Friday, July 10, 2009

How HomeATM Creates a "Card Present" Enviro on the Web

HomeATM's Internet Transactions No Different than Pay at Pump Terminals

Some readers have questioned whether HomeATM's PCI 2.0 Certified PIN Entry Device would qualify as a card-present transaction. I say why wouldn't it? The consumer swipes their card and the consumer swipes their PIN (into a PCI 2.0 Certified PED) I would argue that it is safer than transactions already classified as "card present,"...such as the one depicted on the left. Why? You are swiping your card in the privacy of your own home, so no one can see you enter your PIN and there is no danger of a skimming device having been implanted.

I'd like to set up why the HomeATM transaction is a "card present" transaction by utilizing an excerpt from ATM Marketplace in which they point out how skimming attacks are leading to discussions concerning the USA switching over to "Chip and PIN".

As Canada ramps up its EMV migration, pressure on the U.S. intensifies - By Tracy Kitten editor of ATM Marketplace

Adoption of the Europay, MasterCard, Visa (EMV) Chip and PIN standard is engulfing most of the world.

The movement of Mexico and Canada to the standard is putting pressure on U.S. financial institutions, as more of the world deems magnetic-stripe technology to be outdated and vulnerable to skimming attacks at ATMs and POS devices, including payment-accepting kiosks and pay-at-the-pump terminals.

Many experts suggest that card fraud will migrate to the States, because the mag-stripe is more vulnerable than the chip. Editor's Note: Hackers, like water, will find the path of least resistance and will focus on "card not present" (i.e. "The Web") where they will continue to have a field day.

"I think that onereason the U.S. has not moved to EMV is that the financial institutionsthere might not have a good handle on exactly how much fraud there is,"she said. "Because the country has so many small FIs, and so many FIsoverall, it's hard to really have a handle on what's going oneverywhere."

Editor's Note: I agree that FI's don't have a good handle. When it comes to "card not present" environments I don't think they have a clue. Therefore, I think it would make a lot of sense, (and be a lot less expensive than implementing EMV) to simply "eliminate signature debit" ... the cause of most "card not present" fraud.

If the US were to simply eliminate "signature debit" and replace it with PIN Debit then the cloned cards made in Europe would not work. (except for the rare circumstances the bad guys had the PIN)

Once signature debit was eliminated, the next step would be to eliminate "card not present" environments. The biggest culprit is the World Wide Web.

There's an easy way to convert the web into a "card present" environment. HomeATM replicates the brick and mortar electronic transaction to a "T." Consumers would swipe their credit card, and if it were a debit card, would enter their PIN. Same way they do it in a retail location. Transactions that are swiped and have their PIN entered are not only classified as
"card present"...they are classified as PIN Debit and boast the lowest interchange rates available.

That said, I humbly suggest that there is not one logical argument supporting the fact that a HomeATM transaction is not a true "card present" transaction...and I "implore" ANYONE who can muster one up to leave it in the comment section below.Especially when you consider the fact that the consumer not only swipes, but 2FA's themself by entering their PIN.

What's that? Oh, you are giving me the 17 year-old cashier isn't there to verify that your signature on the receipt matches the one on the back of your card argument? Yeah...Right! With all due respect, my response would be...yeah, but the casheir isn't there to "observe/record" your PIN either...so we eliminated a threat, no created one.

Let me ask you this...How do you get money out of an ATM? You have to have your "card present" and you have to know your PIN.

So how is what we do any different than going to an ATM and withdrawing cash? The banks allow you to do that in real time.

In reality, the Credit Card companies have the luxury to be able to "chargeback" a transaction in order to protect themselves. But they don't do it with PIN transactions, because the PIN proves "your are present!"

So...if it's good enough for the banks, how could it not be good enough for Visa or MasterCard?

What HomeATM does is it replicates ATM access for the web, which is why it is ideal for online banking log-in.

In fact, I could make the argument that our transaction is even safer than going to an ATM. Here's why...you can rest assured there would be no skimming device or camera recording your PIN in the safety of your own home.

Further evidence that we provide a "card present" transaction is as follows:

We replicate a transaction conducted at "pay at the pump terminals. (except for the fact that there are no worries about skimmers having been placed inside the pump itself, AND we encrypt the Track 2 data) Come to think of it, we also replicate a payment accepting kiosk.

The beauty of our approach is that neither scenarios involve a 17 year-old "gamer-dude" carefully checking your signature...(yeah right) and our approach doesn't require shutting off store cameras, having anyone cover their eyes or making sure innocent (until proven guilty) bystanders are all on the up and up...as you enter your PIN. Why? Because, again, it's done in the safety and privacy of your own home!

Come to think about it, now I'm ready to argue that we create a new, "more secure standard." and therefore should have a "lower" Interchange Rate than regular PIN Debit.

What HomeATM creates is a Skimmer/Camera Free/Nobody Looking over your Shoulder/Safety of Your Own Home "Card Present" transaction!

Speaking of creation, when HomeATM created it's "software-based" PIN Debit solution...there were four issues we identified as problematic.

1. Transactions done within the web browser are subject to myriad intrusions by fraudsters...
2. C-Level Intel Executive laughed us out of the room when we presented it to them...
3. Without the consumer swiping the card, there was absolutely no way to know whether they are "in possession" of it...so a software based PIN Debit application "cannot be" classified as "card present" (therefore it would be subject to a much higher interchange than if it were swiped)
4. We briefly wondered what would happen when EMV became ubiquitous. We wondered how a software solution could be capable of transacting the data embedded on the chip? (Hint: It wouldn't)

HomeATM is EMV (Chip and PIN) ready because we our engineers had the 20/20 foresight to envision what tomorrow would bring. Since then, tomorrow has already brought skyrocketing internet fraud, skyrocketing "card not present" fraud, and EMV has become ubiquitous most everywhere in the world, sans United States.

But now there is a lot of chatter regarding EMV coming to the states. When it does, it will be interesting to compare the Interchange Rate of a transaction that reads the embedded chip and has the user enter their PIN vs. a software application that instructs you to "type" in your card number and mouse click you PIN. When put in those terms, you probably have a better understanding as to why our engineering team thought software PIN debit already sounded obsolete to them...

