450K Per Day...Can You Say...SQL (Sequel)

Despite financial institutions taking sensible precautions and employing the latest technologies, the exploits of a young hacker exposes flaws in the system, Wired first reported.

Editor's Note: Oh KNOW!  (or should I say, oh don't  I know IT?) I think it's safe to say that we've (HomeATM) been trying...trying...trying...to drive home(atm)  that message for (at least) the last six months. 

But let's take a time out.  We're going to rely on outside sources now.  Nobody seems to be connecting the dots.  Everything that has transpired over the last year, 5000 SQL attacks per day during the first 2 quarters of 2008 has seen an exponentiation into 450,000 per day. 

So to Imagine that there are flaws in the system related to online fraud really confounds me...NOT!   Sir Prise, Sir REPrise. 

So...all you EFT Networks out there...do you still want a software-based (PIN-Based) so-called solution?  Okay...go for it.  You might be blind to the risks now, but YOU"LL SEE!  Why are you taking the Easy Way out?  Convenience OVER Security?  Anybody out there want to share their opinions?  Click Here, go to the bottom of the post and please comment!    Do you really believe a software approach to protecting your PIN is safe?  We will publish any comment anyone wants to share. 

BACK" to the story...(from SC Magazine)

Court records obtained by Wired show how Israeli-born hacker Ehud Tenenbaumand and his cohorts, using SQL attacks and obtaining administrative passwords, were able to break into the networks of several financial institutions in the United States to steal confidential personal information, which they then sold via the internet. This data was copied onto counterfeit credit cards and used at ATMs to withdraw cash,

Tenenbaum, 29, also known as "The Analyzer," gained notoriety 10 years ago when he broke into computer networks of NASA, the Pentagon and the Knesset, the legislative branch of the Israeli government.

At the time, he was celebrated in Israel -- first being congratulated by now Prime Minister-designate Benjamin Netanyahu for his "damn good IT skills," and then being featured in an advertisement and given a replacement computer to replace the one confiscated by the police, according to the U.S. Department of Defense Information Analysis Center. He then worked as a computer security consultant assisting Israeli enterprises to protect their networks from cyberattacks.

According to the court documents filed in Canada in September 2008, the U.S. Secret Service has been on his trail since October 2007, when they began an investigation into what they termed "an international conspiracy" of hackers attempting to make their way into computer networks of U.S. financial institutions and other businesses.

Continue Reading at SC Magazine

Safe-T-PIN Receives PCI 2.0 PED Certification - The Paypers

HomeATM ePayment Solutions' Safe-T-PIN receives PCI 2.0 PED certification


Online payment services provider HomeATM ePayment Solutions' Safe-T-PIN POS terminal has received Payments Card Industry PIN Entry Device (PCI PED) 2.0 certification.

The pocket-sized Safe-T-PIN provides two-factor authentication for e-commerce transactions and offers users the possibility to swipe their cards instead of keying in their numbers. The terminal allows for authorized person-to-person (P2P) money transfers and offers End-to-End-Encrypted (E2EE) security.

Continue Reading at The Paypers

Safe-T-PIN, HomeATM, PCI 2.0 PED, PCI Certification, Acculynk, Fraud, Hack, Hardware vs. Software, Convenience vs. Security,

First Data Sells 12.5% of JV with Wells Fargo, owns 40%

Wells Fargo takes majority stake in First Data merchant alliance JV

First Data has extended its merchant alliance joint venture with Wells Fargo for five years, the US payments processor revealed today in its full year earnings statement.

As part of the deal, First Data has sold 12.5% of the membership interests in the Wells Fargo Merchant Services venture to the bank for an undisclosed cash consideration. Wells now owns 60% of the company, with First Data holding 40%.

Continue Reading at Finextra

Heartland Threatening Legal Action

Finextra: Heartland threatens rivals over PCI compliance claims

Heartland Payment Systems is threatening legal action against competitors it says are misleading merchant customers with claims they will be penalized for doing business with the processor after it was struck off Visa's list of Payment Card Industry Data Security Standard (PCI DSS) compliant service providers.

Earlier this month Visa removed Heartland, along with RBS WorldPay, from its list of PCI DSS compliant service providers following major data breaches that put the card details of millions of people at risk.

The move prompted confusion among merchants concerned they may judged to be non compliant for using the two payments processors and therefore open to fines.

However, Gartner analyst Avivah Litan says she has received a statement from Visa confirming merchants can continue doing business with the two firms without threat of penalty charges.

This stance will remain valid as long as Heartland and RBS continue to work towards revalidating their PCI compliance, which they are expected to complete within weeks.

"Visa clearly did not want to risk putting the processors out of business, partly because of the potentially enormous disruption to their hundreds of thousands of merchant customers," says Litan.

