Data thefts in Carson City raise caution for merchants

Skimmers struck in Carson City last month, stealing credit card numbers of restaurant and gas station customers. The stolen account numbers typically are sold to overseas and domestic ID theft markets, law enforcement officials say.

A data security expert cautions that business owners can be held responsible and face fines for breeches of customers' information.

The skimmers operated at an Asian restaurant that contracts with employment agencies in Southern California whenever they need a waiter, says Bob Motamenpour, detective with the Carson City Sheriff's Department.

"These are all crooks who come here. They work as waiters for days or weeks and record credit card numbers on a Palm reader," the detective says.

Also implicated was the operator of two gas stations along Highway 395.

"We've had a huge, huge number of complaints. We've talked to the former owner and the present owner," he says.

The detective's advice to motorists: "Don't leave your credit card number on the counter while out at the pump."

A similar data theft was reported at one of the stations two years ago.

"They got the credit card of a local contractor, had two copies made, and went through a $76,000 balance," Motamenpour says. "A local bank took the loss, because they did not have the safeguards in place to detect the fraud."

The Carson City police department invites area merchants to biannual seminars on financial fraud, and usually attracts about 150 at a time.

But it's tough to catch credit card crooks. Many times the merchant bank issuing the credit card feels the incident cannot be investigated. Or store managements are unable to provide the names of employees who were working when a data theft occurred, Motamenpour says.

But management should know that, says Ira Victor, director of compliance practice at Data Clone Labs of Reno. It means the business didn't follow security procedures.

"When an owner says, 'We don't know which employees did this,' it means employees are using a shared password; that's bad security," Victor says.

It's important to link each employee with each transaction, he says, because 70 percent of all security attacks originate within the organization.

The payment card industry mandates that businesses protect credit card information. If they don't, merchants can be made responsible for the loss, their merchant account rates can go up and they can face penalties up to $500,000 or cancellation of their merchant accounts.

"Local merchants need to know they are responsible for data breeches," says Victor. "You're signing an agreement with a merchant bank. In signing the contract, the merchant has in essence already agreed to pay a fine."

Credit-card fraud is tough to track on the other end because nine out of 10 fraudulent transactions are done in a foreign country: China, Russia or the Caribbean. So the bank often will simply reimburse the merchant.

If a business swipes a card, the customer signs and signature matches that on the card, then the merchant is not held responsible, notes Linda Grimm, senior vice president director of operations at Humboldt Merchant Services, an affiliate of First National Bank of Nevada.

Phone and Internet orders are open to more risk. When someone calls in a large order and asks that it be shipped to Timbuktu, merchants should take that as a warning, she says.

But instead, merchants tend to get excited about the large order and ship it to Timbuktu. That's when the merchant who accepts the fraudulent numbers may have to eat the cost.

"The last several years have seen an unprecedented assault on personal and financial data that customers have entrusted to retailers, banks, service providers and credit card companies," says Victor.

The Payment Card Industry Security Data Standard establishes practices for processing, storing and transmitting credit card data. Additionally, new privacy laws from the state that complement these mandates.

Yet, some businesses remain unaware.

"We do presentations throughout the year," says Chuck Lovitt, a sergeant in the financial crimes unit at the Reno Police Department.

Yet despite the surge of tourists constantly passing through town, he says, "Reno is no more susceptible than anywhere else. These crews run in and out."