Authenticate to be positive

Faced with the prospect of unrelenting cyber-attacks, and the card fraud attempts that inevitably follow, financial institutions and payments companies are ramping up investments in systems and services that can help to better authenticate customers and the cards and devices they use to make payments.
The latest indication is that five of the largest banks in the country, through a consortium known as Early Warning Services LLC, have acquired Authentify Inc., a leading provider of phone-based, multifactor authentication to financial institutions and e-commerce companies worldwide. It was followed by news that Early Warning had entered a strategic alliance with BioCatch Ltd., which specializes in behavioral biometrics, authentication and malware detection. Combined with the equity investment Early Warning made two years ago in Payfone Inc., which specializes in mobile authentication, the latest deals position Early Warning to offer all manner of digital multifactor authentication services and the ability to integrate, manage and prioritize multiple authentication procedures on a single platform, the company said.
Multifactor authentication refers to security protocols that rely on multiple sources and methods for authenticating individuals, cards and devices. So, for example, a financial institution using Early Warning to authenticate a new customer, or a customer transaction, can now benefit from intelligence that integrates behavioral analytics with the ability to authenticate consumers, their mobile devices, and their banking and payment activities. If the transaction is a card payment, it might also be subject to the card brands' authentication programs, Verified by Visa and MasterCard SecureCode, generically known as 3D Secure.
Early Warning was born from a check authorization network (known as SCAN), developed by the Star EFT network, which is now part of First Data Corp. Today, Early Warning's owners, combined, control nearly 80 percent of demand deposit (checking) accounts in the country. It counts as clients 1,100 financial institutions, government entities and payments companies. The owner banks are: Bank of America Corp., Branch Banking and Trust Co., Capital One, JPMorgan Chase and Wells Fargo. Early Warning also hosts a digital channels advisory committee with representatives from other large financial institutions, including Citicorp and USAA.
"We're not just solving problems at the individual level for financial institutions," explained Michael Toth, Vice President, Product Management, Digital Channels, at Early Warning. "We're looking across the industry."
This is a major change in an industry like financial services where competition and other concerns have limited interest in things like shared data bases. But it has been necessitated by the changing nature of commerce and growing fraud threats. "We need to change the way we address the problem," said Craig Priess, Founder and Vice President of Guardian Analytics Inc., in a presentation at the BAI Payments Connect conference in March. "You need a deep history of interactions to better understand relationships and behaviors and to identify potential problems."
Jeff Sawitke, Senior Vice President and Chief Product Officer at Verifi Inc., added, "Banks need to be sharing more."

Mobility ushers in new authentication methods

Authentication always has been an underlying component of payment authorization. Historically, authenticating a card payment meant ensuring the numbers on the card were legitimate (authentic) and not just a string of meaningless digits. Over the years, several companies have experimented with more sophisticated approaches, although none succeeded in gaining traction. Pay-by-Touch was one such venture. As the name implied, consumers would swipe their fingers across a POS scanner to initiate payments at stores. Whole Foods Market was a client. Pay-by-Touch was ahead of its time; it never gained much traction.
Today, ongoing adoption of mobile and online payments, the upcoming switch to the EMV (Europay, MasterCard and Visa) security protocol and the iPhone 6 with Apple Pay (which reintroduced finger scans) are pushing the market in new directions.
In addition to Apple, for example, UK-based Barclays Bank also introduced a new biometric finger reading device in late 2014 to replace passwords and PINs for online customers. The device uses infrared lights to scan the blood flow in a customer's finger. Other biometric authentication methods being tested and/or adopted to varying degrees by banks include iris scanning, voice recognition and facial recognition.
Authentication can also be applied to devices. For example, many banks and solutions providers use geolocation data to authenticate mobiles and the customers using them. This method employs GPS technologies to determine where the mobile device is located and compares that to a customer's IP address information. The technology can even be used to block transactions originating from a pre-defined list of IP addresses or countries.
"Mobility changes everything," said R. "Doc" Vaidhyanathan, Vice President, Product Management, Digital Payments, at the security firm CA Technologies. This especially applies to loss considerations. The latest LexisNexis True Cost of Fraud Study, published in January 2015, revealed that not only are merchants losing more money because of online fraud, but mobile fraud is the most costly. The all-in cost for mobile fraud is $3.34 per dollar of fraud losses compared to $3.08 for other channels such as MO/TO sales, LexisNexis reported.
While it may seem a bit out of place now, using mobile devices to authenticate and secure consumer payments is poised to be both common and user friendly, Vaidhyanathan said. That's because mobiles can be used to authenticate with, authenticate to and authenticate through. Plus, most people have their mobiles always at the ready.
The problem for financial institutions and payment companies is that traditional fraud fighting tools and procedures don't work well in a mobile environment. "They're trying to adopt traditional controls for this space, and a lot of those things just don't make sense," Toth said. And it can create a "worse customer experience." An e-commerce provider, for example, may require one-time passwords to authenticate customers. But that can create a lot of friction for a customer who is using his or her smartphone to shop.
"There's a wealth of information available out there" that can improve authentication in a mobile environment, Toth said. BioCatch, for example, can track cognitive digital signatures, such as how a device is held or swiped; Payfone, meanwhile, provides access to intelligence on 297 million wireless customers, Toth added.

Merchants in the dark?

While this bodes well for financial institutions, recent reports suggest merchants' perceptions about fraud, especially mobile fraud, are not keeping pace with reality. For example, the security firm Kount Inc. reported that most of the 2,000 merchants worldwide it recently polled consider the mobile channel equally or less risky than traditional e-commerce (58.8 percent combined). That number is higher than was the case in 2013, when just 49.2 percent of the surveyed merchants responded that the mobile channel is no more risky than traditional e-commerce.
On the other hand, about 10 percent fewer merchants consider mobile commerce somewhat or far riskier than traditional e-commerce, according to the 2015 Mobile Payments & Fraud Survey. This was the third year Kount, working with CardNotPresent.com and The Fraud Practice LLC, surveyed merchant attitudes on mobile payments and fraud.
"The data shows that the industry as a whole is further behind on mobile adoption and fraud protection than they were a year ago, and in fact, some are even pulling back," said Don Bush, Vice President of Marketing at Kount. "It seems everybody knows that mobile is poised to make an impact, but the urgency to make sure mobile fraud protection is in place is lacking."
Here are some additional findings reported by Kount:

• Nearly a quarter (24.2 percent) of merchants recently surveyed believe the mobile channel requires specialized fraud tools, down from 32.2 percent in 2013.
• Mass merchants are more likely to be able to identify mobile devices by type.
• Gaming and social sites are the only category of merchants than can identify all transactions coming from mobile devices, but only 25 percent can determine the device type.
• Just 39.4 percent of merchants track fraud by channel and differentiate mobile fraud from other e-commerce fraud.
• Better than a quarter (28.4 percent) have no plans to add new tools or services to combat mobile channel fraud.
• Just 23.7 percent of the surveyed merchants accept mobile wallets. PayPal is the dominant form of mobile payment accepted, at 54 percent.

Merchant adoption of 3D Secure authentication methods – like Verified by Visa and MasterCard SecureCode – has been equally lackluster. Results of recent surveys by CardinalCommerce and The Fraud Practice indicate that just 43 percent of merchants use these programs. Not surprisingly, midsize and larger merchants are more likely than are smaller merchants to employ 3D Secure. Even among merchants who earn half or more of their revenues from card-not-present (CNP) transactions, just 54 percent use these authentication tools, CardinalCommerce reported.

