TJX named as point-of-compromise in International data breach - millions of people at risk!

Data breaches are happening at an alarming rate. Until some meaningful action is taken to address them, such as following already established principles (data and PCI security compliance), we're probably going to see them continue.

Reuters is reporting (courtesy of the Washington Post):

TJX said the breach involves the computer network that handles credit card, debit card, check and return transactions at its T.J. Maxx, Marshalls, HomeGoods and A.J. Wright stores in the United States and Puerto Rico; and its Winners and HomeSense stores in Canada.

It said the intrusion could also affect customers at stores in the United Kingdom and Ireland, and its Bob's Stores in the United States.

Reuters story, here.

This time not only credit and debit-card information was compromised, but check and all the personal information gathered when someone makes a refund might have been exposed, also.

The breach - reported to have been discovered in December - was kept quiet at the request of law enforcement.

The company has set up hot-lines, which are 866-484-6978 in the United States, 866-903-1408 in Canada and 0800-77-90-15 in the U.K. and Ireland. I called one of them and they didn't seem to be able to answer much, but told me if I wanted more information to go their website, here.

The problem in these large data breaches at merchants (TJX isn't the only one) is that too much personal and financial information is being maintained in databases, which aren't protected properly.

The Privacy Right's Clearinghouse maintains ample evidence of this, here.

The Payment Card Industry has already established data security standards, which aren't being followed in a lot of cases. Visa did a press release announcing that they are offering financial aid to Level 1 and Level 2 merchants. There is also mention that fines will be increased for merchants who fail to comply.

Unfortunately, even Visa states that compliance for Level 1 merchants is at 36 percent and 15 percent for Level 2 merchants.

Although, I commend the action by Visa, I fear fining non-compliant entities might not be enough.

Tech Web's "Dark Reading," has an excellent essay on the need to become more proactive, here.

In their essay, they state:

One recommendation is that Congress pass a law that compels organizations to protect sensitive information rather than one that simply determines when and how customers will be notified after the fact. There's been a consensus in Congress that standards are needed to safeguard personal information, but there's been a lack of unanimity in the details of how this should be done, says, Liz Gasster, acting executive director and general counsel for the Cyber Security Industry Alliance. "It was a real letdown for the citizens of this country that legislators weren't able to overcome their differences last year and pass a law," she says, adding that one big sticking point was Congress not wanting IT security improvements to create additional costs for industries operating in their constituencies.

Maybe with a new Congress, we'll see some "forward thinking" on this issue? After all, it's their responsibility to represent the people, who are having their personal and financial information compromised.

It would also be nice to see more funding to go after the criminals behind this growing problem. After all - the companies being breached aren't the source of this issue.

And besides enacting legislating and prosecuting the criminals doing this, we have the matter of "trust" and "consumer confidence" to consider. These are two "key" business principles that fuel economies. Failure to do something now; might lead to some unfortunate consequences, later.

If you would like to learn more about payment card compliance and data security, here's a site I recommend:

PCI and Data Security Compliance

Here's a previous post, I wrote on this subject:

With all the data breaches - something needs to be done!

Will a hot-line being staffed 24 hours solve the fraud problem in Los Angeles?

A story recently hit the press about Los Angeles County (potentially) losing $2 billion a year to fraud. That's a lot of taxpayer money!

This dollar figure was "estimated" (using Association of Certified Fraud Examiner statistics), which say that 5 percent of all revenues (generic) are lost to "employee fraud, waste and abuse." Nonetheless, there have been a lot of recent allegations of "too much fraud" occurring in Los Angeles County.

The problem with any fraud statistic is that the intention of the people - who commit financial misdeeds (fraud) - normally like to keep it rather anonymous. I keep seeing different figures (the $2 billion was from an article a couple of weeks ago), but the truth is - all anyone knows - is that it appears to be a substantial problem.

Now the County officials are announcing a fraud hot-line to report instances of government fraud and abuse will be manned 24/7.

The LA Times is reporting:

Ratcheting up efforts to crack down on bureaucratic waste, fraud and abuse, Los Angeles officials unveiled a 24-hour whistle-blower hot line Thursday to take tips from workers and the public.

The latest move to clean up City Hall comes two years after the City Controller's Office created a special task force to investigate fraud.

LA Times story written by Rick Orlov, here.

