Mobile Payment Industry News

Thursday, January 22, 2009

SUBASE Command Members Cloned

According to the SUBASE website, "The U.S. Navy's submarine force has the world's most capable submarines, manned by the world's best trained and motivated submariners. During a political or military confrontation, anypotential adversary must assume that United States Navy submarines "are present" and consider the consequences."

However, according to the story below, there's a different kind of adversary out there, and they count on them being "not present." You think some people were up in arms when Dolly was cloned...when they catch these guys, I don't think they'll be sending them up river...they are going "down."

The Dolphin - Credit card cloning on the rise

GROTON, Conn. - Over the last few months, SUBASE command members have reported unauthorized credit card purchases on their personal credit card accounts occurring at retail stores and service stations throughout the country.

None of the naval members were "physically present" in these states and all were in possession of their personal credit cards. Based on this information, it appears that the naval members had their credit cards skimmed and subsequently cloned. Although cloning of credit cards in not considered new, over the last several years, this type of fraud is becoming increasing common with numerous incidents being reported.

Cloning is accomplished by unscrupulous individuals using a cell phone-sized device known as a "skimmer" wherein they are able to swipe the credit card or the leaked credit card information which captures the data on the magnetic strip of the card. The criminal can utilize this information to transfer the data and create a "new" credit card or activate an expired old credit card. The skimming device, costing less than $300 can hold numerous credit card/debit card numbers allowing a thief to later make a duplicate version of the credit or debit card.

Continue Reading at the Dolphin

Canadian Payments Forecast

Technology Strategies International has released a report titled "Canadian Payments Forecast - 2009" forecasting that the Canadian debit and credit card market will be hit by the decline in personal expenditure on consumer goods and services as a result of the economic downturn, but over the long term both forms of payment will command a greater share of all consumer expenditure.

According to the report, "credit card payments will account for 38% of personal consumer expenditure by 2013, approximately double the share predicted for debit card payments."

“By 2013 we expect there to be about 130 million payment cards in circulation in Canada, with card based payments being accepted at about 720,000 merchants”, notes Christie Christelis, President of Technology Strategies International.

“There are a number of high growth segments in the Canadian payments market, the ones with the most promise being mobile contactless payments, cross-border debit and alternative methods for paying online,” he says.

Key findings of the study are:

The recession in Canada will result in lower growth for debit and credit card payments as consumers cut back on their expenditure
Credit card payments will be hit the hardest by the recession
Contactless payments will be the highest growth segment over the next five years, exhibiting phenomenal growth and encroaching on the areas currently dominated by cash and debit cards
Card issuers will use the EMV implementation card reissue cycle to issue cards with contactless payment functionality
Cross border payments will grow by 70% per year over the next five years
Alternative payment mechanisms for online payments (i.e. non-credit card payments) will account for one third of all online payments made by Canadians by 2013
Cash will remain the most frequently used form of payment in Canada

The 110 page report provides a comprehensive review, analysis and forecast of consumer payments in Canada. It identifies high growth segments in the Canadian payments market in the context of some important recent developments in the economy and the industry, including duality in the credit card market, the emerging battleground around merchant discount rates and Interac’s application to the Competition Bureau to convert to a for-profit organization. Detailed forecasts are presented for credit card payments, debit card payments, cash payments, cheque payments, contactless payments, cross-border payments, online payments, ABM installations and POS terminals.

Source: Company press release

Follow PIN Debit Payments Blog on Twitter

I still don't understand the Twitter thing, but what the heck, maybe you can "tweet" me and explain it's attraction. In the meantime, for those who partake, here's the new HomeATM PIN Debit Blog "Twit Cam."

I've also included it in the sidebar...didn't get prime time...down about 7 gadgets...

PIN Debit Payments Blog

Wednesday, January 21, 2009

In God We Trust...Visa/MC is Another Issue(r)

We're Not in Kansas Anymore...the Heartland has been breached and the ROI on PCI may be sucked up by the tornado that is hackers...

In fairness to Heartland Payment Systems, I want to add this addendum to my previous post. Unlike CardSystems, which PBT bought after their 40 million card breach, Heartland was PCI certified.

Then again, so was Hannaford at the retail level. So what does this mean? Since hackers have shifted their attention from retailers to, at least in this case, acquirers, where does it end? It doesn't end here, that's for sure.

I'll tell you where it ends...it "ends at the beginning", and the "beginning of the end" of a transaction is at the Visa/MC network level.

Therefore, Visa/MC and their PCI, which has cost retailers and processors over $2 billion dollars to implement...needs to take some of the blame. Heartland played by "their rules." The hackers were the ones that breached them. So who's really to blame? Sure the hackers would be the first answer, but second to none is Visa/MC.

After all, if you need to "unencrypt" encrypted information, which is where the HPS breach occurred, and it took 4+ months for Visa/MC to determine suspicious activity, then maybe the hackers have gotten to the Point of No Return.

