News > Technology
Hacker hits up to 8M credit cards
Secret Service and FBI probe security breach of Visa, MasterCard, Amex and Discover card accounts.
February 27, 2003: 4:20 PM EST

NEW YORK (CNN) - The Secret Service and the FBI confirmed Wednesday they have been involved for the past two weeks in trying to track down the computer hacker who breached the security system of Data Processors International, which processes credit card transactions on behalf of merchants.

MasterCard, Visa, Discover Financial Services and American Express all have said this week that some of their card accounts had been affected by the breach.

graphic graphic graphic
The hacking incident in which intruders accessed millions of credit cards has consumers confused. Many credit card issuers are not doing much and are waiting for consumers to call them. CNNfn's Fred Katayama reports.

Play video
(QuickTime, Real or Windows Media)

MasterCard estimated that the hacker may have gotten access to information on as many as 8 million credit card accounts overall, including 2.2 million of its own cards. Visa said 3.4 million of its cards were affected, while Discover said only that a small percentage of its cards were involved. American Express, meanwhile, has not disclosed how many of its card accounts were affected.

Data Processors International, which does business as DPI Merchant Services in Omaha, Neb., and was recently acquired by TransFirst, said in a statement Thursday that "information targeted by the system intruder did not include any personal information that could relate a card number to an individual. ... (P)ersonal information including account holder name, address, telephone number and Social Security number were not obtained through the attempted intrusion."

Both DPI and a federal law enforcement official familiar with the case told CNNfn on Wednesday that so far there has been no reported misuse of the information stolen or evidence that any individual account has been tampered with.

Visa, American Express and Discover said earlier this week that they had not seen any fraudulent use of the stolen account numbers so far, and a MasterCard spokeswoman could not say whether any of its cards had been used fraudulently.

The Visa and MasterCard accounts affected make up almost 1 percent of the 574 million Visa and MasterCard accounts in the United States. Visa and MasterCard are associations made up of banks that issue the cards, and spokesmen for both companies said Monday they promptly notified the banks that issued the affected cards.

"We have notified our member financial institutions of the accounts involved, so that they may monitor each account for fraud and/or reissue cards as appropriate," MasterCard said.

American Express (AXP: Research, Estimates) issues its own cards, and Discover is a unit of Morgan Stanley (MWD: Research, Estimates).

What you can do about it

Though the credit card companies and law enforcement have not noticed any fraudulent use of the cards affected, that doesn't mean there may not be fraudulent use in the future, security experts said. Often, when credit card accounts are hacked, account numbers and other information obtained may be sold to others who, in turn, may use that information to make unauthorized purchases.

How to protect yourself
Identity theft survival guide
Guard your social security number

The card companies have zero-liability policies, which protect the card holder from responsibility for any unauthorized charges or fraudulent use. But that doesn't mean they'll necessarily contact you if your account was affected. Some might, but they are not under any obligation to. Consumer advocates recommend that you be vigilant in checking your credit card statement for any charges you did not make. The banks that spoke to CNNfn and CNN/Money said they also would be monitoring the affected accounts for fraud.

If you find any charges you didn't make or simply want to confirm the status of your account, contact your credit card issuer. (In the case of a MasterCard or Visa, you should contact the bank that issued your card. In the case of American Express and Discover, you should contact them directly.)

Calling may be a good first move, but you may also need to alert the company in writing if there have been fraudulent charges. Check the issuer's billing-error reporting procedure. If you can't find it anywhere on your latest statement, ask the issuer how such reports should be handled.

In some cases, your card issuer may take the initiative and alert you first. After it was notified by MasterCard last Friday, Citizens Bank, a financial institution serving the Northeast, shut down the accounts of 8,800 customers whose cards had been affected, bank spokeswoman Pamela Crawley said Monday. All the accounts were safe, she added.

If 8 million card accounts were affected, and all those cards were canceled with new cards issued in their place, it would cost the credit card companies an estimated $200 million, according to credit card experts.

-- Key reporting from CNNfn's Fred Katayama.  Top of page

Honda teams up with GM on self-driving cars
The internet industry is suing California over its net neutrality law
Bumble to expand to India with the help of actress Priyanka Chopra
7 things to know before the bell
SoftBank and Toyota want driverless cars to change the world
Aston Martin falls 5% in its London IPO

graphic graphic