Mobile Payment Industry News

Wednesday, March 11, 2009

Top 10 Most and Least Admired Companies - Fortune

Rank Company Industry Rank

1	Apple	2
2	Walt Disney	1
3	Google	1
4	Nike	1
5	Medco Health Solutions	1
6	Herman Miller	1
7	Amazon.com	2
8	Goldman Sachs Group	1
9	Integrys Energy Group	1
10	Graybar Electric	1

WORST (Least Admired)

1	Dillard's	10
2	Sears Holdings	9
3	Circuit City Stores	11
4	Family Dollar Stores	8
5	PEMEX	14
6	McClatchy	7
7	National City	12
8	Surgutneftegas	14
9	ONEX (Celestica)	10
10	US Airways Group	12

From the March 16, 2009 issue

363 Top Rated Companies

High-Tech Criminals Target ATMs to Steal Vital Personal Financial Information From Customers

ADT Offers New ATM Security Technology to Combat 'Skimming,' Which Results in Millions of Dollars of ATM Fraud Losses

BOCA RATON, Fla., March 11 /PRNewswire/ -- Skimming - a way criminals use high-tech electronic tools to capture personal financial information and steal money from automated teller machine (ATM) customers - is one of the financial industry's fastest-growing crimes, according to the U.S. Secret Service.

Also, the worldwide ATM Industry Association (ATMIA) reports over $1 billion in annual global losses from credit card fraud and electronic crime associated with ATMs.

"But perhaps the most significant skimming cost to financial institutions is the damage to their reputation and the loss of customer confidence that accompanies the theft of personal financial information," said Hank Monaco, vice president for ADT Security Services.

ADT is introducing to North American financial institutions its Anti-Skim(TM) ATM Security Solution that helps prevent skimming attempts and detects skimming devices on all major ATM makes and models.

In a matter of seconds, criminals can place a skimming device on an ATM card reader that blends in with the machine's appearance and does not interfere with its operation. A small wireless camera, concealed near the ATM fascia, is also used to capture the user's personal identification number (PIN) as it is entered. Information from the device and camera is sent wirelessly to the criminal's laptop computer. The ATM user typically has no idea that his or her information has been compromised.

Criminals use the stolen data to "cash out" debit card accounts, clone duplicate credit-debit cards or sell personal financial information to worldwide crime syndicates. Several high-volume transaction ATMs in an area can be targeted in just one day.

Boca Raton Police Chief Dan Alexander said identity theft and related offenses such as ATM skimming are a serious concern in the community. Boca Raton Police will begin a campaign through its Viper program to help raise awareness among residents. Tips will include how to protect your identity from criminals.

"The Strike Out Identity Theft campaign is a perfect example of how community partners such as ADT can work in conjunction with law enforcement to help protect the public," Alexander said.

To help reduce ATM skimming, the ADT solution is installed inside an ATM near the card reader, making it invisible from the outside. The technology helps prevent card-skimming attempts by interrupting the operation of the illegal card reader. The solution also detects the presence of foreign devices placed over or near an ATM card entry slot, without disrupting the customer transaction or operation of most ATMs. For effective, layered ATM security, the ADT solution can trigger a silent alarm for command center response and can coordinate video surveillance of all skimming activities.

The ADT Anti-Skim ATM Security Solution:

* Helps protect the integrity of cardholders' personal financial information during ATM transactions.
* Can trigger a silent alarm for command center response and coordinate video surveillance of all skimming activities.
* Requires no software adjustments to the ATM.
* Does not connect to or affect the ATM communications network.
* Has more than 40,000 successful ATM applications worldwide.

ATM operators should take advantage of anti-skimming solutions, according to Lana Harmelink, ATMIA's chief executive officer, the Americas.

"Skimming is a problem that will continue to grow until available technology is employed to bring it under control," she said. "The technology exists today to help defeat the problem."

Monaco said a recent study by Harris Interactive reported that 67 percent of U.S. adults who use financial institutions with ATMs would likely switch after experiencing ATM fraud or a data breach.