New approaches in the works

Many experts warn that the need for sophisticated authentication tools will increase as more U.S. merchants and card issuers embrace EMV and more fraud moves to CNP environments. "It's a huge concern," said Jim Pitts, Project Manager for Technology Risk at BITS, the technology policy division of the Financial Services Roundtable. Anne Fairchild, Director of EMV Product Management at First Data, agreed, adding, "Everyone seems to be behind the eight ball."
CNP fraud is no small matter. According to Aite Group LLC, 16 percent of card fraud losses in 2013 came from CNP transactions. The Federal Reserve reported in its latest retail payments survey (which covered 2012) that CNP fraud occurred three times more often than did card-present fraud.
"The rise in popularity of mobile wallets has highlighted the challenges issuers face in managing fraud risk within this new channel," said Nandan Sheth, President and Chief Operating Officer at Acculynk. Acculynk operates an authentication gateway for merchants and processors and has developed a software-based scrambling PIN pad that can be used to authenticate customers at the point of account entry, or it can be fine-tuned to kick in for use only with high-risk transactions.
Given that merchant adoption of EMV is only expected to increase as the October 2015 liability shift looms, time is of the essence for all stakeholders to reinforce authentication in the CNP arena.

SIDE NOTE:Fed details consumer smartphone use for payments, banking

Today most adults in the United States (87 percent) have mobile phones, and 71 percent of those devices are smartphones, according to Consumers and Mobile Financial Services 2015. The report, the fourth in as many years from the Federal Reserve Board, revealed that as of December 2014, 39 percent of mobile phone customers had used those devices for mobile banking activities, such as checking balances, transferring money between accounts and depositing checks – up from 33 percent the year before. The use of mobile phones for payments was also up; 22 percent of mobile phone users reported using those devices to make payments in 2014, compared with 17 percent in 2013, the Fed reported. Among smartphone users, the trend is even more pronounced: 28 percent of this group reported making mobile payments in 2014, up from 22 percent the year before. The Fed said that 39 percent of smartphone users reported making POS payments using those devices in 2014. Among consumers who made POS payments with their smartphones last year, 31 percent did so by scanning a barcode or quick response code displayed on their phone screen at the checkout, while just 14 percent used near field communication, tap-and-pay methods.
The Fed's data also points to several geographic and demographic trends in the use of mobile devices for banking and payments. For example, residents of rural communities are less likely to use the mobile channel to bank or make payments than are residents of more densely populated regions.

Not surprisingly, younger consumers are more apt to use their smartphones for banking and payments. Among those 18 to 29 years old, 34 percent made mobile payments in 2014, up from 28 percent in 2013. The 30 to 44 year old age group was only slightly less inclined at 31 percent, up from 21 percent a year earlier. Among 45 to 59 year olds just 16 percent made mobile payments in 2014, the Fed reported.

Authenticate to be positive

Faced with the prospect of unrelenting cyber-attacks, and the card fraud attempts that inevitably follow, financial institutions and payments companies are ramping up investments in systems and services that can help to better authenticate customers and the cards and devices they use to make payments.
The latest indication is that five of the largest banks in the country, through a consortium known as Early Warning Services LLC, have acquired Authentify Inc., a leading provider of phone-based, multifactor authentication to financial institutions and e-commerce companies worldwide. It was followed by news that Early Warning had entered a strategic alliance with BioCatch Ltd., which specializes in behavioral biometrics, authentication and malware detection. Combined with the equity investment Early Warning made two years ago in Payfone Inc., which specializes in mobile authentication, the latest deals position Early Warning to offer all manner of digital multifactor authentication services and the ability to integrate, manage and prioritize multiple authentication procedures on a single platform, the company said.
Multifactor authentication refers to security protocols that rely on multiple sources and methods for authenticating individuals, cards and devices. So, for example, a financial institution using Early Warning to authenticate a new customer, or a customer transaction, can now benefit from intelligence that integrates behavioral analytics with the ability to authenticate consumers, their mobile devices, and their banking and payment activities. If the transaction is a card payment, it might also be subject to the card brands' authentication programs, Verified by Visa and MasterCard SecureCode, generically known as 3D Secure.
Early Warning was born from a check authorization network (known as SCAN), developed by the Star EFT network, which is now part of First Data Corp. Today, Early Warning's owners, combined, control nearly 80 percent of demand deposit (checking) accounts in the country. It counts as clients 1,100 financial institutions, government entities and payments companies. The owner banks are: Bank of America Corp., Branch Banking and Trust Co., Capital One, JPMorgan Chase and Wells Fargo. Early Warning also hosts a digital channels advisory committee with representatives from other large financial institutions, including Citicorp and USAA.
"We're not just solving problems at the individual level for financial institutions," explained Michael Toth, Vice President, Product Management, Digital Channels, at Early Warning. "We're looking across the industry."
This is a major change in an industry like financial services where competition and other concerns have limited interest in things like shared data bases. But it has been necessitated by the changing nature of commerce and growing fraud threats. "We need to change the way we address the problem," said Craig Priess, Founder and Vice President of Guardian Analytics Inc., in a presentation at the BAI Payments Connect conference in March. "You need a deep history of interactions to better understand relationships and behaviors and to identify potential problems."
Jeff Sawitke, Senior Vice President and Chief Product Officer at Verifi Inc., added, "Banks need to be sharing more."

Mobility ushers in new authentication methods

Authentication always has been an underlying component of payment authorization. Historically, authenticating a card payment meant ensuring the numbers on the card were legitimate (authentic) and not just a string of meaningless digits. Over the years, several companies have experimented with more sophisticated approaches, although none succeeded in gaining traction. Pay-by-Touch was one such venture. As the name implied, consumers would swipe their fingers across a POS scanner to initiate payments at stores. Whole Foods Market was a client. Pay-by-Touch was ahead of its time; it never gained much traction.
Today, ongoing adoption of mobile and online payments, the upcoming switch to the EMV (Europay, MasterCard and Visa) security protocol and the iPhone 6 with Apple Pay (which reintroduced finger scans) are pushing the market in new directions.
In addition to Apple, for example, UK-based Barclays Bank also introduced a new biometric finger reading device in late 2014 to replace passwords and PINs for online customers. The device uses infrared lights to scan the blood flow in a customer's finger. Other biometric authentication methods being tested and/or adopted to varying degrees by banks include iris scanning, voice recognition and facial recognition.
Authentication can also be applied to devices. For example, many banks and solutions providers use geolocation data to authenticate mobiles and the customers using them. This method employs GPS technologies to determine where the mobile device is located and compares that to a customer's IP address information. The technology can even be used to block transactions originating from a pre-defined list of IP addresses or countries.
"Mobility changes everything," said R. "Doc" Vaidhyanathan, Vice President, Product Management, Digital Payments, at the security firm CA Technologies. This especially applies to loss considerations. The latest LexisNexis True Cost of Fraud Study, published in January 2015, revealed that not only are merchants losing more money because of online fraud, but mobile fraud is the most costly. The all-in cost for mobile fraud is $3.34 per dollar of fraud losses compared to $3.08 for other channels such as MO/TO sales, LexisNexis reported.
While it may seem a bit out of place now, using mobile devices to authenticate and secure consumer payments is poised to be both common and user friendly, Vaidhyanathan said. That's because mobiles can be used to authenticate with, authenticate to and authenticate through. Plus, most people have their mobiles always at the ready.
The problem for financial institutions and payment companies is that traditional fraud fighting tools and procedures don't work well in a mobile environment. "They're trying to adopt traditional controls for this space, and a lot of those things just don't make sense," Toth said. And it can create a "worse customer experience." An e-commerce provider, for example, may require one-time passwords to authenticate customers. But that can create a lot of friction for a customer who is using his or her smartphone to shop.
"There's a wealth of information available out there" that can improve authentication in a mobile environment, Toth said. BioCatch, for example, can track cognitive digital signatures, such as how a device is held or swiped; Payfone, meanwhile, provides access to intelligence on 297 million wireless customers, Toth added.

