Chapter 2

Introduction to Fraud, Data Theft, and Related Regulatory Mandates

Credit card fraud, identity theft, and broader personal data theft are problems that plague our information-dependent society and predate the age of the Internet. Ironically, things such as automated processing of financial data that make your life easier and more convenient also make crime easier and more convenient. Moreover, the Internet allowed crime that only happened on a small scale to grow and spread globally, and the Internet’s scalability turned electronic-based crimes into a global concern.

Some crime was automated and changed from rare to widespread, for example, Nigerian e-mail or UK Lottery scams. Gone are the days where criminals need to be in the same location, country, or even continent to scam you out of your hard-earned cash. Nigerian e-mail scams started many years ago and are profitable for the scammers. They send out millions of e-mails claiming to be a relative of a Nigerian dignitary with frozen assets and want you to transfer the money for them. You give them your bank account information and/or send them “seed money” to get things moving and end up with nothing. UK Lottery scams aren’t much different with the same basic constructs to get you a cash prize.

Criminals have gone high-tech and have discovered that there is a significant amount of money to be made with very little risk. Hacking a company database or orchestrating a phishing attack while sitting in your pajamas and eating chocolate ice cream in the living room of your house has much more appeal than physically robbing banks or convenience stores. Add to that the lower risk of a confrontation with firearms and electronic crime becomes even more attractive! Depending on the company being targeted, the sophistication of the attack, and sheer luck, sometimes the high-tech crime may also be significantly more lucrative than traditional armed robbery. Sadly, cross-border prosecution issues significantly fuel a cyber-criminal’s activity. When a criminal physically robs a convenience store, he is probably caught on tape and there are witnesses. Plus, law enforcement will mobilize quickly to find and catch the criminal so he may be brought to justice. Cyber-criminals have a couple of things working in their favor, the first of which is their ability to commit crime without ever stepping into the physical location of their victim(s). Couple that with lagging cyber-security laws in most countries and the inability for the victim’s law enforcement to prosecute outside their borders and you have an idea on why cybercrime is on the rise. In addition, the whole ecosystem of criminal outsourcing partners now allow other criminals to only focus on the activities they do best, such as creating malicious software or hosting phishing pages through botnets.

Malicious software (malware) and cyber-criminals are not the only threat. Sadly, the very companies and organizations that are entrusted with sensitive information are often to blame because of a lack of adequate controls to protect sensitive information. In some companies information security is treated with apathy, and in others, a lack of effective controls enables an insider to commit fraud Consumers and businesses are faced with a wide variety of threats to their data and personal information on any given day.

Spyware, phishing attacks, and botnets are all computer attacks that are on the rise and pose a significant threat to corporate and home users, as they connect to the Internet from their computers. However, those threats pale in comparison with the amount of personally identifiable information and sensitive data available to be compromised due to carelessness or negligence by individuals and corporations.

As of today, hundreds of millions of various personal information records have been lost or stolen. Every year since the ChoicePoint breach, we’ve seen major companies fall victim to Payment Card Industry (PCI)-related security breaches. DSW Retail in 2005, The U.S. Department of Veteran’s Affairs in 2006 (and in later years), The TJX Companies in 2007, Hannaford Brothers in 2008, Heartland Payment Systems in 2009, Albrecht Discount (ALDI) in 2010, and Sony in 2011 continue to demonstrate both the poor state of security and increasing sophistication and numbers of the bad guys (as more and more countries have growing populations on the Internet) who want this data and know how to profit from it.

In an “Information is King” era, when more consumers are using computers and the Internet to conduct business and make purchases, taking the proper steps to secure and protect personally identifiable information and other sensitive data has never been more important. It is bad for companies, individuals, and the economy at large if consumer confidence is eroded by having personal information exposed or compromised. It is worthwhile to add that credit card brands are definitely not the only entities suffering from such possible loss of confidence.

Information technologists are affected by a number of laws and regulations designed to coax businesses into addressing their security problems. Depending on what industry a company does business in, they may fall under Sarbanes–Oxley (SOX), the Gramm–Leach–Bliley Act of 1999 (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), Federal Information Security Management Act (FISMA), and other regulatory mandates that we mentioned in the very beginning of Chapter 1, “About PCI and This Book.” Maybe this confusing hodgepodge of alphabet soup—and that is without European and other regional mandates and regulations—makes for a tough job understanding how to comply with all these measures, as many organizations still fail to enforce adequate security. The Unified Compliance Framework (UCF) that can be found at www.unifiedcompliance.com tracks hundreds of IT-relevant regulations, and many commercially available eGRC tools such as RSA’s Archer or IBM’s OpenPages can help build, manage, and reference a common control set to cover all of these compliance initiatives.

Breaches often target consumer credit card information because of the revenue this type of data can generate on the black market. Since our last publication, the value of magnetic stripe data on the black market has declined dramatically, but that doesn’t stop the attacks or the desire to capture other data like PII and PIN-Debit information. Card companies recognized the rising threat to their brands and...