And now you know why "Card Present" Skimmer/Camera Free Transactions can only be conducted by swiping YOUR card, and entering YOUR PIN, in the SAFETY of YOUR home...with SAFE-T-PIN!

To read the rest of the story about EMV Coming to America, click here

Way Systems and FNMS Unveil Pocket-Sized POS Device

FNMS, WAY Systems unveil pocket-sized POS device

Omaha, Neb., July 10, 2009 -- First National Merchant Solutions, one of North America’s leading payment processors, and WAY Systems announced today the availability of the way5000, a pocket-sized, mobile POS device for businesses on the go. First National Merchant Solutions will support and distribute the way5000 through its sales network.

“We’re always on the lookout for innovative methods to help our customers, and the way5000 is an excellent solution for those wanting to accept payments away from a traditional point-of-sale terminal,” said Diana Mehochko, president, First National Merchant Solutions. “It provides portability and most importantly, the device is PCI compliant in an effort to protect cardholder and merchant data.”

“WAY Systems is very proud to continue our ongoing relationship with a prestigious company such as First National Merchant Solutions. WAY Systems has built a reputation for bringing high quality, low-cost mobile point of sale devices to the market and First National Merchant Solutions continues to be one of our most prized business alliances”, said Tim McWeeney, VP, North American Sales for WAY Systems.

About First National Merchant Solutions

First National Merchant Solutions is a top 10 payment processor with more than 50 years of experience providing first-rate service and solutions to businesses across North America. With the combined resources of parent company First National Bank of Omaha and a dedicated, experienced team of industry professionals, First National Merchant Solutions provides complete in-house processing with unparalleled customer service to meet the long-term needs of its customers.

For more information, visit www.fnms.com .

About WAY Systems, Inc.

WAY Systems has designed, developed, tested and delivered end-to-end payment solutions for mobile merchants all over the world. Our products and services are designed to meet the payment transaction needs of mobile merchants and exceed industry security standards. We empower merchants to conduct business anytime, anywhere, and increase their revenue by accepting credit and pin-based debit cards.

Yes Bank and First Data have MoU for ATM Deployment

Yes Bank, First Data partner in India for ATM network

Mumbai, India, July 10, 2009 - YES BANK, India's new age private sector bank, and First Data, a global leader in electronic commerce and payment processing services, today signed a Memorandum of Understanding (MoU) for an innovative ATM deployment programme. In this strategic collaboration, First Data and YES BANK will jointly establish a widespread network of Automated Teller Machines (ATMs) across various cities in India. This initiative will introduce the concept of 'Convenience ATMs' to the Indian market, and help to expand significantly the availability of ATMs to YES BANK customers and to cardholders of other banks. The emphasis will be on providing ATMs at the most convenient locations for the Indian debit cardholder, enhancing the usage and sharing of ATMs.

Under the terms of this MoU, First Data will leverage its extensive ATM capabilities to support YES BANK in identifying new ATM locations and delivering installation and field management services including 24x7 monitoring and vendor management. The initiative will reinforce YES BANK's strategy of expanding its ATM network in high-density consumer locations such as shopping malls and restaurants and in high street business locations.

Announcing this strategic development, Mr. Rana Kapoor, founder/managing director and CEO of YES BANK said, "The collaboration between YES BANK and First Data is unique and significant in the Indian banking landscape. It is also a significant step forward in meeting the Indian regulators' mandate to provide convenient ATM access to bank customers across India. We are delighted that First Data, as a global leader in ATM deployment and management, has partnered with YES BANK on this important initiative."

Mr Kapoor continued, "Our collaboration reflects YES BANK's customer-centric focus and our commitment to revolutionizing the traditional Indian banking experience by bringing the most convenient and high quality services to our customers. This development is truly innovative in terms of size, scale and business model and will deliver tremendous value to our customers across the country. This rollout is in line with YES BANK's ATM expansion strategy - the Bank sees an opportunity to expand its network to 500 ATMs by 2010, 1,500 by 2012 and, over 3,000 ATMs by 2015. This will be fully in line with YES BANK's branch banking rollout strategy to achieve 250 branches by end 2010, 400 branches by 2012 and 750 branches by 2015."

"This pioneering arrangement in India results from First Data's increased focus on growing its ATM business in new markets," said Nigel Lee, senior vice president of First Data in Asia Pacific. "We have decades of experience in delivering reliable and technologically advanced payment solutions on behalf of customers in the banking and retail sectors. We are delighted to be working with YES BANK and playing a pivotal role in driving service improvements for cardholders."

The pilot phase of the programme will begin in August 2009 in Mumbai and Delhi, followed by other cities across India. YES BANK currently has 117 fully operational branches and 93 offsite ATMs across 92 locations in the country, as well as two national operating centres in Mumbai and Gurgaon.

About YES BANK

YES BANK, India's new age private sector bank, is the outcome of the professional and entrepreneurial commitment of its founder, Rana Kapoor and its top management team, to establish a high quality, customer centric, service driven, private Indian bank catering to an emerging India. YES BANK has adopted international best practices, the highest standards of service quality and operational excellence, and offers comprehensive banking and financial solutions to all its valued customers. A key strength and differentiating feature of YES BANK is its knowledge driven approach to banking, and a superior customer experience for its retail, corporate and emerging corporate banking clients.

About First Data

First Data powers the global economy by making it easy, fast and secure for people and businesses to buy goods and services using virtually any form of electronic payment. Whether the choice of payment is a gift card, a credit or debit card or a check, First Data securely processes the transaction and harnesses the power of the data to deliver intelligence and insight for millions of merchant locations and thousands of card issuers in 36 countries. For more information, visit www.firstdata.com .

Source: Company press release.

End-to-End-Security in an Open and Mobile World

Ingenico launches next gen payment security white paper...

Paris, July 10, 2009 -- Ingenico announced the publication of its “End-to-End Security in an Open and Mobile World” whitepaper to coincide with its first International Security Forum which took place in Paris on June 4.