Merchants in the dark?

While this bodes well for financial institutions, recent reports suggest merchants' perceptions about fraud, especially mobile fraud, are not keeping pace with reality. For example, the security firm Kount Inc. reported that most of the 2,000 merchants worldwide it recently polled consider the mobile channel equally or less risky than traditional e-commerce (58.8 percent combined). That number is higher than was the case in 2013, when just 49.2 percent of the surveyed merchants responded that the mobile channel is no more risky than traditional e-commerce.
On the other hand, about 10 percent fewer merchants consider mobile commerce somewhat or far riskier than traditional e-commerce, according to the 2015 Mobile Payments & Fraud Survey. This was the third year Kount, working with CardNotPresent.com and The Fraud Practice LLC, surveyed merchant attitudes on mobile payments and fraud.
"The data shows that the industry as a whole is further behind on mobile adoption and fraud protection than they were a year ago, and in fact, some are even pulling back," said Don Bush, Vice President of Marketing at Kount. "It seems everybody knows that mobile is poised to make an impact, but the urgency to make sure mobile fraud protection is in place is lacking."
Here are some additional findings reported by Kount:

• Nearly a quarter (24.2 percent) of merchants recently surveyed believe the mobile channel requires specialized fraud tools, down from 32.2 percent in 2013.
• Mass merchants are more likely to be able to identify mobile devices by type.
• Gaming and social sites are the only category of merchants than can identify all transactions coming from mobile devices, but only 25 percent can determine the device type.
• Just 39.4 percent of merchants track fraud by channel and differentiate mobile fraud from other e-commerce fraud.
• Better than a quarter (28.4 percent) have no plans to add new tools or services to combat mobile channel fraud.
• Just 23.7 percent of the surveyed merchants accept mobile wallets. PayPal is the dominant form of mobile payment accepted, at 54 percent.

Merchant adoption of 3D Secure authentication methods – like Verified by Visa and MasterCard SecureCode – has been equally lackluster. Results of recent surveys by CardinalCommerce and The Fraud Practice indicate that just 43 percent of merchants use these programs. Not surprisingly, midsize and larger merchants are more likely than are smaller merchants to employ 3D Secure. Even among merchants who earn half or more of their revenues from card-not-present (CNP) transactions, just 54 percent use these authentication tools, CardinalCommerce reported.

New approaches in the works

Many experts warn that the need for sophisticated authentication tools will increase as more U.S. merchants and card issuers embrace EMV and more fraud moves to CNP environments. "It's a huge concern," said Jim Pitts, Project Manager for Technology Risk at BITS, the technology policy division of the Financial Services Roundtable. Anne Fairchild, Director of EMV Product Management at First Data, agreed, adding, "Everyone seems to be behind the eight ball."
CNP fraud is no small matter. According to Aite Group LLC, 16 percent of card fraud losses in 2013 came from CNP transactions. The Federal Reserve reported in its latest retail payments survey (which covered 2012) that CNP fraud occurred three times more often than did card-present fraud.
"The rise in popularity of mobile wallets has highlighted the challenges issuers face in managing fraud risk within this new channel," said Nandan Sheth, President and Chief Operating Officer at Acculynk. Acculynk operates an authentication gateway for merchants and processors and has developed a software-based scrambling PIN pad that can be used to authenticate customers at the point of account entry, or it can be fine-tuned to kick in for use only with high-risk transactions.
Given that merchant adoption of EMV is only expected to increase as the October 2015 liability shift looms, time is of the essence for all stakeholders to reinforce authentication in the CNP arena.

SIDE NOTE:Fed details consumer smartphone use for payments, banking

Today most adults in the United States (87 percent) have mobile phones, and 71 percent of those devices are smartphones, according to Consumers and Mobile Financial Services 2015. The report, the fourth in as many years from the Federal Reserve Board, revealed that as of December 2014, 39 percent of mobile phone customers had used those devices for mobile banking activities, such as checking balances, transferring money between accounts and depositing checks – up from 33 percent the year before. The use of mobile phones for payments was also up; 22 percent of mobile phone users reported using those devices to make payments in 2014, compared with 17 percent in 2013, the Fed reported. Among smartphone users, the trend is even more pronounced: 28 percent of this group reported making mobile payments in 2014, up from 22 percent the year before. The Fed said that 39 percent of smartphone users reported making POS payments using those devices in 2014. Among consumers who made POS payments with their smartphones last year, 31 percent did so by scanning a barcode or quick response code displayed on their phone screen at the checkout, while just 14 percent used near field communication, tap-and-pay methods.
The Fed's data also points to several geographic and demographic trends in the use of mobile devices for banking and payments. For example, residents of rural communities are less likely to use the mobile channel to bank or make payments than are residents of more densely populated regions.

Not surprisingly, younger consumers are more apt to use their smartphones for banking and payments. Among those 18 to 29 years old, 34 percent made mobile payments in 2014, up from 28 percent in 2013. The 30 to 44 year old age group was only slightly less inclined at 31 percent, up from 21 percent a year earlier. Among 45 to 59 year olds just 16 percent made mobile payments in 2014, the Fed reported.

New Products

All-in-One Mobile POS app

Product: PayStand
Company: PayStand PayStand, a startup based in Scotts Valley, Calif., added a mobile payments app to its Payments-as-a-Service platform in order to enable e-commerce and brick-and-mortar merchants to accept payment cards, checks and bitcoin payments. Merchants can use a single dashboard to manage an array of payments schemes without the need to track transactional rates, fees, and assessments, PayStand stated.
The all-in-one mPOS solution is available as a standalone iOS app or as a plug-in to speed the checkout process for existing PayStand merchants who pay a flat monthly subscription for electronic transaction processing.
A card reader that fits into an iPhone audio jack facilitates mag-stripe cards. The iPhone's camera can snap a picture of a paper check, directly debiting the customer's bank account. Bitcoin payments are processed using a unique quick response code that the consumer scans to route Bitcoin payments directly to the merchant's bitcoin wallet, the company noted.

Merchant-centric, ISO-friendly

PayStand, launched a year ago, said it has been steadily dropping its card processing rates as it grows its subscriber base, automatically passing savings to customers in a process it calls "rate sourcing."
"In the past it's been the big banks and credit card processors who have dictated fees, but by empowering merchants to join together, we're starting to turn the tables on the old system," said PayStand Chief Executive Officer Jeremy Almond. "We support merchants directly, and we also support ISOs and marketplaces at the enterprise level." He added that developers can use the PayStand application programming interface to white label the solution, and PayStand is working with ISOs on customized solutions, with near-term plans to create a formal reseller program.
PayStand's free app is currently available in the Apple App Store and the PayStand mag-stripe card reader is shipped upon request. Merchants must first create a PayStand account on their websites to accept payments with the app.

