MasterCard won't disclose who leaked my credit card details
"As indicated in comments, this is common practice in the US as well as EU.  For example, in this Fox Business article, a user had basically the same experience: their card was replaced but without the specific merchant being disclosed.  When the reporter contacted Visa, they were told: ""We also believe that the public interest is best served by quickly notifying financial institutions with the information necessary to protect themselves and their cardholders from fraud losses. Even a slight delay in notification to financial institutions could be costly,” the spokesperson said in an e-mail statement. “Visa works with the breached entity to collect the necessary information and provides payment card issuers with the affected account numbers so they can take steps to protect consumers through independent fraud monitoring, and if needed, reissuing cards. The most critical information needed is the affected accounts, which Visa works to provide as quickly as possible.” What they're not saying, of course, is that it's in Visa's best interests that merchants let Visa know right away when a leak occurs, without having to think about whether it's going to screw that merchant over in the press.  If the merchant has to consider PR, they may not let the networks know in as timely of a fashion - they may at least wait until they've verified the issue in more detail, or even wait until they've found who to pin it on so they don't get blamed. But beyond that, the point is that it's easier for the network (Visa/Mastercard/etc.) to have a system that's just a list of card numbers to submit to the bank for re-issuing; nobody there really cares which merchant was at fault, they just want to re-issue the cards quickly.  Letting you know who's at fault is separate.  There's little reason for the issuing bank to ever know; you should find out from the merchant themselves or from the network (and in my experience, usually the former). Eventually you may well find out - the article suggest that: [T]he situation is common, but there is some good news: consumers do in many cases find out the source of the breach. But of course doesn't go into detail about numbers." I found a german article describing the legal situation in Germany. To summarize As outlined by the many possible reasons in the other answer, it is unclear from the information I have, whether condition 1 holds. Also condition 2 may not hold since the credit card was frozen. I suppose this makes a good argument to MasterCard and my bank, but I also suspect they will not care unless it comes with a attorney letterhead. "Others have already commented on the impact of anything which dissuades merchants from raising possible breaches, so I won't dwell on that. Maybe we need stronger legislation, maybe we don't, but it doesn't change today's answer. Often it works the other way around to what you might expect - rather than the merchant noticing and notifying Visa/MC/others, Visa/MC/others spot patterns of suspicious activity (example 1). I don't have any data on the relative numbers of who is being notified/notifying between merchants and payment processors, but at the point when your card is identified as compromised there's no reason to suppose that an individual merchant in the traditional sense has been compromised, let alone identified. In fact because there's a fast moving investigation it could even be a false alarm that led to your card getting cancelled. Conversely it could be a hugely complex multinational investigation which would be jeopardised. It's simply not safe to assume that simply ""brand X"" has been compromised, therefore everything ""brand X"" knows about you is also compromised: Furthermore there's no reason to assume the merchant has even admitted to, or discovered the root cause. MC/Visa/Banks, at the point at which they're cancelling cards simply can't say (at least not in a way that might expensively backfire involving lots of lawyers) because the standard of proof needed to go on record blaming someone is simply not yet met. So: yes it's common that you aren't told anything for all of the above reasons. And of course if you really want to find out more you may have some success with your local data protection legislation and formally make a subject access request (or local equivalent) to see what that brings back. Be sure to do it in writing, to the official address of both mastercard and your bank." "File a John Doe lawsuit, ""plaintiff to be determined"", and then subpoena the relevant information from Mastercard.  John Doe doesn't countersue, so you're pretty safe doing this.  But it probably won't work.  Mastercard would quash your subpoena.  They will claim that you lack standing to sue anyone because you did not take a loss (which is a fair point).    They are after the people doing the hacking, and the security gaps which make the hacking possible.  And how those gaps arise among businesses just trying to do their best.  It's a hard problem.  And I've done the abuse wars professionally.  OpSec is a big deal.  You simply cannot reveal your methods or even much of your findings, because that will expose too much of your detection method.  The ugly fact is, the bad guys are not that far from winning, and catching them depends on them unwisely using the same known techniques over and over.  When you get a truly novel technique, it costs a fortune in engineering time to unravel what they did and build defenses against it.  If maybe 1% of attacks are this, it is manageable, but if it were 10%, you simply cannot staff an enforcement arm big enough - the trained staff don't exist to hire (unless you steal them from Visa, Amex, etc.)  