MasterCard won't disclose who leaked my credit card details
"As indicated in comments, this is common practice in the US as well as EU.  For example, in this Fox Business article, a user had basically the same experience: their card was replaced but without the specific merchant being disclosed.  When the reporter contacted Visa, they were told: ""We also believe that the public interest is best served by quickly notifying financial institutions with the information necessary to protect themselves and their cardholders from fraud losses. Even a slight delay in notification to financial institutions could be costly,” the spokesperson said in an e-mail statement. “Visa works with the breached entity to collect the necessary information and provides payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring, and if needed, reissuing cards. The most critical information needed is the affected accounts, which Visa works to provide as quickly as possible.” What they're not saying, of course, is that it's in Visa's best interests that merchants let Visa know right away when a leak occurs, without having to think about whether it's going to screw that merchant over in the press.  If the merchant has to consider PR, they may not let the networks know in as timely of a fashion - they may at least wait until they've verified the issue in more detail, or even wait until they've found who to pin it on so they don't get blamed. But beyond that, the point is that it's easier for the network (Visa/Mastercard/etc.) to have a system that's just a list of card numbers to submit to the bank for re-issuing; nobody there really cares which merchant was at fault, they just want to re-issue the cards quickly.  Letting you know who's at fault is separate.  There's little reason for the issuing bank to ever know; you should find out from the merchant themselves or from the network (and in my experience, usually the former). Eventually you may well find out - the article suggest that: [T]he situation is common, but there is some good news: consumers do in many cases find out the source of the breach. But of course doesn't go into detail about numbers." I found a german article describing the legal situation in Germany. To summarize As outlined by the many possible reasons in the other answer, it is unclear from the information I have, whether condition 1 holds. Also condition 2 may not hold since the credit card was frozen. I suppose this makes a good argument to MasterCard and my bank, but I also suspect they will not care unless it comes with a attorney letterhead. "Others have already commented on the impact of anything which dissuades merchants from raising possible breaches, so I won't dwell on that. Maybe we need stronger legislation, maybe we don't, but it doesn't change today's answer. Often it works the other way around to what you might expect - rather than the merchant noticing and notifying Visa/MC/others, Visa/MC/others spot patterns of suspicious activity (example 1). I don't have any data on the relative numbers of who is being notified/notifying between merchants and payment processors, but at the point when your card is identified as compromised there's no reason to suppose that an individual merchant in the traditional sense has been compromised, let alone identified. In fact because there's a fast moving investigation it could even be a false alarm that led to your card getting cancelled. Conversely it could be a hugely complex multinational investigation which would be jeopardised. It's simply not safe to assume that simply ""brand X"" has been compromised, therefore everything ""brand X"" knows about you is also compromised: Furthermore there's no reason to assume the merchant has even admitted to, or discovered the root cause. MC/Visa/Banks, at the point at which they're cancelling cards simply can't say (at least not in a way that might expensively backfire involving lots of lawyers) because the standard of proof needed to go on record blaming someone is simply not yet met. So: yes it's common that you aren't told anything for all of the above reasons. And of course if you really want to find out more you may have some success with your local data protection legislation and formally make a subject access request (or local equivalent) to see what that brings back. Be sure to do it in writing, to the official address of both mastercard and your bank." "File a John Doe lawsuit, ""plaintiff to be determined"", and then subpoena the relevant information from Mastercard.  John Doe doesn't countersue, so you're pretty safe doing this.  But it probably won't work.  Mastercard would quash your subpoena.  They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point).    They are after the people doing the hacking, and the security gaps which make the hacking possible.  And how those gaps arise among businesses just trying to do their best.  It's a hard problem.  And I've done the abuse wars professionally.  OpSec is a big deal.  You simply cannot reveal your methods or even much of your findings, because that will expose too much of your detection method.  The ugly fact is, the bad guys are not that far from winning, and catching them depends on them unwisely using the same known techniques over and over.  When you get a truly novel technique, it costs a fortune in engineering time to unravel what they did and build defenses against it.  If maybe 1% of attacks are this, it is manageable, but if it were 10%, you simply cannot staff an enforcement arm big enough - the trained staff don't exist to hire (unless you steal them from Visa, Amex, etc.)  So as much as you'd like to tell the public, believe me, I'd like to get some credit for what I've done -- they just can't say much or they educate the bad guys, and then have a much tougher problem later.  