A New Threat To Your Credit - Brief Article

Kiplinger's Personal Finance Magazine, April, 2000

Chances are slim, but ONLINE HACKERS could steal your card number or, even worse, your identity.

LINDA FEDAK of Columbus, Ohio, was never a convert to e-commerce. Her husband had bought a few things online, and about a year ago she let her 15-year-old son, Daniel Getson, use her Lazarus Premier Visa card to buy a hard-to-find CD from the Web site CD Universe.

Nevertheless, Fedak was among the 25,000-plus cardholders whose cards were canceled after a hacker broke into the CD Universe data files, stole 300,000 credit card numbers, and then posted some of them on the Web when his ransom demands were rebuffed.

The CD Universe security breach caused surprisingly little stir among online shoppers and e-tailers. In part that's because the hacker didn't intercept information that was being transmitted over the Internet. Instead, he found a way to break into the back-office servers where customer data was stored. "There was nothing special about e-commerce that caused this to happen," says Frank Prince, a senior analyst for Forrester Research, because it could just as easily have happened to any other type of business.

In addition, the breach affected relatively few people, and their losses so far have been fairly small. "When you look at the speed with which a hacker can move, fraud-protection systems and credit card companies can also move rapidly and limit the damage," says Preston Dodd, an analyst for Jupiter Communications.

Credit card issuers will soon be able to provide their customers with alerts and updates to make it easier for them to spot unusual activity, predicts Charles Gerlach, director of eStrategy for Mainspring, a Cambridge, Mass., consulting firm. If you pay your bill online, for instance, you'll see a snapshot of where your card was used.

Fedak isn't aware of any unauthorized charges on her card before it was canceled, but says she'll be going over her statements "with a fine-tooth comb." By law, she's responsible for only the first $50 in fraudulent charges. Of greater concern is whether the thief got enough information to steal her identity, which could lead to a damaged credit rating.