So as much as you'd like to tell the public, believe me, I'd like to get some credit for what I've done -- they just can't say much or they educate the bad guys, and then have a much tougher problem later.  Sorry!  I know how frustrating it is! The credit card companies hammered out PCI-DSS (Payment Card Industry Data Security Standards).  This is a basic set of security rules and practices which should make hacking unlikely.  Compliance is achievable (not easy), and if you do it, you're off the hook.  That is one way Amy can be entirely not at fault.  Example deleted for length, but as a small business, you just can't be a PCI security expert.  You rely on the commitments of others to do a good job, like your bank and merchant account salesman.  There are so many ways this can go wrong that just aren't your fault.   As to the notion of saying ""it affected Amy's customers but it was Doofus the contractor's fault"", that doesn't work, the Internet lynch mob won't hear the details and will kill Amy's business. Then she's suing Mastercard for false light, a type of defamtion there the facts are true but are framed falsely.   And defamation has much more serious consequences in Europe.  Anyway, even a business not at fault has to pay for a PCI-DSS audit.  A business at fault has lots more problems, at the very least paying $50-90 per customer to replace their cards.  The simple fact is 80% of businesses in this situation go bankrupt at this point.   Usually fraudsters make automated attacks using scripts they got from others.  Only a few dozen attacks (on sites) succeed, and then they use other scripts to intercept payment data, which is all they want. They are cookie cutter scripts, and aren't customized for each site, and can't go after whatever personal data is particular to that site. So in most cases all they get is payment data. It's also likely that primary data, like a cloud drive, photo collection or medical records, are kept in completely separate systems with separate security, unlikely to hack both at once even if the hacker is willing to put lots and lots of engineering effort into it.  Most hackers are script kiddies, able to run scripts others provided but unable to hack on their own.   So it's likely that ""none was leaked"" is the reason they didn't give notification of private information leakage.  Lastly, they can't get what you didn't upload.  Site hacking is a well known phenomenon.  A person who is concerned with privacy is cautious to not put things online that are too risky.  It's also possible that this is blind guesswork on the part of Visa/MC, and they haven't positively identified any particular merchant, but are replacing your cards out of an abundance of caution."
"Your best shot in terms of credit card ""compatibility"" would probably be a very large private European Bank, like Deutsche Bank, HSCB or the like issueing a MasterCard. In England it is quite difficult to get an account without being a resident, but I think HSBC offers a so called ""Passport"" account to non-residents with all the usual cards and benefits, even overdraft, but it's probably expensive.   I think you underestimate how heterogeneous the banking world in Europe is. There are plenty of different local systems in each country. France has it's custom CB system and Germany has a system called GiroPay and a cashless system called GeldKarte (which no one really uses). Even if you have a Mastercard or Visa with pin from a European bank, there is no guarantee that it'll work everywhere reliably. I remember my German housemate having loads of trouble with his amazon.de Mastercard in England. In addition, you will most likely be charged for paying with your CC and ATM/Cashpoint withdrawals in any other country. Fees can range up to 3% for a transaction. So ideally you profile which European country you travel to the most and set up the account there. You should also look for cooperations between certain European banks. I remember Barclays and Deutsche Bank cooperating. On a side note: I'm still amazed by how backwards some banking systems are, e.g. the English. I've been using secure (pin/tan) online-banking in Germany for over 10 years. Transfers are quick, international transfers are free, as long as they are in Euro etc. Everything runs pretty smooth. Not so in England, you need to confirm online transactions over the phone (wtf?) and your only security is a pin and memorable information. Inter-bank transfers, if not set up online, cost up to 30 pounds, even though I could just go to the other bank, draw the cash there and pay it in to the account for free. International transfers start at 20 quid etc.   I could hardly imagine, living in a cheque reliant system like the states anymore." "There is no way to stop any merchant from setting a recurring charge flag on a purchase. According to the following article, Mastercard and Visa encourages merchants to use this feature and even give them a better rate. I have found it impossible to stop these unauthorized transactions.  The article sites that the merchant is allowed to march the charges across expired cards to find a good card that you might have as well as the article states they can cross banks to find you if you have the same type of card. Virtual account numbers will not protect you. Sorry but the only solution I have found is to close the account with the bank and move to a different type of card, mastercard to visa, or vice versa. This will only protect you for one move ,because if you have to do this again. Merchants that you thought were forgotten even years later will find you and post a charge legally. Virtual numbers from Mastercard or Visa won't stop them.   I believe this is the number one reason for credit card fraud for consumers. There is no reason for a merchant to let anyone off the hook when the credit card company will side with them.  