"This survey highlights the important role that the ADT Anti-Skim ATM Security Solution can play in helping secure consumer confidence in ATM transactions," he said. "ADT already helps to protect tens of thousands of retail banking facilities, operations centers and ATM operations with a variety of intrusion, access control and video surveillance systems. Our new anti-skim solution adds another layer of protection for financial institutions."

About ADT Security Services

ADT Security Services is a unit of Tyco International and part of ADT Worldwide, the world's largest security provider. In North America, ADT provides electronic security services to nearly five million commercial, government and residential customers. ADT's total security solutions include intrusion, fire protection, video systems, access control, critical condition monitoring, home health services, electronic article surveillance, radio frequency identification (RFID) and integrated systems. ADT's government and commercial customers include a majority of the nation's Fortune 500 companies, all U.S. federal courthouses and over 70 mid to large airports. Headquartered in Boca Raton, Florida, ADT has more than 24,000 employees at approximately 240 locations in the U.S. and Canada. More ADT information is at http://www.adt.com

SOURCE ADT Security Services

skimming, ATM, ATMs, Financial Information, ADT, Financial Institutions, HomeATM, PIN Debit Blog,

New Wave of Internet Acquisitions May Be Ahead

Large companies will buy smaller firms for their technologies instead of investing in R&D. by Alex Goldman:

A new report from J.P. Morgan suggests that the future of Internet business starts with consolidation in 2009, as the biggest companies buy the best of the small.

With the economy approaching zero or even negative growth, Internet companies are still under pressure to grow -- and the only way to do so is through acquisitions, J.P. Morgan Analyst and Managing Director Imran Khan wrote in a report.

Large companies have every reason to put money into mergers, he added.

For one reason, the stock price of smaller companies (those with market capitalizations under $1 billion) is getting cheaper, while the stock of larger companies (those with market caps over $5 billion) is not. While large companies' stock prices remains close in value now to their value at the start of the year, the stock of small companies has fallen in value by 23 percent, on average -- potentially making them a steal.

At the same time, acquisitions would give large companies access to the fruits of smaller companies' research and development, which is becoming increasingly critical as they trim their own research budgets. According to Khan, large companies have decreased the rate of growth of investment in R&D from 25 percent a year ago to a projected 9 percent this year...

Continue Reading at Internet News.com

Chase Paymentech Predicts: PIN Debit Ubiquitous on Web by 2012

Merchant Risk Councils Platinum Day - Afternoon Sessions
by Allen Weinberg - Glenbrook Partners Payments Views

Allen Weinburg, from Glenbrook Partners, who is blogging about the Merchant Risk Council's Las Vegas conference, wrote an article in Payment Views entitled: "Is Now the Time For Online PIN Debit?"

Mike Strada, from Chase Paymentech predicts that PIN Debit on the Internet will be the most widely used payment mechanism on the web by 2012. I agree.

Allen also talks about 4 solutions, and whether 3D Secure might be just as good, if not a better solution. I took a moment out of my morning to leave a comment ascertaining that the answer is probably yes...for all but one.

Is Now the Time for Online PIN Debit?

This session was presented by MikeStrada from Chase Paymentech. Mike is a fan of online PIN debit,especially the notion of giving merchants more choices. His discussionfocused on the different options the 12 North American debit networksare exploring.

Several of the debit networks are exploring PIN debit, some aren’t.ACCEL, NYCE, PULSE and STAR are doing PINless debit for utility andother low risk payments. Mike explained that these are the 4 networksthat are exploring PIN debit on the Internet. Three of these four (allexcept STAR) have recently announced PIN debit pilots.

