FTC launches program for victims of ChoicePoint breach
30036
The U.S. Federal Trade Commission (FTC) has begun mailing claim forms to more than 1,400 identity theft victims who spent money to clear up identity-theft problems due to a security breach at data broker ChoicePoint announced in early 2005.
479464
(InfoWorld) - When data breach investigator Bryan Sartin gets a call to check into an incident involving customer records loss at a retailer, he knows that the situation most likely involves information that has been lifted from a company's point-of-sale systems. Just as the now famous attack on discount clothing chain TJX Stores revolved around the interception of data transmitted wirelessly from the company's registers to its databases, almost every call that Sartin receives from a retailer can be traced back to some issue related to point-of-sale information collection, he said. The data theft gumshoe -- whose official title is managing principal in the Investigative Response unit at managed security services provider Cybertrust, which was purchased by Verizon Business in May 2007 -- contends that if companies did a better job of defending their point-of-sale tools, most could dramatically lower their risk of a breach. "As a rule, companies are doing a better job of protecting against external IT systems intrusions, but if you look into most of these consumer breaches at retailers the point-of-sale technology is typically the common denominator," Sartin said. "Many retailers list the types of systems they use on their Web sites, so the smart criminals look for companies using systems they already know how to beat and simply try to find a way in." If retailers could merely stop collecting as much data at their registers, it would seem, the companies would significantly improve their ability to protect against such attacks, but the issue isn't that simple. In order to protect themselves against fraud on the part of customers -- primarily in the form of inappropriate returns -- the companies are forced to store some form of identification data, typically a credit card number -- to prevent the need to write off even more losses to crime. Among the databases of information scooped from TJX were some that carried such returns information. As a result, retail companies find themselves in a tricky situation where they are being forced to consider alternatives that allow them to reduce the level of customer data collected at the point-of-sale, while retaining enough information to protect against fraud. Flashback to the early 1990s, and video game console maker Nintendo was dealing with a challenging business problem. The Kyoto, Japan-based electronics company was selling millions of its NES video game consoles, but it was also being routinely fleeced by customers via fraudulent returns. Typically such transactions would involve people who would buy new gaming systems, place older, broken consoles in the new box, and then simply return the devices for a full refund. The company was losing large amounts of money and dealing with retailers who were shipping back scads of the worn-out machines, and attempts to implement manual guidelines, such as collecting more detailed data about customers, failed to deliver results. Faced with mounting costs, the company decided to employ a technological strategy for warding off fraudulent activity. By capturing the information on each box carrying each one of its consoles and creating an electronic receipt based on its UPC code and serial number at the point-of-sale, the firm discovered, it could build a database of pertinent information that would allow it to track sales without retaining customer data. By recording the information on the box, along with details about the retailer who sold it -- such as their geographic location and store number -- along with the date and time of an item's sale, Nintendo found that it could prevent many attempted returns that involved fraudulent behavior. The system was piloted at Wal-Mart in 1995, and rapidly expanded into other retailers worldwide. The company soon realized it had a hit on its hands when its largest rival at the time, Sega, came calling after hearing how well the system worked from its own retail partners. As a result, Nintendo decided to spin off the technology into its own company, Siras, in 1999. With massive manufacturers including General Electric, Hewlett-Packard, Philips and Sony, and retailers such as Best Buy, CompUSA, Sears and Target using the Siras Electronic Registration system today, the company maintains it provides an easy solution to the point-of-sale data collection nightmare presently facing retailers. By eliminating the need to collect customer data, including credit card numbers, said company officials, Siras feels it can also allow retailers and manufacturers to protect themselves from information exposure incidents and all the related fallout such events may bring. "Once consumer data is collected it's really just a matter of time before it gets exposed or stolen, and you don't need to be a sophisticated hacker to commit such a crime, a lot of times it's a retail employee who finds a way to capture the data and sell it," said Peter Junger, president of Siras, based in Redmond, Wash. "Meanwhile, many point-of-sale systems can be easily hacked, and radio frequency ID tools that aim to help solve these problems are still many years away." By purposefully avoiding the collection of personal data using a system such as Siras', companies can already begin lowering their risk while streamlining the retail shopping and returns process for themselves and their customers, he said. After collecting the UPC and sales information, the data is transmitted to a national database presided over by Siras, allowing the software maker to handle much of the legwork and eliminate related point-of-sale management costs for retailers, according to Junger. Siras is also in the process of developing other iterations of Electronic Registration for use by law enforcement officials tracking the movement of stolen goods, and for pawn shops and online auction sites that are trying to reduce sales of misappropriated or counterfeit goods. "It's a very simple technological approach to a complex problem," Junger said. "And we're hoping that someday its use will stretch far beyond electronics and other high-end items into almost any type of products that carries a serial number." One company already using Siras' tools is the consumer products division of Philips Electronics North America, the New York based manufacturer of everything from desktop computers to flat-screen TVs. Prior to implementing Siras in 2001, Philips dealt with the same sorts of issues that drove Nintendo to create the technology, but since that time, consumer fraud has been cut significantly, said Tony Sciarrotta, director of returns management for Phillips Consumer Electronics. "It's had a huge bottom-line impact, helping us save not just on the cost of fraudulently returned products, but also the need to reimburse retailers who get victimized," Sciarrotta said. "The consumer information is not attached to registration, which is a huge win for consumers who have concerns about privacy, and for retailers afraid of a breach incident, and the technology can be applied to almost anything you want to sell." Sciarrotta said that he would like to see larger numbers of retailers adopt Siras, and that he believes such tools should be required across the industry to lower the risk of consumer data loss. "There are certainly times when we would like to have a lot more consumer information, but that's not in the best interest of everyone involved, so we need to get it in other ways such as encouraging product registration after the sale," he said. "From our side we don't want to be the police or the gatekeeper, we want to allow our retailers to go about their business as easily as possible with the least amount of risk for loss; over all my years in this industry, this is one of the best ideas I've ever seen along those lines."
636792
Scammers are sending out virus-laden e-mails claiming to have information on complaints filed with the U.S. Federal Trade Commission, the FTC warned Monday.The e-mail appears to come from frauddep@ftc.gov -- a spoofed address -- and it includes a malicious attachment that downloads keylogging software, which is used to steal sensitive information such as passwords and account numbers.&quot;While the e-mail includes the FTC seal, it has grammatical errors, misspellings, and incorrect syntax,&quot; the FTC said in an alert , released Monday. &quot;Recipients should forward the e-mail to spam@uce.gov and then delete it.&quot; E-mail sent to this uce.gov address goes into the FTC&#39;s spam database, which is used by investigators.Online scammers often masquerade as government agencies such as the Internal Revenue Service in the hopes of tricking unsuspecting victims into clicking on attachments or visiting malicious Web sites.
523277
ChoicePoint has settled with 44 states over a data breach that potentially gave criminals access to personal information from more than 145,000 consumers.
709095
Source Code Club&#39;s last attempt to cash in on other people&#39;s intellectual property targeted Enterasys Network&#39;s Dragon intrusion detection system, which SCC offered for $16,000, and Napster&#39;s
289936
New program offers incentives to PC rescue services to sell CA's security software to consumers and small businesses.
196253
Consumer group Which? says banks should automatically compensate victims of online phishing frauds.
