Technology boost needed in battle against credit card fraud

Fraudsters use the most high-tech equipment to manufacture counterfeit credit cards. So how can we ensure our cards stay safe, asks Siobhán Creaton, Finance Correspondent

Police and Federal investigators in Montgomery county could hardly believe their luck. A tip-off from a suspicious retailer had led officers to what was effectively a factory producing counterfeit credit cards.

It was a couple purchasing three $400 (€350) DVD players with a credit card who had initially triggered concern. Security cameras captured the number plate on their black Lexus and led the authorities to their suburban home last April.

Inside, the officers found 600 pages containing more than 40,000 allegedly stolen names and credit card numbers, and more than 100 newly minted cards in 100 different names featuring the trademark Visa logo.

Credit card fraudsters - known as carders - had been causing problems locally for a few months. A number of irate individuals had been contacting shops to query purchases that had appeared on their monthly statements that they had never authorised.

The couple had been using stolen credit card numbers to purchase thousands of dollars worth of goods.

They had purchased gift vouchers that they sold on for less than their face value. Police officers seized racks of shoes and clothes, their black Lexus, a 2003 Mercedes convertible and a Kawasaki motorcycle, among other purchases.

But the most significant discovery was stacks of credit cards, software to create identity cards, laptop computers, machinery to encode magnetic strips and a "skimmer" that records and stores credit card information.

A skimmer is the ultimate tool for a credit card forger. It is a hand-held device that can quickly scan the information stored on a credit card's magnetic strip, which can be downloaded onto a forged card.

Ms Joanne Crane, manager at the Federal Trade Commission's identity theft programme commenting on the case to the Washington Post, said that more advanced technology needed to be developed to safeguard against these devices.

"The technology is probably developed for legal purposes, but it is very quickly put to use for illicit purposes. Computerisation has made identity fraud infinitely easier," she said.

This week up to 3,000 Irish people with Visa and Mastercard credit cards were alerted that fraudsters could be using their details to make purchases.

The warning was part of a global alert issued by the two big global credit card issuers following an "internal security breach" at an unnamed US-based merchant.

Banks such as AIB and Bank of Ireland, whose customers would account for the bulk of those affected, said they were cancelling their cards and would issue new ones shortly.

The banks acknowledged that this would "inconvenience" customers but said they were following best practice in an instance where a security risk had been identified.

However, the announcement came long after Irish financial institutions would have been notified that cards used by customers in the US 12-18 months ago had been compromised.

That would have happened almost immediately after Visa itself was notified of the potential problem.

A spokeswoman for Visa told The Irish Times that it received this information on April 30th but that it was up to banks and building societies to deal with the information as they wished.

It took almost two months for the Irish financial institutions to decide to close the 3,000 accounts and manufacture new cards for these customers.

Mr Nicholas Moore of AIB's credit card division said its fraud prevention unit assessed what action should be taken and that it moved as quickly as was deemed necessary.

But Ms Mary Kirwan, a security specialist, told this newspaper that, while Irish financial institutions were playing down the threat to customers as a result of the theft of credit card details in the US, cancelling cards tended to be considered only as a last resort.

In February, Visa, Mastercard and American Express were forced to alert eight million card holders after a computer hacker obtained their details from an international data processor.

"Estimates suggest this attack will cost banks between $30 million and $40 million to replace cards and to control the damage," according to Ms Kirwan.

The Irish banks will not state how expensive the process is but insist that none of their customers has reported unusual activity on their cards.

"The expense of re-issuing cards is less than the cost of fraud," Mr Moore said.

"We get reports of stolen and lost cards everyday. Our workload increased substantially with this current alert. It was all hands on deck."

He says banks are always reluctant to discuss the type of frauds that could affect their credit card customers for fear of inspiring others to commit similar crimes.

The Irish Bankers Federation has estimated the cost of credit card fraud here at around €5 million annually.

In Britain, credit card fraud is the fastest-growing white-collar crime, with carders estimated to be spending up to £1 million sterling (€1.45 million) a day using stolen or fake credit cards, mainly in the Greater London area.

Card holders there are being warned to take care when disposing of credit card receipts and bank statements, as dustbins have become a rich source of information for would-be carders.

They are also being advised to destroy rather than discard utility bills as they can allow fraudsters effectively to steal your identity and apply for credit cards or other loans in your name.

A Garda spokesman says people should never let their credit cards out of their sight. He says it is common for organised gangs to place people in various retail outlets who can scan and copy credit card details onto new cards.

The Garda Bureau of Fraud Investigation advises that consumers should use their credit card to buy products and services over the internet only via a secure site and only when they know who they are dealing with.

"If an item does appear on a statement that they feel they didn't enter into, they should contact the bank immediately."