The article below does state that Mastercard does have a ""stop recurring payment"" flag.  Apparently no CSR tht I have talked to knows about it when I have asked to get a problem fixed. I have found that the only way to stop these charges from happening is to close all my visa and mastercard credit cards, pay with a check that you write and mail or a PayPal one time payment that is sent to pay for an invoice.   Recurring Credit-Card Charges May Irk Consumers" Jesus this is a horribly written and unnecessarily long article. Could be summed up in 3 paragraphs, and honestly, credit card processing fees isn't some conspiracy. I'd guess that most people who use credit cards are aware this is how visa and MasterCard make money.   This article is written like it's for 14 year olds. Unlike MasterCard and Visa who only provide clearing service and tie up Banks to actually issue cards or POS terminals for merchants; Discover card operates more like American Express. It's a totally different network; cards and POS to merchants are directly offered by Discover Bank only. There is no other banks that issue this card. I work for a hedge fund, not wealth management, but I assume that client information is treated similarly. Misplacing it is a huge deal. The company will probably need to formally investigate it and inform all the clients involved. Even if they can prove that no one looked at the information it's going to make clients question the company's procedures. I could see it being a firing offense,depending on how many clients were affected and the nature of the data. Sorry if that's not what you wanted to hear. "&gt; You mentioned the customer experience randomly in some parts, then threw in Wikileaks in others.  Only random if you don't understand what I'm saying. But I'll just give up instead of repeating again.  &gt; Visa and Mastercard have relationships with banks and/or processors, who have relationships with merchants. […] Cardholders aren't Visa and MC's clients  I still don't understand. Why is the indirect relationship merchant-&gt;processor/bank-&gt;VISA so much stronger than cardholder-&gt;bank-&gt;VISA? Presumably VISA also tell banks not to allow *hardholders* to do illegal stuff with their cards?  &gt;&gt; The WikiLeaks blockade was clearly political. What makes you say otherwise? And this is political.  &gt; So your argument is that anything political is the same as anything else political?  No, it's that the wikileaks thing was clearly political, and trying to say ""that's not relevant because it was a legal matter"" doesn't make sense since everything after ""because"" was wrong.  &gt; As long as their reasons for doing so aren't discriminatory based on status in a protected class, they are (and should be) allowed to refuse service.  I'm not saying they're legally in the wrong." I can't address the psychology of trust involved in your question, but here are some common sense guidelines for dealing with your issue. Make sure you know who you are talking to.  Call the company you need to speak to via a publicly available phone number. An email or something you got in a letter might be from a different source.  If you use a website, you should be sure you are on the correct website. Keep careful records.  Make good notes of each phone call and keep all emails and letters forever. Note the time, name and/or ID of the person you spoke to and numbers called in addition to keeping notes on what actions should be done.  Keep your faxing transmission receipts and shipping tracking numbers too. If you are nervous, ask them why they want the info.  The fraud department should be able to explain it to you.  For example, they probably want your social because that is how your credit report is identified.  If they are going to fix a credit report, they will need a social.  It is doubtful they would have a good explanation why they need your mother's maiden name. Ask for secure transmission, or confirm they have it.  Postal mail isn't so secure, but I'll go out on a limb and say most fax machines today are not really fax machines, but software that deals in PDFs.  At some point you will have to realize you will have to transmit something.  No method is perfect, but you can limit your exposure. Help them do their jobs.  If you are (understandably) nervous, consider their motivations: corporate profit.  BUT that could very well mean not running afoul of the law and (with any luck) treating customers the best way they know to earn business.  If you stymy the fraud department, how can they help you? If the ID theft was serious enough, document your issue for future law enforcement so you getting pulled over for speeding doesn't result in you going to jail for whatever crime the other person did.  Perhaps the fraud department you are dealing with can assist there. Finally, while you work with fraud departments to clear up your name and account, work on the other end to limit future damage.  Freeze your credit.  See if you bank or credit card have monitoring.  Use CreditKarma.com or a similar if you cannot find a free service.  (Please don't ever pay for credit monitoring.) "Concealing parts of a document in order to obtain a signature is illegal. The company committed signature forgery because they effectively modified the document after you signed it (i.e. unfolded the parts that were previously folded). I suggest that you go to your local police department to file a report, citing ""signature forgery"". Once you have the police report, call your bank's fraud department (not the general billing dispute line) and cite the police report right away, specifically calling out ""signature forgery"". I would be surprised if you don't get a favorable outcome."