70

I was recently informed, by the payment processing agency of my bank, that an online shop was compromised and that as a precaution my MasterCard credit card was frozen and replaced. There was no actual fraudulent charge.

I have inquired with my bank which particular shop was compromised, but was told that they do not receive this information from MasterCard for privacy reasons.

I feel that I am entitled to know where my private information was leaked. It does influence my decisions as a consumer. Further I have to consider that other private information may also have been leaked. The privacy argument seems pretextual.

Is it common to withhold this kind of information from affected customers? Are there any further ways to find out more about what happened?

Note: I was unable to speak to anyone at MasterCard, all attempts were forwarded automatically to the bank.

  • 14
    Have you tried contacting Mastercard? They might only tell the bank who has been affected, but it's possible (but by no means guaranteed) that they'll tell the customer where the details came from. – TripeHound May 30 '17 at 16:42
  • 5
    In the US this is definitely the standard practice. I don't know if Germany specifically or the EU generally has consumer laws in place to require disclosure, but the US definitely has no such laws. – quid May 30 '17 at 16:45
  • 35
    Although I agree that you should have a right to know, I also feel that a merchant should have the right to stay anonymous if they choose to. If they could not, it's possible they wouldn't report the breach in the first place for fear of losing business, and that would be even worse for everyone. Of course, MasterCard also has the right to revoke the merchant's ability to accept MC payments, if they felt that the merchant was compromised due to negligence or some other reason that could have reasonably been prevented. – TTT May 30 '17 at 16:59
  • 14
    Additionally, there might not have even been a breach. There may have been an audit of some merchant's data storage practices and though there was no evidence of a breach the merchant was removed from the network and everyone who has ever used that merchant is being issued a new card. – quid May 30 '17 at 16:59
  • 5
    What private information of yours was leaked? I'd argue your credit card number is not your private information; it's the credit card company's. After all, they're the ones getting charged through its leakage. Is your name private (can it be private?) and if you think it somehow is, was it leaked? If not, what was actually leaked? – Mehrdad May 30 '17 at 21:45
64

As indicated in comments, this is common practice in the US as well as EU. For example, in this Fox Business article, a user had basically the same experience: their card was replaced but without the specific merchant being disclosed. When the reporter contacted Visa, they were told:

"We also believe that the public interest is best served by quickly notifying financial institutions with the information necessary to protect themselves and their cardholders from fraud losses. Even a slight delay in notification to financial institutions could be costly,” the spokesperson said in an e-mail statement. “Visa works with the breached entity to collect the necessary information and provides payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring, and if needed, reissuing cards. The most critical information needed is the affected accounts, which Visa works to provide as quickly as possible.”

What they're not saying, of course, is that it's in Visa's best interests that merchants let Visa know right away when a leak occurs, without having to think about whether it's going to screw that merchant over in the press. If the merchant has to consider PR, they may not let the networks know in as timely of a fashion - they may at least wait until they've verified the issue in more detail, or even wait until they've found who to pin it on so they don't get blamed.

But beyond that, the point is that it's easier for the network (Visa/Mastercard/etc.) to have a system that's just a list of card numbers to submit to the bank for re-issuing; nobody there really cares which merchant was at fault, they just want to re-issue the cards quickly. Letting you know who's at fault is separate. There's little reason for the issuing bank to ever know; you should find out from the merchant themselves or from the network (and in my experience, usually the former).

Eventually you may well find out - the article suggest that:

[T]he situation is common, but there is some good news: consumers do in many cases find out the source of the breach.

But of course doesn't go into detail about numbers.

  • 1
    The last claim in the article I find somewhat surprising. I've never been informed about the origin event behind any of the half dozenish times I was issued a new card number. With the semi-exception of one whose timing correlated with a major middleware transaction processing entity being breached, none of them ever could be associated with a breach that made the national news. – Dan Neely May 30 '17 at 18:59
  • 5
    Another issue is the certification Visa does on merchants to handle payment details. They absolve and protect them of any responsibility as long as the merchant adheres to the (rather strong) standards set out. Disclosing their name on request would certainly breach the spirit, if not the letter, of that contract. – Ordous May 30 '17 at 19:00
  • 6
    I think it's also important to note here that while it's tempting to think that the cardholders are the customer of visa or mastercard, it's actually the merchants that are their customers. They are the ones that pay the processing fees. It's generally bad business to go around blowing your customers in for their mistakes. – JimmyJames May 30 '17 at 21:21
  • 1
    Could you bold the main point in your second paragraph. It was hard to see where the actual answer is, but it was there: Visa needs merchants to be comfortable announcing a breech as fast as possible, and protecting the merchant's reputation is part of their process for doing so. – Cort Ammon May 30 '17 at 22:24
  • 6
    I think the entire answer is the actual answer, that's just a part of it. – Joe May 30 '17 at 22:31
8

I found a german article describing the legal situation in Germany. To summarize

  • The "Bundesdatenschutzgesetz (BDSG) § 42a Informationspflicht bei unrechtmäßiger Kenntniserlangung von Daten" Roughly Privacy Act: Obligation to inform on illegal obtainment of information governs this situation.
  • Credit card information is explicitly included in the law (§ 42a 4).
  • Condition 1: It needs to be very likely that a third party has obtained the information and the company needs to know that.
  • Condition 2: There needs to be a severe adverse impact on the affected. The risk of assessing this correctly is with the company.
  • The affected must be informed immediately, but only after counter measures are performed and criminal investigation is not endangered.
  • The disclosure must give the affected a hint on the way the information was illegally obtained, and measures to mitigate potential consequences. The affected shall know that and which information leaked to outsiders.
  • If it would not be feasible to inform each affected, in particular because there are too many, they can also inform the public though at least two half-page newspaper advertisements or the like.

