Friday, October 29, 2010

Report: 20 Percent of Cardholders Use Birthday as PIN

It has been reported that many people are using very weak numbers for their credit and debit card PIN, making it easy for thieves and fraudsters to be able to access their accounts. A study was recently carried out, and officials said that one fifth of cardholders were using their birthdays as their PIN, which is an obvious choice that would easily be rumbled by someone that got their hands on the card.
The study also found that people are very careless with their PIN, and around 13 percent kept their PIN written down on a piece of paper, which they then kept in their purse or wallet along with the card itself. Over 1500 people were polled as part of the study. Officials said that the results seemed to show that whilst people were becoming increasingly stringent when it came to their online banking and accounts they were still very lax with their offline accounts.
Another 17 percent of those polled said that they kept their PIN stored on their mobile phones in case they forgot the number whilst they were out. Worryingly, 25 percent of people said that they set the same PIN on all of their credit and debit cards, which means that of someone got hold of the PIN they could access all of their cards rather than just one.
Speaking of people using their birthdates one researcher said: “I would strongly advise against this. You need to select a number that is memorable to you, but not known by other people, or just learn the PIN that the bank provides you with. Consumers who pay for items on a credit or debit card with a PIN are just as vulnerable to identity theft as people who sign for payments. It’s not rocket science; having your PIN written somewhere in your purse or wallet, right next to your credit or debit card, is asking for trouble.”

Enhanced by Zemanta

Visa Meeting Threat from Alternative/Mobile Payments Head On

Visa Debit logoImage via Wikipedia

From the Editors of American Banker

Visa Inc. said it is prepared to confront alternative and mobile payments head on.

Notably, Visa has talked up its July purchase of CyberSource Corp. as giving it the tools to respond to the constantly evolving e-commerce and mobile payment space. It has also worked with DeviceFidelity Inc. to put Visa payment capabilities in mobile phones through a microSD data card that consumers can install themselves.

Visa discussed its plans during a conference call Wednesday to address its earnings for its fourth quarter, which ended Sept. 30. Its call came as PayPal unveiled multiple new initiatives this week to expand its own influence in mobile payments.
Enhanced by Zemanta

Mobile Phones Emerge as Security Threat Targets

sponsored by Trend Micro, Inc.
Posted: 26 Oct 2010
Published: 26 Oct 2010
Format: PDF
Length: 6  Page(s)
Type: White Paper
Language: English
Today’s technology-driven market has given way to the proliferation of mobile phones with advanced features to cater to consumers’ need to stay connected. It is thus not surprising that the worldwide mobile phone sales has increased. Based on Gartner research, the mobile phone sales increased by 13.8 percent in the second quarter of 2010 while the smartphone sales marked a 50.5 percent growth. Symbian was the most popular smartphone OS, accounting for a 41.2 percent share, though Android was the most popular OS in the United States.


Enhanced by Zemanta

PCI Security Standards Council Releases Version 2.0 of the PCI Data Security Standard and Payment Application Data Security Standard—Feedback from global stakeholders shapes revisions; new standards and website ease implementation for merchants—
WAKEFIELD, Mass.--(BUSINESS WIRE)--The PCI Security Standards Council (PCI SSC), a global, open industry standards body providing management of the Payment Card Industry Data Security Standard (PCI DSS)PIN Transaction Security (PTS) requirements and the Payment Application Data Security Standard (PA-DSS), today released version 2.0 of the PCI DSS and PA-DSS. Reflecting input from the Council’s global stakeholders, this latest version is designed to provide greater clarity and flexibility to facilitate improved understanding of the requirements and eased implementation for merchants. Version 2.0 becomes effective on January 1, 2011.
“The nature of the changes is a testament to the strength and growing global maturity of the standards as a framework for securing cardholder data”
The updated standards were the main topic of discussion at the Council’s Annual Community Meetings in Orlando, Florida and Barcelona, Spainwhere, in the last stage of the lifecycle process, stakeholders had the opportunity for final review of the standards. More than 1,500 people from 600 organizations around the world participated in these gatherings, adding to the thousands of pieces of feedback the Council received from merchants, banks, processors and the PCI community throughout the development process.
summary of changes to the standards was shared with the market prior to the release, highlighting the main types of revisions that include clarifications, additional guidance and evolving requirements.
Version 2.0 does not introduce any new major requirements. The majority of changes are modifications to the language, which clarify the meaning of the requirements and make understanding and adoption easier for merchants. Key revisions serve to reinforce the need for a thorough scoping exercise prior to assessment in order to understand where cardholder data resides; promote more effective log management in securing cardholder data; allow organizations to adopt a risk-based approach when assessing and prioritizing vulnerabilities that is based on their specific business circumstances; and accommodate the unique environments of small merchants to simplify their compliance efforts.
The standards, detailed summary of changes and supporting documentation can be found at
“The nature of the changes is a testament to the strength and growing global maturity of the standards as a framework for securing cardholder data,” said Bob Russo, general manager of the Council. “I want to thank each and every individual and organization who contributed to the development of these standards. It’s their input that’s critical in making the PCI Security Standards an excellent baseline for protecting payment card data.”
In addition to the standards documents, the Council has also launched a new website with updated materials and navigational tools aimed at providing its diverse stakeholders with the targeted information they need to understand the standards and how to apply them in their organizations. As part of a broader initiative to help small merchants develop their PCI security programs, it also includes a dedicated site for this key group with resources to address their unique environments.
The release of version 2.0 begins the new three year lifecycle for standards development, which streamlines the development process by aligning DSS, PA-DSS and PTS on a similar three year schedule. The lifecycle also allows for minor revisions or errata to be issued throughout the cycle as necessary.
The new standards are effective January 1, 2011, but validation against the previous version of the standard (1.2.1) will be allowed until December 31, 2011. This gives stakeholders more time to understand and implement the new versions of the standards as well as provide feedback throughout the process. However, the Council encourages organizations to transition to the updated version as soon as possible. From January 1, 2012 and moving forward, all assessments must be under version 2.0 of the standards.
The Council also invites Participating Organizations and the public to a webinar that covers the updated standards in greater depth, followed by a Q&A session with representatives from the Council’s Technical Working Group. Registration details can be found here:
November 9, 3:00 p.m. ET / noon PT (Participating Organizations only)
November 11, 11:00 a.m. ET / 8:00 a.m. PT (Participating Organizations only)
For More Information:
For more information on the PCI Security Standards Council and how to become a Participating Organization, please visit or contact the PCI SSC Secretariat
About the PCI Security Standards Council
The mission of the PCI Security Standards Council is to enhance payment account security by driving education and awareness of the PCI Data Security Standard and other standards that increase payment data security.
The PCI Security Standards Council was formed by the major payment card brands American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. to provide a transparent forum in which all stakeholders can provide input into the ongoing development, enhancement and dissemination of the PCI Data Security Standard (DSS), PIN Transaction Security (PTS) requirements and the Payment Application Data Security Standard (PA-DSS). Merchants, banks, processors and other vendors are encouraged to join as participating organizations.


PCI Security Standards Council
Laura K. Johnson, +1-781-876-6250

Enhanced by Zemanta

Disqus for ePayment News