Continue Reading at Finextra

Heartland Payment Systems, Avivah Litan, Hack, PCI, Visa, HomeATM, Acculynk

Related articles

• Visa Yanks Heartland/RBS Compliance Status - BTN (pindebit.blogspot.com)
• Visa Covers Butt By 'Delisting' Breached Credit Card Payment Processors [Data Breaches] (consumerist.com)
• More Investment Needed to Secure Credit Cards (pindebit.blogspot.com)
• HomeATM at the (Security) Summit! (pindebit.blogspot.com)
• Malware Inside the Credit Card Machine (loosewireblog.com)
• Updated: Acculynk...Where's the PIN Offset? My Pet PVV (pindebit.blogspot.com)

Card Not Present Fraud up 132% in UK

UK Online Fraud Up 132 Percent From 2007, 243% Since 2001
By Andrew Donoghue  - eWeek Europe

A new police e-crime unit will help combat the threat, according to payments industry body.  Banking trade body APACS has released figures showing that online fraud in the UK has increased by 132 percent from losses in 2007. 

Editor's Note: Wait til next year!  Do you think this trend is going to slow down?  Card Not Present Fraud can ONLY be prevented by  employing and utilizing a PCI 2.0 PED  device.  It would enable online shoppers to swipe their card and safely transmit their beginning to end encrypted PIN (and Track 2 data).  HomeATM provides such a device.  A software only solution, by definition, is still a card not present transaction.  Which do you feel is better?  Feel free to comment below.  My position is that this is just the beginning.  This is a REAL threat and we should not enable the fraudsters...we should enable the consumers, banks and merchants...

Here's the story from eWeek Europe:

In a report released late last week, detailing total fraud figures across all forms of payments, the UK payments association said Internet only fraud totaled around £52.5m.

Apacs also noted that so-called "card not present fraud" which covers internet, phone and mail order, had increased by 243 percent from 2001 to 2008. But the organization was also keen to point out that actual transactions in the sector had increased by 524 per cent from £6.6 billion in 2001 to £41.2 billion during the same period.

Phishing has been a particular problem for the banking and payments industry in the past but according to Apacs other forms of malware are also becoming a problem.

"Although phishing incidents continue to increase, online banking customers are increasingly being targeted by malware attacks, which is why the industry continues to remind customers to ensure that they have their computer’s firewall switched on and anti-virus software installed and kept up-to-date," the organisation stated.

To help combat the growing problem of malware, Apacs said that the recently formed Metropolitan Police Service Police Central e-Crime Unit (PCeU), is helping to coordinate law enforcement in the UK to combat criminal gangs exploiting hacking and malware technology.

"The PCeU will also work with the National Fraud Reporting Centre (NFRC) to provide an enforcement response to technologically-enabled serious crime, and support other police forces on receiving intelligence data from the NFRC," Apacs said in a statement.

The payment association defended recent changes to its infrastructure, designed to speed up processing of online payments: "The new Faster Payments Service is not believed to have impacted last year’s online banking fraud losses. The system was only introduced from the end of May – and the online banking fraud losses in the second half of 2008 more or less match those in the first half of the year," Apacs stated.

HomeATM, PCI 2.0 Certified, PCI 2.0 PED, Acculynk, Card Not Present, Card Present, Fraud, Hackers, UK, Online Fraud, Online Payments, Online Shopping

Credit Cards Next Shoe to Drop for Banks

Credit cards 'next shoe to drop' for Canadian banks

Bloomberg News - Excerpts

Credit-card delinquencies and losses have risen with higher unemployment and personal bankruptcies, according to Moody’s Investors Service. Those trends will continue through 2009, even as issuers reduce credit limits and scale back on offers to entice clients.

Rising Losses

Canadian card losses in the third quarter rose to 3.1% of average balances, the seventh straight period of year- over-year increases, according to Moody’s. By comparison, U.S. card losses rose to 6.6% of balances.

Canadian Imperial Bank of Commerce (CIBC), the country’s No. 5 bank, set aside $152-million for card losses for the period ended Jan. 31, nearly double a year ago. Royal Bank of Canada earmarked $83-million, a 28% increase, while Bank of Montreal reserved $56-million for losses in its MasterCard portfolio, up 47%.

CIBC has the most consumer credit-card loans among Canada’s five-biggest banks with $10.5-billion, representing 6.3% of total loans, according to filings. Royal Bank of Canada has the second highest, followed by Toronto-Dominion, Bank of Nova Scotia and Bank of Montreal.