Mike maintains that PIN debit forecommerce transactions could provide some incremental sales lift formerchants, especially since 14% of debit cards are “ATM only” – i.e.,they don’t have a MasterCard or Visa logo on them and thus can’t beused for general ecommerce transactions.
Mike explored the pros and cons of the four alternatives:

Acculynk (formerly ATM Direct, previously owned bynow-defunct Pay By Touch). ACCEL, NYCE and PULSE have all signed LOIsto do pilots with Acculynk. Mike thinks two more debit networks willannounce pilots within the next 90 days.
Safe-Debit (the same name of the program NYCE wentto market years ago using a CD ROM token). This iteration is usingVerient’s platform to redirect the user to the customer’s home bankingsite for authentication. In this case, the cardholder is sent a onetime PAN for use at the merchant site. Hoping to do a pilot in firsthalf of 2009. This, of course, requires a redirect which scares a lotof merchants due to the increased risk of abandoned shopping carts.
Claerity – technology allows consumer to registercell phone number with their DDA FI. The bank, via the network, sendsone time password back to cell phone which the shopper enters onmerchant checkout page. Network compares the onetime password sent tocell phone with the one issued to the consumer. Not clear who will bearthe cost of the SMS message. Hoping for a 2009 pilot, but unclear if ontrack.
Home ATM – Canadian firm distributes USB PIN padthat has a mag-stripe card reader and encrypts data. Has a distributionagreement with Microsoft, but no announced pilots.

Mike acknowledged one of the big issues that Glenbrook encounterswith our merchant clients – critical mass and the challenge of gettingonline merchants adopting two or three (forget four or more) differentprocesses. Our clients tell us they’ll consider it when the networksadopting a particular approach/technology bring critical mass ofcardholders in aggregate. My sense is that STAR has critical mass untoitself. The next 3 largest networks (assuming Interlink and Maestrowon’t play) would need to converge on a solution to bring critical massto market. Just my opinion, but Mike doesn’t think standardization willhappen in the foreseeable future, and Paymentech has decided to moveforward anyway.

Mike/Chase Paymentech is predicting that be the end of 2010, most ofthe major networks will implement online debit products (excluding, ofcourse, Interlink and Maestro), with transaction pricing somewhere inbetween physical POS interchange and online Visa/MasterCardinterchange.

Mike also predicted that by 2012, online PIN debit could be the mostwidely used payment mechanism on the Internet.

The operating rules forhandling online PIN debit transactions haven’t been worked out, butthey’re working on it. He acknowledges that the rules really should be,and probably will be standardized across networks.

ChasePaymentech has agreed to do a pilot with Acculynk (and is looking for merchants to participate).

Of course there’s the fraud risk associated with these new products(Mike acknowledged it, but didn’t spend much time on this area).

Mike feels the consumer proposition is one of safety, security, and identity theft protection.

One question I have is whether 3D Secure technology could do just aswell as the above four products/technologies mentioned above. Mikethought that it probably could, but he wasn’t aware that any of thedebit networks had considered that path (could mitigate merchantadoption problem).

The merchants in the audience were somewhat skeptical on a number offronts. For example, how to deal with split shipments that span theauthorization time frames. They worried about consumer valueproposition and recalled all the issues they encountered with 3DSecure, particularly how the banks/issuers didn’t do as good a job asthey needed to educating their cardholders.

{ 1 comment… read it below or add one }

: Your comment is awaiting moderation.

You questioned whether 3D Secure Technology could do just as well asthe four products/technologies mentioned above. You pose an interestingquestion, but I want to point out that you cannot lump those fourtogether, as there is one key distinction. 1 uses a hardware device.The other 3 are software-based.

Which leads me to ask a pertinent question… How is it even“possible” to “securely” process a PIN Debit transaction WITHOUTHardware? (a magnetic stripe reader and PED) If a software applicationis utilized, then, by definition, it is a Card Not Present transaction.Thus a software based approach “cannot ” be a pure PIN Debit play…asthe card “must” be present in order to process the track data locatedon the magnetic stripe.

Remember…all PIN-based transactions “require” the submission ofvalid track data in order for the PIN to be properly decrypted. Withouttrack data, PIN submission becomes unnecessary and the transaction isbetter submitted as a manually-entered credit card transaction (withouta PIN), therefore 3D Secure would be just, if not more, effective.

