Its a sad fact of modern American consumer life: Every time we swipe a piece of plastic at a gas station, grocery store or anywhere else, were vulnerable to virtual pickpockets.
Increasingly, credit and debit card numbers have become commodities sold by cyberthieves who harvest them from banks, businesses, restaurants and retailers.
The sophistication of these attacks is unprecedented, said G. Mark Hardy, president of National Security, a Tampa, Fla.-based cybersecurity consulting firm.
Last year, targeted attacks on businesses jumped 42 percent, according to security software firm Symantec. Attacks spiked 31 percent among companies with fewer than 250 employees.
In recent years, restaurants, grocery stores and even the city of Sacramento, Calif., have had their computer systems hacked or compromised.
Its part of a shift from mass attacks by computer viruses, worms and other cyberthreats to more pinpointed, targeted infiltrations, online security experts say. The attackers, often located overseas, find this method more effective because it allows them to fly under the radar and avoid drawing widespread attention to their malware, said Brian Burch, vice president of consumer and small business marketing at Symantec.
Small businesses are frequently targeted because they often lack adequate security practices, Burch said. Additionally, because small firms often partner with bigger organizations, cybercriminals sometimes use them to gain access to a larger company.
Typically, thieves who steal the data from retailers and other targets arent the ones who use it to rack up fraudulent charges. Theres an underground ecosystem for the sale, transfer, purchase and exchange of stolen credit card and debit card information, Hardy said.
Pat Hoschler of Granite Bay, Calif., got a call June 3 from her credit union telling her of suspicious charges on her debit card.
It gives me the creeps to think someone might be using my name and (debit) card information, Hoschler said. I worry about it. I may not use my debit card anymore.
Investigations, arrests and convictions of cybercriminals are continual. Earlier this month, federal prosecutors in New Jersey announced charges against eight members of an alleged international ring that hacked into the computers of major financial institutions and the U.S. military payroll service, attempting to steal at least $15 million from customer accounts.
In April, a Russian cybercrook was sentenced in Washington to more than seven years in federal prison for trafficking in stolen credit and debit cards. When arrested, he was in possession of more than 2.5 million stolen credit and debit card numbers, according to the FBI.
The PCI guidelines
Retailers that process credit card transactions must follow the industrys safe-practices guidelines, the Payment Card Industry Data Security Standards. The PCI guidelines require retailers who accept credit and debit cards to maintain computer network firewalls, use tough passwords and take other precautions. Retailers who dont comply face fines of as much as $100,000 per month, and can be held financially responsible for fraud investigations and victim compensation.
Unfortunately, Hardy said, retailers can do all the right things but still get attacked.
Its like wearing your seat belt, putting your kid in a car seat and having air bags in your car, Hardy said. You can still be hit by someone driving through a red light.
Under PCI standards, retailers cannot hold onto a cards PIN, the three-digit security code, or sensitive information stored in a cards magnetic stripe. In any card transaction, the companys software must automatically delete that information.
Companies can, however, keep a cardholders name, account number and expiration date, such as when they ask your permission to retain the information for automatic payments, subscriptions and the like.
While the PCI standards are considered a good starting point, additional layers of software and computer security precautions are available, computer security experts say. Among them:
• Change default passwords so theyre not easy to guess.
• Restrict the use of PCs involved in processing card transactions so that employees surfing the Web dont unwittingly pick up computer viruses.
• Train cashiers to look for plastic devices stuck into card readers to steal information.
Consultants like Hardy will conduct penetration testing, in which they deliberately break into a businesss computer network to pinpoint weaknesses.
Small businesses need to come to grips with the fact that they could lose a lot more than just data, said Robert Siciliano, online security expert for McAfee. Their reputations are at stake, and their customers will lose confidence in their abilities to provide a safe haven for their data.
Cybertheft can take many forms, such as card readers physically attached to ATMs to skim account numbers, or more sophisticated thievery that invades a computer network and gobbles up vast amounts of data.
The watering-hole attack
In 2012, computer security experts identified a new type of widespread targeting, the watering-hole attack. In that scenario, cybercriminals seek to invade a group or organization by noting the kind of websites the victim frequently visits. When a weakness is detected in one of those sites, its injected with malware or spyware, which then infects the entire group.
According to Symantec, one watering-hole attack last year infected 500 organizations in a single day.
For consumers, the best precaution is simple: Routinely check your monthly credit card and bank statements for suspicious charges.
All that consumers can do is to pay close attention to their statements weekly and (dispute) unauthorized charges ASAP, within 60 days as federal law requires, Siciliano said. If the charges are because of fraud and are reported promptly, consumers are not held liable.
Ultimately, theres one surefire defense: Cancel your card, and ask your bank to issue a new one.
In this situation, Hardy said, thats probably the easiest, cheapest action an individual consumer can take.