As outlined by the many possible reasons in the other answer, it is unclear from the information I have, whether condition 1 holds. Also condition 2 may not hold since the credit card was frozen.

I suppose this makes a good argument to MasterCard and my bank, but I also suspect they will not care unless it comes with a attorney letterhead.

  • 1
    Probably even an attorney letterhead will not matter. They have already complied with the requirements - unless there are verbiage that you have not included that requires the credit card company to disclose from which merchant the leak occured. – Taemyr May 31 '17 at 11:14
  • Well technically, the entity that stored and lost my information needs to inform me. Assuming that there is a web-shop as the letter indicates, they have not. – Tari May 31 '17 at 11:20
  • @Tari: My German isn't good enough to tell for sure, but at a glance, it doesn't look like the entity that lost your information is obliged to inform you directly, as long as they ensure that you are somehow informed of the breach. Letting their credit card processor and/or your bank take care of informing you probably satisfies their legal obligations. – Ilmari Karonen May 31 '17 at 11:37
  • 1
    Good work finding the relevant legislation, and thanks for adding it here! – Joe May 31 '17 at 18:40
  • @IlmariKaronen you have a good point. I don't know, might be something for courts to interpret into the law. A good point is also that the shop might not have (currently valid) contact information, so the way over MasterCard is more reliable. It also depends on how far telling me about the way of illegal obtainment goes. – Tari Jun 1 '17 at 15:17
7

Others have already commented on the impact of anything which dissuades merchants from raising possible breaches, so I won't dwell on that. Maybe we need stronger legislation, maybe we don't, but it doesn't change today's answer. Often it works the other way around to what you might expect - rather than the merchant noticing and notifying Visa/MC/others, Visa/MC/others spot patterns of suspicious activity (example 1).

I don't have any data on the relative numbers of who is being notified/notifying between merchants and payment processors, but at the point when your card is identified as compromised there's no reason to suppose that an individual merchant in the traditional sense has been compromised, let alone identified. In fact because there's a fast moving investigation it could even be a false alarm that led to your card getting cancelled. Conversely it could be a hugely complex multinational investigation which would be jeopardised.

It's simply not safe to assume that simply "brand X" has been compromised, therefore everything "brand X" knows about you is also compromised:

  1. They could be separate systems, so only CC info involved
  2. It could be their upstream payment processing contractor (and by implication all other merchants with the same setup, example 2 but think sagepay/worldpay/paypall etc. in the online world)
  3. (Not related to online so much) could be just one franchisee of a large franchise
  4. They may not even know which online shop, simply the type of data attached in a "dump" indicates it's likely to be online, but the only thing known so far is that your card number had shown up somewhere

Furthermore there's no reason to assume the merchant has even admitted to, or discovered the root cause. MC/Visa/Banks, at the point at which they're cancelling cards simply can't say (at least not in a way that might expensively backfire involving lots of lawyers) because the standard of proof needed to go on record blaming someone is simply not yet met.

So: yes it's common that you aren't told anything for all of the above reasons. And of course if you really want to find out more you may have some success with your local data protection legislation and formally make a subject access request (or local equivalent) to see what that brings back. Be sure to do it in writing, to the official address of both mastercard and your bank.

  • Thank you for the good listing of possible things that may have happened. The wording on the letter I received implied that there was indeed a specific online shop involved, but I guess that doesn't necessarily rule out a POS break. The multitude of different possible events, all concerning my PII, are exactly the reason why I am inquiring for transparency. Fore example if they told me that an unnamed upstream payment processing contractor that handles only my Name, Address, CC was compromised, would already be a huge improvement. – Tari May 31 '17 at 10:14
  • 1
    I don't think this is very relevant to the situation. The sort of letter OP received indicates that a merchant informed the network of a breach of information from their systems, not that a merchant informed the network of a specific incident of fraudulent activity at the merchant. – Joe May 31 '17 at 18:38
  • @Joe I don't imagine there are more than a few form letters used for situations like this. I doubt they have a sufficiently nuanced set of letters to cover all the various subtitles that might lead to a "we've cancelled your card" moment, they may even deliberately hide the fact that they saw your card in a dump somewhere. Furthermore there's no indication from the question to support your assertion that "a merchant informed the network of a breach". Without an exact copy of the letter we can't say. The Q just says "an online shop was compromised", nothing more which could mean many things. – Flexo May 31 '17 at 20:08
  • My point is I don't find this answer to contain information relevant to this question. It's more of a form answer to a generic question, than specific to this one. – Joe May 31 '17 at 21:17
  • @Joe, but my point is that the question itself isn't specific. It says the letter stated "an online shop was compromised" without saying how it was compromised or who noticed that. It didn't say "a merchant reported that their online shop was compromised" in which case I'd be inclined to agree. – Flexo May 31 '17 at 21:35
1

If you really want to know, sue them.

