Hacker News Reader

Comment by pcarolan | Hacker News Reader

The real losers when this happens are the small businesses and nonprofits with recurring payments that have to contact their customers and ask them to reenter their new credit cards after they are replaced. Even in the best case, they're probably out a months revenue which can make or break a company.

View on HN

The article doesn't say anything about credit card numbers being taken. It seems to imply just email address, phone number and physical address was taken.

That kind of information is nearly public (not that it's OK but it seems a lot less damaging).

If more was, it would be good know.

The SEC filing states[1]:

  User contact information – name, address, phone number and email
  address – and internal JPMorgan Chase information relating to
  such users have been compromised.

I have multiple personal and business accounts at Chase, and they collect a shitload of other "internal information", way beyond name, address, phone and email.

Ostensibly for KYC [2] they try to collect personal information about the other members of my company, non-public information about my company's revenues and customers, my work and professional history, business plans and projections, my kids' college plans, real estate holdings, interests in other businesses, etc., etc., etc.

They're very pushy about gathering this information, claiming it's for regulatory compliance. I'm sure it's mostly for their own attempts to hawk their lame financial products.

So that category of "information relating to such users" could be ginormous.

[1] http://investor.shareholder.com/jpmorganchase/secfiling.cfm?...

[2] http://en.wikipedia.org/wiki/Know_your_customer

It's probably even worse than that. I've worked on bank systems. They collect all the things you mention, but also details of your personal finances, where you usually receive money from and how you spend it, guesstimates about your financial situation, 'suspicious' activity, details from every conversation you've ever had with a bank rep, and more.

It's legit. Actually had a fraudulent charge on my Chase card today from a jail phone operator in a southern state.

Only have a couple of recurring bills with the card and don't generally use it at stores, so I'm pretty confident that it was due to the breach at Chase. My biggest concern is someone using the other information they stole to open accounts under my name.

I don't know your card-usage habits, but if it was triggered by a jail phone operator within the US, it's much more likely your account information was taken at an unrelated time/event than this breach.

If stealing card/account information was their goal, there are a lot easier ways to do it. Any time you use your card at a non-official ATM, put it down to pay at a restaurant or even not shredding any mail with account information, you're putting yourself at risk. Heck, account information can be social engineered out of people quite easily as well - your particular usage habits could have nothing to do with it.

It is actually worse than that, isn't it? By law, only individuals are protected against fraud. If any small business account is compromised, they don't have that protection.

Or am I just off in my understanding of fraud protection?

Small businesses get screwed all the time by fraudulent chargebacks: http://en.wikipedia.org/wiki/Chargeback

I'm pretty sure taeric is talking small business credit cards having chargeback. They have almost identical, including the same protections, as a credit card held by an individual.

Do they? Unless things have changed, it was at least reported[1] that they do not have the same legal protections. They may have the same protections from the bank. But not by law.

[1] https://www.schneier.com/blog/archives/2009/08/small_busines...

If reminding customers that they are actually making recurring payments to a company causes that company to go out of business, I don't think we need to shed any tears.

I think he meant that a sudden huge drop in recurring revenue out the blue can sink a small business while it's getting established.

I could see that.

I meant what noir_lord said. Ira Glass' monthly donation to NPR got cancelled when Target breached, for example. You can probably back date such things, but a lot of people don't.

You mean "If requiring customers to go through the trouble of re-submitting all their payment information…", surely. Because what we're talking about here, not merely reminding them that they are paying.

Reply on news.ycombinator.com