The "Mother of All Hacks" will never be Heartland Payment Systems. It will be the electronic payments system at it's very core. Whether it's Visa, MasterCard or NACHA, if any of these systems are breached, it's the end of e-payments as we know it. Do they know it?

With TJ Max, it was the retailers fault (storage), with CardSystems, it was non PCI compliance. (Also storage anomalies) but with Heartland, where does the fault lie? Can it be a PCI certified acquirer's fault? They complied...yet they are going to take the fall. I say that unless new information comes forward...they shouldn't.

So the way I see it, PCI, not Heartland has been breached. And not for the first time.

Hackers may very well have gotten to the very "core" of payment transaction platforms...the point where encrypted info needs to be "unencryped" in order to complete authorization. I'm no security expert, but what good is encryption if it needs to be "unencrypted"...at ANY point in the process?

Does V/MC think their systems are beyond attack? If I was a hacker and I knew the weak point was where unencryption occurs, then it "occurs" to me that point should be the must vulnerable point of attack.

What if ,as I stated in a previous posts the bad guys (darkhats) Ireally know more than the good guys? (the whitehats) Then, is all the money spent to protect data at the "point of sale" morphing into a "point of no returrn" on the investment. If so, what's the point?

In God we Trust...but what about Visa/MC?

Want to "charge" something? Then use Visa/MasterCard. For secure payments, I'll continue to put my faith in the Debit/ATM networks. Heartland admitted, that although all the information on the magnetic stripe was hacked, no PIN's were. That seems to be something the hacker's can't quite PIN down.

PIN Debit Payments Blog

More on the Heartland Breach...a lot more...

Clarification: In a Monday post, "Hackers Affect Debit and ATM Networks" I alluded to the fact that 8500 debit cards were disabled by Forcht Bank because they were compromised. "The cards were comprised when a retail merchant’s computer system was hacked, Forcht's COO Eddie Woodruff said. The breach affected customers of multiple banks and multiple debit and ATM networks". Woodruff went on to say: “Our debit card processor, which is a company called STAR, they had a retail customer, we’re not exactly sure who the retail customer was, and the information we believe may have been compromised,” he said. Well this this is not entirely true.

In fairness, I also reported that First Data Corporation, which operates the STAR Debit and ATM Network, would not comment on how many other banks were affected, but did release in a statement Monday that "the debit card issue we were alerted to could affect not only STAR but also other debit networks." They also said: "this situation is not related to any First Data processing systems or practices."

It now seems like the "hackers affecting the debit and ATM Networks was related to the Heartland Payment Systems (HPS) breach.

I would look for the Heartland breach to get bigger. From everything I've gathered, it looks to me like the malicious software went undetected for about 6 months.

Right now, the conjecture is that 100 million cards have been breached, making it the largest breach ever, blowing away TJ Max (45 million, later bumped to 92 million in court papers) and CardSystems. (40 million)

But 100 million is HPS' "monthly" volume. As I said, this went undetected for months. So, as did the numbers for TJX, expect that "100 million" number to rise.Heartland had 600 million cards go through from May through "late fall" when they discovered the breach. So the final numbers will come in between 100 and 600 million.

That's scary enough but what's really scary here is that Heartland got breached as they unencrypted the information to get authorization from Visa, MasterCard, American Express and Discover. Another words, encrypted information needs to be unencrypted in order to complete the transaction. Heartland's COO, Robert Baldwin stated, “We have industry-leading encryption, but the data has to be unencrypted to request the information, the sniffer was able to grab that authorization data at that point.”

So if that's the point that the sniffer was capable of sniffing, then this is nothing to sneeze at.. Hackers have taken another "giant step" for hack-kind... This very well may go down in the payments industry as "The Mother of All Hacks. Heartland is sure to take a huge financial hit.

"I'm shocked that their stock was only down 7 cents today. I really thought their "inauguration day" "non"-announcement would rub people the wrong way and it would be way down. As people start to realize the magnitude of the breach, and therefore the losses associated with them, I expect HPS stock get "massacred" by...ironically, "Valentine's Day."

And no...no...no...I'm not "heartless" just cynical...we (Pay By Touch) bought CardSystems after their humongous 40 million card breach and the aftermath, including, but not limited to expenses revolving around: losing customers, losing ISO's, dealing with FTC, Visa, MC, MasterCard and Discover bled us dry. Don't believe me? Ask anyone there. Acquiring CardSystems after the breach was a huge mistake. Dealing with the breach was expensive and time consuming. (Click here for FTC reports related to CardSystems)

Don't believe me...how about Avivah Litan?

Avivah Litan, a data security analyst, said that the Heartland breach could result in hundreds of millions in losses and other expenses. “If you add it all up, including legal costs, it could be as much as half a billion dollars in losses — or twice as big as TJX,” she said.

Heartland has a tough road ahead of them...wonder how many shares of HPS stock Bob Carr sold, if any, after May 1st and prior to yesterday...