Sorry!  I know how frustrating it is! The credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards).  This is a basic set of security rules and practices which should make hacking unlikely.  Compliance is achievable (not easy), and if you do it, you're off the hook.  That is one way Amy can be entirely not at fault.  Example deleted for length, but as a small business, you just can't be a PCI security expert.  You rely on the commitments of others to do a good job, like your bank and merchant account salesman.  There are so many ways this can go wrong that just aren't your fault.   As to the notion of saying ""it affected Amy's customers but it was Doofus the contractor's fault"", that doesn't work, the Internet lynch mob won't hear the details and will kill Amy's business. Then she's suing Mastercard for false light, a type of defamtion there the facts are true but are framed falsely.   And defamation has much more serious consequences in Europe.  Anyway, even a business not at fault has to pay for a PCI-DSS audit.  A business at fault has lots more problems, at the very least paying $50-90 per customer to replace their cards.  The simple fact is 80% of businesses in this situation go bankrupt at this point.   Usually fraudsters make automated attacks using scripts they got from others.  Only a few dozen attacks (on sites) succeed, and then they use other scripts to intercept payment data, which is all they want. They are cookie cutter scripts, and aren't customized for each site, and can't go after whatever personal data is particular to that site. So in most cases all they get is payment data. It's also likely that primary data, like a cloud drive, photo collection or medical records, are kept in completely separate systems with separate security, unlikely to hack both at once even if the hacker is willing to put lots and lots of engineering effort into it.  Most hackers are script kiddies, able to run scripts others provided but unable to hack on their own.   So it's likely that ""none was leaked"" is the reason they didn't give notification of private information leakage.  Lastly, they can't get what you didn't upload.  Site hacking is a well known phenomenon.  A person who is concerned with privacy is cautious to not put things online that are too risky.  It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution."
"This question has the [united kingdom] tag, so the information about USA or other law and procedures is probably only of tangential use. Except for understanding that no, this is not something to ignore. It may well indicate someone trying to use your id fraudulently, or some other sort of data-processing foul-up that may adversely impact your credit rating. The first thing I would do is phone the credit card company that sent the letter to inform them that I did not make his application, and ask firmly but politely to speak to their fraud team. I would hope that they would be helpful. It's in their interests as well as yours. (Added later) By the way, do not trust anything written on the letter. It may be a fake letter trying to lure or panic you into some other sort of scam, such as closing your ""compromised"" bank account and transferring the money in it to the ""fraud team"" for ""safety"". (Yes, it sounds stupid, but con-men are experts at what they do, and even finance industry professionals have fallen victim to such scams) So find a telephone number for that credit card company independently, for example Google, and then call that number. If it's the wrong department they'll be able to transfer you internally. If the card company is unhelpful, you have certain legal rights that do not cost much if anything. This credit company is obliged to tell you as an absolute minimum, which credit reference agencies they used when deciding to decline ""your"" application. Yes, you did not make it, but it was in your name and affected your credit rating. There are three main credit rating agencies, and whether or not the bank used them, I would spend the statutory £2 fee (if necessary) with each of them to obtain your statutory credit report, which basically is all data that they hold about you. They are obliged to correct anything which is inaccurate, and you have an absolute right to attach a note to your file explaining, for example, that you allege entries x,y, and z were fraudulently caused by an unknown third party trying to steal your ID. (They may be factually correct, e.g. ""Credit search on "", so it's possible that you cannot have them removed, and it may not be in your interests to have them removed, but you certainly want them flagged as unauthorized).  If you think the fraudster may be known to you, you can also use the Data Protection Act on the company which write to you, requiring them to send you a copy of all data allegedly concerning yourself which it holds. AFAIR this costs £10. In particular you will require sight of the application and signature, if it was made on paper, and the IP address details, if it was made electronically, as well as all the data content and subsequent communications. You may recognise the handwriting, but even if not, you then have documentary evidence that it is not yours. As for the IP address, you can deduce the internet service provider and then use the Data Protection act on them. They may decline to give any details if the fraudster used his own credentials, in which case again you have documentary evidence that it was not you ... and something to give the police and bank fraud investigators if they get interested. I suspect they won't be very interested, if all you uncover is  fraudulent applications that were declined. However, you may uncover a successful fraud, i.e. a live