Slashdot Mirror
Card Processing Software May Store CC Info
An anonymous reader writes "Visa has sent out a warning to customers stating that some card processing software may keep customer data even after a transaction is complete. The setup, two versions of a software made by Fujitsu Transaction Solutions, is used by such companies as Best Buy, OfficeMax, and Staples. It's unknown if any of these large retailers use the poorly-made versions of the software." From the article: "Visa's warning, which was first reported by The Wall Street Journal on Friday, has raised eyebrows in the financial and retail sectors. The software was flagged at a time when thousands of debit-card holders across the country have reported unauthorized withdrawals from their accounts. Bank of America, Washington Mutual and Citibank are among the financial institutions that have replaced more than 200,000 debit cards in the past two months ..."
Not true, most credit card transaction receipts include only the first and last 4 digits of the credit card number. The rest usually consists of *'s or X's.
This is to avoid fraud, the printout only serves the purpose of identifying the proper card with the proper sequence number, amount, date and signature.
Some cheaper, less used systems WILL however print out the complete number. I would personally find another method of payment if you know place X does that, but if you have to use a credit card, don't throw your receipt away in the trash.
This article on the globeandmail.com talks about the inventor of one such device and the associated software (RenCode) and how easy it easy for thieves and others to get their hands on it.
Debit cards have the same protection as credit cards when used as credit cards.
5 /
That's what the banks say, but it's not often born out by experience.
Remember, that visa debit card is attached to your checking account. If someone takes money they're not supposed to, you can end up bouncing checks and getting into all kinds of other trouble. You have to fight to get your money back, and bank does not have to respond immediately - and can even deny your claim.
If you just use a credit card and someone gets your number, it's actually the credit card company's money that's lost - not yours.
Why risk it.
Here's some info from Clark Howard's website about what he calls "Fake Visa's":
http://clarkhoward.com/shownotes/category/7/40/22
Feb 14, 2005 -- Update on Visa check card rights
Visa's check card is supposed to help elminate debt by drafting money directly and immediately from your account that has money. But there are some problems with the cards. First, criminals can empty your checking account if they get their hands on your card. Who pays the bounced checks charges if your check card has been stolen? YOU DO! Also, on a real credit card, if you order something you have the right to dispute the charge if something happens to your order. Until now, you could not dispute an order problem on your check card. Visa is now offering modified dispute rights for check card customers. If you have a check card, look on the back and see if it says 'enterlink'. If your card does say this, then you might be covered under Visa's new policy. Make sure you check with your bank to see if you are covered before you begin ordering on your check card.
Nov 10, 2004 -- Fake Visa warning and Wells Fargo update
Clark has a special warning for people who carry fake Visa cards. There has been a breach of security at one of the big national merchants. No one is saying which merchant it is, but an employee has evidently obtained the records of an untold number of customers. That person is using people's debit card numbers across the country without their knowledge. So, when people try to use their cards, they are being turned away. We need full disclosure by the banking industry about this and anytime it happens. We need to know how many people are affected and what institution is involved. So, for the next seven days, if you carry a fake Visa card, check your account for unauthorized debits. Criminals are striking fast before people realize what's going on. Why is this so important? If someone gets a hold of your fake Visa numbers and charges up your account, that money is gone. You have to fight to get that money back, and banks decide on an individual basis. Also,Visa offers no protection for you if it causes checks to bounce. It's a disgrace, but right now, banks are free to decide whether they want to help you out or not.
(I work for First National Merchant Solutions, a company which helps businesses accept payment by credit card.)
i sk_management/cisp.html If they maintain a secure system, there is no problem at all with them storing their customers' details.
Many highly-moderated posts here are confusing the facts, or saying how they think the system should work.
The merchant SHOULD keep track of the credit card number. They can't print the card number on receipts they give to their customers, but the card number is sometimes the only customer identification they have. If a chargeback or retrieval request comes through, the mechant needs to be able to find information about a specific sale, and they usually find that using the card number.
Someone reported that a business issued a credit to their card without requiring their card number again. This, too, is normal. Even if the merchant didn't store the credit card number, they would only have to call their credit card processing company (like the company I work for), identify themselves properly, give them the day of the original sale and the amount, and WE would tell them your card number and expiration date so they could process the credit. (You would have been wasting that manager's time, if you did talk to them.)
Visa and Mastercard regulations prohibit merchants from storing the CVV2/CVC2 number (that's the 3 digit number printed on the papery stripe on the back of your card), or any of the 'secret' information encoded on the magnetic stripe of the card. Everything else they can store, AS LONG AS THEY COMPLY WITH SECURITY REQUIREMENTS. http://usa.visa.com/business/accepting_visa/ops_r
If there's a security breach, the government's intervention is not required. Processing regulations already demand fines for noncompliance. If a merchant's security is penetrated and they lose a bunch of customer details, they'll have to pay a fine and have their security audited to Visa/Mastercard's satisfaction. These fines scale according to the size of the merchant and their annual transaction volume. The largest merchants (like those many of you are talking about) could face huge fines in the hundreds-of-thousands-of-dollars range, if they're noncompliant and they stay that way for any length of time.
If a merchant is using your card information in a way they shouldn't (for example, assuming you'll put your sale on a card you used last time) that's a customer service issue. If they actually charge your card unauthorized, make them give the money back. If they don't credit your account within 30 days, contact your issuing bank. Chargeback reason "Fraudulent Transaction - No Cardholder Authorization." They aren't actually breaking any rules by using a stored card number, but that's still a pretty dumb thing to do if you want happy customers.
OK, now back on topic. Pin-based debit information, like full magnetic stripe info and ESPECIALLY any information about the pin number challenge/response, should NEVER be stored by any merchant. (They can store the card number, debit network ID, various transaction reference numbers, etc.) If someone's software is doing that, merchants should stop using that software. Maybe Visa/Mastercard should release a bulletin to its member organizations, for its merchants, warning them that if they're using this software they need to stop. (Looks suspiciously like something which inspired the original article, doesn't it?) If merchants fail to switch to other, compliant software versions, they deserve the fines and sanctions they'll incur.
(How can Visa and Mastercard levy fines, if they're not the government? Contract law. Visa and Mastercard require contracts with processing companies, like the one I work for. When we sign on a new merchant, they must sign a merchant processing agreement, which binds them to Visa/Mastercard's regulations, and with that binds them to any fines they might incur.)
Now let's get the discussion back on track. No more of this "businesses are storing my credit card number and I don't like it!" stuff.
They use the information for chargebacks, refunds, reconciliation, auto-renewal, etc..., etc...
Last time I read the VISA and MC guidelines, the only real requirement was that you are never supposed to store the VVC code for longer than you need to get the authorization. Everything else is fair game to store, subject to various security guidelines.
If you are still involved with card processing, you should read up on the latest guidelines. Basically, don't store the PAN or exipiration date unencrypted. And NEVER store the card verification code (CVV2, CVC2, or Amex's CID), track data, or PIN for debit transactions. It should be transmitted to the processor or authorizer and then deleted from memory.
This has been in effect for a couple years now, but only recently (post Card Systems) have the associations started to really crack down. Processors and authorization entities were the first to comply with the more stringent guidelines. Now that they are, for the most part CISP complaint, the next in the chain are merchants.
POS software should include authentication and logging, at minimum, pertaining to lookups of cardholder info. Even tighter controls on cardholder data access should be required.
Post-transaction events such as chargebacks and returns do require access to cardholder details, at least the PAN.