PIN Debit Payments Blog

Safest Way to Pay Online...

In the wake of yesterday's announcement by Heartland, what some are calling the biggest card breach ever, I thought I'd bring you this.

A new web-site launched yesterday, www.JustAskGemalto.com is a place where people can go for expert advice on topics such as Internet security, online payment, password management, credit card fraud, cell phone usage, identity theft and more. Until now, no onesite has gathered all these different topics in one place. As the use of our digital information spreads, we as individuals have a role in safeguarding it more than ever.

The site answers questions such as:

What’s the safest way to pay online? http://www.justaskgemalto.com/en/buying/tips/what-safest-way-pay-online

Editor's Note: I'm going to share their answer right now, because it is exactly what we've been saying about our HomeATM SwipePIN device. This, from their JustAskGemalto.com:

What is the safest way to pay online?

"The safest way to pay online is with some sort of personal digital security device to prove it is really you making the purchase and that the site you are purchasing from is authentic." (Editor's Note: Touche!)

"This could be a smart bankcard you put into a small USB reader when you pay online." Editor's Note: Or it could be your own personal SwipePIN device, such as the SLIDER manufactured by HomeATM...

"This makes online payment much more secure, similar to when you make an ATM withdrawal, because it requires both a card and a PIN code."

Bankers call this “two-factor” authentication. One factor is something you know, the PIN, and the second factor is something you have, the card or token.

However, smart bankcards, like those used in Canada, Latin America, Europe and Japan, are not available in the United States. (Editor's Note: No, they're not, so if you want two-factor authentication, here in the U.S. you'll want to utilize HomeATM's SwipePIN device. Swipe your card (something you have) and Enter Your PIN, (something you know)

One example is how a leading U.K. bank, Barclays, used smart bankcards to stop online fraud. (Editor's Note: Yes, they used their PINSentry device, (click picture on left to enlarge and read) and according to Barclay's demand for the device was higher than expected, it cut fraud and is now asked for by name for new online users, thus generating online sales growth.) I would say it's safe to assume the same results for our SLIDER...thanks for the pilot Barclays!

Other questions currently addressed at the site include:

What is a hotspot and is it safe to use my laptop at the airport?
How does music and video file sharing work?
I hear about 3G networks in iPhone ads, what is that?
If I have a secure connection to a Web site, does that mean I can trust the site?
Do U.S. electronic passports use RFID? http://www.justaskgemalto.com/en/tips/do-us-epassports-use-rfid-technology
Can my neighbor steal data from my Wi-Fi network?
How do I get an emergency replacement passport if I am traveling?
I want to get a phone that works outside the U.S., what should I look for?
Five things you should do when traveling abroad

The Web site also presents informative articles and short videos. www.JustAskGemalto.com is part of a broader business and consumer education initiativeundertaken by $2 billion digital security leader Gemalto, to help guideinformed choices and practices.

Tuesday, January 20, 2009

Largest Breach Ever? Deception Involved?

Brian Krebs, writing for the Washington Post, covered this morning's announcement that Heartland Payment Services was breached. He is calling it one of the largest breaches ever, and according to him, Avivah Litan, a distinguished analyst from Gartner criticized and questioned as deceptive, the "Inauguration Day" release, apparently suggesting that it wouldn't get the coverage it would otherwise.

Payment Processing Breach May Be Largest Ever

A data breach last year at Princeton, N.J., payment processor Heartland Payment Systems may have led to the theft of more than 100 million credit and debit card accounts, the company said today.

If accurate, such figures may make the Heartland incident one of the largest data breaches ever reported.

Robert Baldwin, Heartland's president and chief financial officer, said the company, which processes payments for more than 250,000 businesses, began receiving fraudulent activity reports late last year from MasterCard and Visa on cards that had all been used at merchants which rely on Heartland to process payments.

The data stolen includes the digital information encoded onto the magnetic stripe built into the backs of credit and debit cards. Armed with this data, thieves can fashion counterfeit credit cards by imprinting the same stolen information onto fabricated cards.

"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address," Baldwin said. As a result, he said, the prospect of thieves using the stolen data to rack up massive amounts of fraud at online merchants "is not impossible, but much less likely."

Avivah Litan, a fraud analyst with Gartner Inc., questioned the timing of Heartland's disclosure -- a day in which many Americans and news outlets are glued to coverage of Barack Obama's inauguration as the nation's 44th president. "This looks like the biggest breach ever disclosed, and they're doing it on inauguration day?" Litan said. "I can't believe they waited until today to disclose. That seems very deceptive."

Biometric PIN Debit for M-Commerce?

World's first biometric, waterproof mobile surfaces

Fujitsu has launched what it claims is the world’s first waterproof handset with an embedded biometric sensor. Fujitsu's F-01A: waterproof and secure.

The Symbian-based F-01A supports e-Wallet transactions.

Combine this AND our PIN debit mobile platform and there would be triple-authentication protection for the m-commerce sector...

