4 ms·

The real losers when this happens are the small businesses and nonprofits with recurring payments that have to contact their customers and ask them to reenter t

The real losers when this happens are the small businesses and nonprofits with recurring payments that have to contact their customers and ask them to reenter their new credit cards after they are replaced. Even in the best case, they're probably out a months revenue which can make or break a company.

deleted 12y ago
[deleted]
pantaloons 12y ago
If reminding customers that they are actually making recurring payments to a company causes that company to go out of business, I don't think we need to shed any tears.
- noir_lord 12y ago
  I think he meant that a sudden huge drop in recurring revenue out the blue can sink a small business while it's getting established. I could see that.
- pcarolan 12y ago
  I meant what noir_lord said. Ira Glass' monthly donation to NPR got cancelled when Target breached, for example. You can probably back date such things, but a lot of people don't.
- chc 12y ago
  You mean "If requiring customers to go through the trouble of re-submitting all their payment information…", surely. Because what we're talking about here, not merely reminding them that they are paying.
taeric 12y ago
It is actually worse than that, isn't it? By law, only individuals are protected against fraud. If any small business account is compromised, they don't have that protection. Or am I just off in my understanding of fraud protection?
- staunch 12y ago
  Small businesses get screwed all the time by fraudulent chargebacks: http://en.wikipedia.org/wiki/Chargeback http://en.wikipedia.org/wiki/Chargeback
  - jn1234 12y ago
    I'm pretty sure taeric is talking small business credit cards having chargeback. They have almost identical, including the same protections, as a credit card held by an individual.
    - taeric 12y ago
      Do they? Unless things have changed, it was at least reported[1] that they do not have the same legal protections. They may have the same protections from the bank. But not by law. [1] https://www.schneier.com/blog/archives/2009/08/small_business.html https://www.schneier.com/blog/archives/2009/08/small_busines...
joe_the_user 12y ago
The article doesn't say anything about credit card numbers being taken. It seems to imply just email address, phone number and physical address was taken. That kind of information is nearly public (not that it's OK but it seems a lot less damaging). If more was, it would be good know.
- panarky 12y ago
  The SEC filing states[1]: User contact information – name, address, phone number and email address – and internal JPMorgan Chase information relating to such users have been compromised. I have multiple personal and business accounts at Chase, and they collect a shitload of other "internal information", way beyond name, address, phone and email. Ostensibly for KYC [2] they try to collect personal information about the other members of my company, non-public information about my company's revenues and customers, my work and professional history, business plans and projections, my kids' college plans, real estate holdings, interests in other businesses, etc., etc., etc. They're very pushy about gathering this information, claiming it's for regulatory compliance. I'm sure it's mostly for their own attempts to hawk their lame financial products. So that category of "information relating to such users" could be ginormous. [1] http://investor.shareholder.com/jpmorganchase/secfiling.cfm?filingID=1193125-14-362173 http://investor.shareholder.com/jpmorganchase/secfiling.cfm?... [2] http://en.wikipedia.org/wiki/Know_your_customer http://en.wikipedia.org/wiki/Know_your_customer
  - the_rosentotter 12y ago
    It's probably even worse than that. I've worked on bank systems. They collect all the things you mention, but also details of your personal finances, where you usually receive money from and how you spend it, guesstimates about your financial situation, 'suspicious' activity, details from every conversation you've ever had with a bank rep, and more.
- joelhaus 12y ago
  It's legit. Actually had a fraudulent charge on my Chase card today from a jail phone operator in a southern state. Only have a couple of recurring bills with the card and don't generally use it at stores, so I'm pretty confident that it was due to the breach at Chase. My biggest concern is someone using the other information they stole to open accounts under my name.

deleted 12y ago

[deleted]

pantaloons 12y ago

If reminding customers that they are actually making recurring payments to a company causes that company to go out of business, I don't think we need to shed any tears.

noir_lord 12y ago
I think he meant that a sudden huge drop in recurring revenue out the blue can sink a small business while it's getting established. I could see that.
pcarolan 12y ago
I meant what noir_lord said. Ira Glass' monthly donation to NPR got cancelled when Target breached, for example. You can probably back date such things, but a lot of people don't.
chc 12y ago
You mean "If requiring customers to go through the trouble of re-submitting all their payment information…", surely. Because what we're talking about here, not merely reminding them that they are paying.

taeric 12y ago

It is actually worse than that, isn't it? By law, only individuals are protected against fraud. If any small business account is compromised, they don't have that protection. Or am I just off in my understanding of fraud protection?

staunch 12y ago
Small businesses get screwed all the time by fraudulent chargebacks: http://en.wikipedia.org/wiki/Chargeback http://en.wikipedia.org/wiki/Chargeback
- jn1234 12y ago
  I'm pretty sure taeric is talking small business credit cards having chargeback. They have almost identical, including the same protections, as a credit card held by an individual.
  - taeric 12y ago
    Do they? Unless things have changed, it was at least reported[1] that they do not have the same legal protections. They may have the same protections from the bank. But not by law. [1] https://www.schneier.com/blog/archives/2009/08/small_business.html https://www.schneier.com/blog/archives/2009/08/small_busines...

joe_the_user 12y ago

The article doesn't say anything about credit card numbers being taken. It seems to imply just email address, phone number and physical address was taken. That kind of information is nearly public (not that it's OK but it seems a lot less damaging). If more was, it would be good know.

panarky 12y ago
The SEC filing states[1]: User contact information – name, address, phone number and email address – and internal JPMorgan Chase information relating to such users have been compromised. I have multiple personal and business accounts at Chase, and they collect a shitload of other "internal information", way beyond name, address, phone and email. Ostensibly for KYC [2] they try to collect personal information about the other members of my company, non-public information about my company's revenues and customers, my work and professional history, business plans and projections, my kids' college plans, real estate holdings, interests in other businesses, etc., etc., etc. They're very pushy about gathering this information, claiming it's for regulatory compliance. I'm sure it's mostly for their own attempts to hawk their lame financial products. So that category of "information relating to such users" could be ginormous. [1] http://investor.shareholder.com/jpmorganchase/secfiling.cfm?filingID=1193125-14-362173 http://investor.shareholder.com/jpmorganchase/secfiling.cfm?... [2] http://en.wikipedia.org/wiki/Know_your_customer http://en.wikipedia.org/wiki/Know_your_customer
- the_rosentotter 12y ago
  It's probably even worse than that. I've worked on bank systems. They collect all the things you mention, but also details of your personal finances, where you usually receive money from and how you spend it, guesstimates about your financial situation, 'suspicious' activity, details from every conversation you've ever had with a bank rep, and more.
joelhaus 12y ago
It's legit. Actually had a fraudulent charge on my Chase card today from a jail phone operator in a southern state. Only have a couple of recurring bills with the card and don't generally use it at stores, so I'm pretty confident that it was due to the breach at Chase. My biggest concern is someone using the other information they stole to open accounts under my name.