"Security is at the core of Ingenico’s genes. It is the foundation on which we build our vision of an open and mobile world for the future of payment". Philippe Lazare, CEO Ingenico

With confidence and security key factors, the whitepaper identifies four essential principles at the very heart of the secure payments industry: confidentiality, authenticity, integrity and availability.

The report asserts that total security must take into consideration all elements of the transaction to eliminate risk of failure throughout the payment chain.

The demand for additional services at the point of sale is driving the development of new, function-rich payment devices - incorporating over-the-air administration tools, wireless and USB connectivity, colour screens and a more intuitive interface for the consumer. In addition, these terminals are increasingly incorporating open, standards-based technologies to allow third party application providers and merchants to create and deliver a host of new revenue generating services and applications.

This more complex, less proprietary and open environment requires the very highest levels of security.

The paper investigates these new elements and discusses best practice to assure the very highest levels of security, right across the payment transaction value chain.

Source: Company press release.

comScore Releases Inaugral Study on Mobile Financial Services

Reston, Va., July 10, 2009 --– comScore, Inc. (NASDAQ: SCOR), a leader in measuring the digital world, today released its inaugural study of the mobile financial services industry. The comScore report titled Mobile Financial Services: The Market Today & Opportunities for Tomorrow, provides an in-depth look at the current state of the industry and mobile financial users, and highlights areas for potential growth in this rapidly evolving market. In conjunction with the report, comScore is hosting a supplemental webinar on July 30, which provides additional industry insights from comScore’s expert analysts.

The report leverages multiple comScore data sources to provide a comprehensive view of the mobile financial services market, including an overview of the current U.S. mobile landscape and insights into the mobile banking, credit card, insurance and brokerage sectors.

3G and Smartphone Users Most Likely to Access Accounts Via Browser, Applications a Close Second

Mobile financial services adoption is highly dependent upon device technology and high bandwidth (3G) networks. A study of how mobile users access their banking accounts found that mobile Web browsing ranked as the most popular method for both smartphone (44.1 percent) and 3G users (53.3 percent), followed closely by mobile applications (48.1 percent of 3G users and 40.6 percent of smartphone users).

The relative parity among usage of browsers vs. applications for access to mobile banking indicates the growing importance of ease of use for accessing accounts and conducting transactions. Interestingly, the percentage of mobile bankers who used texting (SMS) for access to their account information was substantially higher among 3G users (41 percent) than Smartphone users (25 percent).

“The increasing adoption of smartphones and access to 3G networks, along with the rapid development of mobile apps, have created a fertile environment for the acceleration of mobile banking,” said Marc Trudeau, comScore senior director. “A seamless mobile banking user experience is necessary for this behavior to take hold, and the convergence of the aforementioned technologies is now making mobile phones a viable access point for personal banking transactions. Financial institutions hoping to capitalize on this quickly emerging consumer banking trend need to be ahead of the curve and understand how consumers are using the mobile channel today and how they would like to use it in the future.”

Convenience of Mobile Banking Important, Even at Home

The comScore report offers unparalleled insight into the usage patterns of mobile financial services users, including their preferred points of access. The largest percent of mobile customers, 31 percent, access their financial accounts primarily from home, even though many households have PC-based Internet available as well. Another 25 percent conduct transactions when running errands, while 15 percent do so during their commute. Nine percent of respondents indicated that they primarily access their accounts while on vacation, and 8 percent do so primarily while traveling for business.

For more information on the report, Mobile Financial Services: The Market Today & Opportunities for Tomorrow, and registering for the webinar, please visit: http://www.comscore.com/Press_Events/Presentations_Whitepapers/2009/The_State_of_Mobile_Financial_Services .

About comScore

comScore, Inc. (NASDAQ: SCOR) is a global leader in measuring the digital world and preferred source of digital marketing intelligence. For more information, please visit www.comscore.com/companyinfo .

Source: Company press release.

IRDA Approves ePayments for Life Insurance Customers

IRDA (Insurance Regulatory and Development Authority) allows e-payment for life insurance customers

Mumbai, Maharashtra, India, July 10, 2009 -- Recognizing the increasing utility of electronic payments, which also ensure safety and speed of such payments, the insurance regulator, Irda has decided to permit payments for all life insurance policyholders and beneficiaries through electronic payment methods such as Electronic Clearing Service (ECS), National Electronic Funds Transfer (NEFT) systems as approved by the RBI (Reserve Bank of India) in addition to account payee cheques as stipulated in the clause mentioned above.

The Irda has modified its earlier order on AML Guidelines dt. 31st March 2006 which among others specifies that all payments should be made after due verification of the bonafide beneficiary through' account payee' cheques.

The above stipulations were aimed at having audit trail and also a control mechanism on all payments in light of the vulnerability of such fund transfers for money laundering purposes, said Irda in its new order.

RBI has been impressing upon banks the need to migrate to electronic modes for initiating and receiving payments, so that the dependence on paper-based clearing products is brought down and the payment systems universe becomes safe, secure, sound and efficient. Electronic payment systems also speed up the clearing process, apart from reducing incidence of frauds inherent in cheques, drafts and other paper modes of payment. Individuals, corporates and government departments are using electronic payment products like ECS, NEFT and RTGS extensively.

Source: Company press release.

Forbes: Odds Look Good for Gamblers

Internet Gaming
Odds Look Good For Gamblers
Javier Espinoza, 07.10.09, 10:43 AM ETLONDON -

Internet gambling seems like a recession-proof business and even the reluctant U.S. might ride the train.

Despite warmer weather and tough economic conditions, sofa spuds are still playing high rollers in virtual casinos. On Thursday online gaming firm PartyGaming, reportedly a takeover target of Nasdaq-listed rival Gigamedia, saw a jump in shares as much a 7% after it said trading in the second quarter has been robust with revenues in line with the first quarter.

Gibraltar-based PartyGaming, one of the world's biggest online gambling firms, also said casino sales had significantly increased from the previous quarter, driven by a substantial increase in the number of games being offered on its PartyCasino site.

"Casino is developing into a major success story and recent poker initiatives are getting traction. We are maintaining our forecasts at this stage but there are increasing grounds for optimism," said Wyn Ellis, an analyst at Numis in London.

