Security blogger Brian Krebs, who first reported the Target data breach news earlier this month, said that compromised cards are being marketed online with information on the state, city, and ZIP code of the Target store where they were used.
Fraud experts say the location information will likely allow buyers of the stolen data to use spoofed versions of cards issued to people in their immediate vicinity, Krebs wrote. "This lets crooks who want to use the cards for in-store fraud avoid any knee-jerk fraud defenses in which a financial institution might block transactions that occur outside the legitimate cardholder's immediate geographic region," he said.
This is believed to be the first time that security experts have observed hyper-localized selling of stolen credit and debit card information following a retail breach.
Target last week disclosed that hackers had accessed data stored on some 40 million credit and debit cards belonging to shoppers who bought merchandise in its stores between November 27 and December 15.
The information exposed in the incident includes the cardholder's name, the credit or debit card number, the card's expiration date, and the CVV security code used to activate the card in a store, Target said.
The breach is believed to have exposed data from cards distributed by most major U.S. credit card issuing banks and credit unions. JP Morgan Chase announced that it had put restrictions on the amount that customers affected by the Target breach could spend or withdraw daily.
Detection may be difficult
James Huguelet, an independent consultant who specializes in retail security, said Krebs' report concurs sporadic reports after the breach that that stolen Target cards were used fraudulently in areas close to where the owners of the cards lived.
Local use of a card makes it more likely that the crooks can use it for a relatively long period of time before a block is put on it, he said. "That makes such cards much more valuable to a criminal. This is a very clever tactic to increase the monetary value of each stolen card. It's one I've not seen used before," Huguelet said.
Card thieves typically sell stolen data to buyers around he world, making it likely that fraud detection tools used by banks will detect the crimes.
Fraud detection tools used by banks and other card issuers look closely at the location where a card is used and the frequency of its use to determine potential criminal use. Banks often decline transactions or require additional authentication for card transactions that originate from new or unexpected locations.
Such detection is harder when a stolen card is used within the area where the card is typically used.
"Whoever is behind this breach appears to have a tremendous amount of not only technical, but also retail operations and payment industry knowledge. This could indicate someone who has previously worked in the retail payments industry." Huguelet said.
Gartner analyst Avivah Litan said that card issuers and others have to significantly ramp up fraud detection capabilities to deal with the new threat.
"It's very significant because it shows how sophisticated the criminals are," Litan said. "They are trying to avoid being spotted by fraud detection systems that check the location of a transaction against the individual's home zip code and the location of that individual's most recent transactions."
This level of sophistication, combined with the sheer large volume of active cards that were compromised, makes fraud detection far more difficult, Litan said. "Companies will need to beef up their fraud detection capabilities and strategies to overcome the criminals' tactics, which is not a simple task and which does not happen overnight," she said.
Major data breaches often have provided a window into the systemic weaknesses exploited by cyber criminals to infiltrate networks and to profit from data theft.
The 2007 breach at TJX Companies, in which hackers accessed data on 45 million credit and debit cards, showed how easily a poorly protected wireless network can be exploited to gain access to a payment network. Massive data compromises at Heartland Payment Systems and Hannaford Brothers in 2009 hammered home the dangers of SQL injection flaws in Web application software.
Post a Comment