Biometric sign-in (who you are) authorizes and activates use of our SwipePIN device, which verifies card present (what you have) by swiping said card, and triple-authenticates the transaction by asking the user to enter their PIN. (what you know)

For more information on the biometric sensor manufacturer visit: Authentec

Credit Card Fraud Up Down Under

Credit Card fraud rates are "jumping" faster than ever, not just here, but around the globe. In this article, the APCA announced that there's been huge rises in CNP transactions and that credit card fraud spiked to 50.2 cents per $1000, or almost 7 times higher than debit's 7.4 cents per $1000 transacted. Here's the article from Karen Dearne, who writes for Austrailian IT.

Credit card fraud spikes | Australian IT

CREDIT card fraud in Australia jumped to $233 million in the last financial year, up from $157 million in 2006-07, according to the Australian Payments Clearing Association.

The losses are due to increased fraud across borders, and huge rises in card-not-present (CNP) fraud involving online, phone or mail transactions. Editor's Note: Huge rises in card-not-present fraud can be eliminated by morphing them into card-present transactions with the HomeATM SwipePIN device...)

Total fraud on Australian credit cards amounted to $132 million; of this, $73 million was obtained by criminals using the cards in other countries. More than $63 million was lost to CNP scams ($22 million within Australia and $41.6 million on locally-issued cards used overseas).

Skimmed and counterfeit cards accounted for $42 million in losses ($18 million within Australia, and $24 million on locally issued cards used overseas).

For the first time, losses due to fraud on cards originally issued overseas topped $100 million; criminals using foreign cards within Australia reaped almost $101 million, up from $66 million in 2006-2007. The number of local cases involving skimmed or counterfeit cards from overseas almost doubled: more than 155,000 incidents were reported, resulting in total losses of $65 million, compared with 82,000 and $40 million the previous year.

At the same time, fraudsters used overseas cards to steal nearly $25 million through CNP transactions locally, up from $16.5 million.

APCA chief executive Chris Hamilton said credit and charge fraud now cost 50.2 cents in every $1000 of payments transacted, up from 38.6 cents previously.

Debit card fraud increased only slightly, from 7.1 cents to 7.4 cents in every $1000 transacted, reflecting the greater security of Eftpos and ATM networks.

Fraud in the Heartland

In yesterday's last post: "Hackers Affect Debit and ATM Networks" I provided information from a story published by "The Times Tribune" that the STAR debit network had seen some suspicious activity and in a response to the situation, STAR said "the debit card issue we were alerted to could affect not only STAR but also other debit networks."

Earlier this morning, came news that one of the nations bigger processors, Heartland Payment Systems has been breached. Are they related or was Avivah Litan, distinguished analyst with Garnter spot-on when she said, "payments and funds transfer processors, rather than retailers are now the one's being targeted by hackers."

Is the "Mother of All Hacks" coming? In that post, when speaking of the recent Royal Bank of Scotland breach, I said: "There is a disturbing development brewing in the payments world. It's bad enough when a retailer's computer security is breached but now we've got us a completely different ballgame. When hackers penetrate the computer systems of major acquirers and processors, well to use a famous quote, "We've got a problem Houston."

This could turn out to be a "Royal pain in the ***" for Visa and Mastercard themselves because acquirers like Royal Bank of Scotland link directly into their networks. On the surface, this appears to be "one small step for hackers but it's "one giant step" for hack-kind."

In that post I quoted Ms. Litan as saying:

“It’s very bad news,” says distinguished analyst Avivah Litan. Unlike retailers’ computer systems, processors’ systems connect directly to the networks of Visa Inc. and MasterCard Inc. “An attacker that breaks into a processor conceivably can get into the heart of the system,” and attacks on acquirers and processors are increasing."

Did she say "get into the Heart of the system?..." Man, she's like the Nostradamus of the payments world...stay tuned...

Heartland Payment Systems Uncovers Malicious Software In Its Processing System
No merchant information or cardholder Social Security numbers compromised.

PRINCETON, N.J., Jan. 20 /PRNewswire-FirstCall/ -- Payments processor Heartland Payment Systems has learned it was the victim of a security breach within its processing system in 2008. Heartland believes the intrusion is contained.

"We found evidence of an intrusion last week and immediately notified federal law enforcement officials as well as the card brands," said Robert H.B. Baldwin, Jr., Heartland's president and chief financial officer. "We understand that this incident may be the result of a widespread global cyber fraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice."

No merchant data or cardholder Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers were involved in the breach. Nor were any of Heartland's check management systems; Canadian, payroll, campus solutions or micropayments operations; Give Something Back Network; or the recently acquired Network Services and Chockstone processing platforms.

After being alerted by Visa(R) and MasterCard(R) of suspicious activity surrounding processed card transactions, Heartland enlisted the help of several forensic auditors to conduct a thorough investigation into the matter. Last week, the investigation uncovered malicious software that compromised data that crossed Heartland's network.

