Return to Answer

But it probably won't work. Mastercard would quash your subpoena. They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point). After all, as the pig said to the chicken when they opened a breakfast cafe... You may be involved, but I'm committed! Mastercard entirely indemnified you from loss, but there aren't any money-gods magically indemnifying Mastercard. They are "all in" to solve a very hard problem of credit card fraud.

And foot soldiers don't get to know what's going on, due to OpSec.

Fortunately Visa and M/C don't have to settle for who'll work for government pay. They can hire the best of the best, and they locate where those people are (Visa halfway between Silicon Valley and San Francisco, Mastercard outside NYC.)

They are after the people doing the hacking, and the security gaps which make the hacking possible. Lots of us have been lucky, but if you've really tried to secure a PC, this itself is hard even if you do attend DefCon, which notably, Amy does not.

And I've done the abuse wars professionally -- really. OpSec is a big deal. You simply cannot reveal your methods or even much of your findings, because that will expose so much of your detection method to a well-informed observer (specifically the bad guy). If he knows, he'll game around the system in five minutes. Sorry! I know how frustrating it is!

Businesses are liable for hacking, but it's impossible to do business when a wildly random set of circumstances could converge to bankrupt your company. So the credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards). This is a basic set of security rules and practices which should make hacking unlikely. Compliance is achievable (not easy), and if you do it, you're off the hook. That is one way Amy can be entirely not at fault.

Or if you own a business, you know you get spammed constantly by salesmen who want you to switch your Visa-MC merchant service over to them. The salesman gets $600 commission when you switch. So Amy's all set, and even added that free WiFi you kept pestering her to add, which she zoned correctly relating to the credit card machines. And Joe Salesman keeps working her over, and she finally relents. The deal promises to use her existing machines, which are P2PE, so that's all set. Oh wait. Unbeknownst to Joe, those machines don't work, but that's OK, the company provides her new machines free (they're not P2PE), and sends out Doofus Bitboy to install them. Well, Doofus knows nothing about PCI-DSS but was told how to fake the paperwork. The secure WiFi's SSID isn't advertised and Doofus can't even find it, so he sticks the machines on the public WiFi.  You see where this is going. The DSS audit confirms Amy had been lied to, and they go after Doofus and the scumball processor who told him how to fake paperwork

Did you follow all that tech talk? No? Neither does Amy, and neither can any small business owner honestly be expected to. Like Amy they have to rely on their vendors. Allowing that scumbag processor to be a processor is Visa/MC's fault.

This is just a super-hard problem: getting regular humans with life-consuming business-owner jobs to do what it takes to stop fraud, without breaking their backs with risk or complexity. And this is part of the drive toward chip cards and self contained P2PE terminals. Our business dodges PCI-DSS by using our ticketing service's merchant account (at a 1% premium) and PayPal Here (P2PE in the wedge) for face to face transactions. The P2PE takes all our tablets, phones and networks out of PCI-DSS scope.

So back to your desire to know it's Amy's Waffles. How does that help the fraud problem? It doesn't. It's a need to know: you don't. Worst case you blow Amy up on social media unfairly. That deters the business next door to voluntarily report their trouble, and they cover it up.

That business is having enough problems without you dogpiling on.

Right off the bat, who do you think paid for that replacement credit card? Bingo. $50 per customer right there. Plus

• the initial cost of a PCI-DSS audit (even if they were innocent)
• huge fines if they weren't
• the actual cost of re-engineering their systems and procedures to be actually compliant
• get re-certified the hard way (since they are now untrusted).
• the cost of being unable to take credit cards while all this is sorted
• the cost of having any credit card revenue in the pipeline "on hold" until all fraudulent transactions are sorted
• oh yeah, and all the fraudulent transactions. So even if they're a hot dog vendor, they could be paying for a lot of leather coats and iPhones.

The simple fact is 80% of businesses in this situation go bankrupt at this point. You'll know who they are, when they fold up. Just the cash flow impacts of losing current and recent credit card transactions will finish off a lot of businesses that are just making it hand-to-mouth.

It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution. Often you see binary businesses like the baseball park and its contract vendor who runs all the concessions, where most poeple end up doing business with both. So they may not know, and telling you would be defamation.

But it probably won't work. Mastercard would quash your subpoena. They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point).

They are after the people doing the hacking, and the security gaps which make the hacking possible. And how those gaps arise among businesses just trying to do their best. It's a hard problem.

And I've done the abuse wars professionally. OpSec is a big deal. You simply cannot reveal your methods or even much of your findings, because that will expose too much of your detection method. The ugly fact is, the bad guys are not that far from winning, and catching them depends on them unwisely using the same known techniques over and over. When you get a truly novel technique, it costs a fortune in engineering time to unravel what they did and build defenses against it. If maybe 1% of attacks are this, it is manageable, but if it were 10%, you simply cannot staff an enforcement arm big enough - the trained staff don't exist to hire (unless you steal them from Visa, Amex, etc.)

So as much as you'd like to tell the public, believe me, I'd like to get some credit for what I've done -- they just can't say much or they educate the bad guys, and then have a much tougher problem later. Sorry! I know how frustrating it is!

The credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards). This is a basic set of security rules and practices which should make hacking unlikely. Compliance is achievable (not easy), and if you do it, you're off the hook. That is one way Amy can be entirely not at fault.

Example deleted for length, but as a small business, you just can't be a PCI security expert. You rely on the commitments of others to do a good job, like your bank and merchant account salesman. There are so many ways this can go wrong that just aren't your fault.

