Stephen Foley: Calm down – despite the data breaches, there's little actual fraud on the cards

Your support helps us to tell the story

Support Now

Find out moreClose

As your White House correspondent, I ask the tough questions and seek the answers that matter.

Your support enables me to be in the room, pressing for transparency and accountability. Without your contributions, we wouldn't have the resources to challenge those in power.

Your donation makes it possible for us to keep doing this important work, keeping you informed every step of the way to the November election

Andrew Feinberg

White House Correspondent

US Outlook: News of arrests in Spain of people believed to part of the hacker group Anonymous, responsible for attacks on Sony and MasterCard in recent months, comes on the heels of another big data breach here in the US. This time it was Citigroup that said its computers had been compromised, with hackers gaining access to credit card details of 200,000 North American customers. It is having to issue new cards.

Just another day, then, in the great war over our personal data.

The Citigroup breach, the largest direct attack on a US bank, has prompted inevitable calls for financial institutions to tighten security procedures, in the hope of staying one step ahead of the hackers. There has been criticism of banks for failing to invest the necessary money in improved security systems, but to my mind this seems unfair, and misses an important point. For all the security breaches, few have resulted in actual fraud on people's accounts. In the Citigroup case, those three-digit security codes on the back of its customers' cards were stored separately. So were their social security numbers, and the expiry dates of their cards. The likelihood of discovering a fraudulent transaction on a Citigroup card is low.

There have been 288 publicly disclosed breaches of financial services companies' computer systems, according to the Identity Theft Resource Centre, and 83 million customer records compromised. That would suggest that, even if you haven't been a victim, you would be likely to know at least one person who has – yet complaints about discovering dodgy transactions are not a staple of pub conversation.

None of this is to minimise the importance of these breaches, just to say that clearing up after them, by telling customers to reset passwords or issuing new cards, might be the best way to deal with them. Laborious new signing-in procedures are an unnecessary hindrance; in the UK, Barclays' requirement that you use a calculator-like device to generate a log-in code every time you go to its website has removed the whole point of internet banking, namely that you can access your account anywhere.

There are tighter rules needed. Citigroup, like Sony and others before it, ought to have revealed the existence of the security breach sooner than it did, so a code of conduct for communication with customers would be a good start.

But breaches are a fact of life in the modern era. The investment should come in technology to detect break-ins and to track down their anonymous perpetrators. As long as we get as many headlines about hacker arrests as we do about hacker attacks, we should be satisfied.