News

Wachovia reissues cards 3 months after Visa alert

Wachovia Corp. announced last month that it reissued debit cards to customers it thought could have been compromised by another processor.

August 7, 2006

This article originally appeared inThe Green SheetJuly 10, 2006.

The recent news that Wachovia Corp. reissued debit cards the week of June 12 to an unspecified number of customers has caused some concern that a new breach of PIN data had occurred.

Acting on a February alert from Visa USA, the bank has only now decided to reissue cards, said Wachovia's manager for retail banking communications, Mary Beth Navarro.

"We marked all the cards that Visa indicates were affected and we've been monitoring them," she said. "More recently, we began to see what we believe was fraud activity and we took immediate action with those customers."

Wachovia also reissued cards to all the accounts identified as possibly compromised, Navarro said. She would not estimate the number of new cards issued.

An undated statement released by Visa said the compromise occurred at an independent, United States-based ATM processor.

"It's important that every entity that handles payment-card information adhere to the highest data-protection standards such as the Payment Card Industry standard to protect the security and privacy of their customers," the Visa release stated.

Visa did not name the processor and would not be interviewed for The Green Sheet story.

"The information we have is based on what Visa told us," Navarro said. "We process our own ATM transactions. We believe our customers were impacted when they used an ATM that used this processor."

Other banks alerted by Visa reissued cards in the first quarter of the year. They may have been responding to breaches not associated with the ATM processor.

Fears for the system

The industry has been concerned about this data compromise, as well as one that is reported to have occurred at a retail chain at around the same time largely because the card associations have been so tight-lipped on the subject. (Read also, System leak compromises debit cards.)

"The two incidents were making people sit up and take notice," said Stuart Taylor, an independent consultant and former VeriFone executive.

In the retail breach, "the fear is that the cryptography has actually been hacked," Taylor said. "If (the encryption keys) have been hacked, that is fairly bad news for the payment-systems as a whole. From a cryptographic standpoint, it shouldn't be possible to retrieve the PINs. Is it really cryptography that's being broken, or is it failure to comply with standards and a matter of human failure? It seems that it has to be a combination of human error and failure to comply with association standards."

MasterCard International did not respond to requests for information.