Sleuthing a credit card data breach

Q. For the fifth time, my Bank of America credit card number was changed due to a data breach. Isn't the credit card issuer required to disclose the merchant that compromised my data? —E.F., Davidson, Md.

A. Although federal law provides consumer financial data protections, it is the states (except Alabama, New Mexico, and South Dakota) that require that customers be notified. But the state laws apply to the entity where the hacking occurred, not to the credit card issuer. Consequently, the bank that issued the credit card may detect fraud and issue new cards to stop losses, but it may not know which retailer was breached. The merchant, though, should give you full disclosure about the breach.

Have you had the same problem? Give us your comments, below.

—Consumer Reports

Consumers need better protections for their financial data. Read our recommendations.