1/5

posted Mar-13-2008
I was going to source a Panel PC from acnodes.com, so I grabbed our bookkeeper's card info - the one used for all our major purchases and recurring payments.
Made the order - no problem.
Now, what's the first thing you do when you order something online and receive a confirmation email with an order tracking link? You click the link to see that it looks normal.
I did - and it looked normal, except there was our cc number, exp date, cvn, billing address....
None of it obfuscated.
And I wasn't prompted for a password either.
With a sick feeling, I decremented the order number on the address line of my browser and saw someone else's order - with their payment information, including cc number, exp date, cvn, billing address....
So we canceled the card immediately, and then spent the rest of the day trying to get someone to give a damn.
Called Acnodes and their response was that they didn't write the code - it was outsourced.
To their surprise, I found their answer less than satisfying, and they couldn't understand why I wanted the site shut down immediately.
You'd think Visa would have some sort of security breach hotline?
Not one that you can find on their site.
Tried the bank - no one there had any kind of hotline number - but they referred me to the FBI's cyber crime division. Of course, simple incompetence isn't a crime, so they referred me to the FTC....
Mind you, all this time I'm browsing through orders in amazement at how long this has gone on.
Stomping my foot in frustration and swearing under (and over) my breath.
There were orders going back at least 4 months, all completely exposed .
I finally googled for an internal number for Visa fraud reporting.
I called them, then emailed them and the site's web host the details, and it was down about 15 minutes later.
It's a damned good thing that I'm a reasonably honest person. That particular site sells only big ticket items. The $1000+ purchase I was making was on the low end of what they sell, so most of the cards I was seeing were Platinum corporate cards - the kind that get paid by someone other than the person making the purchases - the kind that someone carding merchandise would swoon over.
I did email a few of the folks whose cards were exposed. Of the five I emailed, only one even bothered to email back a Thank You.