It’s a sad fact of modern American consumer life: Every time we swipe a piece of plastic at a gas station, grocery store or anywhere else, we’re vulnerable to virtual pickpockets.
Increasingly, credit and debit card numbers have become commodities sold by cyberthieves, who harvest them from banks, businesses, restaurants and retailers.
“The sophistication of these attacks is unprecedented,” said G. Mark Hardy, president of National Security Corp., a Tampa, Fla.-based cybersecurity consulting firm.
Last year, targeted attacks on businesses jumped 42 percent, according to security software firm Symantec. Attacks spiked 31 percent among companies with fewer than 250 employees.
In recent years, restaurants, grocery stores and even the city of Sacramento, Calif. have had their computer systems hacked or compromised.
It’s part of a shift from mass attacks by computer viruses, worms and other cyberthreats to more pinpointed, targeted infiltrations, say online security experts. The attackers, often located overseas, “find this method more effective because it allows them to fly under the radar and avoid drawing widespread attention to their malware,” Brian Burch, vice president of consumer and small business marketing at Symantec, said in an email.
Small businesses are frequently targeted because they often lack adequate security practices, said Burch. Additionally, because small firms often partner with bigger organizations, cybercriminals “sometimes use them to gain access to a larger company.”
That reality hit the Raley’s grocery chain earlier this month, when it said it had been the victim of a cyberattack targeting customers’ credit and debit card numbers. Raley’s spokesman John Segale said forensic computer experts arrived “within hours” of the company being alerted to a possible security breach on May 30, and continue to investigate. The West Sacramento-based grocery chain also said it reported the incident to the FBI.
In an email, FBI spokeswoman Gina Swankie said the Sacramento office was aware of the Raley’s incident but could neither confirm nor deny that a formal investigation is under way.
Typically, the thieves who steal the data from retailers and other targets aren’t the ones who use it to rack up fraudulent charges. “There’s an underground ecosystem for the sale, transfer, purchase and exchange of stolen credit card and debit card information,” said security expert Hardy.
Investigations, arrests and convictions of cybercriminals are continual. Earlier this month, federal prosecutors in New Jersey announced charges against eight members of an alleged international ring that hacked into the computers of major financial institutions and the U.S. military payroll service, attempting to steal at least $15 million from customer accounts.
In April, a Russian cybercrook was sentenced in Washington, D.C. to more than seven years in federal prison for trafficking in stolen credit and debit cards. When arrested, he was in possession of more than 2.5 million stolen credit and debit card numbers, according to the FBI.
Retailers like Raley’s that process credit card transactions must follow the industry’s safe-practices guidelines, known officially as the Payment Card Industry Data Security Standards. The so-called PCI guidelines require retailers who accept credit and debit cards to maintain a computer network firewall, employ tough passwords and take other precautions.
Retailers who don’t comply face fines of up to $100,000 per month, and can be held financially responsible for fraud investigations and compensation to victims.
Raley’s said it recently passed its PCI audit.
Unfortunately, said Hardy, retailers can do all the right things but still get attacked.
“It’s like wearing your seat belt, putting your kid in a car seat and having air bags in your car,” said Hardy. “You can still be hit by someone driving through a red light.”
Under PCI standards, retailers cannot hold onto a card’s PIN, the three-digit security code or sensitive information stored in a card’s magnetic stripe. In any card transaction, the company’s software must automatically delete that information.
Companies can, however, keep a cardholder’s name, account number and expiration date, such as when they ask your permission to retain the information for automatic payments, subscriptions and the like.
While the PCI standards are considered a good starting point, there are additional layers of software and computer security precautions available, say computer security experts. Among them: Change default passwords so they’re not easy to guess, restrict the use of PCs involved in processing card transactions so that employees surfing the web don’t unwittingly pick up computer viruses and train cashiers to look for plastic devices stuck into card readers to steal information.
Consultants like Hardy will conduct “penetration testing,” where they deliberately break into a business’s computer network to pinpoint weaknesses.
Small businesses “need to come to grips with the fact that they could lose a lot more than just data,” said Robert Siciliano, online security expert for McAfee, in an email. “Their reputations are at stake, and their customers will lose confidence in their abilities to provide a safe haven for their data.”
How to Protect Yourself:
- Check your statements: “Unfortunately, consumers’ hands are tied and cannot truly protect their credit card information,” said Robert Siciliano, a Boston-based security expert for McAfee. His best advice: Be diligent about regularly checking your credit card and banking statements for phony charges.
If you do online bill-paying, you can check your credit card or bank statements weekly, even daily. If you’re not online, be sure to check your monthly statement when it arrives in the mail.
“I recommend doing so online,” said Siciliano. “Mobile phone apps offered by your credit card companies make it even easier.”
- Report fraud fast: If you spot a suspicious charge or something you don’t recognize, report it immediately to your card issuer; their phone number is listed on your bill.
Even if it’s a small amount, like $2, flag it. Cyberthieves are known to “test drive” a stolen card number, by running small charges to see if anyone notices.
Generally, if it’s fraud due to a stolen account number and you report it within 60 days, you are not responsible for any fraudulent charges.
(It’s slightly different if your physical credit or debit card is lost or stolen. In that case, you could be held responsible for the first $50 in charges, as long as you report the loss or theft promptly.)
- Card denial: If you try to use your plastic and the transaction is denied, it could be because of fraud. If that happens, don’t delay in contacting your card issuer to find out what’s wrong.
- Guard your cards: Avoid letting your credit card out of your sight. Choose ATMs in well-lighted, very public spaces, such as bank lobbies. When using an ATM machine, look for suspicious attachments or unusual wear/tear. Shield your screen when typing in your PIN number. If you feel someone is too close or watching you, walk away and find an ATM machine somewhere else.
- Keep a list: Have a list – in a safe place – of all your cards, the account numbers and expiration dates, and each company’s 24-hour reporting line, in case of fraud or a stolen/lost card.
- Track credit history: It’s also smart to keep track of your credit reports, just to be sure no one is fraudulently opening accounts in your name. By federal law, every consumer is entitled to one free copy – every year – from each of the three credit-reporting bureaus: Experian, Equifax and TransUnion. You can order your credit reports directly by phone (877-322-8228), or online from AnnualCreditReport.com.
- Think before you click”: By disclosing account information on bogus websites or responding to urgent appeals in emails or on social media, we can be vulnerable, said Burch, of Symantec.
“It’s essential that people learn to spot the telltale signs of social engineering tricks,” he said, such as undue pressure or a false sense of urgency (“Reply now!”), an offer that appears too good to be true and bogus “officialese” intended to make to make something look authentic.
Consumers should avoid pirated software and “marginal websites.” Do not install unsolicited plug-ins if prompted to do so, even on legitimate websites. Links in emails and social media messages should always be viewed skeptically, even if sent from someone you know.