If you are a resident of Los Angeles County and have something to report, the number is (866) 428-1514.

In the recent article, I read quoting the $2 billion loss figure, there were also allegations that very few people are ever prosecuted, or even lose their jobs when caught committing fraud in the County.

In fact, a recent DailyBulletin.com story stated:

Despite the large number of prosecutions, critics said only a small proportion of county employees found to have engaged in fraud and misconduct are disciplined or charged criminally.

While investigators substantiated 120 fraud hot-line cases last year, only 38 employees, or 32 percent, were fired, suspended, transferred or allowed to resign.

Does this mean that the County is losing $2 billion a year to fraud, the hot line only netted 120 "substantiated cases," and of the personnel implicated - 68 percent of them are still employed?

I'm just an "average person," but to me, increasing the fraud hot-line hours isn't going to make this problem go away.

And not going after the problem "aggressively enough" isn't fair to the honest citizens of Los Angeles, who are "footing the bill" for all of this.

I wonder how many private companies would put 2 out of 3 people bilking their bottom lines back to work?

I feel sorry for the investigators trying to put a dent in this problem!

Here is another post, I did on fraud in Los Angeles:

Los Angeles Grand Jury Calls Child Care Program an ATM for Thieves

A new work-at-home business that scams everyone!

With the recent raids on Swift by ICE - a lot of people have wondered how much phony identification is out there. The most recent story about this is out of the Toronto area, where a large counterfeiting ring was discovered in a residential neighborhood.

The home based business was producing counterfeit identification, credit cards, government benefit cards and passports. In other words, they were making anything a criminal, illegal alien, or terrorist would desire - right out of a private home.

The City News (Toronto) is reporting:

The hunt began last May when Red Rocket officials put out a notice about phony Metropasses that were being distributed in the city. From there, they began to follow a long and winding road of deception that eventually led cops to a residence in Mississauga.

Armed with a search warrant, they entered the home last December 20th, and discovered illegal equipment - like computers, hot stamp pressers, special inks and more - that allowed suspects to turn out the illegal phonies by the thousands. They also found seemingly endless supplies of the finished products.

They were stunned to see scores of blank cards, OHIP cards, altered driver's licenses, even passport photos arrayed inside the home.

City News story with interesting video, here.

It's no wonder that both Canada and the United States (as well as many others) are having a huge problem with illegal immigration, border security and financial crimes.

Here are some similar stories about the same activity in the United States:

Is Bashing DHS for the Swift Raids Fair?

Mexican Organized Crime Ring is Mass Producing Fake Documents - and Considers Terrorism an American Problem

And the UK seems to have discovered the same problem:

International Identity Theft Ring tied to Bank

Of course, the people doing this don't honor borders, or jurisdictions - which means the proceeds from this problem can "easily travel" and victimize a lot of people.

OCC is warning the public about counterfeit cashier's checks

I've written a lot about counterfeit cashier's checks, which have spread via the Internet in a number of different scams. Known scams include winning the lottery, secret shopping, overpayment for an item sold on an auction site, or assisting a romantic interest found in a chat-room.

The people who do this are creative and you never know what new "scam mutation" will be discovered tomorrow.

The OCC is warning:

However, cashier’s checks lately have become an attractive vehicle for fraud when used for payments to consumers. Although the amount of a cashier’s check quickly becomes “available” for withdrawal by the consumer after the consumer deposits the check, these funds do not belong to the consumer if the check proves to be fraudulent. It may take weeks to discover that a cashier’s check is fraudulent. In the meantime, the consumer may have irrevocably wired the funds to a scam artist or otherwise used the funds – only to find out later, when the fraud is detected – that the consumer owes the bank the full amount of the cashier’s check that had been deposited.

The OCC offers a lot of insight about the growing problem of counterfeit cashier's checks, here.

Also contained is a FDIC Bank locator, which is an excellent tool because in a lot of scams - the crooks set up phony telephone numbers and even addresses to make themselves appear legitimate.

In the case of cashier's checks, the issuing bank (not yours) is the best place to validate whether an item is legitimate, or not.

FDIC tool, here.

If you would like to see if a particular bank has been targeted with counterfeit cashier's checks - the FDIC issues alerts, here.

Another item to key on is the "scam behavior," which normally will always involve sending money to someone in anticipation of something that is too good to be true!