For a true PIN Debit transaction to occur, a developer mustimplement PIN support as part of the submission process. Without trackdata, it becomes impossible to encrypt or decrypt PIN numbers (becausethe magnetic stripe data is used as part of PIN encryption/decryption).If track data is not submitted, a debit card transaction becomesimpossible and the transaction becomes a manually-entered credit cardtransaction.

That said, I would have to agree with Allen when he says there’s afraud risk associated with these new products (the lone exception beingthe one who utilizes a hardware “SwipePIN” device capable of not onlyproviding: E2EE, 3DES DUKPT, but also encrypting the Track 2 data aswell.) Track2 = PAN+Separator+Expiry Date+ServiceCode +Pvk Index+ PVV +CVV

Is it a coincidence that the event is called “The Merchant RiskCouncil” and although Mike Strada “acknowledged the risk of fraud… “hedidn’t spend much time on it?”

PN Debit card transactions require the availability of two (unlessyou combine them into one) hardware device(s): a PIN pad and a magneticstripe reader. Unless both a PIN pad (which is configurable with aworking key) and a magnetic stripe reader are both available andoperational, these debit card transaction examples cannot be applied asa PIN Debit card transaction requires both track data and an encryptedPIN to proceed.

Therefore, the only logical conclusion is that a Hardware device isrequired, not optional. What’s the big deal with a hardware deviceanyway? Did you ever have to charge your cell-phone…sometimes ahardware accessory is necessary to protect the Holy Grail. (PIN’s)

Otherwise the Heartland Breach will pale in comparison to what willhappen if people start putting their PIN’s into a software-basedapplication. The writing has never so clearly been written on any wall.

Where am I wrong here? Where is Avivah Litan wrong? Where are theSociety of Payment Security Professionals wrong? I’m dying to know,because I was a founding shareholder in Pay By Touch and could havebought ATMDirect out of the PBT bankruptcy “cheap.”.

You mean to tellme that PayPal will fork out nearly $1 BILLION for Bill Me Later butsaid “later” when it came to forking out $600K for ATMDirect? If so,and PIN Debit is the most widely used payment mechanism on the internetby 2012, (as Mike Strada/ChasePaymentech predicts) then not evenbidding on ATMDirect will go down as one of the biggest mistakes inPayPal/Ebay history. (and mine) But I think we're both fine...

TAGS: SwipePIN, Secure Transaction, Debit, Security vs. Convenience, Corey Tisdale, EFT Networks, Accel/Exchange, NYCE, Fiserv, STAR, Pulse, Ashish Bahl, ATMDirect, Internet PIN Debit, Mike Kelly, Shoppers Choice, PaySecure, Acculynk, HomeATM, Society of Secure Payment Professionals, Avivah Litan, HomeATM, PVV, PVKI, PIN Offset, PIN Verification Value, Malware, Keylogging, Screen Scraping, Hackers, Holy Grail, PIN's Stolen, PIN Numbers Hacked, Swipe Don't Type, PAN, PIN, PIN Debit, Hardware vs. Software, Nandan Sheth, Ken Mages, Mark Paul,

Tuesday, March 10, 2009

Cardinal and CyberSource Team Up

MENTOR, Ohio, March 10, 2009 (GLOBE NEWSWIRE) -- CardinalCommerce Corporation, the worldwide-leading payment brand enabler, today announced a new strategic partnership with CyberSource Corporation (Nasdaq:CYBS), a leading provider of electronic payment and risk management solutions. CardinalCommerce has integrated its Cardinal Centinel(r) Platform with CyberSource's payment management services to provide CyberSource merchants with continued, strengthened support for Verified by Visa (VbV) and MasterCard(r) SecureCode(tm) (MCSC).

