft. At least 11 states have stronger notification language than the H.R. 3997 and another eight have stronger rules allowing consumers to freeze their credit accounts to prevent fraudulent use, Montezemolo said.

The key flaws in the bill highlighted by consumer advocates include a requirement of a police report verifying an incident of identity fraud before the victim can place a security freeze on their account and so-called trigger language, which allows the company that suffered a breach to make the decision over whether the incident merits disclosure.

"Having trigger language is ridiculous," said the Privacy Rights Clearinghouse's Givens. "If this bill passes and the trigger language remains intact, there will be few, if any, disclosures about data breaches."

H.R. 3997 will next be considered by the full House of Representatives.

This article originally appeared in Security Focus.

Copyright © 2006, SecurityFocus

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.