File a John Doe lawsuit, "plaintiff to be determined", and then subpoena the relevant information from Mastercard. John Doe doesn't countersue, so you're pretty safe doing this.

But it probably won't work. Mastercard would quash your subpoena. They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point).

This is total war. Amy's Waffles is not the enemy.

They are after the people doing the hacking, and the security gaps which make the hacking possible. And how those gaps arise among businesses just trying to do their best. It's a hard problem.

And I've done the abuse wars professionally. OpSec is a big deal. You simply cannot reveal your methods or even much of your findings, because that will expose too much of your detection method. The ugly fact is, the bad guys are not that far from winning, and catching them depends on them unwisely using the same known techniques over and over. When you get a truly novel technique, it costs a fortune in engineering time to unravel what they did and build defenses against it. If maybe 1% of attacks are this, it is manageable, but if it were 10%, you simply cannot staff an enforcement arm big enough - the trained staff don't exist to hire (unless you steal them from Visa, Amex, etc.)

So as much as you'd like to tell the public, believe me, I'd like to get some credit for what I've done -- they just can't say much or they educate the bad guys, and then have a much tougher problem later. Sorry! I know how frustrating it is!

How this might occur - not Amy's fault

The credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards). This is a basic set of security rules and practices which should make hacking unlikely. Compliance is achievable (not easy), and if you do it, you're off the hook. That is one way Amy can be entirely not at fault.

Example deleted for length, but as a small business, you just can't be a PCI security expert. You rely on the commitments of others to do a good job, like your bank and merchant account salesman. There are so many ways this can go wrong that just aren't your fault.

As to the notion of saying "it affected Amy's customers but it was Doofus the contractor's fault", that doesn't work, the Internet lynch mob won't hear the details and will kill Amy's business. Then she's suing Mastercard for false light, a type of defamtion there the facts are true but are framed falsely. And defamation has much more serious consequences in Europe.

Anyway, even a business not at fault has to pay for a PCI-DSS audit. A business at fault has lots more problems, at the very least paying $50-90 per customer to replace their cards. The simple fact is 80% of businesses in this situation go bankrupt at this point.

That data breach may not be so bad

Usually fraudsters make automated attacks using scripts they got from others. Only a few dozen attacks (on sites) succeed, and then they use other scripts to intercept payment data, which is all they want. They are cookie cutter scripts, and aren't customized for each site, and can't go after whatever personal data is particular to that site. So in most cases all they get is payment data.

It's also likely that primary data, like a cloud drive, photo collection or medical records, are kept in completely separate systems with separate security, unlikely to hack both at once even if the hacker is willing to put lots and lots of engineering effort into it. Most hackers are script kiddies, able to run scripts others provided but unable to hack on their own.

So it's likely that "none was leaked" is the reason they didn't give notification of private information leakage.

Lastly, they can't get what you didn't upload. Site hacking is a well known phenomenon. A person who is concerned with privacy is cautious to not put things online that are too risky.

It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution.

  • 1
    I'm supposed to feel bad for a business that screwed up and let my credit card information get stolen? Yeah, I don't see that (nor do I see how this really answers the question). – Joe May 31 '17 at 21:43
  • 1
    I find your allegations of malicious intention towards innocent business owners alienating. At no point do you recognize my interests for transparency. Your example is off, given that I have been told it was an online shop. But even in your case: Explaining that Doofus is at fault, has been dealt with, and Amy followed all good practices is easily possible without even using tech lingo and establishes the kind of transparency I call for. – Tari Jun 1 '17 at 11:34
  • 1
    Substantial edit. i'm trying! @jpaugh – Harper Jun 1 '17 at 19:20
  • 1
    These comments are really in need of a cleanup for volume, but I've left them for now as they're directly about improving the answer, but I'd like to come back and prune them later. My own view is that this answer does head rather off-topic and it might be better to cut it down to the first paragraph plus a brief summary that omits the technical lingo. – Ganesh Sittampalam Jun 1 '17 at 23:13
  • 1
    "What question would you like answered?" How can transparency be improved with no or little benefit for the bad guys? With the specific goal of allowing me to evaluate 1) what further steps could be done to minimize damages and 2) how seriously the involved parties take the protection of my PPI. Remarks: A) I am not buying a general telling anything helps bad guys. I suppose bad guys will at least figure out easily what batches of CC were frozen. B) suggesting data avoidance in this context is ridiculous. C) Damages from publishing a leak are a consequence of the leak, not the publish. – Tari Jun 2 '17 at 8:16

protected by Community Oct 28 '18 at 7:51

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.