Royal Bank CEO Gordon Nixon said he’s more concerned about rising defaults from credit cards than mortgages in the recession. Royal Bank had $8.93-billion in credit-card loans as of Jan. 31.“There is a natural deterioration in credit in a recessionary environment,” Nixon said on Feb. 26. “Credit-card deterioration always happens much sooner and much more dramatically than you’d have in a mortgage portfolio because they are unsecured loans.”

Canadian banks will see “earnings headwinds” from significant increases in provisions for card losses, Dundee Securities Corp. analyst John Aiken said in an interview. A deteriorating credit-card business is a sign of worsening credit among consumers, which will hurt the banks’ other businesses, he said.

• Credit-card balances at Canadian banks have risen by almost 40% since 2004 to $49.9 billion as consumers took on more debt, Deloitte said in a report last month. Banks and issuers may post an additional $800-million in credit-card losses this year, rising to about $4-billion, the consulting firm said.
  
  
• Canadians owned 71.6-million cards issued by Visa Inc., MasterCard Inc. and American Express Co. at the end of 2007, according to The Nilson Report, an industry publication.

Selected Excerpts from the Calgary Herald via Bloomberg News...to read the entire story, click here.

credit cards, Canadian Banks, Shoe to Drop, HomeATM,

Americans Have a False Sense of PC Security

Computer users are in dire need of a "reality check" when it comes to home PC security, according to the National Cyber Security Alliance and security firm McAfee.

Editor's Note:  Just another reason to employ an End-to-End Encrypted PCI 2.0 Certified Hardware Solution.  Remember, 450,000 SQL attacks DAILY, up from 5000 the first two quarters of 2008.  It's gonna get worse before it gets better..  If you want to trade in your "false sense" for  "REAL" security, we've got it waiting for you.  Swipe...Don't Type.  You're in the Clear Because your Card Data Isn't!



PC World Blog: In a survey released by McAfee and NCSA it was found that while 98 percent of computer users agree that having up-to-date security software is important, a significant portion of those same survey respondents are guilty of having home PC's with security software that is incomplete or dangerously out of date.

Today McAfee also announced 2008 editions of its security software products: McAfee Total Protection, McAfee Internet Security, and McAfee VirusScan Plus.

PC Wakeup Calls Needed

Here are some of the survey highlights:

• Ninety-two percent of Americans think that their anti-virus software is up to date, however only 51 percent actually have currently updated their anti-virus software within the past week.
• Seventy-three percent of PC users in the U.S. think they have a firewall installed and enabled, yet 64 percent actually do.
• About 70 percent of PC users think they have anti-spyware software, but only 55 percent have it installed.
• Over a quarter of PC users say they have anti-phishing software, compared to the 12 percent that actually do.

Over Three Quarters Unprotected

The study paints a grim picture of who really is protected versus those that actually are. The survey reveals under a quarter of PC users are "fully protected" against malware and viruses.

Interestingly the study says older respondents showed more computer "savvy" than their younger counterparts when it comes to PC security. Nearly 25 percent of PC users 45 and older are fully protected, compared to 18 percent of PC users below the age of 44.

The takeaway for PC users is a no-brainer and that is ignorance is not bliss when it comes to PC security. That point is especially important when it comes to home PCs and the amount of personal financial, health, and private communications (e-mail) that is stored on them, the study points out.

Sure the survey comes off on the self-servant side for McAfee. But I suppose slapping people with threatening statistics is a good way to get them to buy up on the latest McAfee software. The language is also a little less than flattering of computer owners, which pretty much boils down to, "You don't know jack, America."

Check out PC World's latest review of McAfee's Internet Security Suite 2007.

Acculynk, HomeATM, False Sense of Security, PIN Debit, PIN Payments Blog, PC World, McAfee, Security, PC, Breach, Fraud, PIN,

Related articles

• Three Bad Computing Habits You Need to Break Right Now (enduserblog.com)

PayPal Provides False Sense of Security

Paypal Protection Gives Online Shoppers False Sense of Security - RealWire

Maybe it Works better on Half.com? Seems to work ok for the guy on the left...he seems to sleep okay at night!

Savvy consumers shouldn’t rely on the Paypal’s Protection for Buyers, which includes the Buyer Complaint Policy and Paypal Buyer Protection for eligible ebay purchases.

Paypal have a tendency to frustrate both buyers and sellers by closing disputes for reasons only known to them. Additionally, their Protection for Buyers imposes over-restrictive time limits, has significant exclusions and has some major limitations:

Inadequate Time Limits
To be eligible for Paypal Protection for Buyers you must start the dispute process within 45 days of payment being sent and if you are going to escalate this, you must do so within 20 days of raising the dispute. This is not adequate. For example, you might not discover that the item you bought is counterfeit until it develops a fault after many months, or you may be advised that the item will not be delivered until back in stock, which may take several weeks.

