With the wide use of debit cards and the increasing amount of Debit Card Fraud, it's good to know what to do if your debit card is compromised (or hacked).

Most compromises involve a criminal gaining unauthorized access to a merchant's or card processor's computer system (sometimes referred to as "hacking" into or installing "malware" to capture data on a system). If this happens, your card number could potentially be used by someone else.

According to most bank and card websites there are some important steps to follow if your card is compromised.

Check your accounts for unauthorized charges or debits and continue monitoring your accounts. This may seem obvious, but your first step should be is looking for any charges you don't recognize on your account. And be sure your bank has your updated Contact information. If they can't contact you, they can't ask about fraudulent charges.

Report a suspicious charge or debit immediately   Contact your bank or card provider immediately if you see an unauthorized debit or charge. Follow up with a written letter. When you communicate in writing; be sure to keep a copy for your records. Report even a small charge right away, sometimes thieves will start with a small debit against your account and return to take more from your account if the first smaller one goes through. And keep paying attention-fraudulent charges or debits to your account might occur many months after the theft of your information during a data breach.

Submit a complaint if you have an issue with your bank or card provider's response Debit card issuers should investigate the charges (generally within 10 business days) and take action quickly (generally within 3 business days). FFIEC's Consumer Help Center--The Consumer Financial Protection Bureau (CFPB) handles consumer complaints about financial products and services. Consumers can submit complaints and find answers to questions at http://www.consumerfinance.gov or by calling the CFPB at (855) 411-2372.

Replace your card, change your PIN   If the bank didn't already do this for you, if a thief charges items to your account, you should cancel the card and have it replaced before more transactions can come through. Even if you're not sure that PIN information was taken, consider changing your PIN just to be on the safe side.This will put an end to any more fake charges.

Ignore anyone contacting you to "verify" your account information by phone or email    Unfortunately; when there is widespread knowledge of a scam, it perpetuates more scamming possibilities -- thieves posing as bank employees, etc. This common scam, referred to as "phishing". Banks and credit unions never ask for account information through phone or email that they initiate. If you receive this type of contact, you should immediately call your card provider (using a customer service number that you get from a different source than the initial call or email) and report it.

Unfortunately there is no way to completely protect yourself from Card Fraud, it's important to be informed on what to do if it should happen to you.

Sources:

https://secure.montereycu.com/newsletter/card_compromise_faq.htm#One

http://www.consumerfinance.gov/blog/four-steps-you-can-take-if-you-think-your-credit-or-debit-card-data-was-hacked/

http://www.ffiec.gov/consumercenter/ (FFIEC's Consumer Help Center)  

Flaws are found in software every day. Some have more impact on us than others. Some aren't even known by the manufacturer of the software but are known by hackers.

How do we stay safe? How can we be confident that our information is secure? There have been a lot of headlines surrounding the security of the software we use and how that impacts us. More devices than ever before have networking capabilities integrated which raises the impact flaws can have. This creates an unprecedented situation were we start having to updating software on appliances such as tvs, refrigerators and baby monitors.

In fact, this was highlighted recently when a video baby monitor that was connected to the internet was "hacked". The version of the software it was running had a problem and this attacker was able to get into the video stream through it. He started screaming "wake up baby!" the parents came to the room and were really scared and confused when the camera moved on its own. They unplugged the monitor and later found out there was a flaw in the software and an update was available for it... rough way to find out.*

The flaw in OpenSSL known as Heartbleed was all over the news for what seemed like forever. This flaw impacted 17.5% of websites world wide. It essentially allowed an attacker to get information from the website that they shouldn't have been able to get. The biggest issue surrounded the ability to extract a "private key" from the website. This allowed another website to trick you into believing it was a legit site even thought it was a fraud. There are multiple steps that a successful attack would need to take but still this was very concerning as it violated the trust we have grown to have in the secure infrastructure of the internet. The flaw was introduced on New Year's Eve 2011 by a college student and wasn't found until two years later.**

Last week Homeland Security was advising people not to use Internet Explorer after a zero day vulnerability was found.*** The problem isn't just related to Microsoft's Internet Explorer, no web browser is safe from flaws. Zero day means that the manufacturer found out about it after it was already being used by hackers "in the wild".****

It is good and necessary to stay up to date and apply security patches but the fact of the matter is that there will be flaws we don't know about until it's too late. This is when thinking critically about what controls should be in place can pay big dividends.

Simple things like having complex passwords that rotate regularly and using multi-factor authentication when available can go a long way. Limiting access of websites to only the ones we need can be frustrating but it plays a critical role at significantly lowering your risk of being impacted by zero day browser attacks.

Some things like Heartbleed aren't preventable but once known it is important to fully understand what this really means to you, your company, and your family. Find a trusted source of balanced information and stay up to date.

Sources:

* http://www.nbcnews.com/tech/security/man-hacks-monitor-screams-baby-girl-n91546
 ** http://online.wsj.com/news/articles/SB10001424052702303873604579495362672447986

*** http://www.us-cert.gov/ncas/current-activity/2014/04/28/Microsoft-Internet-Explorer-Use-After-Free-Vulnerability-Being

**** http://www.symantec.com/threatreport/topic.jsp?id=vulnerability_trends&aid=zero_day_vulnerabilities

Article written by: Ryan Valiquette, Logical Security Officer/Support Technician

For questions on this topic you can reach Ryan at 800-800-6197 Ext. 1056 or [email protected].