Banka kredi kartı süreçlerinde kişisel verilerin büyük veri yöntemleri ile gizliliğinin korunması
Privacy and use of big data  in bank credit card processes
Yazar: MAHBUB DİLAN KOYUNCU KAYA
Danışman: PROF. DR. ENVER ÖZDEMİR
İstanbul Teknik Üniversitesi / Bilişim Enstitüsü / Bilişim Uygulamaları Ana Bilim Dalı / Bilgi Güvenliği Mühendisliği ve Kriptografi Bilim Dalı
Derece: Yüksek Lisans, 2024
Konu: Bilgisayar Mühendisliği Bilimleri-Bilgisayar ve Kontrol = Computer Engineering and Computer Science and Control
Dizin: Büyük veri = Big data ; Elektronik ticaret = Electronic commerce ; Mobil bankacılık = Mobile banking ; Temassız kredi kartları = Contactless credit card ; Veri gizliliği = Data privacy

Özet:
Alışveriş kavramı tarihin ilk çağlarından beri insanoğlunun hayatının merkezinde yer almış, yerleşik hayata geçilerek medenileşme süreçlerine ön ayak olmuş, esasında şu anki medeniyetlerin oluşmasında büyük bir katkısı olan kavramlardan biri olarak karşımıza çıkmıştır. Alışveriş kavramı teknolojinin hızla gelişmesi ile fiziki dünyadan sanal dünyaya taşınmış, e-ticaret, alışveriş siteleri, kripto paralar, kredi kartları vb. kavramlar daha çok duyulmaya başlanmış, 2020 yılında tüm Dünyayı sarsan koronavirüs sebebi ile de sanal alışveriş en üst sınırlarına ulaşmıştır.
Meydana gelen teknolojik gelişmeler bahsi geçen sanal alışveriş kavramını iyice büyütmüş, alışverişte bulunan tüm aktörlerin teknolojik gelişmelere ayak uydurması gerekliliği ortaya çıkmıştır. Bu aktörlerden en büyüklerinden biri olan bankalar teknolojik gelişmelerin hızına yetişmek maksadıyla kredi kartı satış hacimlerini büyütmüş, milyonlara ulaşan müşterilere ulaşmıştır. Fakat her büyüyen ve gelişen sektör gibi bu sektörün de karşılaştığı sanal saldırılar (virüsler, zararlı yazılımlar, hackerler vb.) ve iç saldırılarda (çalışanların bilgi sızdırması vb.) artmış ve bu saldırılardan en çok zarar gören kısmın müşterilere ait kişisel veriler olduğu görülmüştür. Bu minvalde müşterileri korumak maksadıyla Dünya genelinde bazı önlemler alınması gerekmiştir. Avrupa da General Data Protection Regulation adı verilen bankaların yanında, tüm kişisel veri işleyen, saklayan kurum kuruluşların tabi olduğu yasalar oluşturulmuş, bu yasanın Türkiye'ye yansıması da Kişisel Verileri Koruma Kanunu adı verilen (KVKK) uygulaması olmuştur. Bu yasaların uygulamasının yapılabilmesi için yönetmelikler ve iyi uygulama rehberleri hazırlanmış, ilgili kanun ve uygulamalara uyum zorunlu tutularak, tüm kişisel veri işleyen saklayan kurumların özenli davranmaya sebebiyet vermiştir. Bu tip idari önlemlerin yanı sıra teknik önlemlerin alınması da gerekmiş, bu teknik önlemler için belirli dönemler için gözden geçirmelerin eklenmesi sağlanmıştır. Alınan hem idari hem de teknik önlemlerin bankacılık sektörü başta olmak üzere veri saklayan ve veri işleyen diğer sektörlerde de büyük ölçüde anlamlı olduğu fakat, ölçülemeyen birtakım faktörlerin önleminin alınamadığı görülmüştür. Bu faktörlerden en büyüğü ise kurum çalışanlarının içinde bulunduğu insan faktörüdür. Son yıllardaki veri sızıntıları araştırıldığında, en büyük