Is Your Credit Card Number Exposed Online?
620471
Many of our credit card numbers are viewable online -- by anyone.
357252
(InfoWorld) - Troy Aikman may not be happy about it, but the State of Texas has made his address and social security number available via the Internet. Sensitive information on Aikman, formerly a star quarterback with the Dallas Cowboys, and thousands of others is available on the Texas Secretary of State's SOSDirect Web site, according to Steven Peisner, the president of fraud prevention vendor Sellitsafe, who has provided IDG News Service with a half-dozen examples of social security numbers he was able to obtain from the site. As government pushes more and more documents online, Texas is one of many state and local governments across the U.S. that is now struggling to remove sensitive information so that it cannot be misused by criminals. Peisner found social security numbers on tax liens and on loan agreement notifications filed with the state, called Uniform Commercial Code (UCC) financing statements. Texas has been automatically removing sensitive information from all documents filed with SOSDirect since June 2005, and the state is now in the process of redacting this information from earlier filings, said Scott Haywood, a spokesman with the Office of the Texas Secretary of State. But residents whose social security numbers are posted on SOSDirect need to contact the Secretary of State's office directly in order to have them removed right away, he added. That's not good enough for Peisner. "It's pretty cheap to do that... to make someone send in a request," he said. "There are literally hundreds of thousands of documents where social security numbers [are exposed]." He thought that Texas should follow the lead of states like California andÂ Colorado, which shut down access to their UCC databases earlier this year when privacy advocates notified them that they could be misused by identity thieves. Users must submit a credit card number in order to search the Texas database, but Peisner said that lax security makes that barrier meaningless to most hackers. He said he was able to get access to information using a fake name and without providing the three-digit security code listed on the back of most cards. He believes that criminals could obtain information from the site using phony credit card numbers. Peisner said he spoke with staffers at the Texas Secretary of State's office of his concerns last week, but to no avail. "You would think if somebody called up and said that this Web site has a hole so big that you could drive the Spruce Goose through it, that they would take it down." One privacy advocate agreed with Peisner. A name and social security number is all that criminals need to set up a phony credit card application, said Beth Givens, director of Privacy Rights Clearinghouse. "They need to immediately take action and take that Web site offline and in some other way remove or redact [the information]," she said. But according to Haywood, the Texas Secretary of State is required to make the documents available under state public information laws. "Obviously our office is committed to trying to protect personal information in accordance with the law," he said. "But we also have a responsibility to post public information that has been submitted to our office. So we're balancing those responsibilities." Ironically, Texas has recently gone after pawn shops and check-cashing operations in the state for throwing out sensitive data in public dumpsters. The state should take a good look at its own data retention practices, Peisner said. "It's extremely hypocritical. They're talking about information that might not have been properly destroyed or shredded that was in a garbage bag... when there are thousands and possibly hundreds of thousands of citizens whose information is easily available on the Web, where you don't have to go into a garbage dump and get your hands dirty." Â
750420
If you've ever had a credit card purchase mysteriously rejected only to discover later that the bank thought you were a fraudulent user, you may appreciate an effort by MasterCard InternationalÂ to use SMS (short message service) to streamline the process of clearing up card-usage questions.
208225
Trojan flea market thrives online Most people will be looking forward to receiving digital cameras, games and the like - as well as the inevitable pair of socks - this Christmas. But cybercrooks can take the opportunity to splash out, angling for things such as credit card numbers and their corresponding PINs, the trade in which is booming online.â¦
440577
Fraud on UK credit cards has fallen - but identity fraud is on the up, a survey from analysts Datamonitor finds.