card in your name being used by a criminal, or a store or phone credit agreement. In which case obviously get in touch with that company a.s.a.p. to get it shut down and to get the authorities involved in dealing with the crime. In general, write down everything you are told, including phone contact names, and keep it. Confirm anything that you have agreed in writing, and keep copies of the letters you write and of course, the replies you receive. You shouldn't need any lawyer. The UK credit law puts the onus very much on the credit card company to prove that you owe it money, and if a random stranger has stolen your id, it won't be able to do that. In fact, it's most unlikely that it will even try, unless you have a criminal record or a record of financial delinquency. But it may be an awful lot of aggravation for years to come, if somebody has successfully stolen your ID. So even if the first lot of credit reference agency print-outs look ""clean"", check again in about six weeks time and yet again  in maybe 3 months. Finally there is a scheme that you can join if you have been a victim of ID theft. I've forgotten its name but you will probably be told about it. Baically, your credit reference files will be tagged at your request with a requirement for extra precautions to be taken. This should not affect your credit rating but might make obtaining credit more hassle (for example, requests for additional ID before your account is opened after the approval process). Oh, and post a letter to yourself pdq. It's not unknown for fraudsters to persuade the Post Office to redirect all your mail to their address!" I don't see a way that this would make matters worse than just giving them the credit card info... Except that it would make abusing the card easier at some other site (or the bank) if they have a similar (unreasonably weak) security-by-photo test. Still, I'd strongly recommend you use a separate card for this so you can cancel it without disrupting your other credit card uses.  (Actually I'd strongly recommend not doing business with folks who have already demonstrated questionable ethics, but you seem to have made that decision.) "Perhaps mysterious in the sense that any dubious story involving a powerful and influential firm will not have their name actually mentioned?  I've often found when American media runs a story like this, with no details, I can go look at London's Financial Times and they will name-names.  For example CNBC or CNN might run a story ""top wall street firms fined"" and not name the actual firms.  You have to look at non-American media to get actual names." "tl;dr: Anyone who doesn't like what VISA and MasterCard did to wikileaks should not be in favour of this.  This is a slippery slope (yes, really), where participating the the marketplace shall only be allowed by people the powers that be likes. What is ""intolerance""? Should James Damore never be allowed to use paypal for any purpose? How about VISA, MasterCard, should he never be allowed to have a credit card again?  If the government doesn't ""like"" what you're doing then they have made (or can make) it illegal, and you are taken out of the marketplace of ideas and money, if the government thinks this is best.  This is government-sized actions (denying people the possibility to deal with money) done extrajudicially by private entities.  ""I have decided that your legal enterprise should not be allowed to make money"" is terrible!  If you are in favour of this then you should be in favour of the phone company, the electricity company, and gas company to deny service to anyone who's ever been accused of being a paedophile." What can I do to make sure it won't happen? Who is the right person to report this to? (apparently, the police can't make sure that it won't be used for identity theft) You want to contact any one of the credit bureaus and put a fraud alert on your account.   Once you contact one, they automatically contact the other bureaus for you. As part of this, they should send you a credit report.  Review it carefully and note any items that are not yours.  You'll then need to dispute any items that are a result of this identity theft.   You may be required to file a police report regarding the stolen identity, but if you filed one for your stolen wallet, that may be sufficient.   If the person who stole your wallet wants to steal your identity, it may be months before it shows up on your credit report.   Make it a practice to regularly check your credit reports. How do I check at any given time whether my identity was stolen? Unfortunately, there is no easy way to check if your identity was stolen.  The most common way is to check your credit report, but that only checks things that are reported to the credit reporting bureaus.   If they use your information to start an account with a utility company at a rental house that typically won't go on your credit report until they are substantially delinquent.  If they use your information to check into a hospital, that information typically won't show up on your credit report until the hospital sends the bill to collections. I've had a case where the identity theft happened at Chase, but was never reported on my credit.   So my credit report was clear, but Chase disallowed me from banking with them because the identity thief had delinquent accounts with Chase that for whatever reason were not reported to the bureaus. How likely is it that it will be used in any form of identity theft? My gut feeling is that someone who snatches a wallet and immediately runs up the credit cards isn't looking to steal identities, but rather for a quick score.   