Bill_Pay_Video_LG.wmv

Welcome to MBN Payment Systems

MBN's Work at Home Option

MPAY BY MBN PAYMENT SYSTEMS

POS SYSTEM BY MBN PAYMENT SYSTEMS

EZ PAY BY MBN Payment Systems

Mobile leads 2014 payments parade

The story of payments 2014 is an exciting one. Big retailer data breaches continued to dominate the news. A new tech-driven business model is shaking up traditional payments. And China's e-commerce retail giant Alibaba Group Holding Ltd. enjoyed a record-breaking debut in the United States. But arguably the biggest news in payments involved Apple Inc.'s leap into the mobile wallet space with the launch of its near field communication-based Apple Pay.

Apple's September release of Apple Pay came with the tech giant's bold prediction that its mobile payment scheme would revolutionize the way consumers pay for purchases – not just in-store, but anywhere. The reason for Apple's confidence stems from the ease of use of Apple Pay from a consumer standpoint and the security of the scheme that drew praise from issuing banks in the one area that matters from a business standpoint – discounted transaction pricing.

It is Apple Pay's robust security that suggests to banks that Apple Pay transactions are more secure than those of any other mobile wallet in the marketplace. Apple Pay utilizes biometric thumbprint authentication and dynamic tokenization of payment data, along with the security of customer data stored on the hard-to-hack secure element embedded in iPhones.

No other mobile wallet scheme offers this level of security. It is the reason why issuers cut a sweetheart deal with Apple for discounted per-transaction costs. If Apple Pay transactions are more fraud proof, that means banks will incur fewer fraud losses on the back end. The result is that Apple Pay transactions qualify more or less for the card brands' card-present interchange rate, which is cheaper than the more fraud-challenged card-not-present transactions.

This is all shop talk for the simple fact that Apple seems to have cracked the long-sought business model for mobile wallet payments, when its rivals, like Google Wallet and Softcard, have been struggling to gain traction in the marketplace, despite the widely held belief that the future of in-store payments is, in fact, mobile.

MCX underscores Apple

More evidence that Apple has hit on the right combination of cool consumer gadgetry and back-end security to ignite mobile in-store payments comes from a move by the Merchant Customer Exchange, the mobile wallet enterprise backed by mega retailers like Wal-Mart Stores Inc. and Target Corp. MCX, which operates the CurrentC mobile wallet, reminded two of its partners, drugstore chains CVS pharmacy and Rite Aid, that they were contractually barred from accepting mobile wallet transactions that are not CurrentC.

The firm reminder was clearly aimed at inhibiting Apple Pay from gaining traction at retailers in the MCX network. When Apple Pay is seen as such a significant threat to a competitor as large and potentially influential as MCX that it would stifle competition (even if it was legally within its rights to do so), the rest of the industry takes notice that Apple Pay might have "legs."

Commenting on this issue and other noteworthy happenings in the mobile wallet space, Aite Group LLC Analyst Nathalie Reinelt said in a late October blog, "Who knew we worked in such an exciting industry?"

Choke hold on the street

Indeed. It does seem that excitement in the industry has grown in recent years as payments has become a more mainstream topic of conversation. However, along with a greater awareness of payments comes a greater level of scrutiny and outside interference. That reality is no more evident than in the federal government's controversial Operation Choke Point program.

Certainly, the industry needs, and at least grudgingly welcomes, regulation. But when the federal government allegedly starts picking winners and losers based on political bias, as apparently is the case with Operation Choke Point, the very foundation of private enterprise is suddenly in jeopardy.

Operation Choke Point was launched in the spring of 2013 by the U.S. Department of Justice but gained national attention only in 2014. The program is designed to effectively snuff out certain types of businesses deemed high risk, or otherwise objectionable to federal regulators, by denying those businesses the ability to process transactions electronically.

The DOJ "chokes off" this access by forcing payment processors to terminate relationships with those businesses – such as gun shops, coin dealers, check cashing establishments and payday lenders – or face serious repercussions.

According to a report released in May 2014 by the House Committee on Oversight and Government Reform, the program subpoenaed 50 banks and payment processors in the first nine months of its operation to coerce them into severing their relationships with businesses that may be politically incorrect within the halls of power, but are legal nonetheless.

Predictably, the banking community was not pleased. In an April 2014 letter to the DOJ and members of Congress, the Independent Community Bankers of America said Operation Choke Point is bad policy. "While preventing fraud is a top concern for community banks, it needs to be balanced with ensuring that businesses and consumers that operate in accordance with applicable laws can still access payment systems," wrote ICBA President and Chief Executive Officer Camden R. Fine.   In May 2014, the House Committee on Oversight and Government Reform headed by Rep. Darrell Issa, R-Calif., released a report, The Department of Justice's "Operation Choke Point": Illegally Choking Off Legitimate Businesses?, which characterized the program as a strong-arm tactic against financial service providers: comply or else.

"The initiative is predicated on the claim that providing normal banking services to certain merchants creates a 'reputational risk' sufficient to trigger a federal investigation," the report said. "Acting in coordination with Operation Choke Point, bank regulators labeled a wide range of lawful merchants as 'high-risk' – including coin dealers, firearms and ammunition sales, and short-term lending. Operation Choke Point effectively transformed this guidance into an implicit threat of a federal investigation."

The report also charged that the DOJ is aware its program is negatively affecting legitimate, legally operating businesses. "Internal memoranda on Operation Choke Point acknowledge the program's impact on legitimate merchants," the report said. "Senior officials informed Attorney General Eric Holder that as a consequence of Operation Choke Point, banks are exiting entire lines of business deemed 'high risk' by the government."

In July, the Electronic Transactions Association circulated a petition to encourage the payments industry to make its collective voice heard about the issue. And in October, Marsha Jones, President of the Third Party Payment Processors Association, made the important point that concerns about Operation Choke Point go well beyond mere politics, as the precedent set by the program could be exploited by whichever political party is in power.

"Today it's payday lenders and firearms-related businesses; tomorrow, it could be environmental and civil rights groups or family planning clinics," she said. "No one can predict who's next."

Onward to the cloud

Putting aside the specter of government overreach into the private sector, another important development in payments was the rapid rise of a new business model that is squeezing out the traditional service delivery model. In place of the POS terminal-based facilitation of payment processing comes the cloud-based provision of entire suites of business-related services. This change has been gaining momentum for years, but the growth of the independent software vendor (ISV) model, or some variant thereof, seemed to accelerate in 2014.   In May, Vantiv LLC acquired ISV Mercury Payment Systems LLC for $1.65 billion, adding to its previous purchase of another ISV vendor, Element Payment Services Inc. Another large acquirer, Global Payments Inc., has kept pace with Vantiv in the last couple of years, having purchased Accelerated Payment Technologies and Payment Processing Inc. The top 10 acquirers recognize that software-as-a-service (SaaS) tools can provide businesses soup-to-nuts solutions – everything from inventory management to payroll. Merchants see this functionality as a pivotal way to lower overhead and drive growth.