The recent jump in PartyGaming shares might be just a premonition of a much bigger rally next September as industry analysts expect a 2006-anti online gambling law to be scrap in the U.S. by the end of the fall.

"There is a reasonably good chance that the U.S. will introduce some positive online legislation in terms of gambling first at a state level in September and then at a federal level," said Nick Batram, an analyst at KBC Peel Hunt, a brokerage firm in London.

Last May, Rep. Barney Frank introduced a bill to propose that online gambling be legalized and regulated in the United States. (See "Gambling Firms Bet On Barney Frank.") PartyGaming's shares have hovered around the $3.80 mark ever since they dropped from nearly $15.00, just after to the passing of the Unlawful Internet Gambling Enforcement Act in October 2006. (See "Online Bets Are Off.")

But PartyGaming shares, along with rival 888 Holdings, could see a rebound soon. "Some of the share prices have already discounted the U.S. opening up the online gambling markets and the possibility of some sector consolidation, but shares in European online gambling companies will rally European rally there is an element some of the share prices already discounting the US opening to a degree or some sector consolidation," said Batram, adding he still expects shares to rally once regulation for companies in the U.S. is relaxed.

Yet he warns PartyGaming's shares and other stocks like Gigamedia probably won't reach the historic highs they enjoyed before the outlaw act of 2006.

The U.S. government could raise more than $50 billion over 10 years from taxes on legalized online gambling, according to a study by PricewaterhouseCoopers. Online gambling generated revenue of $6 billion last year in North America, more than a quarter the global total of $22.6 billion, up from $17.6 billion in 2006, according to H2 Gambling Capital.

Online Fraud Prevention Methods by PayPal

What are the latest online fraud prevention methods and intelligence ?

Paypal will provide the answers at the Loss Prevention Summit 2009. Free to attend for retailers.

75 per cent of shrinkage losses are attributed to employee and customer theft. Join your peers at the Retail Loss Prevention Summit 2009

Those companies who are not investing in forward thinking, long term loss prevention strategies, incorporating both physical and IT solutions, will continue to see significant dents in their profit margins.

The Retail Bulletin’s Loss Prevention Summit, sponsored by retail technology specialist Torex, is free to attend if you are a retailer and will address the key challenges facing retail and online retail executives in the UK. The program offers a mix of sessions including keynotes, case studies, and Q & A sessions as well as an interactive workshops.The event will enable delegates to benchmark their retail loss prevention strategies and share ideas to enable increased profits through minimising losses from customers and staff both in store and online.

Join your peers already registered as delegates including Homebase, Ted Baker, DSGi, Kingfisher, Wickes, House of Fraser, Waterstone's, Jaeger, Bestbuy Europe, Marks and Spencer, Brown Thomas, Brantano Footwear, Borders, H & M, Pets at Home, Krispy Kreme UK, Monsoon, The Co-operative Group, Boots, Argos, Aurora Fashions, Mothercare, Sunglass Hut, Tesco Direct, The Body Shop International, River Island, Bonmarche, Pret A Manger, Signet Trading Ltd, Lifestyle Sports, Dunelm, Focus DIY, EAT, JJB Sports, Holland & Barrett, Sainsbury's, World Duty Free, Footlocker, Claires, Bennetts, B&Q, Republic, Virgin, Jessops and many more.

The Venue, Reigate Hill Golf Club and Conference Centre, is conveniently located just three minutes from junction 8 of the M25 with local railway stations just 25 minutes from London Victoria. Set in acres of mature parkland this is the perfect setting for a relaxed yet inspiring summit. With 'room to breathe', delegates will have an enjoyable and informative day.

The Summit is free to attend for retailers and full details can be found HERE.

If you are a supplier who provides loss prevention solution or service you should attend this event. For the few remaining sponsorship and exhibiting opportunities please contact Dave Cocking - davec@theretailbulletin.com or call 0115 948 1024

U.S. Bank, TACA Airlines introduce new Visa credit card program

Minneapolis, July 10, 2009 -- U.S. Bank, the sixth-largest bank in the United States, and TACA Airlines, a premiere airline serving North, Central and South America, have partnered to offer the DISTANCIA Visa® and DISTANCIA Visa® Signature credit cards. These cards will dramatically accelerate the benefits and value of the customer’s DISTANCIA frequent flyer membership.

Editor's Note: And, since most travelers book their airfare online, I would think that TACA would enjoy the Interchange savings that an Internet PIN Debit rate could provide.

“TACA is a world-class airline that is recognized as best in class for its service to North, Central and South America, Mexico and the Caribbean. We welcome them to the U.S. Bank family and look forward to serving their loyal customers,” said Pat Coll, executive vice president of U.S. Bank Retail Payment Solutions.

DISTANCIA is the frequent flyer loyalty program of TACA Airlines, which has several hundred thousand members in the United States. DISTANCIA Visa customers will earn one mile for every dollar spent in purchases with the card. Special to this card program is an excess luggage redemption discount, which is particularly meaningful for travelers given the airline industry excess luggage fees. Benefits available only on the DISTANCIA Visa Signature® card include: double miles on TACA Airlines purchases; no preset spending limit; 24-hour complimentary Visa Signature Concierge Service; special offers from the finest hotels, resorts, retail and travel providers; advance ticket sales and preferred seating at popular events; complimentary Zagat® Survey restaurant ratings and reviews; and travel and emergency assistance services including roadside dispatch.

“We are pleased to be partnering with U.S. Bank, an organization that shares our passion for providing value via a great customer experience and a personal touch. Through the collaboration and combined experience of our teams, our new DISTANCIA Visa credit card is a product we believe will meet the specific needs of our target market,” said Matthew Vincett, commercial vice president of TACA Airlines. “The new DISTANCIA Visa will be the only credit card available to U.S. residents that awards DISTANCIA Miles.”

TACA is giving away 10 passes to fly free for a year as part of a sweepstakes promotion to launch the new card program. For more information about the sweepstakes and to learn more about the DISTANCIA Visa cards, visit www.distanciavisa.com .

