Cyber Thieves Targeting Smaller Retailers

Written by Evan Schuman
September 29th, 2006

As the established large E-Commerce sites pour millions of dollars into security and enterprise-league hardened POS systems, cyber crooks have been giving more attention to much smaller and less well-protected merchants.

Those smaller merchants can’t even necessarily protect themselves by opting to not have a Web site, as the thieves are grabbing credit card information as its transmitted over the Internet to POS servers.

“In general, the smaller retailers, whether they’re operating E-Commerce sites or physical stores, don’t have the resources to think about security,” said Gartner Group retail security analyst Avivah Litan.

Many of the POS programs used by smaller retailers “have vulnerabilities. (Criminals) can log into these systems using programs like PCAnywhere and, lo and behold, they can get the credit card and debit card data and sometimes there’s even magstripe data being stored,” Litan said. “A small retailer doesn’t have the time or the resources or the inclination to know about all this.”

A recent Washington Post story highlighted the issue, but it?s been common knowledge in the law enforcement world for years that smaller retailers are very attractive targets.

The goal of the thieves is typically not to use the data to create bogus credit cards as much as is it to collect a large number of numbers and authentication codes and to sell that collection of data to support fraudulent E-Commerce purchases or to purchase stored-value cards and use those to make brick-and-mortar purchases.

Gartner’s Litan said some global cyber crooks have gotten fairly sophisticated in selecting their victims. “I was told by a forensics analyst that there are some thieves in VietNam who have figured out which Point of Sale cash registers are vulnerable,” she said. “They go to the manufacturer’s Web site, find out who the big customers are and they may even find out small customers. They then go attack those terminals. They may not even know how vulnerable they are. For example, they may not have an E-Commerce site, but they may use a terminal program that the vendor maintains through an Internet protocol.”

This trend has started to impact consumer E-Commerce purchasing habits, as consumers tell surveys that they are much more comfortable buying from larger E-Commerce because they feel safer doing so. The dream of every large retail marketing exec?who initially feared those young startups undercutting their price?is being realized.

Not that the feds aren’t doing as good a job as could be expected against cybercrime, with a recent major Secret Service probe a good example of the kinds of techniques today’s law enforcement agent is using.

Much of the problem, though, resides with software vendors pushing POS options for smaller retailers. Greg Buzek, president of the IHL Consulting Group, estimates that there are some 2,000 POS vendors pushing products for the small-retail market, which is a dramatically larger number than service the world’s largest retail chains’ POS needs.

In Buzek’s opinion, the biggest cause of the security weakness for smaller retailers is that much of it “is bad software.”

Another belief is that smaller retailers do not always rigidly abide by accepted security rules, such as the PCI rules forbidding the retention of key credit card information. Many retailers disobey that rule so that they can more easily handle product returns, where the customer will want the credit applied to the credit card that was used, he said.

But many smaller retailers also don’t fully understand what their POS software can and cannot do, which is what the cyberthieves are counting on.

Another suspect in the “who’s at fault” game are security auditors and consultants who tell smaller sites?after an audit?that they’re safe when they’re not.

Buzek and Litan discussed the small retailer security situation with analysts from Forrester, the Lakewest Group and the Retail Systems Alert Group this week during StorefrontBacktalk’s Week In Review audiocast. To listen to the small retail security discussion, please click here.


Comments are closed.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.