Heartland immediately took a number of steps to further secure its systems. In addition, Heartland will implement a next-generation program designed to flag network anomalies in real-time and enable law enforcement to expeditiously apprehend cyber criminals.

Heartland has created a website - www.2008breach.com - to provide information about this incident and advises cardholders to examine their monthly statements closely and report any suspicious activity to their card issuers. Cardholders are not responsible for unauthorized fraudulent charges made by third parties.

"Heartland apologizes for any inconvenience this situation has caused," continued Baldwin. "Heartland is deeply committed to maintaining the security of cardholder data, and we will continue doing everything reasonably possible to achieve this objective."

Monday, January 19, 2009

Hackers Affect Debit and ATM Networks

TheTimesTribune.com, Corbin, KY - Hackers affect debit and ATM networks

Forcht Bank disabled 8,500 customer debit cards this week after learning they could have potentially been hacked into by persons creating duplicate cards.

Eddie Woodruff, chief operations officer for the bank, confirmed that 8,500 of the bank’s roughly 22,000 total debit cards had been deactivated, but the move was primarily a precaution.

“Right now, none of our customers have reported any fraudulent activity on the cards,” Woodruff said. “We’re just trying to take every precaution.”

The cards were comprised when a retail merchant’s computer system was hacked, Woodruff said. The breach affected customers of multiple banks and multiple debit and ATM networks.

“Our debit card processor, which is a company called STAR, they had a retail customer, we’re not exactly sure who the retail customer was, and the information we believe may have been compromised,” he said.

First Data Corporation, which operates the STAR Debit and ATM Network, would not comment on how many other banks were affected, but did release in a statement Monday that "the debit card issue we were alerted to could affect not only STAR but also other debit networks."

The STAR system is used by 2 million ATM and retail locations across the country, according to its Web site.

“While we do not comment on specific matters pertaining to our customers, we can tell you this situation is not related to any First Data processing systems or practices,” stated Nancy Etheredge, spokesperson for First Data. “We are working with our clients, the card associations and card issuing and acquiring banks to monitor and help mitigate the issue and protect consumers.”

Money Transfer Network adds 33,000 locations

Minneapolis, Jan. 19, 2009 -- MoneyGram International (NYSE: MGI) today announced that in 2008 the company added 13 countries and territories and more than 33,000 locations to its global network, helping people and communities around the world by providing more convenient choices for safe and reliable money transfer services.

"Our continued growth--both international and domestic--is a reflection of growing consumer demand, fueled by ongoing global migration trends and our ability to deliver value to our customers and agents across the globe," said Tony Ryan, MoneyGram chief operating officer and executive vice president.

"MoneyGram's diverse, global agent network is our competitive advantage," said Ryan. "We will continue to invest in strategic growth by adding agent locations in key growth areas as well as expanding existing agent relationships, and growing our owned-retail presence."

In 2006, in response to business and market needs, MoneyGram launched its owned-retail strategy in France and Germany, and today operates more than 50 stores and kiosks in high-traffic areas in immigrant communities. Half of the countries joining MoneyGram's network last year are French-speaking, reflecting the company's commitment to serving the needs of France's large immigrant population. According to the World Bank, France is a top-five immigration country with 6.5 million immigrants.

"Our growth in France was vital to adding Algeria, which according to the World Bank, produced the largest influx of immigrants into the country," Ryan said. "Today, we have stronger prospects in the country for expansion through more traditional agent locations."

Germany is a similar success story for MoneyGram. The company established service to Serbia this year, which produces a high volume of immigrants to the country. MoneyGram has 30 owned locations strategically located in Germany.

"Network breeds network and feeds both expansions to new countries and increased locations in key areas around the globe," Ryan said. "The more we grow, the more interested retailers, post offices and financial institutions are in seeking our service to expand and grow their own businesses and offer more services to their customers."

Countries and territories added to MoneyGram's global network include the French-speaking Algeria, Central African Republic, Comoros, French Polynesia, Gabon, Madagascar and New Caledonia. Other countries include Angola, Bermuda, Bhutan, Czech Republic, Serbia, and Slovenia.

About MoneyGram International, Inc.

MoneyGram International, Inc. is a leading global payment services company. The company's major products and services include global money transfers, money orders and payment processing solutions for financial institutions and retail customers. MoneyGram is a New York Stock Exchange listed company with approximately 176,000 global money transfer agent locations in 180 countries and territories. For more information, visit the company's website at www.moneygram.com .

Source: Company press release.

Dilllard's to Use "Planet Payment" Service

Edited Press Release

LONDON -(Dow Jones)- Planet Payment, a multi-currency and data processor, announced Monday that its Pay in Your Currency service, known in the industry as Dynamic Currency Conversion, is now being offered at Dillard's, a fashion apparel and home furnishings retailers in the United States.