TACA is in eight major metropolitan areas in the United States: Los Angeles, San Francisco, Chicago, Dallas, Houston, New York City (JFK), Washington D.C. (Dulles) and Miami. Based in El Salvador, TACA (Transportes Aéreos del Continente Americano or Air Transports of the American Continent) flies to 40 destinations in 23 countries in North, Central, South America and the Caribbean, including daily flights to eight of the largest cities in the United States and Toronto, Canada, with hubs in El Salvador; Lima, Peru; and San Jose, Costa Rica. To learn more, visit www.taca.com .

U.S. Bank has partnered with the airline industry with more than 30 years issuing, processing and acquiring of consumer, business and corporate cards for more than 40 airlines.

U.S. Bancorp (NYSE: USB), with $264 billion in assets, is the parent company of U.S. Bank, the 6th largest commercial bank in the United States. The company operates 2,847 banking offices and 5,183 ATMs in 24 states, and provides a comprehensive line of banking, brokerage, insurance, investment, mortgage, trust and payment services products to consumers, businesses and institutions. Visit U.S. Bancorp on the web at www.usbank.com .

Source: Company press release.

Monnet Could Challenge V/MC with Introduction of European Debit System

Monnet Could Paint Visa and MasterCard into a Corner

Well this is certainly an interesting development. Europe has already converted to Chip and PIN, and because the US has not yet made the shift, they are seeing an enormous increase in Card Not Present fraud. One of the underlying reason is because Visa and MasterCard push the less secure "signature debit" over the more secure "online debit" with rewards programs, which allows fraudsters to clone European Cards and use them in Card Not Present environments.

So, now they may have inadvertently created a monster.

Deustche Bank and the European Central Bank are talking about a new project they call Monnet, an alternative pan-European Debit System designed to challenge the dynamic duopoly debit system.

I have long and often wondered (since the introduction of the check card) when a consortium of banks would band together to create their own debit system. It looks like Monnet may have just painted Visa and MasterCard into a corner on this one.

I would suspect that Monnet would be based on the Chip and PIN system, which is more secure than what Visa and MasterCard have been pushing with their signature debit. I have long said that signature debit should be scrapped in it's entirety and replaced with PIN debit. Maybe that is exactly what will happen in Europe. As I said, interesting. There is absolutely no reason whatsover to believe that the 31 European countries, and their banks would not be successful in pulling this one off. More so than Google over Microsoft with an operating system.

Once and "if" they are indeed successful at introducing their own debit system, then there would be only one thing left to do in order to eliminate "card not present" fraud. What's that you say? Simply eliminate the "card not present" environment...by equipping European Online Shoppers with their very own End-to-End-Encryption POS device with integrated PIN Pad.

Wonder where they could get one? Oh, that's right! HomeATM is EMV...oops, let's start calling that "Chip and PIN" ready.

Here's the story from Bloomberg, along with a bonus (PDF) from eFinanceLab in Frankfort.

Deutsche Bank, Lenders Push for New Debit-Card System (Update1) - Bloomberg.com

Deutsche Bank, Lenders Push for New Debit-Card System (Update1)
By Cornelius Rahn and Aaron Kirchfeld

July (Bloomberg) -- European banks, including Deutsche Bank AG and Societe Generale SA, will likely create a group in October to push ahead with plans for a debit-card system to challenge Visa Inc. and MasterCard Inc., Deutsche Bank Chief Operating Officer Hermann-Josef Lamberti said.

“We all knew it was important to get the Germans and the French to agree,” Lamberti said today at a conference in Frankfurt, where Deutsche Bank is based. “When the rest of Europe sees that these two can agree, then the result has a chance to evolve into a solid European system.”

The European Central Bank and the continent’s lenders have been pushing for the creation of a third pan-European debit system as an alternative to MasterCard’s Maestro and Visa Europe’s V PAY. Societe Generale and BNP Paribas SA, both based in Paris, and Deutsche Bank are among banks working on the project called Monnet.

The goal is to have banks from 31 European countries join the payment system, Lamberti said. Bundesbank board member Hans Georg Fabritius, speaking at the same event, said Europe should have at least one card system based on the continent.

“A duopoly of the two international card companies is an unsatisfying vision for both political and economic reasons for us in Europe,” Fabritius said.

He called Monnet a “promising” cooperation between large German and French banks. So far the project is no more than a concept, and the participation of more European countries would be “beneficial,” he said.

MasterCard, which is based in Purchase, New York, is the second-biggest electronic payment network after San Francisco- based Visa.

Here's the bonus coverage on Monnet...

Monnet, Visa, MasterCard, Deutsche Bank, European Central Bank, European Debit System

Thursday, July 9, 2009

Magstripe 101

What Is The Stripe On the Credit Card?

What Is The Stripe On the Credit Card?

Each day we use our bank issued credit card. Swiping our cards on stores card readers to buy our purchases. Now, how it is that something so small can keep all your bank information. What allows the card reader to see that information? And what is that dark strip on the back of our cards.
The stripe on the back of a credit card is a magnetic stripe, or also called “MagStripe”. The magnetic strip is made up of tiny iron-based magnetic particles in a plastic-like film. Each particle is really a tiny magnet bar about 20-millionths of an inch long.

The magnetic stripe can have data written because the tiny magnet bar can be magnetized in either a north or South Pole direction. The magnetic strip very similar to a cassette tape.
A magnetic stripe card reader can then understand the information that has been written on the three-track stripe.
If the credit card isn’t being accepted, your problem is probably either:

* A dirty or scratched MagStripe
* An erased magnetic stripe
o The most common causes for erased MagStripe are exposure to magnets, like the ones that hold notes &pictures on your refrigerator, or exposure to a store’s EAS (Electronic Article Surveillance) tag demagnetizer.
* Or you are just out of money.

These Three Tracks Stripes on the magnetic stripe each have tracks that are about 1/10th of an inch wide. The ISO/IEC standard 7811, which is used by some banks, specifies:

* Track one – 210 bpi (bits per inch), and holds 79 6-bit plus parity bit read-only characters.
* Track two – 75 bpi, and holds 40 4-bit plus parity bit characters.
* Track three – 210 bpi, and holds 107 4-bit plus parity bit characters.

