5m caught up in US credit card hack

A computer hacker has gained access to the credit card details of more than 5m Mastercard and Visa holders in the US, sparking fears of fraud on a potentially massive scale.

The two companies yesterday said the hacker had got the information by accessing the systems of an undisclosed third party firm which processes payments for retailers.

Both credit card firms said they had immediately informed the issuing banks after the problem was first detected two weeks ago. "This is not something regional, it was throughout the nation and could be any bank," said Visa spokesman, John Abrams.

The companies are working with US law enforcement officials to track down the culprit and discover how he or she managed to crack the system's security.

Identity theft and credit card fraud have become an increasing concern among consumers, particularly with the number of transactions now taking place online. But it is more common, as in this case, for fraudsters to attack host computers where credit card details are held on file by retailers rather than get access to them while the payments are being made over the internet.

None of the information in this hacking, which would include the credit card numbers, appears to have been used fraudulently so far. Around 2m Mastercard holders are affected and 3.4m Visa holders.

Plastic card fraud is booming in Britain - it has grown by 50 per cent in the past two years to £430m. As well as hacking into computer databases, common scams include copying card details when purchases are made, cards going missing in the post, or charging twice for items.

There are more than 560m Visa and Mastercards in circulation in the US. In a statement, Visa said: "High profile companies, government agencies, internet programs and websites will always be targeted by criminals.

"Visa and our vendors are no exception."

But the company tried to reassure customers. "Visa's fraud team immediately notified all affected card-issuing institutions and is working with the third-party payment processor to protect against the threat of a future intrusion."

The companies said customers would not be liable for charges incurred as a result of fraud.