As a Chase customer (checking/auto) who happens to be an eBay user that shopped at Target during the data breach, this is getting really old. I wonder at what point do companies start requesting we change our account numbers (similar to passwords)?
Some already are, sorta. I made a single purchase at Target with a debit card during the period of their breech and my bank automatically sent me a new card with new numbers. It wasn't auto-activated, but once I did activate it, the old card and numbers went into the ether.
Not that it helps a bit if they are hacking banks however.
There was a complete lack of encryption at key points.
The chip is not part of the equation for online transactions. So if everything but the chip is stolen, the bad guys are going to use the card online.
Check out http://krebsonsecurity.com/2014/05/the-target-breach-by-the-..., particularly his "by the numbers" section:
0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions).
With regards to online use, I'll say I'm not familiar with how Chip and Pin really works, but presumably they have some guard for online use, right? Or is that just wide open still?
How would having a having the Chip and Pin have prevented the data from being stolen? It does not. The "Chip and Pin" argument is brought up each time this sort of retail breach happens, like a reflex.
It seems that this is not that same type of system or am I mistaken in some way? Seems to me that it would have helped; my account number/card number/exp. date are useless on their own.
1 million – 3 million – The estimated number of cards stolen from Target that were successfully sold on the black market and used for fraud before issuing banks got around to canceling the rest (based on interviews with three different banks, which found that between 3-7 percent of all cards they were told by Visa/MasterCard were compromised actually ended up experiencing fraud).
So clearly they were able to use the cards.