First Data Corp., the largest U.S. acquirer, has taken a different tack to break into the ISV market. First Data initially invested in an innovative new POS system called Clover Station, then acquired Clover outright. Through its POS terminal, Clover Station, retailers have access to hundreds of business-related apps that are designed specifically for individual types of merchants. Clover leverages the app development community to provide plug-and-play apps for Clover App Market.

But this is only one way the technology and payments worlds are increasingly interacting. One day, the two entities will converge and merge, and each will be so embedded in the other that most distinctions will vanish. Payments has always been technology driven, but has often lacked flexibility and innovation – attributes of the tech start-up culture.

The warning to traditional ISOs and merchant level salespeople (MLSs) is clear: jump on board the SaaS high-tech super-train or be left behind on the ZON Jr. horse-drawn carriage. 

Genie of the IPO

Meanwhile, 2014 witnessed the share-busting entrance of Alibaba into the U.S. e-commerce space. The web giant went public on Sept. 19, when shares were traded at well over 30 percent higher than expected. When the dust settled on that eventful Friday, Alibaba's initial public offering (IPO) had become the biggest debut in the history of Wall Street.

The IPO ended up raising $21.8 billion, surpassing Visa Inc.'s IPO of $17.8 billion in 2008 and Facebook Inc.'s $16 billion in 2012. Images of Alibaba's high-profile founder Jack Ma basking in the glow of the windfall was akin to the storybook dreams of ambitious entrepreneurs all over the world.

Alibaba is likened to a hybrid of Amazon.com Inc., eBay Inc. and eBay-owned PayPal Inc., with a little Google Inc. added to the mix. Analysts predict that Alibaba will struggle to wrest market share away from Amazon or supplant Google's search engine dominance. However, the annual transaction volume that passes through Alibaba's retail websites reportedly surpasses the annual payment volumes of Amazon and eBay combined.

More specifically, Alibaba's proprietary payment engine Alipay might have a bigger impact on the U.S. payments market. Alipay has gone from processing an average of 800,000 transactions daily back in 2007 to 40 million daily transactions in 2010, according to Mercator Advisory Group research.

Alipay's natural rival in the United States is PayPal, and comparisons of the two are intriguing. Mercator said 62 percent of online consumers have PayPal accounts, with PayPal processing 8.8 million payments on an average day. Meanwhile, Alipay represents 50 percent of the China market, but daily processed 18 million mobile payments alone as of February 2014, Mercator reported.

Alibaba's IPO and the unleashing of its highly successful payment engine on the U.S. market may have played a role in eBay's decision to spin off PayPal in 2015. On Sept. 30, about a week-and-a-half after Alibaba's market debut, eBay said that spinning off PayPal into its own independent company would better position PayPal to take advantage of growth opportunities and compete in an ever more crowded and cutthroat marketplace.

In its announcement, eBay said PayPal is the leading payment processor for business-to-consumer exports for Chinese merchants. As much as Alibaba is interested in the U.S. market, U.S. companies like eBay and PayPal recognize tremendous growth opportunities in China and other developing markets.

Data insecurity

Mobile wallet developments and Alibaba added a healthy level of diversity to the "same old, same old" coming from the data breach sphere. Every recent year can be termed the "Year of the Big Breach," since breaches continue to get bigger and bigger, and more frequent. Retailers' networks seem to be under constant attack by increasingly sophisticated and dangerous gangs of cyberthieves.

2013 closed with the inauspicious Target Corp. breach, through which 40 million customer accounts were hacked over that holiday shopping season. 2014 began with the disclosure of a breach at Neimen Marcus in January that was very similar to the Target breach. In April, Michaels Stores Inc. came forward with another one. In June, restaurant chain P.F. Chang's China Bistro Inc. disclosed a breach, followed by Goodwill Industries International Inc. in July. JPMorgan Chase & Co. and The Home Depot U.S.A. Inc. announced breaches in August and September, respectively.

But those were only the biggest, headline-grabbing breaches. According to the Privacy Rights Clearinghouse database, 2014 breaches also occurred at Sony Pictures, Staples Inc., Sears Holdings Corp. (K-Mart), AT&T, Albertson's LLC, Apple, Boeing, Lockheed Martin, eBay, AOL, and the American Express Co. But that cross-section of U.S. companies is only among those that reported breaches. Data security experts believe the majority of breaches, mostly at small businesses (and encompassing relatively small amounts of data), are never reported.

Of the big 2014 breaches, the P.F. Chang's and JPMorgan compromises were particularly revealing of the strange new world being created by cybercrime. In the case of P.F. Chang's, the Chinese food purveyor resorted to old-school, 1970's-style card imprinters, also known as knucklebusters, to accept card payments while it figured out the extent of its breach. The move was instructive of how complicated electronic payment systems have become; their very complexity gives rise to vulnerabilities that fraudsters are only too happy to exploit.

As for the JPMorgan compromise, news updates on the status of the investigation into it continued to evolve. First it came out that the JPMorgan breach may have targeted a few other big banks. Then it was reported that the hack may have targeted 13 other financial institutions as well.

The source of the attack apparently remains unknown, but JPMorgan stated that customer information pertaining to 76 million households and 7 million small businesses was compromised in the breach, although the data affected was limited to names, addresses, phone numbers, and email addresses, and did not include financial account details.

Meanwhile, the Home Depot breach reportedly affected 53 million customer accounts. Like the Target breach, where an HVAC vendor was the source of the compromise, the nexus of the Home Depot intrusion centered on an undisclosed third-party vendor with access to the company's networks. Fraudsters have a number of ways at their disposal to gain access; they can pose as workers on a cleaning crew or simply steal the administrative credentials of that vendor.

Security firm Trustwave has published alarming statistics on how easy it is for fraudsters to figure out those credentials. Out of a sample size of over 625,000 passwords it collected through penetration testing it conducted on businesses' security networks in 2013, Trustwave was able to crack over half of the passwords within minutes, and almost 92 percent of them within one month.

Trustwave also found that the most common password is Password1, followed by Hello123, and maybe the worst password of all time – password. It seems no amount of security can overcome an information technology professional or network administrator too lazy or indifferent to implement strong, complex passwords.

The future is green

Finally, Paul H. Green, payments industry pioneer and founder of The Green Sheet Inc., sold the business in July to Kate Gillespie, who was the company's Chief Operating Officer and General Manager. Green is considered the architect of the ISO enterprise model in the late 1970s and, with American Marketing Corp. (AMCOR), became the first ISO in the 1980s to crack an annual $1 billion in transaction processing volume.

Green launched The Green Sheet in 1983 as a photocopied newsletter for AMCOR's business partners. Over 30 years later, The Green Sheet magazine and website comprise the leading source of news and street-level intelligence for the payments industry, with a specific focus on the ISO and MLS community.

As the owner, President and Chief Executive Officer of The Green Sheet Inc., Kate Gillespie is now part of a growing number of women who have taken leadership roles in American business, either as corporate executives or as independent entrepreneurs. As Gillespie knows, with change comes opportunity, and she is dedicated to continuing to help ISOs and MLSs navigate the profound changes taking place in the industry. 

With hard work and a little luck, 20 years from now The Green Sheet will still be on the front lines, providing education and guidance for a thriving and deeply committed community of payment professionals, including the new breed of the "feet on the street," whatever shape that new breed might take.

