Online Credit Card Fraud Getting Ahead of Ability to Stop it

By James B. Kelleher

The top security experts at the world's two biggest credit-card associations said on Monday that the battle against Internet-based thieves had reached a stalemate and the industry would have to spend millions of dollars over the next decade just to keep up with the criminals.

Speaking at an conference here, John Shaughnessy, senior vice president for fraud prevention at Visa USA and Suzanne Lynch, vice president for security and risk services at MasterCard International, said that organized crime rings -- with the help, in many cases, of former Soviet KGB cryptographers -- were successfully using the Internet and "crimeware" software programs to circumvent the defenses credit-card issuers erected against them.

The picture they presented of an escalatinq struggle between commerce and criminality offered little hope of quick relief for consumers worried about identity theft or for investors in card-issuing banks concerned about security's escalating costs.

The credit-card companies were battling loosely knit, elusive criminal networks responsible for much of the fraud, they said.

"They're very, very good at what they're doing," Shaughnessy told attendees at the Bank Card Conference, "and they're a few steps ahead of us in a couple of areas. They've done their homework about the payments system and because of (them) we all have a chance to lose some sleep at night."

The sobering assessment came one day after Symantec Corp., the world's biggest security software maker, released a report that showed hacking was no longer just the pass-time of precocious teenagers, but now was the province of organized criminals looking to gain access to personal information of computer users -- and their assets.

Symantec said that viruses designed to capture confidential information made up three-quarters of the top 50 viruses, worms and Trojans during the first six months of 2005, up from 54 percent in the last six months of 2004.

Visa's Shaughnessy said FBI data showed the number of Internet-related credit-card crime reports rose 66 percent in 2004 and the average reported loss associated with the online scams tripled to $2,400 from $800 in 2003.

Part of that jump reflects the rise of business done on the Internet, Lynch and Shaughnessy said. But part of it also reflects the increasing sophistication of the criminals.

"We build a 10-foot wall," Lynch said, "and the bad guys build an

11-foot ladder."

While the criminals are increasingly savvy, Shaughnessy and Lynch said that in many cases they were inadvertently helped by sloppy security policies within the payment chain itself -- and by slip-ups by merchants, third-party processors or the credit-card companies themselves.

"I will say that of all the hacks we've seen -- and we've seen hundreds and hundreds of these -- had the third-party been in compliance (with association rules), they probably wouldn't have been hacked," he said.

Shaughnessy said Visa and others were looking at ways of protecting data so that even if a consumer's credit card information was compromised, it would be useless to the criminal. But he warned it would take many years, and lots of money, to set up such a system.

"This is going to take big investments over a number of years and we're talking hundreds of millions of dollars to come up with a secure system," he said. "Maybe 10 years from now we'll have it solved ... It's a tough situation."

Made tougher by the speed with which the criminals exploit even the most harmless information breaches, Lynch said.

Lynch said that as the Red Cross began issuing MasterCard debit cards to victims of Hurricane Katrina earlier this month, a newspaper photographer working on a story about the program took a picture of one recipient holding a card. The photo was quickly posted on the Internet web. "Within eight hours," Lynch said, "there was fraud on the card."

"Somebody had seen the picture -- and unfortunately they hadn't blocked the number -- and so somebody used the card fraudulently."

Copyright 2005 Reuters Limited.

NOTE: For more telecom/internet/networking/computer news from the daily media, check out our feature 'Telecom Digest Extra' each day at

. Hundreds of new articles daily.

USA Today news reports on line at:

[TELECOM Digest Editor's Note: Re-read the last two paragraphs of the story again. Diner's Club used to have a television commercial which included a blown-up, expanded in-close picture of one of their credit cards, and it was issued to 'John Q. Customer', and that card number was used many times in mail order fraud back in the 1960's. Also, you have probably heard of the Brinks Home Security system, where one's house is protected by beams of light which cannot be broken by intruders walking through them (or the alarm goes off, etc.) A television commercial showed a typical installation, with a control panel on the wall. When the occupants entered or left a house, they had to punch in a five digit 'security code' to activate or disarm the system. The commercial showed the homeowner going to bed for the evening and punching in the default code number, '12345' to protect his house and family all night. Although the code number to arm or disarm the system could (and was expected to be) changed from the default, factory-set code of '12345' it turns out most people did not bother to change it from the default (just like many people do not bother to change/eliminate the default 'users' installed at the factory for Unix accounts). Then the people got their houses ripped off when intruders walked in, and used the 20 second grace period to enter the default code. Later versions of the Brink's commercial (just like later commercials for credit cards) don't get into quite that much detail. I understand Red Cross and the FEMA people have gotten good ripoffs from misuse of their cards, also. PAT]