Through the partnership, CyberSource is able to leverage Cardinal's team, which provides active monitoring and quality assurance so participating merchants receive the maximum benefits of VbV and MCSC -- including the potential for fraudulent chargeback protection and interchange savings. By utilizing Cardinal's hosted platform, CyberSource customers will also have the benefit of improved reliability and speed for VbV and MCSC transactions. Enhanced transaction performance and Cardinal quality assurance review are designed to create an optimized authentication experience for both merchants and their customers.

"To be entrusted by one of the world's premier online fraud prevention companies is a great achievement for Cardinal," said Tim Sherwin, EVP/CMO, CardinalCommerce. "We are proud of the incredible growth, adoption, and evolution of our Cardinal Centinel platform that has brought us to this very important partnership. Clearly, we are excited to bring our enhanced payer authentication offering together with CyberSource's well-known payment services to grow our business."
Story continues below ↓advertisement | your ad here

About CyberSource

CyberSource Corporation is a leading provider of electronic payment and risk management solutions. CyberSource solutions enable electronic payment processing for Web, call center, and POS environments. CyberSource also offers industry leading risk management solutions for merchants accepting card-not-present transactions. CyberSource Professional Services designs, integrates, and optimizes commerce transaction processing systems. Approximately 253,000 businesses use CyberSource solutions, including half the companies comprising the Dow Jones Industrial Average. The company is headquartered in Mountain View, California, and has sales and service offices in Japan, the United Kingdom, and other locations in the United States including Bellevue, Washington and American Fork, Utah. For more information on CyberSource please visit www.cybersource.com or email info@cybersource.com. For more information on Authorize.Net small business solutions, please visit www.authorize.net or email sales@authorize.net.

About CardinalCommerce

CardinalCommerce Corporation is the global leader in enabling authenticated payments, secure transactions and alternative payment brands for both eCommerce and mobile commerce. Cardinal Centinel(r)* enables payment brands such as Verified by Visa, MasterCard(r) SecureCode(tm), Amazon Payments(tm), Bill Me Later(r), Clickandbuy(tm), Ebates(tm), eBillme(tm), eLayaway(tm), Google(tm) Checkout, Green Dot(r) MoneyPak(r), Mazooma(tm), MyECheck, NACHA(r) Secure Vault Payments (SVP), PayPal(tm), RevolutionCard(tm), Western Union(r), Ukash(tm), and more to a network of thousands of merchants and merchant service providers. Our mobile commerce platform, Cardinal MAX(tm), makes it simple for retailers to sell and market products through the mobile channel. Cardinal's proprietary and easily deployable technology provides consumers, merchants, credit/debit card issuers, and processors the ability to conduct authenticated Internet, wireless and mobile transactions safely and securely. Headquartered in Cleveland, Ohio, with facilities in the United States, Europe, and Africa, Cardinal services a worldwide customer base.

For more information, visit www.cardinalcommerce.com

Shoppers Choice Runs Acculynk PaySecure (tm) PIN Debit Transaction

Editor's Note: Once, again...two questions. Where's the PVV, and the PIN offset? HomeATM has a lot of knowledgeable and respected card industry authorities on our side (scroll down to the next post) but what's disconcerting, is that the Top 500 Internet Retailers are eager to save money on Interchange Fees.

Acculynk is smart. They are being very generous with their how they slice their transaction fee pie. They are enticing the EFT Networks with some potentially major cabbage, and since they (the EFT networks) are currently making absolutely $0.00 on the Internet, it's alluring, because they're anxious to penetrate this lucrative market. I hope the lure of the cabbage hasn't clouded their judgment, because almost everyone I am talking to sees some major risks to a serious breach. Speaking of breaches...I have ONE BIG QUESTION. When there is a breach, because it's not iffy, it's whenny, who has the liability? Who will they PIN the Blame on? It it the Internet Retailer? Is it the EFT Network? Or did Acculynk get a $500 million Lloyds of London insurance policy? Somebody's got to pay. Who will it be?

