Finance

For years countries outside the United States have used a system called EMV for their credit cards. The short version is that there is a chip inside the card that authenticates the transaction, plus the users has to enter a PIN instead of signing the receipt*. This has some major benefits. The biggest is security, and after the Target credit card leak I think that’s becoming more important to everyone. If someone steals your credit card number, they’ll still need your PIN to make charges.

The breach of data from Target (along with Neiman Marcus and reportedly a few more) seems to be getting worse by the day. There are some things I find highly concerning.

First, some facts. #

1. Attacks started on November 27, 2013 (just in time for Black Friday).
2. The attack went unnoticed until December 15, 2013, over two weeks later.
3. Hackers got names, addresses, email addresses, and phone numbers of 70 million people; 11GB of data total.
4. Siphoned data has been sent to Russia and who knows where else from there.
5. Attackers used a RAM scraper to capture un-encrypted data from point-of-sale systems after the credit card swipe, but before it was encrypted and sent to a central location for routing to the credit card companies.
6. Target and Neiman Marcus both passed all annual compliance testing for their handling of credit card data by the credit card industry standard (PCI-DSS).
7. A similar attack happened in 2005.

Why does this keep happening? #

The short answer is pretty simple, as disappointing as it is. The industry standard is subpar, retailers are too cheap to upgrade, and people are frequently reactive in nature. Now there’s something to react to, let’s see if it works.