A growing number of financial companies are using a powerful, but indiscriminate, weapon in the war on fraud: barring all credit and debit transactions originating in nations known as fraud hot spots.
Banks and processors say country blocks are an effective way to prevent criminals from using stolen data, even though the blocks also prevent legitimate transactions. Visa U.S.A. and MasterCard International say their rules do not permit issuers or processors to block entire nations, but some bankers said they were unaware of those rules, and one said Visa helps set up such blocks.
First Interstate BancSystem Inc. of Billings, Mont., which issues both Visa and MasterCard credit cards, says it has blocked credit transactions from two countries, the United Kingdom and South Africa, each for brief periods last summer.
Greg Wamsley, the finance and risk manager for First Interstate's credit card division, called country blocks "a big hammer" that should be used sparingly. "We don't like to do it, because we're leaving cardholders that might be there legitimately without a payment mechanism."
Angie Wong, the division's president, said blocking credit transactions helped "eliminate some loss for the bank."
The banking company has also imposed blocks on its debit cards.
Other companies have been more aggressive in their blocking. One of the more extreme examples: First Bank and Trust Co. of Abingdon, Va., which issues Visa debit cards, does not accept transactions originating anywhere outside the United States unless a customer asks for permission to use their cards abroad.
Leton L. Harding, First Bank's executive vice president, says he has been using country blocks since his company was hit by a rash of bogus debit transactions from Hong Kong about three years ago.
First Bank's customers, who live mostly in Virginia's Shenandoah Valley and east Tennessee, do not travel extensively, but the company takes pains to notify all its customers of the blocks, Mr. Harding said. "If you are going overseas, and you travel quite a bit, we can either turn it on and leave it on, or if you're going for a period of time, we can turn it on for a temporary period."
Rosetta Jones, a spokeswoman for Visa, said it permits issuers and processors to decline authorization only at the card level. It does not allow "wholesale blocks on countries."
Jessica Antle, a MasterCard spokeswoman, wrote in an e-mail that it is "against our rules to block all transactions out of a specific country because of the level of fraud in that country."
But Mr. Harding said he was unaware that blocking transactions by country violates Visa's rules. "They may be against the rules, but we've been doing it, and no one's brought that to our attention."
And Mr. Wamsley said neither Visa nor MasterCard has made any attempt to stop First Interstate from using country blocks.
"Until somebody from Visa or MasterCard tells me differently - that I don't have the tool available - why wouldn't I use it?" he said.
James A. Hanisch, the executive vice president for network operations and corporate development for the Ontario, Calif., credit union debit company Co-op Network, said credit unions began requesting country blocks about three years ago; 15% of his company's 700 credit unions are using them now.
Once a country block is put in place, it remains in effect indefinitely, Mr. Hanisch said, and many of the network's credit unions block more than one country.
Kevin Gregoire, an executive vice president of Fiserv EFT, the signature debit transaction processing unit of Fiserv Inc., said country blocks are becoming more popular with his bank and credit union customers.
These customers are not asking to "turn down this country for today in order to prevent an attack," he said. They want to "turn down this country permanently."
Mr. Hanisch said Co-op uses bank identification numbers to identify and stop transactions from blocked nations. He also said the approach is "within the spirit" of the card associations' rules.
But Visa says it views country blocks as an overly broad response that prohibits valid and fraudulent transactions, and the San Francisco association prefers to work with banks to find more finely tuned ways to prevent fraud.
Richard S. Jenkins, the senior vice president and corporate counsel for the Johnston, Iowa, debit network Shazam Inc., said that only about three of its 1,700 bank customers use country blocks.
"It's obviously practical at times to establish a temporary block because of fraud," especially when "institutions are losing money and they want to put a stop to the bleeding," Mr. Jenkins said.
He also said that Visa is well aware of the practice and sets up blocks itself "if there is a business rationale to do so, such as evidence of fraud coming from a country."
In a statement, Visa said that "if an issuer experiences extraordinary circumstances such as major fraud attack, Visa would give them some time to mitigate their losses, however, if we continue to receive complaints and or they continue to block transactions Visa has the ability to assess fines."
Ms. Antle wrote in an e-mail that MasterCard has never had to enforce its rule against country blocks.
"We have received no cardholder complaints about this," she wrote. "If and when we receive a complaint, we would investigate it and proceed from there."
Several of the banking executives said the most commonly blocked countries are in Eastern Europe, especially Romania, Russia, and the Ukraine. Some Asian countries, such as Hong Kong, have also been blocked, as have Spain and countries in Latin America.
Jason Korstange, a spokesman for TCF Financial Inc. of Wayzata, Minn., which issues only debit cards, said it occasionally puts temporary blocks on countries when there is a spike in fraud. Some blocks last only a few hours, he said.
Angela Gillespie, the deputy Bank Secrecy Act compliance officer for First Horizon National Corp. of Memphis, said it does not use country blocks at all. However, it does pay extra attention to transactions from countries on the Office of Foreign Assets Control's list of places where U.S. citizens and businesses may not do business. The list includes Iran, Cuba, Sudan, Syria, and North Korea.
Tony Hayes, a vice president with Dove Consulting Group Inc., a Boston division of Hitachi Consulting Corp., said blocking transactions on a countrywide basis has "certainly become much more prevalent" in the last few years. "People are definitely doing it, because the losses are too great."
But he called this "sledgehammer approach" unsophisticated and said blocking transactions by merchant code within a foreign country is a more effective way to prevent fraud.
Mr. Gregoire said that country blocks are no more than a "stopgap measure" until the criminals "figure out a way to move to another country."
Mr. Hanisch said Eastern Europe has long been a major source of card fraud, but fraud from Hong Kong is a growing problem. It has been easy to impose country blocks in Eastern Europe, because relatively few members of Co-op Network's credit unions go there, he said, but the network will not block transactions from Hong Kong, which is a "significant destination" for tourists and business travelers.
Instead, the network uses things like its neural network to "look for transactions out of pattern," he said.