What's good about all this, is the fact that PIN Debit for the Internet is getting some well deserved exposure. What's potentially bad is that PIN's may get some exposure too. "I told you so" won't feel good. I'd rather provide exposure to the risks, than have PIN's exposed to the risk.

It is easy to overlook the online payment platformas a simple link in the e-commerce chain. However, choosing the rightpayment system could make the difference between a successful businessthat is trusted by its customers, and one that is burdened/destroyed by fraud.Asking the right questions of prospective providers and looking closelyat the technical, security, and particularly the anti-fraudcredentials, will help build a solid platform for success online.

Here's the latest press release from Acculynk:

PRESS RELEASE ShoppersChoice.com Runs First PaySecure(TM) PIN Debit Transaction

Acculynk delivers "real" debit card processing via the Internet

ATLANTA, Mar 10, 2009 (BUSINESS WIRE) -- ShoppersChoice.com, a luxury cooking and outdoor living retailer, is processing purchases made with PaySecure(TM), the first and only software service for PIN debit on the Internet.

PaySecure(TM) meets consumer demands for increased security and convenience, while providing merchants lower interchange fees, reduced fraud and charge-backs, guaranteed funds and simple implementation with the online checkout.

"We are very excited to bring PaySecure(TM) to our website because we are constantly seeking new, innovative payment methods that are convenient, safe and easy for our customers to use," said Corey Tisdale, COO, ShoppersChoice.com. "What we especially like about PaySecure(TM) is that our customers don't need to enroll in a program or download an interface to use it, which keeps customers on our site."

Over the past five years, various attempts have been made to bring PIN debit online, but no solution has succeeded in gaining traction with merchants, consumers, EFT networks and issuers. PIN debit is an ideal online payment method because it provides an extra layer of security for consumers and cost savings for merchants, while offering attractive margins to issuers and a new revenue source for EFT networks.

PaySecure(TM) is the first product to gain approval by four EFT networks, including ACCEL/Exchange from Fiserv and NYCE, to run Internet PIN debit transactions.

"The industry has waited a long time for a PIN debit solution that meets the security requirements of the EFT networks but could also be accepted by merchants, consumers and issuers and become a 'standard' for PIN debit online," said Mike Kelly, General Manager of ACCEL/Exchange EFT network, owned by Fiserv, the leading global provider of financial services technology solutions. "We feel Acculynk's product could become this standard."

ShoppersChoice.com represents the first of four pilot merchants that will trial the service. Pending the results of the pilot, over 20% of the Internet 500 retailers have expressed interest in launching the solution as part of their consumer checkout options.

PaySecure(TM) has the potential for widespread adoption because it provides a simple checkout experience and can be used with a consumer's existing debit card and PIN. "PaySecure(TM) leverages a familiar payment method - PIN debit - that is already preferred at the retail point of sale but has never been offered online in a software-only service," said Ashish Bahl, CEO of Acculynk. "We have designed our service to mimic the brick and mortar PIN debit payment experience so it is completely intuitive for customers to understand and use, which will help ensure consumer adoption."

About ShoppersChoice.com
ShoppersChoice.com is a luxury cooking and outdoor living retailer. ShoppersChoice.com offers the best service, the best selection, the best trained staff, and the fastest ship times available on- or off-line at a price point that meets or beats all other online retailers. ShoppersChoice.com is one of the Top 500 Internet retailers and is headquartered in Baton Rouge, LA. For more information, visit www.shopperschoice.com.

About Acculynk
Acculynk is a leading technology provider with a suite of software-only services that secure online transactions. Backed by a powerful encryption and authentication framework protected by a family of issued and pending patents, Acculynk's services provide greater security, reliability, convenience and return on investment for consumers, merchants, networks, issuers and acquirers. For more information, visit www.acculynk.com.
SOURCE: Acculynk

Acculynk
Corporate Contact:
Danielle Duclos, 678-894-7013
Director of Marketing
dduclos@acculynk.com

Copyright Business Wire 2009 End of Story

TAGS:

Monday, March 9, 2009

Updated: Acculynk...Where's the PIN Offset? My Pet PVV

Updated: I just got off the phone with Chris A. Mark, CEO and Founder of the Aegenis Group and the Society of Secure Payment Professionals.