Staples urges diligence post breach, stakeholders point fingers

Adata security breach involving Staples Inc., initially reported in October 2014, has been confirmed by the Framingham, Mass-based retail office supply chain. The far-reaching event impacted 119 of the 1,500 Staples locations in 35 states. Malicious software discovered inside cash registers was intercepting credit card transactions and transmitting cardholder data to a criminal host network. The company believes that up to 1.16 million credit cards may have been affected by the breach.

A company press release issued on Dec. 19 stated that "malware may have allowed access to some transaction data at affected stores, including cardholder names, payment card numbers, expiration dates, and card verification codes. At 113 stores, the malware may have allowed access to this data for purchases made from August 10, 2014 through September 16, 2014. At two stores, the malware may have allowed access to data from purchases made from July 20, 2014 through September 16, 2014."

Staples urges consumer due diligence

Staples spokesman Mark Cautela reported that the company is working closely with law enforcement in an ongoing investigation. "We take the protection of customer information very seriously, and are working to resolve the situation," Cautela said, adding that consumers will not be held responsible for any fraudulent activity that is reported in a timely manner.

Staples published a list of affected locations from Alabama to Wyoming. Located at http://staples.newshq.businesswire.com/statement, it includes each store's window of vulnerability from the malware's initial installation date to the time of its removal. Consumers are urged to review credit card statements and promptly notify card issuing banks of any suspicious charges. Staples is also offering free identity protection services and credit reports to customers who used their cards at affected stores during the relevant time periods.

Same malware, different store

Forensic analysts have noted similarities that link the Staples data compromise with an earlier incident reported in January 2014 by Michaels Stores Inc., an Irving, Texas-based arts and crafts retailer that is the parent company of Michaels and Aaron Brothers stores. Malware used in tampered POS devices at both Staples and Michaels was found to be communicating with the same criminal host network.

The January 2014 attack was the latest in a series of data breaches for Michaels, beginning with a May 2011 attack involving what the company described as "90 individual PIN pads that showed signs of tampering" that were subsequently disabled. While the incident affected less than one percent of its stores, the company installed 7,200 PIN pad readers in all 964 stores as an added precaution. Unfortunately, this costly measure proved to be insufficient protection from further data attacks. A press release issued on April 17, 2014, disclosed additional, ongoing malicious activities.

The release stated: "Regarding Michaels stores, the attack targeted a limited portion of the point-of-sale systems at a varying number of stores between May 8, 2013 and January 27, 2014. Only a small percentage of payment cards used in the affected stores during the times of exposure were impacted by this issue. The analysis conducted by the security firms and the Company shows that approximately 2.6 million cards may have been impacted, which represents about 7 percent of payment cards used at Michaels stores in the U.S. during the relevant time period. The locations and potential dates of exposure for each affected Michaels store are listed on www.michaels.com ."

Meanwhile, controversy erupted as a result of a survey released by the Independent Community Bankers of America, whose members reported reissuing approximately 7.5 million payment cards in the wake of the The Home Depot U.S.A. Inc. breach, at a total cost of $90 million.

In a Dec. 18 press release about the survey, John Buhrmaster, ICBA Chairman and President, stated, "Community banks continue to absorb exorbitant costs due to data breaches, and they do so upfront because their primary concern is to protect their customers. However, this is money—more than $90 million—that could be used for lending in local communities to homeowners, small business owners and budding entrepreneurs to spur local economic growth and stability. For this reason, we continue to advocate that the costs associated with data breaches be borne by the party that experiences the breach. Communities and customers should not suffer for the faults of retailers.”

In addition, the ICBA stated it promulgates the following five data security principles:

1. The costs of data breaches should ultimately be borne by the breached party.
2. All participants in the payments system — including merchants — should be subject to Gramm-Leach-Bliley Act–like data-security standards.
3. A national data-security breach and notification standard should be implemented to replace the current patchwork of state laws.
4. Unnecessary barriers to effective threat-information sharing between law enforcement and the financial and retail sectors should be removed.
5. While community banks and other financial institutions continue to move to chip technology for debit and credit cards, these technologies alone may not have prevented the recent retailer breaches and do not protect against fraud in “card-not-present” transactions, such as online purchases.

In response, executives from several leading retailers' associations, including the National Retail Federation, Retail Industry Leaders Association and Merchant Advisory Group, released a letter to the ICBA claiming that these principles are "based in part on misinformation and at best incomplete."

This is just the latest volley of finger pointing between retailers and financial institutions seeking to assign blame and consequences for the data breaches plaguing our payment systems.

EMV prioritized

One positive development to arise from the recent epidemic of security data breaches can be seen in the retail community's heightened sense of urgency about upgrading and securing existing card payment systems. Staples stated it plans to enhance the security of its POS systems with up-to-date tokenization and point-to-point encryption technology. Home Depot and Target Corp. plan to install EMV readers in 2015, a move that reflects a majority of Level 1 retailers' near-term objectives. Target has reportedly committed $148 million in upgrades to its processing systems in the wake of its massive credit card breach.

Deborah Baxley, Principal at Capgemini, and an active member of Princeton, N.J.-based Smart Card Alliance, sees EMV (Europay, MasterCard and Visa) enablement of the POS infrastructure as a positive step for the retail community. "While EMV doesn't offer 100 percent protection from security attacks, it will greatly reduce vulnerabilities, because EMV cards store payment information in a secure chip rather than on a magnetic stripe," Baxley said. "A counterfeit EMV card that is stolen from a database will fail because the issuer will recognize it as a chip card, and not a magnetic stripe card."

Baxley mentioned that merchants who migrate to EMV ahead of the Oct. 1, 2015, deadline will be further protected from financial liability in the event of a costly data breach. She stressed the need for all payments industry stakeholders to work together to correct vulnerabilities in older legacy infrastructures and protect the integrity of payment card processing systems.

---

New Year's Eve countdown to PCI DSS 3.0
Friday, December 26, 2014

When the ball drops at 12 a.m. on Jan. 1, 2015, it will mark the beginning of a new year, as well as the deadline for implementation of a new set of security standards. The PCI Security Standards Council released Payment Card Industry (PCI) Data Security Standard (DSS) 3.0 in January 2014, and gave merchants and payment services providers one year to review and upgrade their PCI DSS 2.0-compliant systems.

The security community embraced the new standards, noting the enhanced protections for e-commerce, widely considered to be a leading point-of-entry for cyber attacks. Many security analysts emphasize that security best practice requires constant vigilance that extends far beyond required scans, penetration tests and self assessment questionnaires.

Sustainable best practices are business-as-usual

Suraj Srinivas, Director of Security Consulting at ANX, a Michigan-based data security organization, sees the spirit of constant vigilance reflected in the business as usual (BAU) concept introduced in PCI DSS version 3.0.

"ANX Qualified Security Assessors (QSAs) were early adopters of this concept, having seen its success in other audit program," Srinivas said. "The key to success for any compliance program is its sustainability. Sustainability is achieved by having a methodical process for ensuring that all the necessary preparatory steps are performed during the course of the year, easing the burden of the annual PCI assessment."

He added that a common piece of advice that ANX offers clients is to "measure twice and cut once," which is aligned with the company's overall approach. ANX supports customers' BAU initiatives with a blended approach that leverages a software-as-a-service compliance tool with the hands-on expertise of the company's QSAs. He believes the company's focus on sustainable best practices keeps compliance in the forefront as a systematic, year-round process for its customers.