Credit Card typically uses only tracks-1 & 2. Track-3 is a read/write track (which includes your encrypted PIN, country codes, currency units and amount on your account); this is not standardized among all banks.
The information on track-1 is contained in two formats: A, which is reserved for proprietary use of the card issuer, and B, which includes the following:

* Start sentinel – one character
* Format code=”B” – one character (alpha only)
* Primary account number – up to 19 characters
* Separator – one character
* Country code – three characters
* Name – two to 26 characters
* Separator – one character
* Expiration date or separator – four characters or one character
* Discretionary data – enough characters to fill out maximum record length (79 characters total)
* End sentinel – one character
* Longitudinal redundancy check (LRC) – one character LRC is a form of computed check character.

The format for track two, developed by the banking industry, is as follows:

* Start sentinel – one character
* Primary account number – up to 19 characters
* Separator – one character
* Country code – three characters
* Expiration date or separator – four characters or one character
* Discretionary data – enough characters to fill out maximum record length (40 characters total)
* LRC – one character

There are three basic methods for determining whether your credit card will pay for what you’re charging:

* Voice authentication – Small Merchants do using a touch-tone phone.
* Electronic data capture – (EDC) MagStripe-card swipe terminals
* Virtual terminals on the Internet

How all of this works:
After the credit card is swipes through a reader, the EDC software at the point-of-sale (POS) terminal dials a stored phone number (using a modem) to call an acquirer. An acquirer is an organization that collects credit card authentication requests from merchants and provides the merchants with a guarantee payment.
When the acquirer company gets the credit-card authentication request, it checks the transaction for validity and the record on the MagStripe for:

* Merchant ID
* Valid card number
* Expiration date
* Credit-card limit
* Card usage

With Single dial-up transactions, they are processed at 1,200 to 2,400 bits per second (bps), while direct Internet attachment uses much higher speeds via this protocol. Using Internet protocol, the cardholder enters their personal identification number (PIN) using a pin pad.
The PIN is not on the card — it is encrypted in the database. Creation of your PIN can be interred in on the bank’s computers in an encrypted form.
Also, the communications between the ATM and the bank’s central computer are encrypted to prevent would-be thieves from tapping into the phone lines, recording the signals sent to the ATM to authorize the dispensing of cash and then feeding the same signals to the ATM to trick it into unauthorized dispensing of cash.
If all of this isn’t enough protection, there are now cards that utilize even more security measures than your conventional credit card: Smart Cards.

Magnetic Stripe, Magstripe, Credit Card, HomeATM

Consumers’ fears about online fraud

New Consumer Research from the Secure POS Vendor Alliance Underscores Need for Greater Payment Security Measures

Global survey results are call to action for industry players to increase consumer trust

Seventy-three percent of consumers surveyed in the United States, France and Great Britain say that more stringent standards are required before they will trust the security of their credit card transactions.

And almost half (46 percent) are concerned about the potential for a security breach when paying with their credit or PIN-based cards, according to an international survey released today by the Secure POS Vendor Alliance (SPVA), a non-profit business organization created by Hypercom (NYSE: HYC), Ingenico S.A. (EURONEXT: ING) and VeriFone (NYSE: PAY).

SPVA focuses on standardized implementation of existing security standards, security of the payment device lifecycle and security threat analysis and intelligence.

“Security is clearly a pivotal issue for the industry and consumers,” said Christophe Dolique, SPVA Chairman and EVP, Global Marketing & Transaction Services at Ingenico. “These findings confirm the strong correlation between the strength and quality of security and consumers’ views and behaviors toward using card payment systems presenting the payments industry with a unique opportunity to come together and achieve positive change.”

When paying for goods, consumers are entering their PIN number when making purchases using their cards 74% of the time.
Figures vary in the UK (84%), USA (56%) and France (74%

Growing awareness of data breaches that industry experts have been working to combat for years, leads 62 percent of consumers to feel particularly worried about using their card and PIN to make a purchase if the outlet had suffered a data breach.

Eighty-four percent say that companies that suffer a data breach should be required to make the incident public, reinforcing the idea that vendors and retailers run the risk of devastating their brand if a breach occurs.

Sixty-five percent of respondents report that they are often or always concerned about Internet fraud.

Download this press release (PDF)
Download the SPVA Global Consumer Survey Key Findings (PDF)
Download the SPVA Global Consumer Survey Data (XLS)

###

The SPVA survey results represent 1,030 consumers: 407 UK, 303 USA, 320 France (51 percent male, 49 percent female, average age 40). It has a three percent margin of error and was conducted by Loudhouse Research, a London-based research consultancy firm. Complete survey data can be found at www.spva.org.

About SPVA (www.spva.org)
The Secure POS Vendor Alliance (SPVA) is a non-profit organization that works with the multiple stakeholders of the payment value chain. Its aim is to develop an end-to-end security framework and to enhance security elements of payment solutions which protect cardholder information and defend merchants and acquirers against security breaches, while helping reducing fraud and lowering risk for all electronic payment stakeholders.

About Hypercom (www.hypercom.com)
Global payment technology leader Hypercom Corporation delivers a full suite of high security, end-to-end electronic payment products and services. The Company's solutions address the high security electronic transaction needs of banks and other financial institutions, processors, large scale retailers, smaller merchants, quick service restaurants, and users in the transportation, petroleum, healthcare, prepaid, unattended and many other markets. Hypercom solutions enable businesses in more than 100 countries to securely expand their revenues and profits. With its acquisition of Thales e-Transactions in 2008, Hypercom became the second largest provider of electronic payment solutions and services in Western Europe, and solidified its position as the third largest provider globally.

About Ingenico (www.ingenico.com)
Throughout the world, banks and retailers rely on Ingenico for secure and expedient electronic transaction acceptance. Ingenico solutions leverage proven technology, established standards and unparalleled ergonomics to provide optimal reliability, versatility and usability. This comprehensive range of products is complemented by a global array of services and partnerships, enabling businesses in a number of vertical sectors to accept transactions anywhere their business takes them.