Significant Exclusions
It is wrong to think that all products are automatically covered under Paypal’s Protection for Buyers. There are exclusions and it isn’t always apparent where this is the case and depends on the particular ebay site being used and the item being purchased. Two notable exclusions are motor vehicles and airline tickets.

Major Paypal Buyer Complaint Policy Limitations
The Buyer Complaint Policy which provides protection for transactions outside ebay also has two significant limitations.

First, Paypal will not make a decision on whether an item is “not as described”. For example, if you buy a new book and it turns out to be used or is damaged, you can use the process to make a dispute, but you are on your own. Paypal will not get involved nor make a decision either way.

Second, for items that are not delivered Paypal will only refund your money if they can recover this from the seller. Fraudsters know this and are likely to withdraw your money as soon as they get it.

Continue Reading

Related articles by Zemanta

• New eBay Fraud (schneier.com)
• eBay Looking to Expand PayPal's Reach (technologizer.com)
• eBay takes a step back from e-commerce (dailyfinance.com)
• EBay's Big Plans for PayPal (businessweek.com)
• Skype on the Block? (marketingpilgrim.com)

Cybercriminals Cache In (Google)

Cybercrime server exposed through Google cache

Channel Register: Some 22,000 card records have been exposed on Google through cached copies of data stored on a defunct cybercrime server.

ITnews in Australia says that 19,000 of the 22,000 exposed details referred to U.S. and U.K. cards and that data came from Google cache records from a disused Internet payment gateway.

The cybercrime site, registered in Vietnam, is no longer operational. The data includes credit card numbers, expiration dates, names and addresses for accounts held with Visa, Mastercard, American Express, Solo and Delta.

Click to continue

Related articles

• On to the Next Breach... (pindebit.blogspot.com)
• Credit cards 'next shoe to drop' for Canadian banks (financialpost.com)
• Will any one of Bank of America, Citibank, CapOne or Chase buy a transaction network in 2009? (hubdub.com)

Gartner: Fraud Increasing Bank's Risk of Losing Customers

Card fraud pushes consumers to non-bank online payments

Digital Transactions: A new Gartner Inc. report suggests that financial fraud could drive consumers away from banks and into the arms of electronic payment systems, such as PayPal, that they perceive to be more secure.

The report, based on surveys of 5,000 adults, estimates about 7.5 percent of U.S. adults lost money to some form of financial fraud in 2008.

Gartner’s results add to a growing body of evidence that fraud costs banks customers, not just dollars.

In 2008, victims of electronic-checking and/or savings-account transfer fraud were five times more likely to change banks because of security concerns.

Fraud involving credit and debit/ATM cards was the method most actively used by crooks to steal money, claiming 36 percent more victims in 2008 than other types of fraud, according to Gartner

Related articles

• Gartner: 7.5% of US Adults Victims of Financial Fraud (pindebit.blogspot.com)
• Mercator Study on Japanese Payment Market (pindebit.blogspot.com)

To Hell With Convenience

Here are some excerpts from an article in todays Mirror.co.uk 

You'll note that criminals prefer Card Not Present crimes.  So how do you get rid of Card NOT Present crimes?  Get rid of Card NOT Present transactions.  Swipe...Don't Type!

You also might take note that "convenience vs. security" only works in a perfect world.  If that perfect world is breached...all hell breaks loose.  Consumers might be protected, but "two weeks of hell" sounds rather "inconvenient" to me.  Wait a minute...If I saved 3 seconds on 20 transactions, no nevermind, still not worth even an hour in hell...

Therefore, "To Hell with Convenience" is this posts title.  Here's theirs: 

Debit and credit card users beware - new fronts have opened in the clone wars
The Mirror UK  By Tricia Phillips 25/03/2009

Maxine Skelton knows to her cost the pain of card cloning fraud – she’s been hit not once, not twice but THREE times. The rip-off’s a big earner for thieves, with cases doubling in the past two years to push dodgy bank transactions to a record £609million.

Maxine fell victim to one of the biggest scams around, a counterfeit card copied using stolen UK card details for use in countries yet to upgrade to chip and PIN.

“It was awful. I had two weeks of hell with no access to any cash in my account.

I had to use my credit card to live off. This type of thing really does mess up your life.” Maxine was able to prove she hadn’t spent the money and got her cash refunded.

“It has made me really careful now. I don’t let my cards out of my sight, I tear up all my receipts, I double-check every item on my statements and I’m wary at cashpoints. It’s worrying knowing strangers can steal from your account.”

Kerry D’Souza, a fraud expert at card protection company CPP, says: “Criminals like card-not-present crimes because they can do it without having to make face-to-face transactions.

Click here to read the entire story at the Mirror