Slashdot Mirror

← Back to Stories (view on slashdot.org)

Card Processing Software May Store CC Info

Posted by ryuzaki0 on from the i'll-just-hang-onto-this dept.

An anonymous reader writes "Visa has sent out a warning to customers stating that some card processing software may keep customer data even after a transaction is complete. The setup, two versions of a software made by Fujitsu Transaction Solutions, is used by such companies as Best Buy, OfficeMax, and Staples. It's unknown if any of these large retailers use the poorly-made versions of the software." From the article: "Visa's warning, which was first reported by The Wall Street Journal on Friday, has raised eyebrows in the financial and retail sectors. The software was flagged at a time when thousands of debit-card holders across the country have reported unauthorized withdrawals from their accounts. Bank of America, Washington Mutual and Citibank are among the financial institutions that have replaced more than 200,000 debit cards in the past two months ..."

2 of 177 comments (clear)

  1. It's widespread... by cardpuncher · · Score: 5, Interesting

    I know a number of (UK) mailorder businesses that routinely store the card number, expiry date and CVV of all transactions. It's either done for convenience (if a refund is required later you don't have to phone the customer to get the card number) or because of operational issues (for example, there is a batch process that extracts the payment details from one system and passes it to another to actually debit the card and it has to be repeatable in case one part of the process fails: the lazy solution is to store everything indefinitely).

    The need to retain customer confidence in the card-processing system means that the interesting question of who would be liable in the case of a mass theft is unlikely to be tested in court - even if it were useful to do so (a lot of mailorder businesses are not cash rich and neither are the software companies that supply them).

    This risk will persist until there is some sort of two-factor authentication on all card transactions.

  2. Re:What are we supposed to use? by gEvil+(beta) · · Score: 5, Funny

    They just scan the UPC on the reciept, and viola...

    I'm sorry, but I see no reason for them to need to look at my viola to decide whether or not I'm eligible to return some clothing.

    --
    This guy's the limit!