Visa And MasterCard Not Obliged To Notify Customers Following Security Breach

by Glen Shapiro, LawAndTax-News.com, New York

27 September 2005

Ruling on Friday in California, San Francisco Superior Court Judge Richard Kramer stated that, in his opinion, credit card providers Visa and MasterCard were not obliged to notify cardholders of a security breach which exposed hundreds of thousands of them to possible fraud.

The security breach began last year at CardSystems Solutions Inc., a payment processing firm which deals with both Visa and MasterCard accounts.

Around 40 million accountholders were exposed to potential abuse, with the information gathered by the unknown hacker sufficient in 264,000 cases to allow significant fraud to take place.

In a consumer lawsuit, it was argued that the two credit card providers should have notified the potentially affected cardholders individually.

However, they responded by stating that they do not have direct relationships with the accountholders, and any notification should be the job of the banks which issued the cards. Visa and MasterCard additionally argued that the press release issued in June of this year on the matter satisfied their disclosure obligations.

Speaking last week, Judge Kramer sided with the credit card organisations' further assertion that their "zero liability" policy for customers in cases of fraudulent activity meant that there was little actual risk being faced by the cardholders, stating that:

"I don't see the emergency. I don't think there is an immediate threat of irreparable injury."

Recommended