Layer 8

Security is fundamentally about people, and everything we know about people is relevant to security. -- B. Schneier

Hey, that dog food’s actually kinda tasty.

I was doing my Quicken updates this morning and saw a bunch of transactions going by on my credit card that confused me:

“Xfer Purchase Bal to [some other number]”

WTF??

So I went downstairs to my stack of paper mail, and found one of those innocuously marked envelopes that are rigid in the middle and just scream “NEW CREDIT CARDS.” Opened it, and sure enough, there were new credit cards with a BRIGHT yellow slip of paper enclosed, explaining that one of the merchants I had done business with in the past had reported a security breach, and to be on the safe side they were closing my old card account and opening a new one for me.  They gave me until the middle of next month to call and activate my new cards, otherwise they’d close my account completely.

Okay, I’ve got to give Citibank major props here.  Obviously they’ve got this worked out to a science now.  The automated card activation phone tree let me choose to talk to a service rep, who knew why I was calling and had the right “security breach” script in place.  The only thing that bugged me is that they wouldn’t tell me who the merchant was, citing “ongoing security investigations.” But they made it as easy as possible for me to switch things over, and the service rep mentioned in passing that they were having to change “millions of card numbers.”

The only annoying thing is that I have to change bill paying details, automated charges, and the like, at various online sites.  But at least I know that my old account is closed and even if I forget to update someplace, the worst that will happen is that the charge will be rejected.  But it could be much, much, much worse.  I could have actually seen a fraudulent charge before they had done anything.

So I’ve got a new “real life anecdote” to tell my users the next time I have to lecture them about security and identity theft.  That’s not a bad thing.

Posted by shrdlu on Saturday, September 22, 2007
(3) CommentsPermalink blogmarks Favicon del.icio.us Favicon Digg Favicon Fark Favicon Furl Favicon Google Bookmarks Favicon StumbleUpon Favicon Technorati Favicon TailRank Favicon
Page 1 of 1 pages