647139
Raising the fine line US consumer watchdog the Federal Trade Commission (FTC) is calling for a bigger stick with which to punish spyware purveyors.â¦
635335
Data broker ChoicePoint Inc. will pay US$500,000 and has agreed to change the way it screens new customers under a multistate settlement for aÂ 2004 data breach.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
621621
Organizations and law enforcement agencies fighting spyware are making progress, but new tools in an antispyware bill stalled in the U.S. Congress could improve the efforts, a member of the U.S. Federal Trade Commission said Monday.One of the spyware bills passed by the House of Representatives earlier this year, the Spy Act, would give the FTC authority to impose civil fines on companies that distribute spyware to consumers&#39; computers. The bill, along with the Internet Spyware Prevention (or I-SPY) Act, have&#160;stalled in the Senate&#160;since passing the House in May and June.The FTC has the authority to collect profits from spyware operations and collect money for consumer redress, but it lacks the authority to impose other fines, as it does when going after spammers, said Commissioner Jon Leibowitz, speaking at a spyware forum in Washington, D.C.Assigning a dollar figure to consumer harm is tricky in many spyware cases, especially when the spyware delivers pop-up advertisements to computers, Leibowitz said. It&#39;s sometimes difficult to get courts to assign large consumer damages to pop-up cases, he said.In some cases, spyware damages are assessed by judges &quot;who don&#39;t even use computers,&quot; said Dave Koehler, with the FTC&#39;s Bureau of Consumer Protection.The Spy Act would allow the FTC to fine spyware vendors up to $3 million for hijacking computers, delivering unwanted adware, and other violations, and $1 million for collecting personal data without permission, in addition to going after the vendor&#39;s profits and seeking consumer redress.Additional authority to impose civil fines would give the FTC &quot;an enormous deterrent,&quot; Leibowitz said.&quot;Right now, companies know that the worst they can do is lose their profits,&quot; he added. &quot;They&#39;re not going to get fined on top of that.&quot;The FTC has brought several spyware actions against companies. In February, the agency settled&#160;a case against adware distributor DirectRevenue. In that case, DirectRevenue settled for $1.5 million, based on its profits, but the founders of the company had received more than $20 million in venture-capital funding, Leibowitz said.While participants in the spyware forum said there continue to be many challenges, including a growing trend of foreign spyware vendors, the cost of spyware to U.S. consumers seems to be falling. Consumer Reports estimated that spyware cost U.S. consumers $2.6 billion in 2006, but only $1.7 billion in 2007, noted Ari Schwartz, deputy director of the Center for Democracy and Technology, a supporter of StopBadware.org, a consumer-protection effort aimed at spyware and other malicious code.The drop in the cost of spyware can be attributed to a number of factors, Schwartz said. Antispyware technology is getting better, the FTC has taken action against spyware vendors, and StopBadware.org has distributed a&#160;list of malicious Web sites, he said. In addition, some states have taken action against spyware, and cybersecurity groups&#39; public education programs seem to be working, he said.But Ron Teixeira, executive director of the National Cyber Security Alliance (NCSA), noted that consumers may know more about spyware, but they aren&#39;t always acting on their knowledge. A survey released by the NCSA and McAfee earlier this month found 78 percent of respondents&#39; computers didn&#39;t have all three of what the NCSA calls the &quot;core protection&quot; software: anti-virus, antispyware, and firewall.&quot;We&#39;re not seeing a huge increase in the actual behavior change,&quot; he said.
134612
A U.S. court in Wyoming has ordered a Web-based information broker to stop selling telephone records without owners&#39; consent and to turn over nearly $200,000 in profits from the operation, the U.S. Federal Trade Commission announced Monday.AccuSearch, doing business as Abika.com, and owner Jay Patel used &quot;false pretenses, fraudulent statements, fraudulent or stolen documents or other misrepresentations&quot; to induce telecom carriers to disclose the confidential records, the FTC said in a news release.Judge William Downes of the U.S. District Court for the District of Wyoming ordered the company to stop selling telephone records in a Dec. 20 decision announced Monday. The judge also ordered the company, based in Cheyenne, Wyoming, to turn over information so that the FTC can notify the people whose telephone records were sold.Abika.com advertised that it could obtain the confidential phone records of any individual -- including details about outgoing and incoming calls -- and make that information available to customers for a fee, the FTC said in a May 2006 complaint. The FTC charged that the company&#39;s methods of obtaining phone records, including posing as a customer of a telecom carrier, violated the FTC Act, which bars unfair business practices.A representative of Abika.com didn&#39;t immediately respond to a request for comment. The company continues to sell such information&#160;as criminal, tax, mortgage, and driving records through its Web site.The defendants have appealed the order to the U.S. Tenth Circuit Court of Appeals.Downes found that the company&#39;s ways of obtaining phone records without consumers&#39; consent was &quot;necessarily accomplished through illegal means,&quot; and that defendants knew that the phone records were being obtained surreptitiously.The company&#39;s actions caused major problems to consumers, including serious health and safety risks experienced by some consumers from stalkers and abusers; economic harm associated with changing telephone carriers and upgrading security on their accounts; and a host of &quot;substantial and real&quot; emotional harms, the judge said.Consumers had no way to avoid these harms, he wrote. &quot;In fact, the evidence presented before the court indicates that confidential consumer phone records were sold through Abika.com despite considerable efforts by consumers to maintain the privacy of those records,&quot; the judge wrote.Finally, the court found no countervailing benefits to consumers or competition that could be derived from the defendants&#39; practice.Downes also rejected the defendants&#39; claimed immunity under the Communications Decency Act, a federal statute that confers immunity on interactive computer service providers for publishing information content provided by a third party. The judge found that the argument failed partly because the defendants participated in creating the content they sought to have immune from prosecution, the FTC said.
