Mobile Payment Industry News

Thursday, October 8, 2009

RSA and VeriSign Team Up On Cloud-Based, Two-Factor Authentication Offering

Technical and Sales Partnership of Two "Best-in-Class" Authentication Providers Broadens Options for Customers by Enabling the VeriSign(R) Identity Protection Authentication Service to Support RSA SecurID(R) OTP Credentials

BEDFORD, Mass. and MOUNTAIN VIEW, Calif., Oct. 8 /PRNewswire/ -- RSA, The Security Division of EMC (NYSE: EMC) and VeriSign, Inc. (Nasdaq: VRSN), the trusted provider of Internet infrastructure services for the networked world, are working together to provide organizations with the mutual benefit of an expanded VeriSign® Identity Protection (VIP) Authentication Service through the availability of RSA SecurID® two-factor authentication technology for more choice in one-time password (OTP) authentication. VIP is a managed, shared authentication solution that provides its users with a single one-time password (OTP) authentication device to securely access multiple Web sites.

Organizations in search of strong authentication solutions will benefit from being able to use VIP in combination with RSA SecurID hardware tokens. RSA and VeriSign, both of whom were recently rated Best-in-Class for Multi-Channel Authentication Technology by Javelin Strategy & Research(1), are teaming up to address the market segment for managed, shared authentication services, offering organizations the convenience of a single platform.

The technical and sales partnership signals a new chapter in the longstanding relationship between RSA and VeriSign. Twenty-five years ago, RSA pioneered two-factor authentication and encryption and in 1995, VeriSign was founded as a separate entity leveraging RSA technology to develop and provide digital identities through a managed services model.

"RSA and VeriSign have a long history of complementary and innovative security solutions and standards, such as SSL, that enabled internet usage and growth," said Jim Bidzos, VeriSign executive chairman and founder. "We have again joined forces to benefit users by providing managed, shared authentication services on a single platform. No one is better equipped to deliver comprehensive, best-in-class authentication solutions than RSA and VeriSign."

"Inventive collaboration between key industry leaders is critical to delivering higher value to customers and responding to the ever-changing threat environment," said Art Coviello, executive vice president of EMC Corp. and president of RSA. "Together with VeriSign, we've worked hard over the decades to help ensure online transactions are safe, secure and trustworthy. With more than 40 million users of RSA SecurID worldwide, we're thrilled at the opportunity to serve customers through the VIP Network."

VeriSign plans to complete the integration of the RSA SecurID Authentication Engine into the VIP Authentication Service by the end of December 2009, which will enable VIP customers to use RSA SecurID hardware authenticators. At that time, VeriSign will also resell RSA SecurID hardware tokens to VIP prospects and customers, and RSA will likewise resell the VIP Authentication Service to its prospects and customers.

"Institutions worldwide face growing risks to their assets, legal liability and reputations as they seek to securely and conveniently authenticate their customers across multiple channels," said Robert Vamosi, Security, Risk & Fraud Analyst for Javelin Strategy & Research. "RSA and VeriSign, both of whom were selected as Best-In-Class for authentication technology, are offering an enhanced, scalable, cloud-based global authentication network that is greater than the sum of its parts. This partnership will be a significant force in the adoption of two-factor authentication worldwide."

Mary T. Monahan, managing partner and research director at Javelin Strategy & Research, added, "The alliance of two powerhouses with the integration of RSA SecurID technology into VIP will strengthen their combined market leadership and work to increase the collective clout of both VeriSign and RSA."

As part of the agreement, the companies will work to transfer all existing RSA GoID customers to the VIP Authentication Service by the end of Q2 2010. RSA will work closely with all existing RSA GoID customers for a smooth, uninterrupted transition to the VIP Authentication Service. VeriSign is committed to delivering the highest standards of customer care and technical innovation that RSA GoID customers expect today.

The VIP Authentication Service implements two-factor authentication through VeriSign's cloud-based Security as a Service (SaaS) model, which enables organizations to accelerate authentication system deployments while driving down per user costs. Currently with more than 100 members on the network worldwide, the VIP Authentication Service enables strong authentication for tens of millions of mobile users. The VIP Authentication Service is part of a portfolio of authentication products that include PKI and SSL certificates, which in total, account for more than a billion authentication look-ups each day. The RSA GoID managed, shared consumer authentication service is designed to identify users before they interact with a Web site or online application.

The RSA SecurID two-factor authentication system is used by more than 40 million people across more than 30,000 organizations worldwide to help prevent unauthorized access to corporate applications and resources. The system is comprised of a broad range of hardware and software authenticators that provide end users with a one-time password, along with its software engine -- RSA® Authentication Manager. The RSA SecurID solution is part of RSA's complete portfolio of cloud-based and on-premise authentication technologies that when combined, protect more than 300 million online identities worldwide.

About RSA

RSA, The Security Division of EMC, is the premier provider of security solutions for business acceleration, helping the world's leading organizations succeed by solving their most complex and sensitive security challenges. RSA's information-centric approach to security guards the integrity and confidentiality of information throughout its lifecycle -- no matter where it moves, who accesses it or how it is used.

RSA offers industry-leading solutions in identity assurance & access control, data loss prevention & encryption, compliance & security information management and fraud protection. These solutions bring trust to millions of user identities, the transactions that they perform, and the data that is generated. For more information, please visit www.RSA.com and www.EMC.com.

About VeriSign

VeriSign, Inc. (Nasdaq: VRSN) is the trusted provider of Internet infrastructure services for the networked world. Billions of times each day, VeriSign helps companies and consumers all over the world engage in communications and commerce with confidence. Additional news and information about the company is available at www.verisign.com.

Electronic Payment Exchange Welcomes New Visa Best Practices for Data Field Encryption

Electronic Payment Exchange (EPX), a leading merchant acquirer and payment processor, said today that the recent Visa release of data field encryption best practices provides welcome leadership to merchants, technology professionals, and vendors looking for practical ways to reduce the risk of data breach. EPX is the first payment processor to offer a true end-to-end solution that endorses and incorporates both tokenization and encryption for securing cardholder data from the card reader through the entire transaction lifecycle, and believes the Visa best practices validate their approach.

Wilmington, DE (Vocus/PRWEB ) October 8, 2009 -- Electronic Payment Exchange (EPX), a leading merchant acquirer and payment processor, said today that the recent Visa release of data field encryption best practices provides welcome leadership to merchants, technology professionals, and vendors looking for practical ways to reduce the risk of data breach. EPX is the first payment processor to offer a true end-to-end solution that endorses and incorporates both tokenization and encryption for securing cardholder data from the card reader through the entire transaction lifecycle, and believes the Visa best practices validate their approach.

The best practices for data field encryption (also known as end-to-end encryption or point-to-point encryption) announced by Visa on October 5, 2009 work toward developing a standard approach while offering guidance to payment solution providers. Visa establishes five key implementation objectives for payment providers who deploy end-to-end encryption: limiting the availability of cleartext cardholder and authentication data; using robust key management solutions that are consistent with international standards; using key lengths and cryptographic algorithms that are consistent with international standards; protecting cryptographic devices from physical/logical compromises; and using alternate identifiers for business processes that require the account number after authorization.

“The technologies built into EPX BuyerWall goes hand-in-hand with the data field encryption objectives established in the Visa best practices document,” says EPX Chief Security Officer Matt Ornce. “Using encrypted card readers with our EPX BuyerWall solution satisfies the Visa’s objectives and provides strong protection for merchants against potential data breaches.”

According to the Visa data field encryption best practices document, “no single technology can completely solve for fraud.”

Ornce wholeheartedly agrees. “EPX’s solution uses both end-to-end encryption to encrypt card data from the point of sale, and tokenization on the back end of the transaction,” he says. “Encryption at the card reader protects merchants against potential breaches before card numbers even leave the swipe for authorization. EPX BuyerWall tokenization replaces account numbers with values that are meaningless to would-be thieves and cannot be reverse-engineered to reveal the card numbers. Combined, they provide unparalleled fraud protection for a merchant’s customers.”

About Electronic Payment Exchange

Founded in 1979, Electronic Payment Exchange is the global, industry-leading provider of fully integrated, end-to-end payment solutions for merchants across all distribution channels. EPX offers a full range of payment processing services for leading merchants, retailers, etailers, and banks in the United States, Canada, Europe, Latin America, and the Caribbean.

EPX is a participating organization of the Payment Card Industry Security Standards Council. EPX is PCI v1.2 compliant, a VISA USA Cardholder Information Security Program (CISP) Compliant Service Provider, and a MasterCard Site Data Protection (SDP) Compliant Service Provider.

For more information about EPX, visit www.epx.com or contact EPX at 302-246-3110.

Contact:

Steven M. Kendus, Marketing Director

Electronic Payment Exchange

302.246.3091

# # #

Typing Mostly Misunderstood

Over the course of the last couple of months I have blogged on the weaknesses of SSL. In fact, the new improved EV (Extended Validation) SSL can be manipulated by the bad guys because of inherent weaknesses in browsers...

EV SSL Encryption Is Safe! "Yeah...Right!" | PIN Debit Payments Blog - Jul 08, 2009

EV SSL Sessions are Safe...Yeah Right! Part Deaux | PIN Debit ... Jul 14, 2009

PIN Debit Payments Blog: Browser Flaws Nullify EV SSL Jul 24, 2009

Here's more on Secure Sockets Layer web sessions from Dark Reading

At the end of the day, the cause of all these problems is that we continue to "type" (some call it "entering") credit/debit card numbers and passwords into a box in the browser. Typing is still mostly Misunderstood...

SSL Still Mostly Misunderstood

By Kelly Jackson Higgins DarkReading

Most users ensure their Web sessions are using Secure Sockets Layer (SSL) before entering their credit card information, but less than half do so when typing their passwords onto a Web page, according to a new survey.

Just what SSL does and doesn't do isn't clear to many users, and the way Websites implement it doesn't help: "The biggest issue is the general population doesn't know what SSL is, why they're using it, and it's ingrained in them that it always makes them secure, which is not always the case," says Tyler Reguly, senior security engineer for nCircle, who surveyed a cross-section of users -- technical and nontechnical -- and shared the results of his findings today during a panel presentation about SSL at the SecTor Conference in Toronto.

Reguly's survey found that while 83 percent of users check they're using an SSL-secured session before entering their credit card information on a Website, only 41 percent do so when typing in their passwords. "It's scary that people care so little about their passwords than they do about their credit card numbers," he says. "You see surveys saying that anywhere from 30 to 60 percent of users are using the same password everywhere, so they're probably using it for online banking, too."

It has been a rough year for SSL, with the groundbreaking man-in-the-middle hack by researcher Moxie Marlinspike, which dupes a user into thinking he's in an HTTPS session when in reality he has been taken elsewhere by the attacker, as well as a demonstration by researcher Mike Zusman showing how several certificate authorities (CAs) themselves are vulnerable to attacks when issuing SSL certificates. And Dan Kaminsky at Black Hat USA exposed critical flaws in X.509 certificate technology used in SSL.

Continue Dark Reading

Compuware to Acquire Gomez for $295 Million

Lexington, Massachusetts, October 7, 2009

Compuware Corporation (NASDAQ:CPWR) and Gomez yesterday announced the signing of a definitive agreement for Compuware to acquire privately-held Gomez, Inc. Compuware is the world's leading application performance management software company, and Gomez is the leader in Web application experience management. The $295 million cash acquisition is expected to close in November of 2009.

“Together, Compuware and Gomez provide the industry’s only unified Application Performance Management solution, spanning the Enterprise and Internet,” said Compuware President and Chief Operating Officer Bob Paul. “For business and IT executives who are moving more business-critical applications onto the Internet, Compuware can now offer unified visibility, isolation and resolution of application performance problems from the data center to the customer. Competitive offerings only cover isolated portions of the Enterprise-Internet application delivery chain.”

Headquartered in Lexington, Massachusetts, Gomez employs 272 people around the world. Substantially all of these employees, including the leadership team, are expected to remain with Compuware after the close of the transaction.

“This agreement marks a fundamental breakthrough in how IT and business leaders can manage the performance of all the applications that drive their businesses,” said Jaime Ellertson, Chief Executive Officer and President, Gomez. “The complementary nature of our products and our already-existing product integration will allow Compuware and Gomez to rapidly deliver dramatically extended value to our mutual customers.”

“Compuware’s financial strength, its R&D horsepower, and its geographic reach will benefit both our employees and our customers,” said Richard Brekka, Chairman of the Board, Gomez.

With the addition of Gomez—which delivers its offering through a Software as a Service (SaaS) model—to Compuware’s SaaS revenues, Compuware becomes the world’s leading SaaS infrastructure management provider. SaaS continues to become a more desirable way to acquire software due to a lower cost of ownership and faster, easier adoption and maintenance.

For complete details on how this agreement sets the new standard for managing the performance of business applications, visit http://www.compuware.com/gomez.

The completion of the transaction is subject to customary government approvals and the satisfaction of other customary conditions.

Compuware Corporation

Founded in 1973, Compuware provides software, experts and best practices to ensure applications work well and deliver business value. Compuware helps CIOs optimize end-to-end application performance for leading businesses around the world, including 46 of the top 50 Fortune 500 companies. Learn more at: http://www.compuware.com.

Conference Call Information

Compuware will host a conference call to discuss this agreement at 8:30 a.m. Eastern time (12:30 GMT) today. To join the conference call, interested parties from the United States should call 800-230-1092. For international access, the conference call number is +1-612-326-1027. No password is required. To download the presentation that will be used during the conference call, visit http://compuware.com/gomez.

A conference call replay will also be available. The United States replay number will be 800-475-6701, and the international replay number will be +1-320-365-3844. The replay passcode will be 118303. Additionally, investors can listen to the conference call via webcast by visiting the Compuware Corporation Investor Relations web site at http://www.compuware.com.

About Gomez

Gomez, Inc. is the leader in Web application experience management, providing an on-demand platform that organizations use to optimize the performance, availability, and quality of their Web and mobile applications. The Gomez platform identifies business-impacting issues by testing and measuring Web applications from the "outside-in" — across all users, browsers, devices, and geographies — using a global network of over 100,000 locations. The self-service Gomez platform integrates Web load testing, Web performance management, cross-browser testing, and Web performance business analysis. Over 2,500 customers worldwide, ranging from small companies to large enterprises — including 12 of the top 20 most visited US Web sites — use Gomez to increase revenue, build brand loyalty, and decrease costs. Gomez is a registered service mark of Gomez, Inc. All other trademarks and service marks are the property of their respective owners.

Follow Gomez on Twitter: @Gomez_Inc

Connect with Gomez on Facebook: http://companies.to/gomez/

Join the Gomez User Group on LinkedIn

Media Contacts

Samantha McGarry

Gomez, Inc.

(781) 778-2783

smcgarry@gomez.com

Kristina Leblanc

(508) 930-5636

kristinawleblanc@gmail.com

Interchange Fee Hearing Today....Click to Watch Webcast

H.R. 2382 (Interchange Fees) Hearing Scheduled for Today October 8th...

Interchange Bill Scheduled for House Committee Hearing

Thursday, October 8, 2009, 10:00 a.m., 2128 Rayburn House Office Building. The Full Committee will hold a hearing on: “H.R. 2382, the Credit Card Interchange Fees Act of 2009 and H.R. 3639, the Expedited CARD Reform for Consumers Act of 2009”

H.R. 2382, the Credit Card Interchange Fees Act of 2009 and H.R. 3639, the Expedited CARD Reform for Consumers Act of 2009

10 a.m., Thursday, October 8, 2009, 2128 Rayburn House Office Building

Full Committee

Click here to watch live webcast of this hearing.

Canadian Debit Shakeup

Green Sheet - In the fall of 2008, Visa Inc. and MasterCard Worldwide revealed plans to introduce their branded PIN-debit cards into Canada. MasterCard launched several pilot programs for its Maestro Debit Card in early 2009. As a condition to entering the market, the company agreed to set transaction fees to mirror those of Interac, Canada's not-for-profit debit network collectively owned by Canadian banks.

However, a year later Visa has yet to enter the Canadian debit market: Company officials said they have no intention of setting a flat debit transaction fee or introducing any debit programs without interchange.

MasterCard said Canadian merchants are not charged interchange for Maestro debit card transactions; instead, a flat fee of 5 cents in Canada (about 4 cents in the United States) is charged per transaction. In contrast, Interac's median fees reportedly average 12 cents, with most small ticket items costing approximately 7 cents per transaction.

Points of contention

"The banks are somewhat ambiguous because ironically they stand to gain the most, but I think the main reason that Visa and MasterCard want to implement the discount rate for debit cards is to be able to offer the points or rewards programs that tie the consumer to their card brand," said Joseph Iuso, Chief Executive Officer of UseMyBank Services Inc., a Toronto-based firm that facilitates real-time debit transactions through online bank accounts.

Iuso noted that both Visa and MasterCard are trying to develop a system in which, regardless of whether consumers make credit or debit card transactions, the brands can leverage air miles and loyalty programs to attract consumers.

"For MasterCard to get its Maestro debit card here, they actually had to agree to the same rates as Interac," Iuso said. "However, you would think they'd want to keep the discount rate or at least get it implemented eventually. Otherwise, how are they going to come up with the money to sponsor those things? The long-term play is to come in cheap – though they might be accused of undercutting Interac. Ultimately, to offer those programs, they have to be costed somewhere."

Iuso added that Interac's concern with regard to the introduction of Visa and MasterCard in the Canadian debit market is that banks will be unable to resist the new revenue streams interchange and rewards programs would generate. He estimates that Canadian companies could increase business 30 to 40 percent with the ability to accept Visa and MasterCard debit cards.

Door number one, two or three

No regulatory issues prevent Visa or MasterCard from entering and competing in the Canadian debit market. It simply comes down to whether banks and merchants choose to accept the cards.

"The crux of the problem with the federations and the associations is their contention that if you introduce interchange, the merchants are going to end up eating the costs," Iuso noted. "But on the other side, you're going to increase your ability to take money from consumers. The banks merely have to say they want to partner with the card provider. They're already in bed with the card brands, so why wouldn't they want to do it?"

Reshaping the business model

Iuso said that once Visa and MasterCard debit cards become entrenched in Canada – which he believes is only a matter of time – Interac will suffer because transactions will be settled through banks' networks and not Interac's.

He sees two possible means of resolution: Visa will either acquiesce and match Interac's and MasterCard's transaction rates, or Interac will be forced to join other debit networks around the globe (like NYCE, Star, and Pulse) to generate additional revenue streams. To do this, Interac would have to become a for-profit company.

"Operating as a for-profit organization would probably be their smartest move," Iuso said. "They need to be able to innovate to compete with the other brands, but it's hard to do when you have board members looking at the business model from a cost basis instead of a profit center. "Interac doesn't have to like Visa and MasterCard coming in because they know that once you start to add points to a debit card, why would someone want to use an Interac card? But ironically, this situation gives them the forum to say to the competition committee that we're no longer the only people in Canada doing debit, so let's open up the market to give us a chance to compete."

V/MC Shares Rise on Optimism over Interchange Legislation?

Maybe the Interchange Bill isn't going to affect MasterCard and Visa as much as some analysts originally thought. Yesterday, both saw their stock rise on heavy volume.

Bot V and MC stock had not performed well since the highly touted 7-Eleven petition drive. The impact and the hoopla surrounding the delivery of the petitions to Congress garnered a lot of media attention.

First Visa shot back that it's own study showed that consumers, by a 2-1 margin feel that Interchange Fees are a simple cost of doing business.

Then MasterCard released evidence that suggested 7-Eleven's petition drive "conveniently" left out some key facts and was thus deceptive. Finally, the EPC (Electronic Payments Coality) chimed in with a statement saying 7-Eleven tricked and deceived their customers into signing the petition. The response by V/MC and EPC might have had some impact on stock traders because today the Wall Street Journal reports that

"Shares of MasterCard Inc. (MA) and Visa Inc. (V) rose on heavy volume Wednesday despite the broader market's decline, a move analysts attributed to several factors, including a bit more optimism about possible interchange-fee legislation.

Late last month, the stocks were hurt after Sen. Chris Dodd, D-Conn., said he was working on a bill to modify interchange fees, which credit-card issuers collect when transactions are completed on the cards they've issued.

As Rep. Barney Frank, D-Mass., and the House Finance Committee get ready for their first hearing on interchange legislation Thursday, Susquehanna analyst James Friedman suggested there may have been some change of stance by a representative or other turmoil among the proponents of the fee change.

Susquehanna or its affiliates beneficially own 1% or more of MasterCard".

Continue Reading at WSJ.com

Visa Inc. to Announce Fiscal Fourth Quarter and Full-Year 2009 Financial Results on October 27, 2009

SAN FRANCISCO, Oct. 7 /PRNewswire-FirstCall/ -- Visa Inc. (NYSE: V) will report its fiscal fourth quarter and full-year 2009 financial results on Tuesday, October 27, 2009. The results will be included in a press release, with accompanying financial information, which will be released before market open and posted on the Visa Investor Relations website.

Visa's executive management team will then host a live audio webcast beginning at 8:00 a.m. Eastern Time (5:00 a.m. Pacific Time) to discuss the financial results and business highlights.

All interested parties are invited to listen to the live webcast at http://investor.visa.com. A replay of the webcast will be available on the Visa Investor Relations website for 30 days.

About Visa: Visa operates the world's largest retail electronic payments network providing processing services and payment product platforms. This includes consumer credit, debit, prepaid and commercial payments, which are offered under the Visa, Visa Electron, Interlink and PLUS brands. Visa enjoys unsurpassed acceptance around the world and Visa/PLUS is one of the world's largest global ATM networks, offering cash access in local currency in more than 170 countries. For more information, visit www.corporate.visa.com

    Contacts:
   Jack Carsky, Investor Relations
   Visa Inc.
   Tel: +1 415 932 2213
   E-mail: ir@visa.com

    Will Valentine, Media Relations
   Visa Inc.
   Tel: +1 415 932 2564
   E-mail: globalmedia@visa.com

SOURCE Visa Inc.

Online Gambling on The Hill

I suppose the $4.8 Billion dollars per year that online gambling would generate is more than a drop in the bucket.. Here's an excerpt from story published yesterday on "The Hill"

By Michael Waxman, Safe and Secure Internet Gambling Initiative (www.safeandsecureig.org)

Up to $48 billion in new revenue would be generated over the next decade by regulating and taxing Internet gambling, according a PriceWaterhouse-Coopers analysis. Whether you support or oppose the idea of giving Americans the freedom to gamble online, the activity is flourishing in an uncontrolled marketplace, sending billions in revenue out of the U.S. economy, overseas and underground.

Despite attempts to prohibit the activity, Americans continue to wager online more than $100 billion annually.

It’s time for Congress to end a failed prohibition and replace it with a regulatory environment where consumers are protected and billions in new revenue can finally be dedicated to better serve our country.

Wednesday, October 7, 2009

Malware Economy is Thriving

Last week I did a post entitled: Game Over: Hackers Win!

Dennis Fisher of Threatpost.com a security blog by Kapersky Labs says it ain't over til it's over!

He also says the bad guys are doing great and the good guys aren't...(sounds over to me)

TORONTO -- The legitimate economy may be in rough shape right now, but the same cannot be said for the underground economy. Malware authors and botmasters are thriving, experts say, with some online criminals charging as much as $3,500 for their attack toolkits.

But don't be intimidated by the high price point. That's a premium product. More basic exploit kits can be had for as little as $100. But even at that price, the attackers are doing just fine, thank you.

"The bad guys are doing really great," said Roy Firestein of Digital Defence, speaking in a session on modern crimeware toolkits at the SecTor 2009 conference here. "How are the good guys doing? Not so good."

Continue Reading

More On the E-Mail Hijackings

Internet security experts are warning millions of email users not to get caught with their pants down and change their passwords immediately.

Following an apparently effective scam that harvested thousands of Hotmail login identifications and posted them online, Microsoft and other email providers are telling account holders to be safe and to change their login information as soon as possible.

Password information for Hotmail (Microsoft), G-Mail (Google), Yahoo, America OnLine (AOL), Earthlink and Comcast accounts were also posted in the online listing that was taken down shortly after it appeared but was certainly up long enough for those with criminal intent to copy the information.

Microsoft, Google and Yahoo said they are working with customers to recover any hijacked accounts.

Google Doodle Bar Code

What's up with the Google Doodle today? It's the Bar Code Logo because today is the 57th anniversary of the Invention of the Bar Code...

In other news, Google is offering advice on "strong passwords". (The Password is: Oxymoron!) Here's a snippet from Information Week:

Passwords remain the primary means of online authentication, despite their shortcomings. (Editor's Note: Read that again!)

By Thomas Claburn InformationWeek
October 7, 2009 03:14 PM

It's National Cybersecurity Awareness Month and Google would like to remind you to choose strong passwords for your online services. Coincidentally, several thousand users of Windows Live Hotmail, along with some users of Gmail and Yahoo Mail, are in need of new passwords.

SANS Internet Storm Center handler Adrien de Beaupr is advising users of Hotmail, Gmail, and Yahoo Mail to change their passwords following the exposure of several thousand Hotmail credentials on a Web site over the weekend. According to Microsoft, the exposure was likely result of a phishing scam. And reports indicate that some Gmail and Yahoo Mail account information was also revealed.

Anyone who may have entered account information in a phishing site should pick a different password right away.

Continue Reading

Zeus Online Banking Trojan Webinar Infected with...Zeus!

According to a story from Brian Krebs, a company produced a webinar on the online banking password stealing Trojan Zeus and was then targeted by the Zeus keepers:

"On Sept. 1, security industry start-up Silver Tail Systems held an in-depth online seminar for its bank and e-commerce clients that examined the stealth and sophistication of Zeus, a data-stealing Trojan horse program that organized thieves have used in a string of lucrative cyber heists this year.

A week later, Silver Tail learned that Zeus had infiltrated its own network defenses.

Silver Tail founder Laura Mather said she believes her company was targeted by criminals wielding Zeus specifically because of the recent webinar, which spotlighted the myriad ways in which Zeus can defeat online banking security measures. Still, she said the incident shows this family of malware can be a threat to any business - even security companies.

Continue Reading at Brian Krebs Security Fix

The Zeus-themed webinar that Silver Tail believes prompted this attack is long, but well worth a watch for anyone involved in defending networks. The ThreatExpert blog also recently published an excellent (yet far more technical) deep-dive on Zeus."

Operation Phish Fry

According to KTLA: Operation Phish Fry (shouldn't it be Phry?) "netted" a bunch of Egyptian Phishermen.

"Dozens of people are under arrest in Southern California, Nevada, North Carolina and Egypt in a major crackdown against identity theft.

The FBI has launched "Operation Phish Fry" to bust an identity theft ring that has victimized thousands of people.

Laura Eimiller, an FBI spokeswoman in Los Angeles, says about 100 arrests are expected - many of them in the Los Angeles area. Eimiller says the suspects are accused of running a "phishing" scheme that used computer intrusion and fraud to obtain personal information that allowed them to withdraw money from bank accounts.

"Phishing" scams often involve fake e-mails that direct victims to a bogus Web site where they are asked to update personal information, such as passwords and account numbers.

The LA Times Blog is reporting that 100 have already been arrested and 53 have already been indicted.

The federal indictment, which is due to be unsealed today, names 53 indicted suspects as well as 47 non-indicted co-conspirators from Egypt, said Laura Eimiller, the FBI spokeswoman.

Aussies Fall Victim To Retail EFT-POS Skim-Scam

Skimmers are usually placed on ATM's but now it looks like they are moving to the point of sale terminals. Kind of makes a case for purchasing online from a device you can trust, like your very own HomeATM SLIM!

A GLOBAL crime gang has struck in Perth with a new card skimming fraud phenomenon that fleeces bank accounts from point-of-sale EFTPOS machines.

Fraudsters have stolen hundreds of thousands of dollars from thousands of Perth cardholders in an EFTPOS scam.

Police say they have received "substantial information" regarding machines being used to "skim" credit and debit cards of details - including PIN numbers - throughout the metropolitan area. WA Police today issued a state-wide alert after receiving dozens of complaints reporting missing money after transactions from EFTPOS machines at shops, including fast food outlets, since Monday.

They have revealed few details of the devices or investigation - citing "operational sensitivities" - but say the devices have compromised EFTPOS point-of-sale machines. Until now, police have only been aware of automatic teller machines skimming scams, whereby criminals obtain bank account and PIN details after fitting secret card-reading devices to ATMs and hidden mobile phone cameras to record bank customers entering their secret PIN number.

Retailers have been asked to contact police if they suspect their EFTPOS machines have been tampered with. People are being advised to check their bank statements to ensure all withdrawals are legitimate and to contact police if they have concerns.

A Perth woman says she has lost $3,500 from her bank account...

Fiserv to Deliver E-bills to Financial Institution Websites for Progress Energy Florida

Fiserv announced today that Progress Energy is extending the use of eBill Distribution to the electric utility's Florida region. The agreement with Progress Energy is an expansion of the existing relationship between Fiserv and the Fortune 500 energy company which serves customers in the Carolinas and Florida. Fiserv already provides eBill Distribution to Progress Energy customers in the Carolinas, as well as walk-in bill payment services in all three states. Now, Progress Energy customers in the Carolinas and Florida can receive their Progress Energy bill at any of the more than 3,000 financial institution websites in the Fiserv network.

Here's their Press Release:

Fiserv to Deliver E-bills to Financial Institution Websites for Progress Energy Florida

- Expansion of e-bill delivery channel allows company to meet more customers online for bill viewing and payment -

Brookfield, Wis., October 7, 2009 -PIN Payments News Blog- Fiserv, Inc. (NASDAQ: FISV), the leading global provider of financial services technology solutions, today announced that Progress Energy is extending the use of eBill Distribution to the electric utility's Florida region. The agreement with Progress Energy is an expansion of the existing relationship between Fiserv and the Fortune 500 energy company which serves customers in the Carolinas and Florida. Fiserv already provides eBill Distribution to Progress Energy customers in the Carolinas, as well as walk-in bill payment services in all three states. Now, Progress Energy customers in the Carolinas and Florida can receive their Progress Energy bill at any of the more than 3,000 financial institution websites in the Fiserv network. According to financial industry analyst firm Javelin Strategy & Research, banks and credit unions represent the fastest-growing channel for viewing and paying bills online, making eBill Distribution a natural

complement to offering paperless options at Progress-Energy.com.

eBill Distribution from Fiserv enables companies like Progress Energy to offer paperless electronic bills, commonly known as e-bills. E-bills replicate the same information as the traditional paper bill, but are securely delivered to a financial institution or billing company Website instead of a physical mailbox. Customers who receive e-bills can schedule a specific date on which their bill will be paid and take advantage of features such as email reminders.

By eliminating the mailed statement, consumers can take a small, simple step toward the reduction of paper use, thereby preserving the environment. According to a 2009 Fiserv-sponsored study conducted by The Marketing Workshop and Harris Interactive, 58 percent of consumers cite the protection of the environment as a key reason to receive e-bills and turn off the corresponding paper bill.

According to the same study, 41 percent of current online banking users indicated plans to pay more bills online at their financial institution's Web site in the coming months. Progress Energy's commitment to paperless billing can allow the company to capitalize on this trend and provide customers additional billing options. As a testament to this commitment, Progress Energy Carolinas recently collaborated with Fiserv to educate consumers to turn off their paper bills and begin receiving e-bills through their financial institution. This campaign resulted in a 206 percent e-bill adoption rate increase, and encouraged Progress Energy to extend the bank channel e-bill delivery option to its Florida customers.

"Progress Energy is at the forefront of meeting its customers at their point of preference when it comes to viewing and paying bills, and Fiserv is proud to be a partner," said Jardon Bouska, president, Biller Solutions, Fiserv. "Whether it is educating consumers about the benefits of e-bills and serving them through the bank channel or providing access to convenient retail and agent locations for walk-in based payments, we will continue to help Progress Energy leverage billing and payment touch points and ensure positive customer interactions."

Since 2000, Fiserv and Progress Energy together have delivered valuable billing and payment options for Progress Energy customers. In addition to powering Progress Energy's electronic billing and payment channels, Fiserv makes available to all Progress Energy customers the ability to pay bills in-person at more than 16,000 retail agent sites, such as convenience stores, grocery stores, drug stores, and retail shipping and postal stores.

Fiserv offers a robust portfolio for optimizing bill pay touch points to maximize profitability, including electronic and paper bill production and distribution, on-demand and recurring bill payment (via agent, web, IVR and walk-in channels) as well as e-lockbox and remittance processing.

About Fiserv

Fiserv, Inc. (NASDAQ: FISV) is the world leader in information management and e-commerce systems for the financial services industry, driving innovation that transforms banking for financial institutions and their customers. Ranked No. 1 on the FinTech 100 survey of top technology partners to the financial services industry, Fiserv celebrates its 25th year in 2009. More on Fiserv at www.fiserv.com, and examples of award-winning innovation are listed at www.newfiserv.com.

# # #

New Report Out on Bank Overdraft Fees

This report from the folks at Responsible Lending purports that Bank's have basically engaged in abusive practices in order to maximize overdraft fee revenue.

It also explains why some banks have recently decided to cut back on the amounts they charge for overdraft fees.

Click the graphic on the right to read their harsh conclusion.

Viewer Warning: If you are a banker, some of the recommendations contained in this report may be disturbing!

To think that they actually have the tenacity to call it Overdraft Protection is amusing.

Responsible Lending Report on Bank Overdraft Fees

Online Banking Fraud in the UK Hits a New High

There is a disturbing trend going on. The hackers steal our username and passwords and banks respond by telling us to "type" more information into a box on their online banking website. I don't get it. There's a website in the U.K. designed to help people fight the fight against online banking fraud called: www.BankSafeOnline.org

Here's what they have to say.

The three essential steps to protect your computer are:

Use anti-virus software and keep it up-to-date on a regular basis.

Install and learn how to use a personal firewall.

Download the latest security updates (or patches) for your web browser and operating system.

Oh really? As I mentioned yesterday, a report by Trusteer says that Zeus, an online banking Trojan which steals your online banking credentials, bypasses up-to-date anti-virus software 77% of the time. So if you want to feel 23% protected, by all means listen to their advice. Firewalls are like locked windows. Hackers just break the glass to get in. The latest security updates are nothing more than an admission that browsers are not safe. Why would you need weekly "security" updates if the browser was secure in the first place.

There's only one way to authenticate an online banking customer. Think ATM. Think dispersal of cash in real time. Why is that system trusted by banks? Because the security behind the authentication works. Why not 100% replicate that process for online banking log-in? Exactly...why not?

Here's more on the 55% growth in online banking fraud during the first 6 months of the year. Prediction. When the report comes out on the growth of online banking for the second 6 months, it will be bigger than the first 6 months. Mark my words...or at least these three words: Zeus, Clampi, urlZone.

Jeremy Kirk, IDG News Service

Wednesday, October 07, 2009 7:40 AM PDT

Online banking fraud in the U.K. has risen to the highest level in at least three years, according to industry figures released Wednesday.

Online banking fraud increased 55 percent to £39 million (US$62.4 million) in the first six months of the year compared to the same period a year ago, said Financial Fraud Action U.K. (FFA), formerly known as APACS. FFA collects data reported by U.K. financial institutions.

FFA attributed the rise to sophisticated malicious software programs that infect vulnerable consumer computers. FFA also counted 26,000 phishing sites, which are fraudulent Web sites designed to trick people into divulging their log-ins and passwords.

The rise in banking fraud comes as U.K. banks have taken more rigorous measures to combat online fraud. While U.S. banks often only require a log-in and password to get access to online banking, U.K. banks often have several more steps.

Editor's Note: More steps are futile. I've got a business associate that says banks understand the security risks, but I disagree and what follows is proof that they just don't get it! Here's an exercise in futility by NatWest:

For example, NatWest -- owned by the Royal Bank of Scotland Group -- requires customers to "type" (enter) their birth date plus "type" (enter) a unique four digit code. During the second step, a person is prompted to enter ("type") enter some digits of a separate four-digit PIN (Personal Identification Number), which is not the same as the person's ATM card. Then, the Web site asks the user to ("type") enter "another password", but only specific parts of it, such as the second, fourth and seventh letter. NatWest asks for a different combination every time. If you fail to log in successfully, the account can't be accessed online.

Nonetheless, most bank security measures are defeatable if a person falls victim to a phishing scam and sends a fraudster their authentication credentials. Editor's Note: When consumers type, the information they type is fair-game to the hackers. It doesn't matter if you instruct the consumer to type the 4th letter of every 5th word in War and Peace or every 7th letter of every 14th word in Genesis. Typing is the problem.

SPVA Announces New President

Former Technology Executive to Lead Secure POS Vendor Alliance

New president Steven Hughes provides more than a decade of experience

to rapidly-growing global payment security organization

ATLANTA – October 7, 2009 – The Secure POS Vendor Alliance (SPVA), a non-profit business organization founded by Hypercom (NYSE: HYC), Ingenico S.A. (EURONEXT: ING) and VeriFone (NYSE: PAY) is pleased to announce that it has named Steven Hughes, formerly executive director for the Oracle Applications Users Group (OAUG), as its president. In his new role, Hughes will focus on strategic direction, membership development and act as liaison among the three founding board members. Hughes leads a newly-installed team of SPVA staff who will service SPVA’s growing membership base.

“Steven brings valuable skills and a track record of success in global membership expansion and retention,” said Christophe Dolique, SPVA Chairman and EVP, Global Marketing & Transaction Services at Ingenico. “At this stage of SPVA’s development, I could not think of a better individual to manage our efforts to focus the card payments industry on compliance.”

The SPVA launched in April 2009 to foster widespread compliance of existing security standards to protect cardholder information and defend merchants and acquirers against security breach. Its aim is to simplify compliance efforts, diminish the chaos and confusion often associated with standardization and reduce costs for all stakeholders. Hughes was selected by the SPVA board due to his success in growing the OAUG into one of the largest independent user groups in the world, among other accomplishments.

“I look forward to growing the SPVA into the premiere organization for facilitating a common understanding and acceptance of various security requirements and standards,” said Steven Hughes, SPVA president. “With the strong leadership team already in place, I am confident this objective can be attained.”

SPVA has experienced rapid growth since its launch at the ETA show in Las Vegas with prominent industry leaders joining, including Atos Worldline, Heartland Payment Systems, Moneris Solutions, Radiant Systems, Inc. and Witham Laboratories. Membership is open to all vendors that develop secure POS payment systems or have products or solutions that interact with secure POS payment devices such as retailers, acquirers and banks.

To learn more about the SPVA, visit www.spva.org.

###

About Secure POS Vendor Alliance (www.spva.org) The Secure POS Vendor Alliance (SPVA) is a non-profit organization that works with the multiple stakeholders of the payment value chain. Its aim is to develop an end-to-end security framework and to enhance security elements of payment solutions which protect cardholder information and defend merchants and acquirers against security breaches, while helping reducing fraud and lowering risk for all electronic payment stakeholders.

About Hypercom (www.hypercom.com) Global payment technology leader Hypercom Corporation delivers a full suite of high security, end-to-end electronic payment products and services. The Company's solutions address the high security electronic transaction needs of banks and other financial institutions, processors, large scale retailers, smaller merchants, quick service restaurants, and users in the transportation, petroleum, healthcare, prepaid, unattended and many other markets. Hypercom solutions enable businesses in more than 100 countries to securely expand their revenues and profits. Hypercom is a founding member of the Secure POS Vendor Alliance (SPVA) and is the second largest provider of electronic payment solutions and services in Western Europe and third largest provider globally.

About Ingenico (www.ingenico.com)

Ingenico is the world’s leading provider of payment solutions, with over 15 million terminals deployed in more than 125 countries. Its 2,500 employees worldwide support retailers, banks and service providers to optimize and secure their electronic payments solutions, develop their offer of services and increase their point of sales revenue. Ingenico generated pro-forma revenue of €780M in 2008.

About VeriFone Holdings, Inc. (www.verifone.com)

VeriFone Holdings, Inc. (“VeriFone”), a global leader in secure electronic payment technologies, provides expertise, solutions and services for today with a migration strategy for tomorrow. VeriFone delivers solutions that add value to the point of sale, resulting in improved merchant retention and the generation of new sources of revenue for its partners and customers. VeriFone solutions are specifically designed to meet the needs of vertical markets including financial, retail, petroleum, government and healthcare.

Thursday, October 8, 2009

H.R. 2382 (Interchange Fees) Hearing Scheduled for Today October 8th...

Wednesday, October 7, 2009

Disqus for ePayment News