oranın çalışanların verileri maddi kazanç karşılığında kurum dışına çıkarması olarak görülmektedir. Her ne kadar idari ve teknik önlemler alınsa dahi veri sızıntısının tam olarak önüne geçilemediği görülmektedir. Bu noktada en iyi çözümün temin edilen kişisel verinin azaltılması olacağı su götürmez bir gerçektir. Konusu Banka Kredi Kartı Süreçlerinde Kişisel Verilerin Büyük Veri Yöntemleri İle Gizliliğinin Korunması olan tezimiz içerisinde, teknolojik gelişmeler, yaşanılan dijital dönüşüm ve müşteri alışkanlıkları bankacılık sektöründe sıklıkla kullanılan kredi kartlarını baz alarak bankaların kişisel veri kavramını, bu verilerin müşterilerden temin edildiği kredi kartı başvuru sürecinden, kredi kartından yapılan harcamanın ödendiği sürecin tamamında bankalarca yapılan işlemleri, Türkiye'de ve Dünyada yürürlükte olan kişisel veri koruma yasaları, bunların kredi kartı ile ilgili maddeleri, bankalarca alınan idari ve teknik önlemler hakkında bilgi verilmeye çalışılmıştır. Bahsi gecen idari ve teknik önlemlerin yeterli olmadığı durumlara da yer verilmiş, hangi yöntemler ile verilerin sızdırıldığı, sızdırılan verilerin daha çok pazarlama ve maddi kazanç sağlama amacıyla kullanıldığı istatistikler ve basına yansımış haberler, KVKK`nin bildiri sayfası kullanılarak gösterilmeye çalışılmıştır.
Tez konusuna da ilham veren, KVKK`nin bildiri sayfasında örneğine rastlanan bankaların kredi kartı sahibi müşterilerinin hesap özeti bilgilerini e-posta adreslerinde meydana gelen karışıklık sebebi ile üçüncü kişilerle sehven paylaşabildiği görülmüş, bu bilgi ışığında 5 farklı müşterinin 2 farklı bankaya ait 2021 Haziran-2023 Haziran dönemi için alınan kredi kartı hesap özetleri ile basit bir analiz yapılmaya çalışılmış, KVKK kısıtlamaları, müşterilerin özel hayatlarını paylaşmak istememesi sebebi ile sadece 5 farklı müşterinin 2 yıllık hesap özetlerinin temin edildiği, söz konusu verinin örneklem anlamında yeterli olmadığı kanaatine varılarak, SQL dili kullanılarak mevcut 5 müşteri üzerinden yapay 100 müşteri oluşturulmuş ve analiz üretilen 100 müşteri üzerinden tekrarlanmıştır. Basit bir analiz ile gerçekleştirilen işbu çalışmanın sonuçları değerlendirildiğinde, yalnızca müşterilerin hesap özetlerine bakılarak (yaptıkları harcamalar) cinsiyetleri, gelir bilgisi aralığı, çalışılan isin özellikleri, yaşanılan ülke, şehir bilgisi, sağlık geçmişi, madde, sigara veyahut alkol kullanımı, mezun olunan okul bilgisi, müşterinin kişisel mal varlığı bilgisi (araba, ev) vb. hakkında tahminde bulunabildiği görülmüştür. Bu durumun özellikle bankacılık sektörü ile çalışan, ürün satışında öne geçmeyi arzulayan üçüncü taraf kişi ve kurumlar tarafından ne kadar iştah acıcı olduğu anlaşılabilir. Bu tehlikeyi bertaraf etmek, kişisel verilerin üçüncü tarafların eline geçmesini önlemek maksadı ile neler yapılacağı araştırılmış hem anonimlik hem de banka işlemlerinde kimlik doğrulamasının yapılmasını sağlayacak hibrit grup kimlik doğrulama sisteminin var olduğu görülmüş ve öneri olarak bu sistemin bankacılık sektörü ve veri işleyen, saklayan tüm kurum ve kuruluşlara verilmiştir.

