$300M Credit Card Fraud Case Highlights Role of Regulators and Bitcoin’s Unique Security Advantages

Yesterday, U.S prosecutors charged six foreign nationals with the largest cyber fraud case in U.S. history. The men allegedly orchestrated more than $300 million in credit and debit card thefts by illegally accessing computers at Citigroup, Nasdaq, PNC Financial, Visa Jordan, an additional Visa Inc licensee, Discover, Dow Jones, and retailers including JetBlue, Carrefour, Hannaford Brothers, 7-Eleven, J.C. Penny and more.

The group executed its spree over nearly a decade, even landing one of the members in jail in 2008 on a 20-year prison sentence. The other five members included four Russian nationals and one Ukrainian, all between the ages of 26 and 32. Two were caught in the Netherlands in June 2012, one of which has been extradited to the U.S.; the other three members of the gang remain at large.

The men allegedly used SQL injections to gain access to target servers before downloading mass amounts of data, including more than 160 million credit card numbers and account login info. They then sold that information on internet forums to be used by recipients for illicit transactions.

Counterparty Risk Highlighted

This case highlights the risk many overlook when turning over wealth or personal data to major firms. As illustrated by the names listed above, even the largest firms with immense IT security budgets present risk to their financial counterparties. This is regularly highlighted during bank runs like those in Cyprus earlier this year, but often left unconsidered with the countless additional parties people interact with financially outside of their banking institutions.

It comes as no surprise then that at least some portion of the population, cognizant of these risks, would look to avoid them if possible and find alternative security measures for their accumulated wealth. Bitcoin’s ability to facilitate that level of independence from intermediary parties for wealth storage and transfer has made it the target of regulatory ire, even as cases like this highlight the very reason such an option is needed.

Counterparties Alleviate Personal Responsibility

While the option of acting as one’s own bank may be appealing to some, the benefits of an explicit entity being responsible for issues like malfeasance or security breaches are tangible. When given the option, most people would alleviate themselves of personal liability and instead place it on a person or entity that can be held accountable.

The companies involved in the security breach described likely all have two important procedures in place: customer assurance and cybersecurity insurance. Though the fraudsters may have been responsible for more than $300 million of fraudulent activity, the vast majority of the financial burden of that will rest on the card companies who will reimburse customers to protect their brand. In many cases, that will also mean reversal of transactions that have already occurred, passing financial burden on the merchants who accepted the fraudulent payments. While the direct fraud victims may be reimbursed for their losses, the hit to merchants is ultimately felt by all consumers by way of higher prices to compensate for margins lost to fraud.

The companies listed likely all have cybersecurity insurance as well, meaning they will look to pass on financial losses to their insurers and may be successful in doing so, depending on the circumstances of each case. From a consumer standpoint, these multilevel backstops largely mitigate the counterparty risk described above.

Regulators Play An Important Role

Many entrepreneurs, particularly in the bitcoin space, will argue that the role of regulators is overly burdensome. Yet, cases like this illustrate why a structured and enforceable regulatory environment can have important benefits. As will likely be the case after the situation described above and the recent SEC charges against the operator of the Bitcoin Savings and Trust, regulators’ strict enforcement of the laws discourage potential fraudsters from pursuing the such activity in the future.

While regulations may hinder the number of new companies able to jump the high hurdle of compliance, they also bring confidence to consumers who know that the law is there to protect them against potential cons when possible. That confidence may, in turn, provide significant benefit to regulated industries by broadening the customer base. While there are certainly points to debate about which regulations make sense and which are doing more harm than good, it comes as no surprise that much of the population will show little concern for the plight of the burdened entrepreneur.