The Pay in Your Currency service provides international shoppers paying for their purchases with Visa or MasterCard payment cards with the choice to pay in their home currency at the point of sale, rather than allowing their issuing bank to perform the conversion after the sale has been completed. The service provides greater clarity and certainty to international purchases by allowing the customer to pay in the currency that he or she knows best - their own. The service is being offered through Fifth Third Processing Solutions, (Cincinnati, Ohio) Dillard's current credit card acquirer.

(END) Dow Jones Newswires
01-19-09 0327ET
Copyright (c) 2009 Dow Jones & Company, Inc.

Battle Against Card Fraud Heats Up

In an effort to reduce credit card fraud, HSBC announced it is going to analyze each and every transaction. This will result in both consumer frustration and inconvenience because a higher percentage of legitimate transactions will be declined. In addition, further inconveniences include the fact that consumers need to provide travel plans to banks, and banks are recommending the use of cash and travelers checks along with credit cards when traveling. It certainly appears that convenience has taken a back seat to security and our so-called "cashless society" has been put on hold a while. This from the BBC over the weekend....

BBC NEWS | Business | Card fraud crackdown accelerated

Card fraud crackdown accelerated - Holiday makers are advised to take several different payment methods

A leading bank is introducing new technology which will mean that every credit card transaction will be scrutinized for fraud. HSBC is introducing the program, which will affect 10 million card accounts and millions of transactions. The banking industry has warned that more legitimate transactions will be queried or canceled as a result. Card fraud is rising - up 14% in the first half of 2008 - and fraud abroad now accounts for 40% of all card crime.

Travelers are being advised to take several different payment methods, including cash, credit cards and travellers' cheques when they go abroad. After several years of falling numbers, card fraud started rising again in 2007. Latest figures show that card fraud could have exceeded £600m in 2008, and banks are using increasingly sophisticated systems to try to outwit fraudsters.

HSBC previously checked 25% of card transactions but is currently rolling out a system that means all card transactions will be screened in real time, with a decision made in a fraction of a second. Bart Patrick of SAS UK, which is providing the software system for HSBC, said: "When you put your card in the machine it's carrying out an automatic check against your pattern of normal use - and making a decision about whether that is real or fraudulent."

He said banks were constantly battling with fraudsters to reduce the levels of crime. "Card fraud is an arms race. The banks will come up with one way of dealing with it, the fraudsters will come up with a way round it."

"What we have seen with chip and pin - it was successful for 18 months, two years - the fraudsters have worked a way round it, so we are now looking at more sophisticated means."

However as the banks become more proactive in targeting fraudsters, more people could find their legitimate transactions are declined or queried. When Sally Wiber went on holiday to Borneo, she followed industry advice and told her bank where she was going. (See: Wanna Get Away?)

But her credit and debit cards were blocked when she tried to use them on her first day. "I spent much of the first day trying to deal with my bank and getting internet access, and then had a rather frustrating phone call trying to make sure that I could use my cards for the rest of my holiday," she said.

Continue Reading at BBC Watch Video at BBC

Skimmer "Sentenced in Seattle"

Skimmer Now Jail Bird

The owner of a Redmond, WA tobacco shop was sentenced to less than three years in prison for skimming $300,000 off more than 300 credit cards. That's a little harsher than $200 bucks and get outta town" (see Saturday's post) but not as harsh of a sentence as the same crime will see in the future.

Here's the U.S. Attorney's Office news release:

HRANT "MIKE" ASLANYAN, 38, of Redmond, Washington, was sentenced today in U.S. District Court in Seattle to 33 months in prison, five years of supervised release and over $214,000 in restitution for Bank Fraud. ASLANYAN, the owner of a small tobacco and convenience store, pleaded guilty on June 13, 2008, admitting that he skimmed the debit and credit card numbers of more than 300 of his store customers. Those stolen numbers were used to steal money or incur credit from seventeen different banks. At sentencing U.S. District Judge Ricardo S. Martinez said, "This type of crime victimizes totally innocent people who are just going about their daily business." Judge Martinez ordered ASLANYAN taken into custody immediately to begin serving his sentence.

According to the Seattle Times Police Blotter: In late 2004 though early 2006, law enforcement investigated a rash of reports of compromised credit and debit cards. Dozens of people had their credit and debit cards used, without their permission, to withdraw money in the Las Vegas, Nevada and Los Angeles, California areas. Some seventeen financial institutions were hit for about $300,000. Some 300 Redmond area accounts were accessed. (Editor's Note: Just think how much more he could've made if Bill Gates was a smoker!)

The place where each of the victims had used their credit or debit card, was "Smokers Choice" a small tobacco and convenience store in Redmond. Thirty-five of the victims specifically identified ASLANYAN as the person who had run their credit or debit card. The skimmer that records credit or debit card information was never recovered.

ASLANYAN has refused to assist law enforcement by identifying his co-conspirators who used the information to incur credit charges or raid victim bank accounts.

