Log In

Reset Password

Banks to tighten-up credit card security

Bank of Bermuda and Butterfield Bank are moving to make credit card transactions more secure with the introduction of equipment and software that will limit the display of credit card account numbers on receipts.

Currently, a range of local venues from restaurants to jewellers to grocers print the customer name as well as full account numbers and the card expiration date on receipts. Losing such a receipt can be just as hazardous to financial health as losing a credit card as it contains enough information to go on a shopping spree.

A spokeswoman for the Department of Consumer Affairs told the department's board was concerned enough about the security issue to meet with both the Bank of Bermuda and Butterfield Bank. However she said, the department itself had received no complaints about credit card security.

Fear that identity thieves can thrive on discarded receipts and documents containing consumers' information is a worldwide concern. While American states such as California and Washington have enacted laws to ensure merchants truncate card numbers, the card associations themselves are also pursuing the same mandate. Visa and Mastercard are requiring that all receipts issued in the United States suppress this information by next April. The European deadline is July, 2006. While Mastercard International has mandated that all new equipment landing in Bermuda must truncate card numbers by April next year, Visa International will not insist upon local merchants truncating account numbers until April, 2007.

Wayne Pimentel, manager of the card processing centre at Bank of Bermuda told his bank has already acted on the security issue and aims to see all of its merchants truncating credit card numbers by the earlier deadline.

"April, 2005 is the date that any new equipment has to suppress data. April, 2007 is the date all equipment has to suppress data so what we have done is shoot for April, 2005 because we were in the process of upgrading our equipment in the field anyway, so as we do that we have been taking steps to do (card truncation)."

Mr. Pimentel said that while the Bank's merchant terminals have already been programmed to truncate the card numbers, some of the bank's merchants who own their own equipment or software have not yet made the required changes.

"We are working with them and anticipate that they will be fully compliant by the April 2005 deadline" he said, adding that in many cases the change can be made through a simple software upgrade that they can download to their terminal. Older terminals may however have to be replaced.

Susan Mylchreest, head of electronic banking at Butterfield Bank said that her bank has also been working to suppress all but the last four digits of the cardholder account number and the entire expiration date (PAN truncation).

"This required a significant amount of work and resources. We are happy to state, however that testing is near completion and we are hoping to begin piloting to our merchants in the next few months."

She added: "Butterfield Bank decided that it was in the best interest of its cardholders to introduce PAN truncation and so began to work ahead of any actual mandate. "Safeguarding our customers from potential card fraud requires constant vigilance and is an on-going effort. We will continue to scrutinise our services and work to make them as safe as we can."

While Capital G does not participate in the credit card acquiring market and has no control over how merchants process transaction, the bank's senior vice president and head of card services Jorge Diago told that Capital G ? like the other banks ? already truncates card numbers printed at their automated teller machines.

"We are working closely with the card associations in order to make sure that the business in Bermuda is in compliance with their rules and regulations so from our perspective to protect our card holders we are constantly talking to them and letting them know to protect their card numbers at all times."

Mr. Pimentel says that if a customer does see their full card details on a credit card receipt they should take the same approach they always have and "not leave receipts lying around.

"Secure them or destroy them, which again is a common sense approach they have always followed," he said.