I don't know if there are statistics that back up my hunch. Visa, Mastercard have very strong consumer protection. I have been wondering about this question for a while but never got around to asking it here: What happens if a retailer knowingly defrauds me? My guess is the first party to ask for help is Visa, Mastercard: a retailer knowingly defrauding you is unlikely to refund you any money. However, slip-ups do happen. If this is a retailer of good repute, they will not only refund you the money but send you a gift card too! Please do followup this post with what helped you in the end, but my guess is, your first (and last) line of defense would be Visa, Mastercard. Anything that would go through the bank would take such a lot of time and effort, that you would be better off writing it off. Yes. I doubt I'll see a penny of that money, but will now forever have to wait for the other shoe to stop, not only on my credit cards being stolen but also potentially my identity. There's no time limit to this, could be years later. It really sucks, you're lucky not to be involved. Like email and spam, fighting creditcard fraud is a cat and mouse game, with technology and processes constantly being developed to reduce fraud. The CVV on the back of the card is just one more layer of security.  Requiring the CVV generally requires you to physically have access to the card. CVV should not be stored by any merchant. This frustrates card skimming fraud as the CVV is not present in the track data and fraud caused by database compromises.  You should never use your PIN online. MC/VISA both have implementations of 3D-Secure (SecureCode for MC and Verified by VISA) which require a password / code to confirm card ownership. Depends on both Issuer and Merchant implementing the standard.  Regarding not needing a PIN at the airport, some low value transactions no longer need PINs, depending on the Issuer and Scheme (VISA/MC). MasterCard PayPass or VISA PayWave enable low value contactless transactions without PIN. In Australia, the maximum value for a contactless transactions is $100 AUD. At some merchants (McDonalds for example) a PIN is not required for for meals purchased with VISA (at least, for the cheeseburger I bought there as a test). This makes sense - if you don't need a PIN for a contactless purchase, why do you need it for a chip based purchase?  So - why allow PIN free transactions? On average customers report stolen credit cards / wallet very quickly and the losses are correspondingly small. As card issuers are always online, cards can be cancelled very quickly after being reported lost / stolen. Finally, by performing transactions for just a few cents or pennies, the merchant (Spotify) can likely validate you are the owner of the card as you'd need access to your online bank to confirm the transactions.  PayPal do this with bank account to confirm ownership. (Unless I've misunderstood your statement). You are correct, I didn't understand that at all. Apparently us consumers don't need to know when our financial information is susceptible to being compromised.   One question: Is your username based on the Redwall book series? I loved all those books. "&gt; But I explicitly mentioned the customer experience, which is completely different and no matter how much you want your industry experience to matter for that, it doesn't affect it.  You mentioned the customer experience randomly in some parts, then threw in Wikileaks in others. If we're talking about the customer experience, we need to drop the payment processors aspect, because the majority of the time, the consumer doesn't even know who processes their card payments let alone care, and again, PayPal is not even close to the only option. If this were 1998 and people were really wary of buying online, then it would be a bigger deal to be banned from PayPal. But it's not 1998, and a ton of people don't care, and there are all kinds of alternatives.  PayPal can deny service all it wants (and it does that on a regular basis) and that in no way means that a business can't accept cards. You're ""customer experience"" premise is flawed. I literally spend all day helping businesses set up credit card processing, and PayPal is a drop in the bucket.   &gt;Could you clarify for me how VISA/MasterCard managed to block a merchant, who presumably wasn't a direct customer (but instead a payment processor customer), but cannot block a card holder? (yes, this is an honest question)  Visa and Mastercard have relationships with banks and/or processors, who have relationships with merchants. Visa and MC's agreements with banks and processors stipulate that those banks and processors can't offer services to companies engaging in illegal activity. Wikileaks was (allegedly) engaging in illegal activity, and it's on that basis that Visa and MC denied service to WL.  Visa and Mastercard have almost nothing to do with cardholders. They don't issue credit cards to cardholders, they aren't the ones that do credit checks to determine creditworthiness, they aren't the ones helping you with your monthly statement or a dispute, etc. Cardholders aren't Visa and MC's clients. When a transaction is run, it's authenticated by the bank that issued the card, not by Visa or MC, and it's the bank, not Visa or MC, that would block transactions or freeze a cardholder account.   &gt;The WikiLeaks blockade was clearly political. What makes you say otherwise? And this is political.  So your argument is that anything political is the same as anything else political? Kind of a stretch..  