8m caught in US credit card fraud

A computer hacker has gained access to the credit card details of more than 8m Mastercard, Visa, American Express and Discover holders in the US, sparking fears of fraud on a potentially massive scale.

The companies yesterday said the hacker had accessed the systems of an undisclosed third party company which processes retailers' payments.

The companies involved said they had immediately informed the issuing banks after the problem was first detected, two weeks ago.

"This is not something regional, it was throughout the nation and could be any bank," said Visa spokesman John Abrams.

They are working with US law enforcement officials to track down the culprit and discover how he or she managed to crack the system's security.

Identity theft and credit card fraud have become an increasing concern among consumers, particularly with the number of transactions taking place online.

But it is more common, as in this case, for fraudsters to attack host computers where credit card details are held on file by retailers rather than to access to them while the payments are being made over the internet. None of the information in this hacking, which would include the credit card numbers, appears to have been used fraudulently so far.

Around 2m Mastercard holders are affected and some 3.4m holders of Visa cards. The other two declined to give figures, but Mastercard admitted the total was 8m. Discover is a unit of the Morgan Stanley banking group.

Plastic card fraud is booming in Britain - it has grown by 50% in the past two years to £430m. As well as hacking into computer databases, common scams include copying card details when purchases are made, stealing cards in the post, or registering charges twice for items.

There are more than 560m Visa and Mastercards in circulation in the US alone.

Visa said: "High profile companies, government agencies, internet programs and websites will always be targeted by criminals. Visa and our vendors are no exception." But it tried to reassure customers: "Visa's fraud team immediately notified all affected card-issuing institutions and is working with the third-party payment processor to protect against the threat of a future intrusion."

The firms affected said customers would not be liable for charges as a result of the fraud.