About VeriFone Holdings, Inc. (www.verifone.com)
VeriFone Holdings, Inc. (“VeriFone”) (NYSE: PAY), a global leader in secure electronic payment technologies, provides expertise, solutions and services for today with a migration strategy for tomorrow. VeriFone delivers solutions that add value to the point of sale, resulting in improved merchant retention and the generation of new sources of revenue for its partners and customers. VeriFone solutions are specifically designed to meet the needs of vertical markets including financial, retail, petroleum, government and healthcare.

UATP Addes Virgin America as New Merchant

UATP adds Virgin America as new merchant

Washington, July 9, 2009 -- Universal Air Travel Plan, Inc. (UATP) continues its expansion adding Virgin America as its newest merchant effective immediately. To meet customer demand, Virgin America adds UATP as a form of payment to help expand its market share in the airline industry.

"As a new airline, we've quickly recognized the demand for UATP acceptance and want to expand our corporate client base while lowering distribution costs," said Diana Walke, Vice President of Planning and Sales at Virgin America. "Virgin America is injecting some healthy competition into the airline industry with our award-winning service, low fares and upscale amenities - and corporate travelers are responding."

Launched in August 2007, Virgin America is a new California-based airline on a mission to make flying good again - with brand new planes, attractive fares, topnotch service, and a host of innovative amenities that are reinventing domestic air travel. UATP will enhance Virgin America's strategic plan through UATP's mission of helping airlines lower distribution costs with low merchant service fees and a global network available to all corporate travelers. Ticket purchases are available to the UATP Network through traditional channels and Virgin America will continue to enhance availability for all UATP cardholders.

"Focusing on the key drivers for success, a strong business strategy and expanding services, Virgin America has positioned itself for rapid growth," Ralph Kaiser, president and CEO, UATP stated. "The Virgin brand is a leader in the airline industry and Virgin America will be able to increase its market share in the corporate travel arena."

The airline's base of operations is San Francisco International Airport's ultra-modern International Terminal. Virgin America flies to San Francisco, Los Angeles, New York, Washington D.C., Seattle, Las Vegas, San Diego, Boston and Orange County.

For more information, visit http://uatp.com or www.virginamerica.com .

About UATP

UATP accounts are accepted as a form of payment for corporate business travel by Amtrak(R), airlines and travel agencies worldwide. UATP accounts are issued by: Air New Zealand (ANZFF.PK), American Airlines (NYSE: AMR), Austrian Airlines (AUALF.PK), Continental Airlines (NYSE: CAL), Delta Air Lines (NYSE: DAL), Japan Airlines (JALSY.PK), Northwest Airlines, Qantas Airways, Ltd. (QUBSF.PK), United Airlines (Nasdaq: UAUA), and US Airways (NYSE: LCC). AirPlus International issues the UATP-based Company Account for: British Airways (LSE: BAY.L), Continental Airlines (NYSE: CAL), and Lufthansa German Airlines.

Source: Company press release.

Alipay Knocks Out Paypal as World's Largest eCommerce Payment Platform

Alipay Punches in as #1 Contender for First Time...

Editor's Note: Could not resist using the picture on the right. The first thing that came to mind when I read the Alipay article below was Ali "delisting" Liston as champion. Speaking of List-on PayPal is now List-ed as #2 as Alipay registered it's 200 millionth user. (PayPal had 180 million at last count)

No worries PayPal...China is kicking our butt in everything, internet users, video games, etc. so I would take it with a grain of (smelling) salt.

Here's the story:

From China Tech News

Chinese online payment platform Alipay has announced that the company has gained over 200 million users, exceeding the world's largest e-commerce payment platform Paypal.

According to news on Sohu.com, at the end of August 2008, the number of Alipay users reached 100 million. It took five years for Alipay to accumulate the 100 million users since it first appeared on Taobao.com in October 2003. During the past ten months, the number of Alipay's users further increased from 100 million to 200 million.

Prior to this, the world's largest third-party payment platform PayPal said it had about 180 million users in 190 countries and regions around the world. With the 200 million users, Alipay exceeds PayPal for the first time to become the world's largest third-party online payment platform by user scale, and its users are mainly from the Chinese market.

Shao Xiaofeng, president of Alipay, told local media that though Alipay's current trading value is still lower than that of Paypal, the company is expected to exceed the latter within three years.

Alipay's rapid development has close relationship with the fast growth of the number of Chinese netizens and the development of the Internet economy of the country. Statistics released by China Internet Network Information Center show that by May 2009, China had 320 million netizens and about 62.5% of these netizens are users of Alipay. In addition, the number of Chinese netizens is expected to reach over 600 million in the next two years.

eBillMe Introduces CashBack Loyalty Program

First Rewards Program for Online Cash Checkout Announced by eBillme

Online shoppers who pay using eBillme will now receive cash back for every purchase

This is truly a landmark offering for online cash payments

Rye Brook, NY (PRWEB) July 9, 2009 --Cash back rewards, a loyalty program traditionally associated with expensive credit cards, has now entered the cash world.

Starting today, eBillme(TM), the payment option that enables consumers and small businesses to shop debt free and pay securely with cash, will give consumers 1% cash back for every purchase made using the cash checkout option. All consumers are eligible for the eBillme Rewards Program.

"This is truly a landmark offering for online cash payments," says Marwan Forzley, President and CEO of eBillme. "More consumers are shifting away from credit and making better financial decisions. We want to reward shoppers who pay with cash by offering the perks of shopping online with a credit card but without the interest fees and debt. Not only does eBillme offer a higher level of protection and more safeguards than a credit card with our buyer protection program, but now, every eBillme purchase will earn consumers cash rewards. There could not be a better time for consumers to try secure cash checkout with eBillme."

In order to qualify, online shoppers select eBillme for checkout at one of over 800 online merchant sites offering the credit card alternative payment option. Consumers can then sign-up for eBillme's cash back rewards and immediately start earning 1% cash back for every order. Once $10 in rewards has been earned, the cash can be redeemed on eBillme merchant sites, or shoppers may choose to continue earning before redeeming.

eBillme is the most secure way to pay online. When shoppers choose the option at checkout, their order is confirmed with an eBill sent to their e-mail address. Consumers simply pay the eBill through their online checking or savings account - the same way they pay utilities, loans, insurance, and other bills. The transaction occurs securely, bank to bank, with no personal or financial information required or transmitted over the Internet. And with buyer protection features including a satisfaction guarantee, best price guarantee, in-transit protection, and fraud protection, consumers can shop with confidence knowing their eBillme transaction is guaranteed and protected.

