View PDF of this issue - The Green Sheet

59
News
MasterCard, said, "We don't comment on pricing. If and
when our pricing has a material impact on our financials,
we will disclose this impact in the ordinary course."
FACTA flags
identity fraud
Two amendments to the Fair and Accurate Credit
Transactions Act (FACTA) went into effect Jan.
1, 2008. They require bankcard issuers to establish
guidelines that red flag and deter potential
instances of identity theft.
Section 114 of FACTA deals with procedures for card issuers
when they receive a request for a change of address
on an existing account and said request is soon followed
by another request for an additional or replacement credit
or debit card.
Section 315 outlines the policy for financial institutions
and consumer reporting agencies when the address on a
consumer's new account application is not the same as the
one listed on a consumer report.
Unlike the Payment Card Industry Data Security Standard,
which attempts to stop private customer data from being
stolen in the first place, these two FACTA amendments
endeavor to flag possible instances when data thieves try
to use the data.
to the more expensive operation of manually screening
address mismatches, which ID Insight said costs financial
institutions $31 per application.
According to the Federal Trade Commission, nearly 10
million U.S. citizens are victims of identity theft annually,
making for a $50 billion drain on the economy. The FTC
claims 15,000 to 20,000 consumers contact it every week
with concerns about identity fraud.
In 2006 testimony to the FTC, card issuers
criticized the proposed FACTA rules, arguing the
new guidelines would be labor-intensive and costly.
Visa Inc. testimony also stated that financial institutions
had already set up broad and effective systems for discovering
instances of identity fraud. Other organizations
have contended the FACTA rules would straightjacket the
card issuers' efforts to uncover identity theft.
Before FACTA was signed into law in 2003, financial institutions
relied on two sets of federal guidelines to combat
identity theft: the Customer Identification Program rule
(CIP) in the USA Patriot Act of 2001 and the information
security guidelines of the 1999 Gramm-Leach-Bliley Act
(GLB). But CIP was meant as a counter-terrorism measure,
and GLB has not reportedly stemmed the flow of data
security breaches.
According to identity theft solution provider ID Insight
Inc., the critical action in an identity theft scenario is when
access to an account is diverted from the intended victim
to the thief.
The victim's address is the most vulnerable access point.
The address is also the most likely piece of consumer
information to change over time, potentially preventing
discovery of the theft.
Expensive scrutiny
The dilemma for card issuers deciding how closely to
scrutinize card applications has concerned the cost in
time and money associated with checking and verifying
addresses on each application.
It is estimated that up to 17% of Americans move every
year. Card issuers therefore assume the majority of
address discrepancies on new card applications are the
result of individuals moving from one place to another.
ID Insight calculated that 1% or less of mismatched
address occurrences are the result of identity theft.
This proportionally small number of fraudulent address
mismatches goes undiscovered until it's too late. And
issuers see this as the price of doing business, as opposed