Home Depot security hack: What to do if your cards are breached

The recent hacking of Home Depot's payment data systems serves as a reminder to consumers that their personal data from their payment cards can be vulnerable to security breaches. But there are steps consumers should take immediately after such a breach, and some steps to help maximize their protection.

Monitor your statements but pay particular attention to small charges, analyst says

Home Depot has confirmed that customers who used credit or debit cards at stores in Canada and the U.S. from April could be affected by a security breach. (Associated Press)

The recent hacking of Home Depot's payment data systems serves as a reminder to consumers that their personal data from their payment cards can be vulnerable to security breaches.

On Monday, Home Depot announced that customers who used credit or debit cards at stores in Canada and the U.S. from April could be affected by the breach. The news came months after another large retailer, Target, revealed that more than 70 million people may have been affected by its own data breach, which, along with credit card data, included the stealing of names, mailing addresses, phone numbers and email addresses.

But there are steps consumers should take after such a breach, and some steps to help maximize their protection.

Anyone who may be a victim should immediately contact their bank, inform them that they may have been affected by the breach and follow the recommendations of their card providers.

Zero liability

As Home Depot said on its website, "the policies of the payment card brands such as Visa, MasterCard, American Express and Discover provide that you have zero liability for any unauthorized charges if you report them in a timely manner."

"So if somebody pushes a fraudulent charge to your Visa or MasterCard, there is protection there," said Mark Nunnikhoven, who is vice-president of cloud and emerging technologies at the internet security software firm Trend Micro. But Nunnikhoven cautioned that there's not as much protection on a debit card.

While it may seem obvious, customers should check out the affected retailer's website for information. Nunnikhoven said Home Depot has provided good information and is also offering 12 months of free Equifax identity theft protection.

"Basically, they up the suspicion level on your record and they send you regular reports on anything that's been done to your credit rating," Nunnikohoven said.

"It's a solid service. For Home Depot, it's expected at this point if you suffer a breach, to offer this type of service to customers. But it's up to you as a customer who shopped at Home Depot during that time to self identify and call Equifax and get that taken care of."

It's also important for customers to monitor their statements for any suspicious transactions. Look for all sorts of transactions but pay particular attention to small ones, Nunnikohoven said.

"The first thing [customers] look for is really large transactions. What you're actually looking for is the exact opposite. Very, very tiny transactions. As soon as they steal a card, they try to test transactions. So three or four dollars, something smallto see if the card will accept it or not."

But to help maximize protection in general, "you want to make sure you have a chip-and-PIN enabled debit and credit card," Nunnikohoven said. "If you don't, go to the bank, they're more than happy to issue one."

The chip increases your protection level by making the number less valuable to criminals, he said. (Chip-and-PIN cards are used throughout Canada and the European Union but are not deployed widely in the U.S.)

"It reduces the likelihood that somebody's able to physically clone or use a clone card."

"Once you have chip-and-PIN make sure you don't share your PIN," Nunnikohoven added. Standard advice but, "it needs to be said."


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Member

Join the conversation  Create account

Already have an account?