Apparently, John Stewart, Editor of Digital Transaction News, saw this post and called Chris to discuss a "hardware vs. software" approach.

I had our CEO, Ken Mages join us on the phone. Chris is probably one of the foremost experts in PCI and payments security and 1 of about 20 people in the world who "truly" understands how a PIN transaction works, so since Ken is another 1 of the 20, it made sense for him to collaborate with Chris.

In fact, here's a little backgrounder on Mr. Mark: Quite impressive to say the least...

The Aegenis Group is led by

Chris Mark, CISSP, CIPP; CEO/President and Founder

Mr. Mark is an experienced information security professional and PCIexpert. Over the past six years, Mr. Mark has worked in variousinformation security capacities within the payment services’ segment.Most recently, Mr. Mark was employed at MasterCard Worldwide where hewas one of MasterCard’s representatives on the Payment Card IndustrySecurity Standards’ Council (PCI-SSC)Technical Working Group. In addition to founding an informationsecurity company and conducting numerous PCI assessments for merchants,service providers, and members, Mr. Mark has worked with bothMasterCard Worldwide and Visa USA on components of their respectivedata security programs.

Mr. Mark is also contracted with Visa to train all of their majoracquirers and the top 3000 merchants in the PCI DSS. Prior to joiningthe civilian sector, Mr. Mark served in both the United States MarineCorps, where he operated as an elite Force Reconnaissance Marine andMarine Scout/Sniper, and in the US Navy where he was selected to serveas a Navy SEAL Officer. Subsequent to sustaining a career endingtraining injury, Mr. Mark served as the Training Officer and ChiefInstructor of the US Marine Corps Basic Reconnaissance Course where hewas responsible for screening, selecting, and training eliteReconnaissance Marine Candidates. Mr. Mark is a combat veteran ofOperation Continue Hope, Mogadishu, Somalia. Mr. Mark holds the CISSP,and CIPP professional certifications, numerous technicalcertifications, and has an MBA and BA degrees.

Here's an excerpt from an email he sent me:

John,

John Stewart from Digital Transactions called to ask about the differences in Home ATM and Acculink. I was very clear that conceptually I feel HomeATM is a much better solution.

Please feel free to call me to discuss the article comments.

Chris
Chris A Mark, CISSP, CPISA, CPISM, CIPP
The Aegenis Group, Inc.

We spoke at length about the security of our solution and he was impressed enough to want to learn more and we are happy to provide him with anything and everything we can so that we can empower his analysis. We agreed to FedEx him a SwipePIN device (pictured below) and we'll talk again after Ken gets back from the Merchant Risk Council meeting in Las Vegas on Thursday or Friday. I'll provide an update. Here's the rest of the story....

In an effort to prove that I am not alone in questioning the security of Acculynk's Floating PIN Pad I am going use a respected third party resource to back up my concerns... just in case people confuse common sense for competitive jealousy. I assure you, I have none. (common sense that is...lol)

In fact, in an act of fairness...I hereby extend an open invitation to any C-Level Executive at Acculynk to address the two questions highlighted on the graphic on the left. I am more than happy to allow them the opportunity to set the record straight. It is not my intention to berate their solution. It IS my intention to prevent a future breach that makes Heartland's pale in comparison...which is exactly what would happen if hackers got their fraudy-little fingers on PIN's.

As I said, I've spoken to Acculynk President Nandan Sheth quite a few times over the course of the last year and have nothing but good things to say about the him. As a matter of fact, after taking my cell-phone off the charger, I see that I missed a call from him earlier this afternoon, so I owe him a return call...

The following is from the Society of Payment Security Professionals blog written by Chris A. Mark, CISSP, CPISA, CPISM, CIPP, Founder and CEO of The Aegenis Group.

