Headlines:
CVS Upgrading Security of Data Site
The Woonsocket, R.I., drugstore chain CVS Corp. blocked access to its loyalty card Web site Tuesday after a consumer advocacy group said its authentication process offered inadequate security.
CVS has issued 50 million ExtraCare cards, which offer consumers discounts on products and lets the store keep track of customers' purchases. Customers can view their purchase history online and submit the information to their insurance carriers for reimbursement for medical expenses.
The group, Consumers Against Supermarket Privacy Invasion and Numbering, said Monday that the CVS site offers poor protection against unauthorized access. People can log on using a customer's card number and ZIP code and the first three letters of the customer's last name. Once logged on, consumers can access a list of recent purchases.
CVS said Tuesday that it has no knowledge of any improper use of the information, but it is "in the process of creating additional security hurdles for accessing this purchase information."
Social Security and credit card numbers were not exposed, nor was any medical information, CVS said.
The site has been active for six months.
Katherine Albrecht, the consumer group's founder and director, said that medical items "are some of the most private purchases. … They've collected a monstrous database."
Ms. Albrecht suggested that consumers be required to opt into the ExtraCare program's data collection feature. "This should really wake people up" to how much information retailers are collecting about consumers, she said.
Customer loyalty programs have become very common among retailers. Merchants have long used the programs to keep track of purchases, but some companies are now looking for ways to expand the programs.
For example, the Denver transaction processor First Data Corp. has developed a system that lets supermarket customers pay for groceries by using the loyalty card to initiate an automated clearing house debit to their bank account. Safeway Inc. has been doing this in its grocery stores since 2002, and other processors have said they are developing or offering similar products.
TD Banknorth Using E-Payment Service
TD Banknorth Inc. of Portland, Maine, has expanded its relationship with the New Jersey electronic payment technology vendor Princeton eCom Corp.
On Tuesday, Princeton eCom said that TD Banknorth, which is majority owned by Toronto-Dominion Bank, is using the CollectPay One-Time Pay service to let customers make automated single payments over the Internet or through an interactive voice response system. Customer service representatives previously handled these payments.
Kendall Beal, the vice president of e-commerce at TD Banknorth, said in the vendor's press release that the Princeton eCom service "has significantly enhanced our payment channels, provided more convenience for our customers, and lowered costs through a reduction in paper payments and payment claims."
Princeton eCom said TD Banknorth also uses its pay anyone service for recurring online bill payments and is adding the Real-Time Digital Scanline service for automated verification of online payees and account numbers.
