Why Aren't Credit Card Companies Using A Google Defense Mechanism?

from the interesting-ideas dept

Bennett Haselton has written up an interesting article at Slashdot, highlighting just how easy it is to find large collections of credit card information using Google. The method is pretty straightforward — and has been written about extensively in the past. What’s interesting, though, is that Haselton wonders why the credit card companies haven’t done anything about it. Obviously, they can’t prevent card info from being leaked or available online — but they absolutely can continue to scan for such information and issue new cards to those whose info was compromised. Of course, the reason they don’t do this is that the “cost” probably seems high, and the cost of not doing anything isn’t particularly high. However, Haselton also notes that this is the type of thing that others could easily help fix as well — and if the credit card companies could build up more of a community, it’s likely that volunteers probably would have written scripts that would find these cards and alert the victims years ago, when this issue was first discovered. While it’s fun for some people to bash companies that bring together a community of supporters and volunteers, it’s not hard to see cases such as this one where having a community who can be a lot more efficient at solving big problems can be a good thing.

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Why Aren't Credit Card Companies Using A Google Defense Mechanism?”

Subscribe: RSS Leave a comment
zcat says:

finding credit-card numbers..

They don’t need to search for any particular number; they just need to search for a particular pattern. Better still the major banks could come to some arrangement with google to look out for these pages (example; any page with three or more numbers in the form “4060 ?????? ??????”) and automatically send the bank a list of URL’s as fast as googlebot finds them.

T.J. says:

Communities???? Sure its a good idea in theory, but we all know with the ridiculous interest rates credit companies that they could easily afford to have a staff take care of it. It’s one of the things your interest pays for. Thats like saying McDonald’s saying it’s not responsible for hairs in your food. While I do think open source software and communities are an excellent thing, i also believe that these credit card companies should be obligated to take care of the problem themselves.

SailorRipley says:

Re: Re:

I don’t agree.

The credit card companies are under no obligation whatsoever to pro-actively take care of the problem themselves.

As long as it is cheaper for them to do nothing (and just eat the loss resulting from the information being out on the web) as annoying that may be for anybody whose cc information is out on the web, it’s their right to do nothing. Why would/should the CC be obligated to take care of a problem they had nothing to do with creating? It’s not their fault other companies are careless enough to let CC information leak onto the web (TJ Maxx comes to mind…hmmmm coincidence?)

If/when it becomes more costly to do nothing, they will take care of the problem. But they’d have the right to whine it’s not fair they have to spend $$ on taking care of a problem they had no part in creating

and btw, the McD analogy is so fundamentally flawed I’m not even going to bother

Answer. says:

Why don't the credit card companies do anything?

Credit card companies don’t do anything because they don’t have any incentive to fix the problem, but they do have an incentive not to.
I have a close friend who was a victim of identity theft. The thief/thieves used his personal information to open new credit cards under his name and ring up charges as fast as he could shut the cards down. Because he had reported his cards as stolen and the credit card companies were aware of what was going on, the companies would obligingly take off the charges. But they kept raising his interest rate every time it happened. So on one hand, they were acknowledging that it wasn’t his fault, while on the other hand, they were gouging him for it. His credit rating and interest rate got so bad that no store will accept his credit card and he has to use cash for everything.

The worst part? The guy worked for the Attorney General’s Identity Theft department at the time. And what he learned there was that there was absolutely nothing he could do about his situation, because the credit card companies do whatever they want.

nedu says:

Identification and Authorization

Step back a bit…

Using an account identifer as an authorization token is just idiotic.

How many of you use your username as your password? Please (virtually) raise your (virtual) hands. We have a FAQ on security basics for you.

In-person transactions in 3-space usually require the actual card. That is, the account number is used for account identification. Meanwhile, something owned (the card itself) together with something characteristic (a signature) is sufficient for authorization.

But for distance transactions, the authorization component is stripped off. That’s just stupid.

In a ubiquitiously networked world, a remote transaction should involve the customer communicating with the card issuer and securely authorizing the specific transaction.
There’s no reason that this shouldn’t be a relatively seamless part of a transaction with a merchant. The merchant, the customer and the several banks involved are all capable of communicating with each other in real time over the network.

Of course, this architecture wouldn’t work for telephone or mail-order purchases. But as on-line purchasing increases in importance, those older methods become less important. Thus, it should be possible to place additional burdens on those older styles of remote transaction without burdening most customers and most merchants excessively.

The flat fact is that account identifiers cannot realistically be kept secret. The identifier has to be disclosed to too many parties. Otoh, transaction authorization tokens should be shared with the minimum number of parties. A customer shouldn’t be disclosing their transaction authorization token(s) to anyone but their own bank.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...