Wikileaks was denied service by the card brands for allegedly engaging in illegal activity. PayPal is denying service of its own volition, which FYI, it does every day to legal businesses. As long as their reasons for doing so aren't discriminatory based on status in a protected class, they are (and should be) allowed to refuse service." "&gt;You could say the same about any public utility. (except the one largest one, technically)  There are literally thousands and thousands of processors, which is not the case with utilities. Additionally, processors don't need to have any kind of office or presence anywhere near the business they're serving, which means being able to choose without geographical restrictions. Also, PayPal is not a utility. This is not a relevant comparison.  &gt;Are you saying they are unable, both contractually and technically, to affect the consumer side?  They'd have to revoke their partnerships with banks who issue cards, which they aren't going to do, because consumers using cards is how they make money. Banks could choose not to issue cards, but they're already free to do that. (There's no right to a credit card.)  &gt;But also by selectively quoting me you are (deliberately?) side-stepping what actually happened in the WikiLeaks case, to focus on the consumer side.  Visa and Mastercard prohibited payments to Wikileaks on the basis of WL allegedly facilitating illegal activity. How is that relevant to what PayPal's doing?   &gt;You must buy things in different corners of the Internet than I do. The customer experience (to me) is that there is ""the store"" or you can pay with PayPal. Yes, ""the store"" is actually a payment processor but this is a quick slippery slope to ""what? You can just set up your own payment processor once they've all blocked your legal business"".  What are you talking about? You acknowledge that the store has its own processing but somehow that's not enough because someday they might not have processing and have to go through PayPal?  Processors *already* deny service to legal businesses. Notably, anything considered ""high risk"" - which includes travel services, pharmaceuticals, firearms, adult entertainment, telemarketing, debt collection, tobacco, and more - but also for businesses with poor credit, high chargebacks, business practices they don't agree with, lots of international transactions, etc.   It literally happens all the time. And, there are so many processors (tens of thousands) that there's another processor willing to step in.   Tons of websites don't even use PayPal anymore, and the ones that do often layer it on top of a different payment option. (PayPal is trying hard to increase their presence in stores because of the competition in the internet space.) No one is unable to accept payments if they're barred from PayPal. PayPal actually cuts off accounts all the time because people use it for things against PayPal's TOS.   Amazon payments, Shopify, and Stripe are the ones that most people know off the tops of their heads for online processing, but there are literally thousands. No one is somehow unable to conduct business if they can't use PayPal.   The only time that businesses can't really get processing is if they do something like rack up chargebacks and disappear or commit fraud against a processor. In those cases, the processor can put that business on the Terminated Merchant File (or MATCH list) and other processors will see that there's been a problem with that customer and not take them on. Even in those cases, businesses can rectify the issue and get off the MATCH list or they can look for processors that will serve them anyway and expect to pay a premium for it." Chip and Pin cards are popular in Europe, however in the US we don't have them.  Visa/MC and Amex can issue chip and pin cards but no merchants or machines are set up here to take them.  Only certain countries in Europe use them and since you could possibly have a US visitor or a non-chip and pin person using your machine or eating at your restaurant they usually allow you to sign or just omit the pin if the card doesn't have a chip. It is definitely less secure, but the entire credit card industry in the US is running right now without it, so I don't think the major credit card companies care too much (they just pass the fraud on to the merchants anyway). I have read numerous accounts of this, and yes, it is criminal, but no, they can't figure out who did, though presumably the people handling the accounts were guilty of this. Mutant human [Angelo Mozilo](http://en.wikipedia.org/wiki/Angelo_Mozilo)'s organization stands out as the worst offender in this regard with no trickery too extreme.  Ironically sourcing these particular accounts is difficult because of the sheer amount of material pertaining to subprime mortgages and fraud in general. Its not public information but it would be hard to keep it a secret. By its very nature, a custodial bank has to interact with various brokers, middle office systems, back office systems - many of which are third party. And the investment firm will likely be giving out their custodial information to these third parties to set up interfaces and whatnot. So, my questions: Are payment cards provide sufficient security now? Yes. If so, how is that achieved? Depending on your country's laws, of course. In most places (The US and EU, notably), there's a statutory limit on liability for fraudulent charges. For transactions when the card is not present, proving that the charge is not fraudulent is merchants' task. Why do online services ask for all those CVV codes and expiration date   information, if, whenever you poke the card out of your wallet, all of   its information becomes visible to everyone in the close area? What   can I do to secure myself? Is it? Try to copy someones credit card info next time you're in the line at the local grocery store. BTW, some of my friends tend to rub off the CVV code from the cards   they get immediately after receiving; nevertheless, it could have   already been written down by some unfair bank employee. Rubbish.