In asking for 33 months of imprisonment, Assistant United States Attorney Vince Lombardi argued that the victims go beyond the banks that lost money, to the people whose accounts were violated. "It is difficult to overstate the feeling of victimization felt by individuals who find their identity and account information stolen, merely because they chose to entrust Defendant with their debit or credit card when buying cigarettes or other items... Identity theft and related fraud crimes have been an epidemic in this judicial district ... this particular crime impacted hundreds of individuals," Mr. Lombardi wrote in his sentencing memo.

The case was investigated by the U.S. Secret Service, the Redmond Police Department, the Bellevue Police Department, and the Duvall Police Department.

Comment:

January 17, 2009 at 9:43 AM

$300,000 stolen, yet only $214,000 restitution ... how come not the whole $300,000 ?.. only 33 months in prison?? must have been some pretty heavy plea bargening going on here.. this sleeze should be made to pay back the WHOLE thing and do at least 10 years.. especially since he refused to co-operate with the investigators in naming his partners.. something here has gotta change in our "justice" system...

tsgt - ephrata,WA

Final Results for Cyber Holiday Pulse Index

The Pulse Index is an annual tracking of online shopping activity during the holiday season. From November through January, Chase Paymentech monitors the daily activity of 25 of the largest 150 Internet retailers. The data includes the total number of payment transactions and total dollar value processed. The data is taken from transactions crossing Chase Paymentech's global processing platform.

Final Results for Cyber Holiday Pulse Index

"The Pulse Index was remarkable this year," said Mia Shernoff, marketing executive for Chase Paymentech. "Because it tracks actual transactions on a daily basis for such a large number of major e-commerce merchants, the Index provided unique insight into the behavior of online shoppers and how the economic climate affected their buying patterns."

Online Holiday Shopping 2008 - A Mixed Bag

For the 2008 holiday shopping season, the Pulse Index results represent online purchases beginning on November 1, running through December 31. While sales volume and transaction count both show an increase, the average ticket, or amount per sale, declined.

The statistics indicated:

Sales volume for the holiday season was up a modest 4.5 percent versus 2007.
Transaction count was up a significant 16.5 percent.
Average value per transaction was down an unanticipated 10.3 percent.

According to Forrester Research Principal Analyst Sucharita Mulpuru, the mixed e-commerce news highlights the environment faced by retailers this year. "This holiday season challenged all retailers," she said. "Web transaction volume was up significantly from last year, but the relatively lower revenue numbers point to aggressive discounting by retailers and eager deal-hunting by shoppers."

The tough shopping season, however, was an opportunity for some e-commerce merchants. Said Mulpuru, "A few branded retailers with very favorable pricing strategies were able to take advantage of the holiday season's circumstances and increase their market share. There should be a shakeout of Web retailers, but that will leave the remaining players more favorably positioned for growth into 2010 and beyond."

Additional highlights of the 2008 Pulse Index included:

The peak shopping season (the period between Thanksgiving and Christmas) sales were down 4.5 percent, but transaction volume was actually up 5.2 percent - this despite five fewer shopping days during this period versus 2007.
The largest day for transactions was Tuesday, December 16, with 3.96 million transactions. This was only slightly higher than Wednesday, Dec 17, which saw 3.95 million transactions.
The largest day for sales was Tuesday, December 2, with more than $218 million, topping Wednesday, December 17, which saw more than $217 million.

Said Aaron Press, director of market research for Chase Paymentech, "The practical lesson we took from this year's Pulse Index is that all of the hype surrounding Cyber Monday, is just that: hype. Merchants looking to capture additional sales or attract new customers should consider focusing their discounts and promotions on the middle of the week. Tuesday through Thursday is the peak shopping time for online consumers."

Mia Shernoff concluded, "There is a lot of value in being able to see the information and trends reflected in an index representing actual transactions among e-commerce merchants. It helps companies with everything from allocating resources to scheduling promotions during a crucial time."

Data and charts are updated daily, with weekly commentary to explain any trends, offer historical insight and provide context. Guest commentary will be provided by Sucharita Mulpuru from Forrrester and Aaron Press, Director of Market Analysis for Chase Paymentech. Visit the Pulse Index every business day at 2:00 P.M. EST to see the daily numbers, or subscribe to our weekly commentary via RSS. Media inquiries should be directed to James Wester, Director of Corporate Communications for Chase Paymentech at 877.843.5631 www.chasepaymentech.com

Source: Presss Release

Saturday, January 17, 2009

Circuit City Shorts Out

Hope you used your gift cards...

Back on November 11th, in a post I called "Short Circuit in Gift Cards?" I stated:

"If You've got a Circuit City Gift Card, Use it Now!

...Circuit City tried to reassure shoppers that it would be business as usual despite its Chapter 11 bankruptcy filing. I wouldn't be the least bit surprised, if and when the Circuit City gift cards do indeed short-circuit, to see the gift card landscape vastly affected forever. There needs to be either new regulation introduced or someone will have to come up with an improved program... otherwise consumers will shy away, from, especially the "closed loop" gift cards.