Abstract:
PRIVACY AND USE OF BIG DATA IN BANK CREDIT CARD PROCESSES SUMMARY The concept of shopping has been at the center of human life since the early ages of history, it has initiated the civilization processes through the transition to settled life, and in fact, it has emerged as one of the concepts that made a great contribution to the formation of current civilizations. With the rapid development of technology, the concept of shopping has moved from the physical world to the virtual world, E-commerce, shopping sites, cryptocurrencies, credit cards, etc. concepts are starting to be heard more. Due to the coronavirus that shook the whole world in 2020, virtual shopping has reached its highest limits. The technological developments that have occurred have greatly expanded the concept of virtual shopping, and the necessity for all actors involved in shopping to keep up with technological developments has emerged. Banks, one of the largest of these actors, have increased their credit card sales volumes and reached millions of customers in order to keep up with the pace of technological developments. However, like every growing and developing sector, the virtual attacks (viruses, malware, hackers, etc.) and internal attacks (employees leaking information, etc.) faced by this sector have increased and it has been observed that the part that is most damaged by these attacks is the personal data of the customers. In this regard, some precautions had to be taken around the world in order to protect customers. In Europe, laws called General Data Protection Regulation, which are subject to banks as well as all institutions that process and store personal data, have been created, and the reflection of this law in Turkey is the so-called Personal Data Protection Law (KVKK). In order to implement these laws, regulations and good practice guides have been prepared, and compliance with the relevant laws and practices has been made mandatory, causing all institutions that process and store personal data to act carefully. In addition to such administrative measures, technical measures also had to be taken, and these technical measures were required for certain periods. It has been observed that both administrative and technical measures taken are largely significant in the banking sector and other sectors that store and process data, but some unmeasurable factors cannot be taken into account. The biggest human factor among these factors is the employees of the institution. When data leaks in recent years are investigated, the largest rate is seen as employees leaving the organization's data in exchange for financial gain. Even though administrative and technical measures are taken, it is seen that data leakage cannot be completely prevented. At this point, it is an undeniable fact that the best solution would be to reduce the personal data provided. Protecting the personal information of customers trading in financial markets is important in increasing the reliability of both the banking system and existing financial markets, in increasing compliance with global laws, in preventing all kinds of abuse using customer information, in protecting the brand value of financial markets, in protecting financial market actors as a result of the acquisition of personal data. It will xx make a great contribution to reducing data storage and security costs. With the developing technological developments, it can be seen that blockchain-based studies that aim to minimize the personal information of the customers in question have begun to be used. The most striking cases can be observed that the personal data used in the banking sector is used not only for the transactions to be made by the customers, but also for marketing purposes by the bank through the analyzes obtained from this data, and even these data are shared with third parties. From this situation, it can be clearly seen how important the use of blockchain-based technologies in the banking sector is in terms of speed, efficiency, transparency and reliability. In the thesis, the figures for the use of credit cards in the banking sector, especially in the world and in Turkey, are given, how high the usage rates are, examining the personal data that banks receive from customers in credit card use in terms of quality and quantity, the laws and rules for the protection of personal data in the world and Turkey. Practices, compliance with these laws and rules, abusive transactions, especially the sharing of customers' personal data with third parties by bank employees have been revealed. As a result, the results obtained in a very short time from the artificial data created with the data received from the customers are an important beginning in terms of showing the level that these data will reach by using more comprehensive and purposeful technological tools. With the development of technology, e-commerce transactions and, in parallel, credit cards, the use of which has increased considerably in e-commerce transactions, whether private life information and spending habits information of the relevant customers can be accessed through the statements showing the expenditures made within a certain period of time sent to the customers or not, and personal information can be obtained with this information. It has been tested whether marketing techniques can be presented and whether this information will lead to abusive situations. It is clear that when it becomes possible for banks and third parties to use the information obtained only through credit card expenditures of individual customers in the financial world, there will be a problem related to the diversity of personal data that needs to be solved and the inability to protect this data, and the development of a system to solve this problem will be inevitable. At this point, my thesis will provide guidance on how to create a financial system by minimizing the use of personal data. The fact that technological developments are advancing incredibly means that the risks for the banking sector and the e-commerce sector, which