362334
(InfoWorld) - The personal details of thousands of mostly U.S.-based PC users have been discovered stashed on a server located in France, another indication of use of the Internet to collect personal data on a vast scale. The Web page, which was live as of Monday morning, does not contain financial details of the users. But other Web pages associated with the same domain indicate the site could be connected to a group of hackers based in the Middle East known for their involvement in other Internet financial crime as well as defacing Web sites, said Chris Boyd, research manager for FaceTime Communications Inc., a security company. He posted more details on a company blog . The ISP (Internet service provider) that hosts the page has been contacted, Boyd said. The data appears to have been collected in April 2006, according to timestamps in the file, and includes the full names of people, their address and their IP address. Also included are the names of the Web sites from which the details were apparently collected. The names of those Web sites, most of which are now not active, appear to offer a freebie, with names such as www.likefreestuff.com and www.freebgift.com. The offer of a free gift is often made in exchange for data, Boyd said. There's nothing illegal about collecting data that users voluntarily submit. Likewise, the storing of personal details for marketing purposes is also not illegal. But leaving those details open on a server could violate European or U.S. data protection laws. It's not clear how that data on the French server is being used, but various hackers forums are aware it has been exposed, Boyd said. The e-mail addresses could immediately be used to send spam, while the addresses of the users could potentially be used for identity fraud. Research into the domain name hosting the data has also turned up clues that it may be connected to well-known hacking groups, he said. The server the domain is hosted on also hosts nearly 24,000 other domain names, another indication of possibly either phishing or other scam activity, Boyd said. One page on the same server contains a hacking tool that can be used for a variety of other nefarious activity, such as building custom Web pages with exploit code. The tool, called King IE Exploiter, is an application that can be used to find malicious software that can be incorporated into malicious Web pages, Boyd said. The application has been linked with Trojan horse programs aimed at stealing bank details and other malware that sends spam, he said. Interestingly, when King IE Exploiter starts running, it lists several usernames of hackers, Boyd said. "They're got quite a history for being known for all sort of elaborate scams and attacks," he said. Those attacks include a worm found two years ago that installed a fake BitTorrent client on targeted computers that distributed large video files. The users whose data is now circulating on the Internet in this incident may be less protected that other victims of large data breaches. In the U.S., some states have laws where businesses must contact those affected by a loss of data. However, user may be unaware how their data is now circulating or is used if it was collected by scammers, Boyd said. "It is quite worrying," Boyd said. "Obviously, they are quite happily gathering up all of this information."
322824
Nearly 50 percent of Internet users have searched for their own name online, but few regularly monitor their online presence with great regularity. Even more people -- 53 percent of Internet users to be exact -- have searched online for information about personal and business contacts.
183492
NEW YORK -- Consumers of Internet pornography who secretly signed up for memberships on adult-oriented Web sites in the past few months may be in for a shock -- some of their personal information, including e-mail addresses, may have been compromised by a security breach.
686971
HARTFORD, Conn. - More than 1,700 state workers recently learned that some of their personal information, including their names and Social Security numbers, had been inadvertently posted on the Internet.
675654
Although online shopping has its risks, your credit-card number and other personal information are just as likely to be stolen in a very low-tech way.
418284
GADFLY ALREADY the internet age has given us 'phishing', when criminals use emails to persuade you to give them your bank details.  Now it seems we have the less crooked but nonetheless enraging online experience of 'philfing'  an acronym for 'purposely hiding what I'm looking for'.
666587
WASHINGTON -- Don't tell your cell phone any secrets. It might not keep them. Second-hand phones purchased over the Internet surrendered credit card numbers and bank account passwords, business secrets and even evidence of adultery.
46638
By Jenifer K. Nii Deseret Morning News  An e-mail purportedly sent by Utah Community Credit Union is an attempt by "phishers" to obtain personal and financial information from UCCU members, the credit union said Friday.
270132
(InfoWorld) - Credit card thieves are becoming big-time charity donors, but it's not out of the goodness of their hearts. According to Symantec, the criminals are starting to use charitable donations as a way to check whether their stolen credit card numbers are working. Fraudsters have been using a similar technique for years, but until recently, they tended to make minor purchases on online retail sites. Now, as these sites have become better at identifying and blocking these transactions, the criminals have begun looking elsewhere, said Zulfikar Ramzan, senior principal researcher with Symantec. "Using a charitable organization as a way to verify a credit card number is a relatively new technique, and it's probably being used by a minority of the more innovative guys," he said. Credit card numbers are bought and sold in underground "carder" forums, which bring together the people who have stolen the credit card numbers with those who want to use them. These charitable donations are typically made by the person buying the card numbers as a final check to ensure that the numbers will work, Ramzan said. Last month, the Red Cross was forced to return nearly $7,000 that was donated in the course of 700 fraudulent transactions, said Carrie Martin, a spokeswoman for the American Red Cross. "We routinely see this kind of activity," she said. "We have someone in place who deals with this on a regular basis." This fraud accounted for a tiny sliver of the Red Cross's $6 billion in revenue last year, but the organization also has to pay staff to stay on top of the fraud, Martin said. This is not the only time that fraudsters have found ways to misuse charities. In another common scam, the criminal will give the charity a fake check and ask that a portion of it be returned in cash. Though the check will initially clear in the charity's bank account it will eventually be returned. By then, however, the charity will have already paid out to the thieves. "These kinds of things have hit charities before," said Ramzan "I feel bad because all these charities are trying to do good and you have these fraudsters that try to take advantage of them because of the way they work."
616996
Credit cards issuers may face penalty from the regulators as credit cards solicitation is not as reliable as they are said. Consumers sometimes are not given the whole information about the possibly imposed
162029
Rise in online identity fraud has companies on the hook: Educate customers or lose them.
180867
Your Social Security number is the link to your bank account, your credit card number, your identity. âThe fact of the matter is the Social Security number is the key,â said Jay Foley