Opinion - News Analysis   

The growing problem of credit card fraud

Andrew Brown

It only takes one weak link to unleash a chain of trouble online.

I'M PUZZLED why there has not been more of an outcry over the TKX credit card theft. It is the largest and best-organised theft of credit card numbers that has ever come to light. The company involved, the big American retailer that owns TK Maxx, has released as little information as possible, as slowly as it can. But The Wall Street Journal last month made clear that something between 47.5 million and 200 million credit card numbers were stolen by a sophisticated crime ring of Romanian hackers and Russian mafia.

What is really frightening about the break-in is that it worked because the company was using the same technology that you or I use when we connect to a wireless network. My normal reaction to the news that someone has broken an encryption system is sane indifference. I have no secrets that would be interesting to the sort of people who can crack really serious encryption. I don't, for example, encrypt my wireless network at home, though I do restrict access to the family laptops. But anyone who really wanted to could sit across the road with a laptop and read everything that was transmitted over the wireless network in my house.

This is more or less how the TKX hackers started. They sat in the parking lot of a mall and eavesdropped on the wireless traffic within the shop and beyond. You might not think of large shops as hubs of Wi-Fi activity, but they are. How else does the magic box into which a waiter shoves your credit card at the end of a meal check that you can really afford it? How else does the magic wand that reads prices from barcodes work its magic? All this wireless traffic is encrypted, of course, but in the case of TKX, it was encrypted using the old, weak, WEP standard — which is almost certainly what you are using at home.

Once the hackers had collected enough data from low-level activity to break the WEP cypher being used by a store, they could then listen in to all its traffic with the main data warehouses, and pick from that stream user names and passwords, which let them log in as trusted employees. From there they were able eventually to gain access to every credit card number on the system — including several million held at a data store in England. By this stage, they were using ordinary home computers as their launchpads, which had been taken over through the Internet by spyware. None of them seems so far to have been caught.

The criminals who were caught, and whose capture led to the discovery of the theft, were some of those to whom the original hackers had sold the credit card details. Their methods, too, were pretty sophisticated. Instead of buying things with the stolen credit cards, they bought gift certificates, which could later be exchanged for saleable goods. In this way, one gang stole $8 million from Wal-Mart in a couple of months last year. Among their first victims were refugees from Hurricane Katrina — TK Maxx, the biggest of TJX's brands, sells cheap clothing to the poor.

The lawsuits arising from this will reverberate around the American system for years. But a couple of points are worth noting. The first is that in this kind of large-scale fraud there is nothing that the individual customer can do for protection.

The second is that credit card details are more profitable to steal than money. Money can be spent only once. A credit card number can be reused many times: a TKX victim found the Florida gang had bought $45,000 worth of Wal-Mart gift cards on her account. They bought them in $400 units, because the $500 ones required an explicit credit check.

The third point is that a form of crime so profitable, and so safe if you are clever and careful, must only proliferate. Last week a group of German security researchers published a method that will enable any WEP key to be cracked in two minutes on an ordinary laptop. —

© Guardian Newspapers Limited 2007

Printer friendly page  
Send this article to Friends by E-Mail

Stories in this Section

Strife in Palestine
Defending the whales
Unintended consequences of blue berets' actions
Disquiet in the dovecotes
The growing problem of credit card fraud
Why is Lebanon so unstable?
Corrections and Clarifications
UPA rule
Saving the Congress
Farming
A response

Copyright © 2007, The Hindu. Republication or redissemination of the contents of this screen are expressly prohibited without the written consent of The Hindu