So if you have a Circuit City gift card use it immediately..."

Hope you did, because yesterday Circuit City announced they are "shuttering" all 567 stores. If you haven't used them, there's no rush...you can shop at CircuitCity.com through tomorrow. (January 18th) Store liquidations begin as early as today and last until...?

According to the Chicago Tribune, "The sooner consumers use their gift cards, the better. Circuit City's group of liquidators have agreed to honor gift cards for at least the first few weeks. Deadlines for gift card use are expected to be posted in stores within the next couple of days."

"We are extremely disappointed by this outcome,” said James A. Marcum, acting president and chief executive of Circuit City Stores. He called the liquidation “the only possible path” for the 60-year-old company."

The NY Times writes: "The demise of Circuit City, while not surprising given its declining sales, is part of a radical shift (Editor's Note: call it "radical" but I say "paradigm") taking place in retailing. Weak chains — unable to weather the freeze-up in consumer spending and choked by tight credit markets — are closing.

Look for that "Amazon Thanksgiving Day Parade" by 2011, eh?

PIN Debit Payments Blog

$200 Bucks and Get Outta Town

Hmmm, I always thought that age-old line was "Don't do the crime if you can't do the time." Apparently that's not true in West Vancouver.

"Don't Refrain if You Can Gain" seems to be more applicable..

$200 bucks? Heck, go 72 mph in a 65 zone here and you'll be penalized more than that...

Here's a story from CTV British Columbia where they tell the tale of a PIN Pad thief who got fined $200 bucks and has to leave town by "high noon." Unbelievable. I've reproduced the comments from their site, and as you can read, people are getting fed up with these types of crimes. As I've posted in the past...why rob a bank? That's 20 years...this is $200 bucks. If he didn't get caught "red-handed" what would his take be? IMHO, the judge got this one "way wrong." At least the message he's sending is...

Here's the story: CTV British Columbia- PIN pad thief gets $200 fine and deportation order - CTV News, Shows and Sports -- Canadian Television

PIN pad thief gets $200 fine and deportation order
Updated: Fri Jan. 16 2009 18:32:54 Darcy Wintonyk, ctvbc.ca

Police in West Vancouver have caught a PIN pad thief red-handed -- and kicked him out of the province. On Tuesday night, the owner of a Park Royal area juice bar called police after someone stole the PIN pad from the counter. He had just serving two customers and noticed that the device was missing.

Editor's Note: Notice the pic of the PIN Pad (below right) with a steel tether to prevent it from getting stolen...

Police apprehended the men shortly after near Marine Dr. and 14th St. after being alerted by a transit operator. After a brief investigation, police recovered the pad from a rental car parked nearby. On Thursday, 23-year-old Quebec native Jonathan Ramirez-Dionne pled guilty to theft under $5,000 in a North Vancouver courtroom.

"He was sentenced to one year probation and a $200 fine," says Const. Jeff Palmer.

But that's not all. The judge has also given the unusual order for him to leave the area. "An interesting aspect of his probationary requirement the judge has ordered him to leave British Columbia by four o'clock Friday afternoon and he's not to be found in British Columbia during the term of his probation."

The owner of the juice bar doesn't think the penalty is heavy enough. "It's funny because if I was caught speeding, it would be a bigger fine, and you know it's less of a heinous crime per say, and they get $200 which is a little bit bizarre," says Blake Goddard.

Police advise merchants to securely attach pin pads to counters at and to train staff to regularly check the devices. This isn't the first time Park Royal mall has been hit by debit thieves. Last March, police warned customers to change their PIN numbers after two La Senza's and an Aldo store had their PIN pads stolen.
PIN pads don't normally record PIN numbers, but the devices can be modified to take in personal information. In August 2007, phony PIN pads turned up at four retail stores, including and thieves used the stolen information to withdraw money from hundreds of accounts.

Please Add Comments(7)
Don
I like that the judge told him to get out of BC. I think 200 dollars is pretty light as a fine for this type of crime though.
Pat in the Valley
What kind of justice is this - first he breaks the law, can steal potentially mega bucks and all he gets is the boot from the Province. When will the Justice System finally get it? and hand out appropriate sentencing and not just another "slap on the wrist".
Christine
That is ridiculous! $200 fine, what a joke! How will we know that the guy is actually leaving the Province and who is going to keep track of him?
Ashley
What a joke that is! Apparently in BC and in Canada it pays to lead a life of crime. Wasn't too impressed to be watching this story on the 6pm news on CTV and watched the report show the viewers exactally how to remove it. I know its not rocket science but come on..
C
Umm... I agree with your statement "PIN pads don't normally record PIN numbers, but the devices can be modified to take in personal information." but your on-air story is misleading viewers that PIN pads ARE storing information when they DO NOT. Only counterfeit PIN pads store/steal information.
Aden
Thats awsome thats what you get when you steal from our province Au revouir frenchy
Bangedup
what a joke - time to change the laws