Stephen Foley: Calm down – despite the data breaches, there's little actual fraud on the cards
Saturday 11 June 2011
US Outlook: News of arrests in Spain of people believed to part of the hacker group Anonymous, responsible for attacks on Sony and MasterCard in recent months, comes on the heels of another big data breach here in the US. This time it was Citigroup that said its computers had been compromised, with hackers gaining access to credit card details of 200,000 North American customers. It is having to issue new cards.
Just another day, then, in the great war over our personal data.
The Citigroup breach, the largest direct attack on a US bank, has prompted inevitable calls for financial institutions to tighten security procedures, in the hope of staying one step ahead of the hackers. There has been criticism of banks for failing to invest the necessary money in improved security systems, but to my mind this seems unfair, and misses an important point. For all the security breaches, few have resulted in actual fraud on people's accounts. In the Citigroup case, those three-digit security codes on the back of its customers' cards were stored separately. So were their social security numbers, and the expiry dates of their cards. The likelihood of discovering a fraudulent transaction on a Citigroup card is low.
There have been 288 publicly disclosed breaches of financial services companies' computer systems, according to the Identity Theft Resource Centre, and 83 million customer records compromised. That would suggest that, even if you haven't been a victim, you would be likely to know at least one person who has – yet complaints about discovering dodgy transactions are not a staple of pub conversation.
None of this is to minimise the importance of these breaches, just to say that clearing up after them, by telling customers to reset passwords or issuing new cards, might be the best way to deal with them. Laborious new signing-in procedures are an unnecessary hindrance; in the UK, Barclays' requirement that you use a calculator-like device to generate a log-in code every time you go to its website has removed the whole point of internet banking, namely that you can access your account anywhere.
There are tighter rules needed. Citigroup, like Sony and others before it, ought to have revealed the existence of the security breach sooner than it did, so a code of conduct for communication with customers would be a good start.
But breaches are a fact of life in the modern era. The investment should come in technology to detect break-ins and to track down their anonymous perpetrators. As long as we get as many headlines about hacker arrests as we do about hacker attacks, we should be satisfied.
Anonymity order lifted for triple child killer David McGreavy jailed in 1973
World news in pictures
Far-right French historian, 78-year-old Dominique Venner, commits suicide in Notre Dame in protest against gay marriage
Plenty of Fish dating site founder pulls 'Intimate Encounters' option to ward off sleazy men
Video emerges of Pope Francis reportedly performing an exorcism in St Peter’s Square
- 1 Gay couple beaten in park urge MPs to moderate language on gay marriage
- 2 After woman sells virginity for $780,000, here are the results of our prostitution survey
- 3 China agrees to impose carbon targets by 2016
- 4 Exclusive: Championship clubs set to push for safe-standing trials
- 5 Far-right French historian, 78-year-old Dominique Venner, commits suicide in Notre Dame in protest against gay marriage
BMF is the UK’s biggest and best loved outdoor fitness classes
Find out what The Independent's resident travel expert has to say about one of the most beautiful small cities in the world
Win anything from gadgets to five-star holidays on our competitions and offers page.