And another from the lists of Hettinga. JMR From: "R. A. Hettinga" <[EMAIL PROTECTED]> Date: Thu, 3 Jan 2002 12:17:01 -0500
http://www.msnbc.com/news/598102.asp?0dm=C12OT Retail gift cards often unprotected Some stores ignore security, putting consumer funds at risk By Bob Sullivan MSNBC Dec. 27 - Ahead of the holidays, gift-givers gave away millions of magnetic stripe gift cards charged with billions of dollars in value. By now, the money might already be stolen. MSNBC.COM HAS LEARNED that fraud artists can easily drain the value off a gift card even while it sits seemingly safe inside a wallet or a dresser drawer. Some retailers don't take basic security steps to protect against counterfeiting that would cheat consumers out of the money stored on the cards. Add to that surprising merchant "expiration" fees and leftover balances that revert to the retailers, and the cards may not really be such a good deal for consumers. CARDS VERY POPULAR It's obvious why gift cards are so popular with merchants. The digital form of the old-fashioned gift certificate is much easier to track and trace since it fits neatly into credit card payment processing systems and into wallets. They also act as irresistible loyalty cards, drawing in consumers who might not otherwise visit the store - consumers who often spend more than the value of the card once they arrive. And stumped gift givers seem to love them - over $20 billion was charged onto gift cards in 2000, with much more expected when the figure is tallied this year. The mini, transferable bank accounts represented by gift cards don't earn interest, making them effectively an interest-free loan for retailers. But despite these unbeatable loan terms, some merchants aren't even doing the basics to protect consumer funds attached to those cards, MSNBC.com has learned. In some cases, it's trivial for a criminal to drain the money out of a purchased gift card, without even touching the victim's card. And that's not all - merchants themselves drain funds from the card by charging fees for lack of use, a practice that has already attracted lawsuits in California. Meanwhile, some analysts say up to 20 percent of the value placed on gift cards is never spent, the leftover funds making for a tidy profit margin for some merchants, although none are willing to discuss this in detail. SAFER FOR RETAILERS, NOT CONSUMERS There's irony here. Merchants generally consider gift cards to be safer than their old paper counterparts, which became easy to copy with the advent of laser printers. That's true - it is harder to cheat retailers. Counterfeiting gift cards from scratch is certainly more difficult than printing paper gift certificates. Physically, they are "harder" to steal, as well. Unlike gift certificates, gift cards have no value until they are "charged" by a store cashier. But it's now much easier for criminals to "steal" the cards from consumers, after they are purchased, using digital methods - if the cards are not implemented by the merchants carefully. MSNBC.com's research found that one of the nation's largest retailers, which claims to have sold millions of gift cards, hasn't adhered with even basic protections normally afforded magnetic stripe cards. As a result, none of that money is safe - it's easy for a criminal to steal the value loaded onto a gift card once it's been sold to an unwitting consumer. In fact, even seconds after the card is "charged," a thief in another part of the country could spend those funds in another of the chain's stores. The company's name isn't being published to avoid giving criminals a too-easy target. HOW IT WORKS The problem with the cards is simple. Magnetic stripes on the back of credit cards, ATM cards and gift cards are supposed to include information that isn't printed on the front of the card, or isn't easily derivable from the front of the card. But in this retailer's case, all a thief needs is the account number printed on the card and a few hundreds of dollars worth of equipment to steal the value placed on any card purchased by a gift-giving consumer. One scenario would work like this. A thief at a store buys a single gift card, but while standing in line, looks at the account numbers printed on the next 10 cards. Since the store's cards are only glued to a piece of cardboard, rather than encased in packaging, the account numbers are easy to see. The thief then goes home, and using a credit card encoder, reprograms the magnetic stripe to one of the account numbers lifted while in line. He then calls the 800 number provided by the store and finds out how much value was placed on the "stolen" card by a consumer who has since purchased it. The moment he is sure the card has been charged, the thief goes back into the store and spends the victim's funds. Even though the account being drained is different from the account printed on the card the thief is using, the store is never the wiser, because clerks rarely check to see if the numbers match. Hacks, Attacks & Scams * Dirty tricks of hunt for al-Qaida cash * Step inside the world of hacking * SCAMS AND FRAUD The scenario is not so far fetched. In fact, something very similar was described on an Internet bulletin board recently: "There is very little to stop someone from coming into your store and stealing cards that have not been activated," the poster wrote. "Then they could go home and copy them and return the originals to your shelves without you ever knowing. Then they could look each day and as soon as someone bought one of these cards they could go use the copy they made and buy what they wanted. Then when the real customer went to use the card it would come up as having zero balance." In another post, disclosed to MSNBC.com by a member of an Internet group devoted to counterfeiting plastic cards, a writer suggests a similar strategy: "The only good idea I heard was to take a stash of inactivated cards, go to your car, read them and dump their info onto a laptop, and then put the cards back, check up to see if any of the cards got activated via 1-800##," the writer says. In a note on the same discussion thread, one poster reveals the exact data format for the retail giant's magnetic gift card stripe. IMPRACTICAL A spokesperson for the retailer acknowledged the possibility for fraud but said that the company has never received a single report of such criminal activity and shrugged off the scenario as impractical. "In theory, I think there might be potential for what you're concerned about here, but there's concerns for peoples' pockets getting picked, too," said the spokesperson. The company outsources gift card manufacture and database, but wouldn't provide the supplier's name. "How many cards can I sit in a (store), and flip the cards over, and write the number down?" Not all retailers take that position. For example, at Kmart, the account number is completely invisible until the card packaging is ripped. Kmart also puts a four-digit code called a "CVC" on its magnetic stripes that isn't included on the face of the card. That one extra step makes duplicating the cards infinitely more difficult, according to magnetic strip security expert Tom Trusty. At Home Depot, re-programmable magnetic stripes are shunned altogether in favor of bar codes. But others fail to disguise the information contained on magnetic stripes. Another major retailer uses account numbers that are entirely sequential, another no-no in the magnetic stripe industry. 