Protecting the transaction life cycle

Frank Stornello, Chief Marketing and Strategy Officer for Verifi, noted that the impact of omni-channel trends on payment technology has made full life cycle transaction protection critical for best-in-class online commerce. For retailers, protecting omni-channel payments from start to finish while ensuring a seamless shopping experience requires a careful blend of pre- and post-sale security and fraud prevention.

"The landscape of payments is quickly evolving and new payment options and technologies are emerging rapidly – giving consumers many choices for payment: mobile, online, cash, credit, loyalty points and digital currencies to name a few," Stornello said. "Unfortunately, security lapses change shopper behavior. Studies show a direct correlation between a data breach and consumer confidence - threatening the merchant's ability to remain in business."

E-commerce: not one-size-fits-all

PCI DSS 3.0 guidelines categorize e-commerce merchants by matching self-assessment questionnaires (SAQs), scans and testing levels to each group's degree of exposure to cardholder data. Many security analysts believe e-commerce merchants who implement PCI 3.0 security controls will significantly mitigate the risk of cyber attacks.

Following are three distinct forms of e-commerce and their respective SAQ's:

• SAQ A merchants, as defined by the PCI SSC, are card-not-present merchants that do not store cardholder data in electronic format and do not process or transmit any cardholder data on their systems or premises. These companies outsource credit card processing to third party service providers, and do not need to conduct penetration testing or scans. A 14 question SAQ A and Attestation of Compliance are their only requirements.
• SAQ A-EP merchants are e-commerce merchants who partially outsource their e-commerce payment channel to PCI DSS validated third parties and do not electronically store, process, or transmit any cardholder data on their systems or premises. SAQ D
• SAQ D, which comprises 335 questions, is the most rigorous PCI DSS 3.0 SAQ due to the increased risk of fraud by merchants and payment service providers in this category. These types of processing environments include e-commerce merchants who accept cardholder data on their websites and merchants who store electronic data.

Merchants remain first line of defense

Verifi's Stornello noted that as payments become more complex, merchants will increasingly be called upon to shoulder the "full burden of true as well as friendly fraud" as consumers increasingly rely on them to protect the integrity of their payment transactions.

"Merchants are facing confusing statements, changing compliance requirements, determined hackers, and no shortage of processing fees, multiple discount rates, and chargebacks," Stornello added. "Consumers expect merchants to protect their payments at all phases of the transaction lifecycle - even identity theft - which occurs before the payment card even enters the payment stream."

---

Congress of two minds about legal pot
Tuesday, December 23, 2014

The U.S. Department of Justice has been ordered to stop making trouble for individuals and businesses that take advantage of state medical marijuana laws. However, the demand, attached to the $1.1 trillion federal budget bill that was signed into law Dec. 16, 2014, is not a total condemnation of the federal government's efforts to stamp out marijuana legalization initiatives.

"It merely restricts the use of funds in a one-year budget bill," noted a web post by the National Law Review. "The bill does not exempt marijuana has as an illegal Schedule I drug under the federal Controlled Substances Act."

In fact, the very same bill includes a provision that blocks Washington, D.C., from implementing a local referendum legalizing possession of marijuana there. Washington, a city of almost 700,000, is a "federal district" under the exclusive jurisdiction of Congress, which can veto any local laws.

A budgetary maneuver

Typically when the voters of the "district" approve controversial laws opponents will attempt to invalidate those measures with budgetary maneuvers. Tucked into the 701 page budget bill signed into law last week was a provision stating: "None of the Federal funds contained in this Act may be used to enact or carry out any law, rule, or regulation to legalize or otherwise reduce penalties associated with the possession, use, or distribution of any Schedule I substance under the Controlled Substances Act."

The budget bill is an omnibus package of legislation that appropriates funds for federal agencies and programs through Sept. 30, 2015. It was a must-pass bill, because without operating funds the government would have had to shut down. Often lawmakers will use a must-pass bill such as a budget measure to advance initiatives that might lack support to pass on their own. Appropriately enough, these omnibus legislative initiatives are known as "Christmas trees" among Washington insiders.

The budget bill provision addressing medical marijuana addresses funds appropriated to the Department of Justice, and specifically refers to medical marijuana laws in 12 states and Washington, D.C. It instructs that no funds appropriated to Justice Department "may be used" to prevent those states and Washington "from implementing their own State laws that authorized the use, distribution, possession or cultivation of medical marijuana."

Last year, the Justice Department stated it would back off efforts to challenge state laws legalizing recreational pot use, provided those states establish strong regulatory regimens.

---

Ingenico spots six payments trends to watch in 2015
Friday, December 19, 2014

At the close of 2014, payments leaders are reflecting on the year's highlights and looking ahead to what many believe will be a defining year for the industry. An unprecedented number of disruptions have occurred over the past twelve months, led by emerging technologies, the expanding role of data analytics, and changes in purchasing behaviors and banking environments.

The digital transformation of payments is perhaps most evident in the changing role of payments industry equipment manufacturers. Top brands have evolved from device-centric models to holistic, end-to-end solutions that are compatible with diverse populations of POS hardware and software.

Thierry Denis, North American President of Ingenico Group, a global enterprise dedicated to seamless payments with U.S. headquarters in Atlanta, expects to see more disruption in 2015, as EMV (short for Europay, MasterCard and Visa) adoption, mobile payments and improved security standards continue to shape the future of merchant services. For this article, Denis discussed six top payments trends Ingenico identified for 2015.

1. Security to remain a key driver in payments

As the last region in the world to adopt EMV, the United States became an easy target for cyber criminals who found it relatively easy to steal cardholder data processed on mag stripe card readers, compared with the more secure method of smart card payment processing. A record number of data security breaches occurred in the North American region in 2014.

Ingenico Group advises all merchant services providers to work closely with retailers to address this. Many companies are revisiting security strategies to improve their protection of card data environments in conformance with guidelines of the PCI Security Standards Council (PCI SSC).

2. Companies to combine P2PE and EMV to optimize security

Also known as end-to-end encryption, P2PE encrypts card data from the entry point of a merchant's POS device to a point of secure decryption outside the merchant's environment, such as a payment processor.

Many Tier 1 and 2 merchants are preparing for the Oct 2015 EMV liability shift with a shortcut approach that links EMV and P2PE planning, an approach that Ingenico calls "semi-integrated." This aims to take the entire merchant environment out of Payment Card Industry (PCI) Data Security Standard (DSS) scope and solve the EMV piece at the same time via a seamless payments system that addresses both PCI and EMV compliance.

3. Security upgrades, outsourcing expected to grow in 2015

Ingenico noted that small to midsize business owners have been slower to implement EMV technology that would help protect their processing systems from malicious attacks. This is puzzling, considering that a majority of data security breaches have taken place at Level 4 merchants, according to data provided by the PCI SSC.

Even the upcoming liability shift has not made a significant impact on EMV adoption in this segment. Ingenico predicts that over half of Tier 3 and 4 merchants will not have implemented EMV payment processing by the October 15, 2015 deadline.

Ingenico believes online fraud and chargebacks will become increasingly complex to manage in the global marketplace, as merchants shift their focus to international markets and mobile commerce continues to drive growth in many developing countries.

