Slashdot Mirror
Target Hackers Have More Data Than They Can Sell
itwbennett writes "The hackers who stole millions of credit card numbers from Target customers are probably 'laying low knowing that everyone is looking for them,' says Alex Holden, who runs cybercrime consultancy Hold Security. But it's also likely that they can't sell them: 'You can imagine that having a lot of stolen credit cards will not net the hackers, say $35 per card for all 40 million,' said Holden. 'Even if the hackers are willing to sell cards for $1 a card, no one will buy the stolen goods in these amounts.'"
The TargetCardCoin
You can always reduce things. They can sell a smaller subsets.
next to everybody's card has been stolen, is it time for everybody to get a new card? It'll make the stolen database worthless, as well as all other databases of stolen credit cards...
My bank (Chase) has sent out new cards to anyone that had a transaction at Target during the time period they indicated of the breach, and many other banks/financial institutions have done likewise. The value of the purloined data is heading towards nil quickly.
And now you understand the dilemma of De Beers and OPEC, which have more diamonds and oil than they know what to do with and trickle them to the market to keep the price up.
Security through Ubiquity!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
The data was stolen by the company that prints the replacement cards.
Help stamp out iliturcy.
It's 110 million. Yes about 1/3 of the U.S. population has used a credit card at Target. I pray they don't hit Wal Mart.
ugh! lying low not laying low.
Actually, the merchant eats it - at least that's been my experience as a merchant. The ingestion process is called a chargeback. It's one reason why credit card issuers are so glad to make refunds to consumers. Merchants live in fear of chargebacks because not only do they lose the revenue, they also have to pay a penalty.
As a merchant, you quickly figure out that it's best to accommodate any request for a refund, even if you think you're being treated unfairly. For example, I recently had a customer in another country who asked me to pay his local taxes on the sale I had just made to him. So I gave him a refund for the amount of the tax. Easy decision.
(I shouldn't be telling you folks this, it's supposed to be a dirty little secret. Don't tell anybody else.)
What kind of awful bank / credit card company do you have that charges you a replacement fee? I literally replaced my debit card and credit card without any fee, and my debit card was even replaced with a temporary one free of charge.
Furthermore, most of them would likely prefer to send out a card rather than have to deal with claims of account fraud, which costs them money to investigate as well as to eventually replace.
I'm no fan of the banks, but this is ridiculous.
The onus is upon the merchant to prove the charge was legit. For an in-store transaction, this usually means a copy of the signature on the credit card receipt. You send that to the credit card clearinghouse, they compare it to the signature the credit card company provides, and decide if the cardholder really made the purchase or not.
For online transactions, you're pretty much SOL. The credit card companies provide tools to let you try to confirm the cardholder is legit before completing the transaction. e.g. Compare billing address and phone number to that provided by the purchaser (this is why gas station pumps require you to type in a zip code - they're not trying to collect marketing data, it's cross-checking what you type with the zip code on file for the card). The better cards also keep a list of authorized shipping addresses on file, and the merchant can decline the sale if the shipping address for the order doesn't match that on file. But if the customer makes a chargeback, all you can do is show the clearinghouse that you used the tools they provided and hope they decline the chargeback. Usually the customer wins no questions asked, and the merchant just eats the loss as a cost of doing business (like shoplifting).
The banks and credit card companies have done a pretty good job making sure they don't pay anything for fraud (except the customer support rep's wages), all while charging exorbitant interest and fees purportedly to combat fraud. (In their defense, the interest and fees do pay for a different type of fraud - non-payment from customers, though I still think it's excessive.)
Theoretically, yes. Practically, it doesn't happen.
You sell something. 40 days later, the customer calls their bank. The bank mails a form, which the customer receives 10 days later. They fill it in and mail it back. 14 days later, the bank deducts the amount from the merchant's receipts. Ten days after that, the merchant receives a letter saying they've been charged back for a transaction that occurred over two months ago. They money has already been taken from them, subtracted from recent sales.
IF the merchant digs up a signed receipt, they can start the process to dispute the chargeback. 90 days later they'll just get another letter saying the customer now says the product wasn't as advertised.
What HAS worked for me, in a small business, is to call the customer and start some friendly small talk. "Hi George, it's Ray from bettercgi.com. How was your vacation? ...". After establishing that human contact so the customer sees me as an actual person, I mention the chargeback. "I wanted to see if there was a misunderstanding because the bank sent me a letter saying you filed a fraud report against me...". When they are reminded of what the charge is for, I used to ask them to call the bank and cancel the chargeback. That involves the bank mailing another form for them to fill out, so that never ended up working. Now, I just get them to repay the amount. I end up eating the chargeback fee of about $39, plus the double processing fees. I then CALL them 20 days later and REMIND them what the charge is for because people who forget and charge back once tend to forget and charge back again.
As a consumer, please keep in mind your credit card provides strong protection from FRAUD. When you call the bank and charge back, you are accusing someone of fraud.
The onus is upon the merchant to prove the charge was legit. For an in-store transaction, this usually means a copy of the signature on the credit card receipt. You send that to the credit card clearinghouse, they compare it to the signature the credit card company provides, and decide if the cardholder really made the purchase or not.
In light of that, it fascinates me that those electronic signature gizmos at stores work so badly. Half the time, I can't even recognize my own signature because half of it's missing. I guess signature comparisons to dispute chargebacks must not happen very often - I assume that merchants just roll over and die most of the time. The fact that we're all faithfully made to sign on those things probably is just psychology to make us feel like we can't commit friendly fraud by disputing our own purchases.
Somehow, as a favor to someone, I ended up managing the operations of a service based company for a short period of time. We would have customers that constantly were saying: "Do you know who I am?" Usually the past, past, past president of some condo association. Or customers who thought we'd starve without their business and make all kinds of unreasonable demands that would result in a loss to us. We'd let that happen maybe two or three times and when it became apparent that the customer's behavior was chronic I would simply tell them that our goal was to satisfy our customers in every way and obviously we were unable to meet their needs. We valued their satisfaction and felt they would be better served by another company. I'd then suggest a competitor for them to call. The reactions were priceless! They couldn't believe they were being "fired". It helped us two ways. First, it freed up our resources to service the customers who appreciated being treated fairly (and we really were service oriented, money back guarantee on everything.) Second, by the time our competitor figured out what kind of customer they just took on they had suffered the loss.
This was a service industry where there was more work to do than we had people to do it so there really was no loss to us in culling the bad ones. Offtopic I know but maybe someone will benefit from our experience.
Does the stolen-card pusher take plastic?
1. Buy 1 stolen card for $35
2. Buy x stolen cards using a previously acquired stolen card
3. Wash/Rinse/Repeat
4. ???
5. Profit
...when everything is a crime, everyone is a criminal.