'Hackers are looking for new exploits all the time and see any large corporation as a legitimate target.' - TOM TRUSTY Magnetic stripe expert A spokesperson for that company refused to comment on its gift card program or its security. Trusty said he wasn't surprised by the problems. Some companies erroneously assume that merely placing numbers on a magnetic stripe provides the necessary security, he said. That's becoming less and less true as the price of black market magnetic stripe encoders continues to fall, according to Trusty, an independent consultant who writes a column dealing with payment card security and computer fraud for the Bank Administration Institute's monthly Bank Fraud publication. "Hackers are looking for new exploits all the time and see any large corporation as a legitimate target. There are few (if any) targets larger than (major retailers), and it is difficult to imagine hackers ignoring such a simple exploit when they go to such great lengths trying other less attractive targets," he said. Furthermore, merely altering magnetic stripe information is a fairly risk-free way to commit fraud, he said. "Even if someone were caught with a card that contained a magnetic stripe that resulted in value coming off someone else's card, the perpetrator could probably just claim total ignorance," Trusty said. NO CONSUMER PROTECTION 'Gift cards, otherwise known as stored value cards, have absolutely no protection under state or federal law.' - MARGO SAUNDERS National Consumer Law Center A consumer victimized by such a thief wouldn't find out until he or she tried to use the card or checked its balance. And since the cards are not protected by the same laws governing credit cards, the consumer would have no legal recourse against the retailer. "Gift cards, otherwise known as stored value cards, have absolutely no protection under state or federal law," said Margo Saunders of the National Consumer Law Center. In fact, policies printed on many gift card packages often include statements like "We cannot be responsible for funds used without your knowledge." While simple practicality might a make large-scale, multimillion-dollar fraud implausible, there might be a market for counterfeit cards. Gift cards are sold by the hundreds on Internet auction sites like eBay for about 75 cents on the dollar. MSNBC.com has not identified any current sales as fraudulent. THEORY OR REALITY While retailers interviewed for this story say they hadn't experienced this kind of thievery, stories of gift card fraud aren't pure fancy. In fact, the cards have become a favorite tool of small-time money launderers - local police blotters are littered with reports of criminals who purchase gift cards with stolen credit cards, buy items with them, and return the items for cash. And there have been incidents of virtual gift card counterfeiting as well. During the last holiday season, scam artists working in a mall in Bellevue, Wash., wrote down account numbers for mall gift cards that were purchased for large amounts. They then printed up digital duplicates of those cards and spent the funds. According to the Tyler Morning Telegraph, teen-agers used a similar method for using gift cards to steal money from an electronics retailer in Tyler, Texas last December. But retailers genuinely feel the cards are much safer than gift certificates, according to Dan Horne, a Providence College professor who studies the gift card industry. "The big selling feature of these is that they reduce employee fraud," Horne said. "Fraud is certainly harder. I suppose there are sophisticated people out there who can (defraud the cards), but I haven't heard much about it. It hasn't come up at any industry meetings." OTHER THORNY ISSUES What has come up at those meetings are other thorny issues involving the cards. Horne says at some retailers, as much as 40 percent of the funds loaded on cards go unspent, and it's currently unclear what happens to the money. If the cards really were treated as bank accounts, then the amount would qualify as "unclaimed property," and in most states would fall under "escheat" laws - in other words, the funds would revert to the state government. But according to lawyer Mark Chavez, "the reality is most gift card issuers ignoring the escheat laws." In anticipation of that controversy, most retailers are currently imposing a fee for "non-use." For example, Wal-mart charges $1 per month after 24 months; Barnes and Noble charges $1.50 monthly after 18 months. Those fees irked Oakland, Calif., resident Valentina Morgan, who hired Chavez and filed suit against a dozen retailers insisting the fees are illegal under a 1997 California law making gift certificate fees illegal. Most cards now indicate the fees don't apply to cards purchased in California. "The retailer is getting cash in exchange for a gift card. Why should they be able to charge fees on that?" Chavez said. NOT IMPOSSIBLE TO FIX But Trusty warned the biggest headache gift cards may bring could involve quick and easy fraud that could go undetected for weeks or months. He blames magnetic stripe security novices who may have designed a company's system and left it wide open to attack. "A card base must have security designed right into the system, including the cards, the stripes, the account numbers, and retail procedures when the cards are accepted for purchases. There is absolutely no protection afforded by the technicalities of producing plastic cards," he said, adding that the problem, while widespread, isn't impossible to fix. "This problem is by no means ... an inevitable inherent risk associated with issuing gift cards. It is possible to secure these cards, and certainly (retail stores) could take immediate remedial steps like verifying the outside of the plastic against the magnetic stripe data. Doing this would reduce risk immediately." -- ----------------- R. A. Hettinga <mailto: [EMAIL PROTECTED]> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- You are currently subscribed to e-gold-list as: [email protected] To unsubscribe send a blank email to [EMAIL PROTECTED] http://www.e-gold.com/stats.html lets you observe the e-gold system's activity now!
