NCB pulls credit cards after breach

Steven Jackson, Business Reporter

National Commercial Bank Jamaica Ltd (NCB) will replace its Visa and MasterCards in other to protect customers from possible fraud arising from the breach at a processing centre operated by a third party.

It's the same breach that affected the third-party processing of select CIBC FirstCaribbean Bank cardholders, according to NCB officials.

"A general advisory was received from Visa and MasterCard notifying a compromise of card data which took place at a processing centre within the LAC region (outside of Jamaica). This compromise posed a potential risk/impact for many banks within this region," said NCB through its communications office in response to Sunday Business queries.

"As a precautionary measure to protect our customers and the integrity of our cards payment system, we therefore made the decision to replace all cards impacted (Visa and MasterCard) and have been directly managing our card relations in this regard since February."

NCB said customers will not be charged for new cards. When questioned explicitly whether all cardholders would receive new cards, the bank clarified separately: "We took the decision to replace all cards impacted. It is purposely vague."

The number of affected cardholders is unknown. The bank offers NCB Visa Classic, NCB Visa Gold, NCB Visa Signature, NCB Visa Business, NCB MasterCard and NCB Travelmaster credit cards. The replacement will not affect its KeyCard holders, which is the bank's proprietary card.

Visa said it does not as a matter of policy comment on what it called "compromise incidents".

"Visa works with the breached entity and their financial institution to provide card issuers with the compromised accounts so the issuers can take steps to protect consumers through independent fraud monitoring and, if needed, reissuing cards," said the corporate relations rep for Visa Latin America and Caribbean office, Militza Gonzalez, via email to Sunday Business.

"As a result of many factors, including Visa's advanced fraud-monitoring capabilities, the incidence of fraud involving compromised accounts is actually rare, and fraud rates remain near historic lows."

MasterCard did not acknowledge requests for comment.

NCB said its cardholders will receive verbal or written notification on steps to receive a replacement card. The precise origin or scope of the breach remains unknown.

"It happened and it is being managed by Visa, MasterCard and our customer service department," said a bank representative.

In February, CIBC FirstCaribbean also alerted customers that client records were potentially accessed by outsiders which resulted in the bank issuing a notice to cardholders. The bank advised cardholders to monitor card activity, and said high-risk cardholders would receive new cards.

Nigel Holness, the head of CIBC FirstCaribbean Jamaica, was said to be on vacation and unavailable for comment, when Sunday Business sought an update.

Calls and messages to the foreign credit card companies for comment on the breach were unanswered.

Bruce Bowen, president of Scotiabank Jamaica, said his bank's cards are unaffected.

"I would have been aware of such a matter within 24 to 48 hour and I have not heard of a breach on our cards," said Bowen on Thursday. "Most banks usually share information when something like that happens and we haven't heard of anything like that. And there has not been a breach at Scotia."

Central bank data on credit card receivables at commercial banks — which is used as a proxy for the market — was last reported in September 2012 at J$23.13 billion.

The banks do not directly disclose the value of their individual credit-card portfolios, but Scotia Group last reported its combined personal loan and credit-card portfolio at J$51.45 billion, and separately estimated its share of the market at just over 40 per cent; while NCB group disclosed a personal-loan portfolio of J$51.41 billion, as at September 2012.

NCB and Scotia are the top-two players in the market of seven banks.

steven.jackson@gleanerjm.com