ABOUT eBillme
eBillme(TM) is the only online payment solution that extends the convenience of online banking to the merchant's checkout process. The service enhances security for online shoppers, and enables merchants to increase sales while reducing transaction costs. No financial data is exposed and the payment transaction is securely transferred from the customer's bank to the retailer's bank. Consumers can shop online, by catalog or through call centers, and pay for their purchases at their bank, credit union, or bill pay portal using the security and convenience of online banking. For more information, please visit eBillme.com or eBillme's Online Debt-Free Shopping Mall, ShopDebtFree.com.

Links

eBillme Website: eBillme.com
eBillme Blog: blog.ebillme.com

Want to Read Something Scary? DDoS Attacks from North Korea?

Report: North Korea May Be Behind DDOS Attacks On U.S., Korean Government Sites

By Tim Wilson | DarkReading

Supporters of North Korea may be behind a series of denial-of-service attacks that have crippled U.S. and South Korean government Websites during the past five days, a news report says.

According to an Associated Press report, an unnamed South Korean lawmaker's aide stated that intelligence agencies believe North Korean sympathizers are behind the distributed denial-of-service attacks, which overwhelmed at least a dozen U.S. government sites and 11 South Korean sites, including the U.S. White House and South Korea's Blue House.

The National Intelligence Service -- South Korea's main spy agency -- told AP it couldn't immediately confirm the report.

Other news reports say the attacks also targeted nongovernment sites, including the New York Stock Exchange, the Nasdaq stock market, and The Washington Post.

DoS, DDos, North Korea, South Korea, U.S. Government Websites

Study: Encryption Reduces Risk of Data Breach

Encryption reduces risk of data breach: study - Computer Business Review : News

Well here's a surprising insight. A new study from the Ponemon Institute found that...are you ready? "Encryption reduces risk of data breach" I guess the next study should be whether or not it's safer to type or swipe. Because swiping your card means the data is encrypted. I can save them the cost of performing the study. Swiping Reduces the Risk of Cardholder Data Being Breached!

Published:08-July-2009 By Kevin White

Enterprise encryption technology not fully exploited

Encryption does help reduce the likelihood of an enterprise data loss or data breach incident latest research has confirmed, but organizations are still not doing as much as they could with the technology.

In a study carried out by the reputable Ponemon Institute for PGP Corp, a third of those companies reporting no data loss incident in the last year claimed to have had instigated an enterprise-wide encryption policy.

In contrast, organizations experiencing the highest number of data loss incidents were found to be the least likely to have introduced a consistently enforced, company-wide strategy governing the use of data encryption technologies.

Of firms reporting more than five loss incidents, none had any kind of encryption strategy in place.

The study found that 57% of UK businesses are now using some type of encryption solution in order to protect sensitive information, with around 36% having introduced a partial strategy to protect certain applications, departmental activities or data such as credit card numbers.

“Encryption is most widely used to protect the data held on file servers, Virtual Private Networks (VPN) and databases. VOIP and mainframe encryption are the least deployed applications,” the report noted.

Despite the widespread use of smartphones, only 34% of the study partcipants said they believe it is only sometimes necessary to encrypt the confidential data held on portable devices. Some 13% think it completely unimportant.

As many as 615 IT security professionals at enterprises and public sector organisations were polled for the study, which found that 70% of UK organisations have been hit by at least one data breach incident within the last year. That number is up from 60% in the previous year.

To Read the Full Report Click Here (requires registration)

In its 2009 Annual Study: UK Enterprise Encryption Trends, Ponemon notes that the public sector experienced the highest number of data loss incidents in the last year.

Phillip Dunkelberger, CEO of PGP said, “This study underlines the critical importance of implementing an encryption strategy that encompasses all aspects of an organisation’s data, not to just meet privacy or data security regulations but to also protect against brand damage and loss of customers."

Yesterday, Kent-based Jubilee Managing Agency Ltd became the latest company to be found in breach of the Data Protection Act, after the insurance company had to report the loss of an unencrypted disk containing the personal details of around 2,100 individual UK policyholders.

It has been instructed by the ICO to sign a 'formal undertaking' to enhance its data protection methods.

The Ponemon Institute has estimated the average UK data breach costs a total of £1.7 million - said to be the equivalent of £60 for every record compromised.

Encryption, HomeATM, E2EE Terminals

Suicide Linked to TJX Probe - Hackers 11

Former Teen Hacker’s Suicide Linked to TJX Probe

By Kevin Poulsen
July 9, 2009 |
12:00 am |
Categories: Hacks and Cracks

A Miami man who achieved fame as a teenager for hacking NASA and the Pentagon took his own life last year after Secret Service agents accused him of being part of the conspiracy responsible for the largest identity theft in U.S. history, his family says.

Jonathan James, 24, was found dead of a self-inflicted gunshot wound in his home on May 18, 2008, less than two weeks after agents raided his house in connection with a hacking ring that penetrated TJX, DSW and OfficeMax, among others. In a five page suicide note, James wrote that he was innocent, but was certain federal officials would make him a scapegoat.

“I have no faith in the ‘justice’ system,” he wrote. ” Perhaps my actions today, and this letter, will send a stronger message to the public. Either way, I have lost control over this situation, and this is my only way to regain control.”

The note was provided to Wired.com this week by James’ father, Robert, who kept the details of his son’s death quiet for over a year because of the ongoing prosecutions over the retail hacks.

James apparently suffered from depression; agents executing the search warrant found another suicide note James had written years earlier, but did not seize his gun. The Secret Service declined to comment on the matter Wednesday, citing the continuing TJX prosecutions.

“Sometimes I thought he was pretty smart,” says his father. “Sometimes I thought, oh my God, I’ve raised an idiot. And the jury is still out.”

Continue Reading at Wired