Slashdot Mirror
Card Processing Software May Store CC Info
An anonymous reader writes "Visa has sent out a warning to customers stating that some card processing software may keep customer data even after a transaction is complete. The setup, two versions of a software made by Fujitsu Transaction Solutions, is used by such companies as Best Buy, OfficeMax, and Staples. It's unknown if any of these large retailers use the poorly-made versions of the software." From the article: "Visa's warning, which was first reported by The Wall Street Journal on Friday, has raised eyebrows in the financial and retail sectors. The software was flagged at a time when thousands of debit-card holders across the country have reported unauthorized withdrawals from their accounts. Bank of America, Washington Mutual and Citibank are among the financial institutions that have replaced more than 200,000 debit cards in the past two months ..."
not in the next 50 years... Until there is a "PERFECT" system in place for financial transactions, plus, too many remote "poor" areas that can't afford the other gizmos required for electronic payment. Long live cold hard cash.
Sig Hansen?
We apologize for the preceding message. All those responsible have been sacked.
I hate to tell you this, but the store has saved your credit card information almost EVERY TIME you have ever used a credit card in a retail store in recent years. The reason? They HAVE to, otherwise they would never get paid.
What happens is this: at the end of the day, the store (often from the store, but sometimes it's done from the corporate office) and the credit provider perform a process called Settlement, where they compare a log of the credit card transactions for the day. The retailer does not get paid for the credit card sales until the transactions are reconciled.
If the retailer and the credit provider are smart, the data is held and transmitted using encryption, but I know for a fact that this is not always so - I write Point Of Sale/credit authorization systems for a living.
What is needed is a law that forces companies dealing with bank and finantial details (banks, credit card companies, card processors, insurance companies, finance companies, ATM providers, EFTPOS/credit card processing machine providers and so on) to take greater efforts to keep it secure, much like HIPPA mandates high security for medical records.
Essentialy it would mandate things like "any device or software that holds on to any finantial data after it is no longer required to process whatever transaction the data was given for is illegal" and "All devices storing or transporting or moving finantial data must use encryption" (for example, any US website taking banking details, finantial details or credit card details must use SSL or similar to encrypt the data as it goes over the internet) as well as requiring (for example) banks to do more to make it harder for phishing sites to fool users into plugging in their password (there are certainly solutions out there so its not like its not possible for the banks to do it, they just dont because it would cost too much to fix it).
Also this law should have bigger penalties for companies who dont protect this data and it gets copied as a result (much like how there are penatlies if medical data is copied)
Well,I don't know about other stores, but I know the Gap must keep your info. When you return something there with your reciept, they don't need your credit card. They just scan the UPC on the reciept, and viola, the charge on your credit card is reversed. I don't like that, because it means that somewhere there is a database with your credit card info. I am sure there is fine print somewhere that makes you authorize this...
And All I Ask is a Tall Ship And a Star to Steer Her By
Banks already have that - it's the Gramm-Leach-Bliley act and purportedly is meant to protect customer financial privacy.
I think that the gist of the article, though, is that the merchants are not under the same regulatory burden - and that is where the weak link in the chain is at the moment.
A fine is a tax you pay for doing wrong and a tax is a fine you pay for doing all right.
The problem, as I see it, is vendors that store all customer information, in a single logical location, long term. For instance, after a purchase is valiated, which online takes 30 seconds, my adress and CVVC should be delinked from my cc number. Keep the CC number in a transaction log, but get rid of the CVC and only keep the address in a ship log. I know this is not going to happen, as it is complicated, but it should help protect us. I am with you though. We need laws that makes bad practice a liability on the vendors, banks, and device providers that utilize it.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
Thanks for pointing out what should have been obvious... reminds me that I ran a retail shop in the 80's, and submitted my charges on paper.
And anybody who RTFA noted that the issue concerned DEBIT cards. You don't worry much about getting your credit card stolen, because the liability is limited. Debit cards are a whole 'nother story, and the problem here is that some debit-card software had been storing the PIN number as well as the card number... so anybody who got the numbers could go to an ATM and empty your bank account in seconds. Additionally, a stolen debit card is a much greater risk for identity theft than a stolen credit card.
Troubleshooting. Same reason you can store CVV2 codes, even though CISP says *never* store CCV2 codes. You'd be surprised how often this shit comees in handy when you are trying to figure out why a series of transactions failed. It's way easier to figure out what is fucked-up with a transaction if you can see all the data. Businesses ( and customers too, actually ) don't like to hear "Well it failed, but we don't keep data for that stuff, so that's all I can tell you." They are very into the why, and sometimes without that data there just is no why.
Not to say that you should do it, you'll *take it in the shorts* for doing this in a prod environment, it is stupidly dangerous...but everybody thinks their systems are secure, right?
remember the wisdom of Mahatma Gandhi: If enough peasants die horribly, someone will probably notice