In the article he published last October, Chris questioned the security of Acculynk's Floating PIN Pad. Online PIN Debit; Great Idea or Not so Great Idea?

The big questions he asked about (besides security) is that if a "card is not present" (CNP) i.e. in Acculynks model one must manually type in the credit or debit card's personal account number (PAN) and if it's determined that the card can be used with a PIN, then the floating PIN Pad GUI pops up. The e-shopper then uses the floating PIN Pad to enter their PIN. So...with no swipe...just type...they want to know: "Where is the PIN Verification Value (PVV) and where is the PIN Offset stored?" Good questions! In a traditional PIN Debit transaction (like the one that most closely mimics the consumer experience in a grocery store...the PVV and PIN Offset is resident on the magnetic stripe. No Swipe...No Stripe! No Stripe...No PVV...NO PIN Offset.

Besides the fact that in 500+ breaches, software was 92 times more likely to be breached than hardware, those were two more very important reasons why HomeATM went with a Hardware based solution.

Here's an excerpt from the Society of Security Professional Blog:

I (Chris) want to thank Susan Kohl for sending this over. Digital Transactions has published several articles on new technology that will allow PIN Debit for eCommerce sites. Read the article here.

In short, the new technology will present a buyer with a floating ‘PIN Pad’ on the screen. Users can then enter their PIN which will then allow the merchant to immediately debit the user’s account for payment. While the technology appears very compelling from a convenience perspective I have to admit that it also gives me pause. In my mind, there are a number of potential issues with this technology. I am sure (or at least hoping) the companies, banks and card brands are working through these issues but they merit discussion here anyhow.

From a security perspective, I am challenged by the technology. My first thought is key stroke logging and malicious software. Now I know people will likely say that this is possible with traditional eCommerce transactions. This is accurate. In this scenario, however, PIN data is being transmitted. As discussed in a previous entry, there may not be a limit to the liability associated with compromise of PIN data. It brings another question to light, as well.

If the transaction is a ‘card not present’ transaction then where is the PIN Verification Value / PIN Offset stored?

In a traditional PIN Debit transaction it is resident on the magnetic stripe of the card. This has several benefits one of which is that it prevents a data thief from obtaining a PIN and only the primary account number and being able to conduct PIN based transactions.

If the card is not required to be presented, it appears that this would allow fraudsters to obtain the PAN or other card data and the PIN and conduct transactions.

Editor's Note: Holy Grail Batman! See I'm not biased. And I'm not alone with my "concerns." Do you have any? As always, feel free to leave a comment. Click on the title of the post, and the comments will be enabled on the bottom. Have a salubrious weekend!

Acculynk, HomeATM, PIN Offset, PIN Verfication Value, Society of Payment Security Professionals, Heartland Breach, PIN Debit, HomeATM, Internet PIN Debit, Anthony Freeman, The Aegenis Group

Ten Commandments of Web Payments

The Ten Commandments of the Web Payment Card Industry

I   Thou shalt assume that the operating system software environment is compromised by all sorts of malware.

II   All cards shall be secured with a PIN number.

III No user will ever be asked to provide their PIN to anyone.

IV All PIN numbers shall be entered via a secure I/O method, either an encryptedPED or controlled keyboard input.

V    All credit card PIN’s must differ from your bank issued PIN.

VI   All card, personal, and key information shall be encrypted in volatile siliconand/or memory prior to transmission.

VII At no time will any sensitive data be transmitted in the clear.

VIII No card or account data will be stored in user accessible storage.

IX   All silicon will be secured to a circuit board with a Tamper ProofModule or Trusted Platform Module.

X      On any wPCI certified web portal, no two parties will directly transmitaccount information to one another.

Wednesday, March 11, 2009

Tuesday, March 10, 2009

Monday, March 9, 2009

The Aegenis Group is led by

Chris Mark, CISSP, CIPP; CEO/President and Founder

Disqus for ePayment News