Banking Law

Some articles of interest for those of us with nothing better to do:

CIO Asia has a one year look back at the TJX breach that we've discussed (most recently here) and finds some interesting lessons. One of them is that data breaches can be incredibly costly. Who knew? TJX has spent or set aside $250 million in 12 months. On the other hand, sales are up. According to one expert, customers know they aren't going to be left holding the bag for fraudulent credit card charges, so they're continuing to shop at the company's stores.

Another lesson learned is the divide between retailers and credit card issuing banks that's become more pronounced since the security breach was announced.

The TJX breach exposed a fundamental rift, with banks and credit card companies on one side and merchants on the other. In several states, credit unions and smaller banks have lobbied the legislatures to pass new laws requiring retailers to reimburse them for the costs involved in notifying customers of breaches and reissuing cards.

But the lobbying attempts failed everywhere except in Minnesota, which last May approved the Plastic Card Security Act -- a law that holds breached entities financially responsible if they were storing prohibited card data on their systems.

In fighting the state bills, retailers have argued that the commissions they pay to card companies on each transaction are supposed to cover fraud-related costs, making any additional payments a double penalty. They also said that the only reason they store payment card data is because they're required to by the credit card companies. In October, the National Retail Federation (NRF) asked Visa and the other card companies to drop that requirement.

The NRF's request is echoed by Litan, who long has argued for fundamental changes in the card industry's payment process, via the introduction of measures such as one-time passwords and all PIN-based transactions.

I'd add that banks haven't given up on state laws that hold retailers responsible. New laws have been proposed in Michigan and Washington.

The final lesson learned by CIO Asia is that the data hackers aren't easy to catch. They're still on the loose.

At Re: The Auditors, Francine McKenna takes a look at the massive trading losses absorbed by Societe Generale and the decision of a special committee of its board of directors to bring in "independent auditors" PriceWaterhouseCoopers to assist in looking at the causes of the loss and its extent. Francine convincingly argues that not only is PWC not truly "independent," but that none of the Big 4 could be "really independent."

After all the bleating by regulators to banks about the critical use of multifactor authentication, one of the most surprising aspects of that fiasco was that the rogue trader was able to engage in his trading activities in part because he and others who had responsibility to approve his trades had access to the system through only one factor authentication, name and password. The young man purloined the passwords of the others involved in the trading process. Not state of the art authentication, exactly, was it?

Finally, the wild tale of Richard Davet, who fought foreclosure, much of the time pro se, for 11 years until finally getting the boot, is not dead. A couple of weeks ago the  US Court of Appeals for the Sixth Circuit denied his motion for a rehearing of its  previous ruling that upheld the district court's dismissal of his complaint. Undaunted, he vows to appeal to the US Supreme Court. As is every deadbeat's right.