grow and develop with technology in the world in Turkey, are increasing. For this risk, there is a worldwide rule to practice on the security of risks in the personal data layer, entering the security data. In Turkey, the Personal Data Protection Law was created in response to the General Data Protection Regulation, and for the credit card, which we focus on in our work, the Banking and Credit Card Law were created and related regulations. The adoption of such administrative measures serves as a preventive measure against the loss of personal data. Furthermore, banks and e-commerce sites have adopted technical measures relating to virus protection, network security and how data is recorded and destroyed. However, as explained in the previous sections of our work, despite the precautionary measures taken, it is not possible to prevent data leaks, especially from employees, and completely protect yourself from social engineering. For this reason, it was proposed to reduce the type and number of personal data collected from customers, to guarantee anonymity using group authentication and to use identity verification systems. xxi It is important to see that e-commerce applications have replaced traditional commerce both globally and in Turkey, and credit cards are an element that accelerates and nourishes the use of e-commerce. As can be noted, it can be said that both the use of credit cards and the development of e-commerce concepts are explained in the best scenario under normal conditions, in a sterile environment without any external forces or dangerous situations. In fact, it is a great need to state that this development process in the real financial market encountered major problems, and although some of these problems were solved, a significant part of them was ignored. It would be an optimistic judgment to say that the actors in the financial markets, namely banks, commercial enterprises, and lastly and most importantly, individuals, always make the right decisions and make financial market movements without considering undeserved interests. Especially in recent years, identity fraud and identity forgery transactions, especially data leaks, have become widespread in financial markets, there are problems in eliminating internal and external attacks occurring in banks, technology companies and even government institutions, and commercial enterprises engaged in e-commerce do not have sufficient technology security infrastructures. It appears that it cannot be provided. Various practices, laws and rules have begun to be implemented around the world to solve these problems. In particular, the protection of the security infrastructures of e-commerce sites with SSL certificates, the use of 3D Secure methods at the time of payment, the security standards used to process credit cards of major card brands called PCI DSS Payment Card Industry Data Security Standard. When taken into consideration, the existing protection methods are effective for individual/commercial use in the financial market. It will be seen that it aims to protect the information that all customers share with financial organizations (banks, government institutions, e-commerce sites). In our thesis, the subject of which is PRIVACY AND USE OF BIG DATA IN BANK CREDIT CARD PROCESSES, technological developments, digital transformation and customer habits are based on the credit cards that are frequently used in the banking sector. An attempt has been made to provide information about the transactions made by the Banks during the entire payment process, the personal data protection laws in force in Turkey and the World, their credit card-related articles, and the administrative and technical measures taken by the Banks. Situations where the mentioned administrative and technical measures are not sufficient are also included, and the methods by which the data is leaked, the statistics and the news reflected in the press, where the leaked data is used for marketing and financial gain purposes, are tried to be shown using the KVKK's notification page. It has been seen that the bank's credit card holder customers' account statement information can be accidentally shared with third parties due to the confusion in their e-mail addresses, an example of which is found on the notification page of KVKK, which inspired the subject of the thesis. In the light of this information, 2021 June 2023 accounts of 5 different customers belonging to 2 different banks A simple analysis was attempted with the credit card account statements received for the June period. Due to KVKK restrictions and customers not wanting to share their private lives, 2-year account statements of only 5 different customers were provided, and it was concluded that the data in question was not sufficient in terms of sample, and it was available using SQL language. An artificial 100 customers were created out of 5 customers and the analysis was repeated on the 100 generated customers. When the results of this study, which was carried out with a simple analysis, are evaluated, only by looking at the account statements of the customers (their expenditures), their gender, income information range, characteristics of the job they work in, country of residence, city information, health history, xxii substance, cigarette or alcohol use, information about the school they graduated from, It has been observed that the customer can make predictions about asset information (car, house), etc. It can be understood how distressing this situation is, especially for third-party individuals and institutions working with the banking sector and wishing to get ahead in product sales. In order to eliminate this danger and prevent personal data from falling into the hands of third parties, it was researched what to do, it was seen that there was a hybrid group authentication system that would provide both anonymity and authentication in bank transactions, and as a recommendation, this system was used in the banking sector and all institutions that process and store data and given to organizations.