As to the notion of saying "it affected Amy's customers but it was Doofus the contractor's fault", that doesn't work, the Internet lynch mob won't hear the details and will kill Amy's business. Then she's suing Mastercard for false light, a type of defamtion there the facts are true but are framed falsely. And defamation has much more serious consequences in Europe.

Anyway, even a business not at fault has to pay for a PCI-DSS audit. A business at fault has lots more problems, at the very least paying $50-90 per customer to replace their cards. The simple fact is 80% of businesses in this situation go bankrupt at this point.

That data breach may not be so bad

Usually fraudsters make automated attacks using scripts they got from others. Only a few dozen attacks (on sites) succeed, and then they use other scripts to intercept payment data, which is all they want. They are cookie cutter scripts, and aren't customized for each site, and can't go after whatever personal data is particular to that site. So in most cases all they get is payment data.

It's also likely that primary data, like a cloud drive, photo collection or medical records, are kept in completely separate systems with separate security, unlikely to hack both at once even if the hacker is willing to put lots and lots of engineering effort into it. Most hackers are script kiddies, able to run scripts others provided but unable to hack on their own.

So it's likely that "none was leaked" is the reason they didn't give notification of private information leakage.

Lastly, they can't get what you didn't upload. Site hacking is a well known phenomenon. A person who is concerned with privacy is cautious to not put things online that are too risky.

It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution.

And I've done the abuse wars professionally -- really. OpSec is a big deal. You simply cannot reveal your methods or even much of your findings, because that will expose so much of your detection method to a well-informed observer (specifically the bad guy). If he knows, he'll game around the system in five minutes. Sorry! I know how frustrating it is!

However you are likely to see Mastercard quash your subpoena. They will claim that you lack standing to sue anyone because you did not take a loss. You may also have an opportunity to have a frank off-record conversation with a Mastercard lawyer as to why they don't routinely expose businesses which have breach problems, and that conversation may be rather educational to you, and you may find it to be entirely reasonable.

I know that's hard to hear when you're holding a pitchfork in one hand and a torch in the other, but do not underestimate the impact of an angry mob. Social media outrage crucifying people has often been quite unjust.

  After all, as the pig said to the chicken when they opened a breakfast cafe... You may be involved, but I'm committed! Mastercard entirely indemnified you from loss, but there aren't any money-gods magically indemnifying Mastercard. They are "all in", and are eating all the losses on this, except what they are able to pry out of the business. And believe me, they aim to get paid.  (And that is part of why they don't want to help the pitchfork gang finish off the business).

But it probably won't work. Mastercard would quash your subpoena. They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point). After all, as the pig said to the chicken when they opened a breakfast cafe... You may be involved, but I'm committed! Mastercard entirely indemnified you from loss, but there aren't any money-gods magically indemnifying Mastercard. They are "all in" to solve a very hard problem of credit card fraud.

This is total war. Amy's Waffles is not the enemy.

And foot soldiers don't get to know what's going on, due to OpSec.

Fortunately Visa and M/C don't have to settle for who'll work for government pay. They can hire the best of the best, and they locate where those people are (Visa halfway between Silicon Valley and San Francisco, Mastercard outside NYC.)

They are after the people doing the hacking, and the security gaps which make the hacking possible. Lots of us have been lucky, but if you've really tried to secure a PC, this itself is hard even if you do attend DefCon, which notably, Amy does not.

How this might occur - not Amy's fault

Businesses are liable for hacking, but it's impossible to do business when a wildly random set of circumstances could converge to bankrupt your company. So the credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards). This is a basic set of security rules and practices which should make hacking unlikely. Compliance is achievable (not easy), and if you do it, you're off the hook. That is one way Amy can be entirely not at fault.

Or if you own a business, you know you get spammed constantly by salesmen who want you to switch your Visa-MC merchant service over to them. The salesman gets $600 commission when you switch. So Amy's all set, and even added that free WiFi you kept pestering her to add, which she zoned correctly relating to the credit card machines. And Joe Salesman keeps working her over, and she finally relents. The deal promises to use her existing machines, which are P2PE, so that's all set. Oh wait. Unbeknownst to Joe, those machines don't work, but that's OK, the company provides her new machines free (they're not P2PE), and sends out Doofus Bitboy to install them. Well, Doofus knows nothing about PCI-DSS but was told how to fake the paperwork. The secure WiFi's SSID isn't advertised and Doofus can't even find it, so he sticks the machines on the public WiFi. You see where this is going. The DSS audit confirms Amy had been lied to, and they go after Doofus and the scumball processor who told him how to fake paperwork

Did you follow all that tech talk? No? Neither does Amy, and neither can any small business owner honestly be expected to. Like Amy they have to rely on their vendors. Allowing that scumbag processor to be a processor is Visa/MC's fault.

This is just a super-hard problem: getting regular humans with life-consuming business-owner jobs to do what it takes to stop fraud, without breaking their backs with risk or complexity. And this is part of the drive toward chip cards and self contained P2PE terminals. Our business dodges PCI-DSS by using our ticketing service's merchant account (at a 1% premium) and PayPal Here (P2PE in the wedge) for face to face transactions. The P2PE takes all our tablets, phones and networks out of PCI-DSS scope.

So back to your desire to know it's Amy's Waffles. How does that help the fraud problem? It doesn't. It's a need to know: you don't. Worst case you blow Amy up on social media unfairly. That deters the business next door to voluntarily report their trouble, and they cover it up.