Monroe County Sheriff’s Office Hot on the Case…
photo credit: FreeImages.com/Lotus Head
Catherine Sessler never expected the call she received from her bank regarding hers and her husband Steve’s credit cards.
They were the latest victims of credit card fraud.
“We didn’t do anything out of the ordinary,” said Sessler, a civil servant at the Monroe County Sheriff ’s Office. “Our bank (Pittsford Federal Credit Union) called us when our cards were charged in another state. Our bank denied the charges and put a freeze on my account. My other card was charged in Albany. I noticed that one when I logged on to check my account because I knew I had used that card in town and by that time, several of my friends from town had been notified by their banks of the fraudulent charges. Steve and I began to realize it was a widespread problem so I called to report it. Though our bank caught it right away, I wanted the police to be aware and begin an investigation.”
One common place that all the victims had been to was Flaherty’s Three Flags Inn in Honeoye Falls. Flaherty’s has been working with the Monroe County Sheriff ’s Office on the matter and put the following statement out on Facebook April 9.
To our loyal customers… In regards to Flaherty’s Honeoye Falls…
It has been brought to our attention that several of our customers have had unauthorized purchases on their Credit Card accounts. I was told late Thursday of two customers that thought their accounts had been compromised. By Friday evening we had been alerted to several others.
If you have recently dined at Flaherty’s Honeoye Falls, please look over your bank statement to insure your account has not been compromised. Flaherty’s has not been notified of any breaches of security to their merchant processing accounts by bank authorities but do respect our community members and would like to make you aware of an issue.
Friday morning I contacted the IT company we use. Initially, I thought that a piece of malware that was found on our computer could have been the problem. However, when I contacted our credit card processor, Merchant Link, they assured us that the processing system we use is the most secure system available. It is Point-to-Point encryption. This means that when we swipe a credit card, it is instantly given a Token or Tokenized– the credit card numbers are never present on our computer or point of sale units. And that no malware could compromise the credit card numbers because the credit card numbers are not stored anywhere on our systems.
That said we do not know how this has happened. We have contacted the Monroe County Sheriff ’s Department and are working with detective Eric Mezzopreti. His office phone number is 753-4466. Please feel free to contact him with details concerning the compromise of your card.
We will be posting information as we get it here on Facebook and through our website and Flaherty’s newsletter as well as information at our restaurant. We truly apologize for this occurrence and we want you to know that we are working to make sure this does not happen again.
Yours truly
Tim and Terry Flaherty
Other businesses in town have also been talked about on social media as a possible source of the breach, although some as of press time had not been contacted by the Sheriff ’s Office.
The case highlights the need for greater security measures for credit cards. “This issue brings to light the need for implementation of Pin & Chip technology at a faster rate than what the consumer is currently experiencing,” stated Deric West, owner of Honeoye Falls Market Place. “HFMP purchased state of the art pin pads last fall which are fully PPI compliant implementing unique point to point encryption giving each transaction a unique signature completely shielding credit card numbers from being viewed or used in a fraudulent manner. Our terminals are also equipped with tamper technology that shuts them down and displays an error message if they are opened or tampered with. In addition to the transaction encryption, and security features of the pin pads, HFMP is a member of the connected payments network, which is a unique environment resulting in HFMP never storing any credit card data locally on our servers.”
West said that the investigator handling the case in Honeoye Falls has not currently contacted HFMP, but that the business will work diligently with any agency investigating this matter.
“We approach our customers’ credit cards with an abundance of caution and make continual investments in technology to stay at the forefront of data security thus significantly eliminating opportunities for data breaches,” West said. “While this issue is mired in technical jargon, at the end of the day we have a secure system our customers can be confident in. I would encourage any one with concerns to contact myself or a member of our management team and we will be happy to have a more specific conversation.”
The Monroe County Sheriff ’s Office could not provide a specific number of victims.
“We are currently collecting information and we are looking at all avenues, including the possibility of malware,” said Monroe County Sheriff ’s spokesman Corporal John Helfer by phone on Tuesday, April 12.
The pin and chip (PPI) technology refers to the level of encryption on the pin pads which totally encrypt the transaction the second it happens. Retailers who own their own switch or interface with the credit card companies allow the customer to insert the card in the bottom reader versus swiping on the top reader. Target, Walmart, Home Depot etc. are using the Chip portion of the card readers. This brings some security for cards that have an altered mag stripe but the PIN will really limit the fraud. PIN has not been implemented as of yet.
The issue with pin and chip centers around the fact that retailers such as HFMP have made all the required equipment upgrades to take pin and chip versus the swipe but in contrast the conduit software processors or switch between the retailer and VISA, Master Card, etc. are not ready form a software standpoint and regulatory agencies and lawmakers keep wrangling over a date to implement the PIN portion of the new system which the majority of the security against fraud lies.
NCR is creating a task force to help fast track this process. The delay in using the pin and chip technology is nationwide. Sources say even places such as Wegmans are still using the swipe technology.