621954
The U.S. Federal Trade Commission has asked a federal court to make two Florida companies stop telephone pretexting and to pay back victims of the practice.
332659
A credit union in Massachusetts has sent TJX an invoice for $590,000 to cover the monetary costs and reputational damage that the financial institution says it incurred as a result of the data breach disclosed by the retailer in January.
575510
The Federal Trade Commission on Thursday filed the first case in the country against software companies accused of infecting computers with intrusive "spyware" and then trying to sell people the solution.
428558
The TJX Companies, Inc., a discount retailer, said Friday it settled class action lawsuits in the United States, Canada and Puerto Rico stemming from a massive security breach of customer data that affected at least 45 million credit and debit cards.
350888
The U.S. Federal Trade Commission has filed charges against a payment processing company, accusing it of attempting to debit consumers&#39; bank accounts for up to $200 million on behalf of dishonest merchants.Those consumers either never received the goods or received worthless items, said the FTC, which filed the complaint with seven other U.S. states. The payment company allegedly violated both federal and state consumer fraud laws, telemarketing rules, and FTC regulations regarding the unfair processing of payments.The payment processing company went by several names, which are listed in a FTC news release. The FTC alleges the company processed payments for fraudulent telemarketers and Internet-based merchants that used deceptive sales scripts and methods.About $69 million of the $200 million in transactions were either rejected by consumers or returned because of lack of proper payment authorization, the FTC said.The FTC wants to refund consumers and force the company to forfeit money it still holds from the fraud in addition to other civil penalties. The complaint was filed in the U.S. District Court for the Eastern District of Pennsylvania.The states that have joined the suit are Illinois, Iowa, Nevada, North Carolina, North Dakota, Ohio, and Vermont.
484329
The U.S. Federal Trade Commission (FTC) has asked a federal court to require an alleged Web page hijacking operation to obey previous orders barring unfair and deceptive practices.Walter Rines, business partner Sanford Wallace, and Rines&#39; company, Online Turbo Merchant, diverted users of MySpace.com to other Web sites and barraged them with ads to earn advertising commissions, according to court papers filed with the FTC. The defendants used pagejacking, phishing, and other methods to target MySpace users in violation of a previous court order, the FTC said in a news release.The FTC, in a Jan. 23 filing, asked the U.S. District Court for the District of New Hampshire to order the defendants to give up the money they earned from their MySpace scheme.Rines&#39; listed phone number in New Hampshire was disconnected.In October 2005, the FTC charged Odysseus Marketing and its owner, Rines, with luring consumers to their Web site by offering free software, including a program that supposedly allowed them to engage in anonymous peer-to-peer file sharing. The software was bundled with spyware that intercepted and replaced search results and barraged consumers&#39; computers with pop-up ads, the FTC said. The software also stole users&#39; personal information, and users were unable to locate or uninstall the spyware through reasonable means, the FTC said.The FTC alleged that the defendants&#39; software captured consumers&#39; personal information and transmitted the information to the defendants&#39; servers. Consumers were unable to locate or uninstall the spyware through reasonable means, the agency charged. The court ordered a preliminary halt to these practices pending trial, and in October 2006 Odysseus and Rines settled the charges by stipulating to a permanent injunction.The permanent injunction prohibited the defendants from redirecting consumers&#39; computers; from changing any Web browser&#39;s default home page; and from modifying or replacing the functions of any computer application. It required Rines and his company to obtain consumers&#39; express consent before downloading or distributing any content to their computers.The permanent injunction also imposed a $1.75 million judgment, and all but $10,000 was suspended based on the defendants&#39; inability to pay.In its recent filing, the FTC alleges that Rines, his company, and Wallace knew of the permanent injunction and violated that order by diverting users from MySpace.com to their Web sites.