Fraud rates in cross-border and mobile commerce experience generally exceed those of domestic e-commerce. Ingenico expects merchants to increasingly outsource fraud management to online payment or fraud specialists in 2015.

4. In-store mobile payments to drive merchant-consumer engagement

Merchants of all sizes and categories have expressed the desire to partner with their customers in every step of the commerce journey. Many brick-and-mortar retailers have implemented in-store mobile POS solutions with smart posters and kiosks that facilitate consumer purchasing decisions without being overly intrusive. Solutions such as iBeacon help retailers stay connected to their consumer base and better understand and track who's shopping in their stores, Ingenico noted.

In an ongoing effort to support customers' preferred payment methods, many Tier 3 and 4 merchants are upgrading processing systems to support near field communication and Apple Pay. Ingenico sees increasing adoption of ApplePay by Tier 3 and 4 merchants as evidence that Apple is inspiring technology upgrades in this market where EMV could not.

5. Role of e-commerce to expand

Consumers, increasingly willing to spend online, have been driving the global expansion of e-commerce and adoption of new, more secure methods of online shopping.

According to Ingenico, mobile commerce is driving overall online commerce growth in many international markets. Consumers increasingly expect a seamless buying experience that's integrated across multiple platforms, including mobile devices, automobiles and wearable technology.

Merchants will require a developer-centric approach from vendors with easy access to modern application programming interfaces to be able to sell goods and services in the omni-channel world.

6. Data analytics, trusted relationships to optimize performance

Ingenico also expects advanced data analytics and visualization software to play a central role in identifying and removing bottlenecks in the payment process and improve conversion rates. Many enhanced intelligence solutions enable merchants to benchmark payment performance against peers and discover new market opportunities.

Greg Boardman, Senior Vice President of Product Development at Ingenico Group, sees the next several years as challenging but exciting times for large and small retailers. He has been involved in a number of payments industry initiatives focused on improving adoption of P2PE and EMV, technologies that he considers as critical priorities.

Boardman believes broad implementation of these solutions will require more than just technical savvy; it will increasingly depend on the cooperation of all stakeholders in the value chain, and partnerships that are based on respect and trust. Both retailers and acquirers have benefitted from the new collaborative model, and Boardman and his colleagues expect to momentum to continue in the New Year.

"The fundamental but long overdue technology implementations of P2PE and EMV acceptance requires a long runway and will dominate most budgets and human resources, [and] unfortunately comes at a time when innovation in payments is at a fever pitch," Boardman said. "Choosing the right strategies to benefit from both sides of this equation can be difficult. Satisfying the base requirements while also entertaining the possibilities for new payment schemes and mobility initiatives demands a level of focus and partnership that very few organizations in payments understand."

---

Charge Anywhere breach puts spotlight on TPSPs
Wednesday, December 17, 2014

Recent news of a security breach at Charge Anywhere has raised concerns about vulnerabilities that may exist in payments industry middleware and third-party service providers (TPSPs).

Charge Anywhere, a New Jersey-based payment gateway, has long been considered an innovator in the mobile payments space, marketing payment solutions and services through ISO and reseller distribution channels since 2002. Now, the company is working with its channel partners to help them mitigate risk, as well as teaming up with security specialists to forensically investigate malware initially discovered on Sept. 22, 2014. The malware has since been removed.

In a written notice posted on the company's website, Charge Anywhere stated its investigation had "revealed that an unauthorized person initially gained access to the network and installed sophisticated malware that was then used to create the ability to capture segments of outbound network traffic. Much of the outbound traffic was encrypted. However, the format and method of connection for certain outbound messages enabled the unauthorized person to capture and ultimately then gain access to plain text payment card transaction authorization requests.

"While we discovered the malware on September 22, 2014, it required extensive forensic investigative efforts to de-code it and determine its capabilities. During the exhaustive investigation, only files containing the segments of captured network traffic from August 17, 2014 through September 24, 2014 were identified. Although we only found evidence of actual network traffic capture for this short time frame, the unauthorized person had the ability to capture network traffic as early as November 5, 2009."

The malicious act struck a collective nerve in the vast, interconnected payments ecosystem. Other reports of high-profile data breaches such as those at Bebe Stores Inc., The Home Depot Inc., and Target Corp. made no mention of the processors or middleware service providers behind compromised big-box brands.

However, the Charge Anywhere breach provided news media with a rare behind-the-scenes peek at the payments industry. Charge Anywhere senior management said they appreciate the gestures of support received from industry friends and colleagues and told The Green Sheet the company needs a bit more time before its representatives can make further comments. The ultimate impact the apparent five-year intrusion will have on Charge Anywhere's business is as yet unknown.

PCI provides guidance, not guarantees

Chris Bucolo, ControlScan's Senior Manager of Security Consulting, noted that hackers have become more advanced, sophisticated and innovative at exploiting vulnerabilities in merchant and processor environments, prompting some clients to debate the overall effectiveness of Payment Card Industry (PCI) Data Security Standard (DSS) security.

"Some of our clients claim that PCI security doesn't go far enough because you can pass a couple of tests but still be at risk for a data breach," Bucolo said. He added that PCI is designed to provide guidelines but not guarantees. He recommended that payment professionals and merchants perform due diligence when vetting prospective service providers and make sure they fully understand the potential providers' security practices. He would like to see more clients push for detailed explanations about the ways in which service providers manage security.

"We encourage clients to ask the tough questions," Bucolo said. "When their processor says, 'We're compliant,' clients can ask processors how frequently they test security levels and how they assess the compliance of other third-party service providers in their networks."

Build relationships with trusted TPSPs

ControlScan is a member company of Third-Party Security Assurance Group, a special interest group of The PCI Security Standards Council (PCI SSC) that's focused on security best practices by TPSPs. The committee published a report in August 2014 providing guidance to businesses that use TPSPs to "store, process, or transmit cardholder data on the entity's behalf, or to manage components of the entity's cardholder data environment (CDE), such as routers, firewalls, databases, physical security, and/or servers."

The comprehensive 44-page report covers everything from how to identify an appropriate TPSP to how to perform risk assessments and maintain a satisfactory, ongoing relationship with aligned interests and optimal security practices. The guidelines list five milestones in a business relationship with a third party: setting expectations, gaining transparency, establishing communications, requesting evidence and obtaining information about PCI compliance.

The report gives several reasons that justify the time and effort involved in developing and implementing a strong TPSP monitoring program. Such a program:

• Improves the security of the cardholder data environment
• Sets expectations for businesses and their service providers
• Keeps the lines of communication open with a formal monitoring program
• Shows businesses how to actively participate in protecting their card data environments by taking a proactive—instead of reactive—position
• Can demonstrates compliance with a key section of the PCI DSS if requested by a party performing an assessment

Biff Matthews is President of CardWare International, a full-service provider of hardware, software, supply logistics and call center services in Heath, Ohio. Matthews saw similarities in the PCI SSC guidelines and the federal guidelines that require banks to know their customers. He noted that all financial institutions, ISOs and merchant level salespeople should really know their vendors, including the individuals who download their POS and PIN entry devices.

Matthews advised to ask plenty of questions before establishing a working relationship. "Is that service provider PCI compliant, and a certified ESO [encryption services organization]?" Matthews said. "Don't hesitate to validate their computer system, physical location security and perform employee background checks. Be secure."