Layer 8

Security is fundamentally about people, and everything we know about people is relevant to security. -- B. Schneier

Hey, that dog food’s actually kinda tasty.

I was doing my Quicken updates this morning and saw a bunch of transactions going by on my credit card that confused me:

“Xfer Purchase Bal to [some other number]”

WTF??

So I went downstairs to my stack of paper mail, and found one of those innocuously marked envelopes that are rigid in the middle and just scream “NEW CREDIT CARDS.”  Opened it, and sure enough, there were new credit cards with a BRIGHT yellow slip of paper enclosed, explaining that one of the merchants I had done business with in the past had reported a security breach, and to be on the safe side they were closing my old card account and opening a new one for me.  They gave me until the middle of next month to call and activate my new cards, otherwise they’d close my account completely.

Okay, I’ve got to give Citibank major props here.  Obviously they’ve got this worked out to a science now.  The automated card activation phone tree let me choose to talk to a service rep, who knew why I was calling and had the right “security breach” script in place.  The only thing that bugged me is that they wouldn’t tell me who the merchant was, citing “ongoing security investigations.”  But they made it as easy as possible for me to switch things over, and the service rep mentioned in passing that they were having to change “millions of card numbers.” 

The only annoying thing is that I have to change bill paying details, automated charges, and the like, at various online sites.  But at least I know that my old account is closed and even if I forget to update someplace, the worst that will happen is that the charge will be rejected.  But it could be much, much, much worse.  I could have actually seen a fraudulent charge before they had done anything.

So I’ve got a new “real life anecdote” to tell my users the next time I have to lecture them about security and identity theft.  That’s not a bad thing.

Posted by shrdlu on Saturday, September 22, 2007
(3) CommentsPermalink blogmarks Favicon del.icio.us Favicon Digg Favicon Fark Favicon Furl Favicon Google Bookmarks Favicon StumbleUpon Favicon Technorati Favicon TailRank Favicon

Next entry: Tip o' the day.

Previous entry: Redeeming social value?

Comments

arthur United States on 09/24  at  08:48 AM:

A real shame they didn’t oh _call_ you or something like that….

shrdlu United States on 09/24  at  09:03 AM:

They can’t.  Another security habit we have is to give out only our fax number to companies.  It cuts down on telemarketing calls, and we figure that if someone REALLY wants to get hold of us, they’ll figure out they’re calling a fax machine and they’ll send us a fax. grin

deichmans United States on 09/26  at  12:56 PM:

Citi told me the merchant was TJ Maxx, who was hacked back in January or February, giving up beaucoup CC #s to the hackers.

Page 1 of 1 pages

Add a comment

Name:

Email:

Location:

URL:

Smileys

Remember my personal information

Notify me of follow-up comments?

Submit the word you see below: