Mobile Payment Industry News

Friday, January 23, 2009

Data Isn't but V/MC's Protected

In my last post, I ended it by saying that Heartland's only chance for survial is getting the dynamic duopoly, a.k.a. V/MC, to cover the costs incurred by the banks having to replace consumer cards. I thought they had a decent argument, given the fact that they were PCI compliant.

Well, I just got done reading an article which contained a statement from Visa regarding PCI assessments...it seems to thwart any legal argument Heartland may have.

You see, apparently the data might not be protected, but V/MC has certainly made sure that they are.

Information Week's Andrew Conry-Murray, in an article titled, "PCI is Meaningless, But We Still Need It", points out:

Assessments "do not guarantee that those security controls remain in place after the review is complete." In other words, a company is only compliant with PCI's security standards during the time of review. Once the assessors leave the building, all bets are off.

He goes on to say: "I believe PCI was constructed this way for two reasons.

First, it absolves the assessors and the card brands of any liability should a compliant company get breached. The issue of liability is critical, because breaches attract lawsuits the way roadkill attracts crows."

Yes, and it looks like Heartland gets to play the part of roadkill...the banks/V/MC get to pick their part, scratch that, pick-a-part in their role as a "murder of crows."

Heartland's tough battle just got tougher...and the prognosis isn't good. Lizbith...dis is da big one!

PIN Debit Payments Blog

Questions About PCI Effectiveness - Network World

I saw an interesting article in Network World, which basically questions PCI's effectiveness in the wake of the RBS and Heartland breaches. In a post I wrote earlier this week, "In God We Trust, Visa/MC is Another Issue(r). I wrote:

The "Mother of All Hacks" will never be Heartland Payment Systems. It will be the electronic payment system at it's very core. Whether it's Visa, MasterCard or NACHA, if any of these system are breached, it's the end of e-payments as we know it. Do they know it?"

I'm aware of someone else who knows it....in this article, Avivah Litan points out some very interesting facts, some of which I've included below. To read the entire article, click the Network World link below:

Heartland breach raises questions about PCI standard's effectiveness - Network World

It's not yet known if Heartland Payment Systems' newly disclosed data breach will count as the largest card heist ever. But some analysts say what is clear is that the Payment Card Industry data security standard that Visa and MasterCard require isn't sufficient to ensure cardholder data is safeguarded.

"Billions is being spent on PCI compliance, but it isn't really working," says Gartner analyst Avivah Litan. "PCI's dirty little secret is that it doesn't mandate encryption inside a private network because then all the processors would have to encrypt."

Encryption of data would make it much harder for attackers to benefit from the kind of network break-in that Heartland suffered, in which cyber-criminals tapped into a monthly stream of 100 million debit and credit cards for several months using malware installed on processing computers.

"The processors are definitely being targeted," Litan says, noting that once a breach occurs, it can have a terrible impact on business. CardSystems, which suffered a data breach in 2005, was basically put out of business as a result of it.

Editor's Note: Speaking of impact, will Heartland ever recover from this nightmare? There's definitely a black cloud hanging over it. Yesterday their stock went into a free fall, ending 42% lower than it started out. I expect a significant merchant attrition impact, so even if they do come out of it, it won't be as the nations 6th largest acquirer. At the end of the day, I believe what determines Heartland's survival, is whether they (or their lawyers) can get Visa/MC to cover the banks cost of replacing all the debit/credit cards.

You might think that the fact that they were PCI certified and that the data was encrypted when it left the building, but unencrypted at the V/MC level would provide fodder for a good argument. I have the sneaky feeling that the "dynamic duopoly" will hold that Heartland is liable. It's going to messier before it gets prettier, no doubt.

Thursday, January 22, 2009

Inauguration Day Fraud

Heartland's Bad Ticker took a blow today as their stock dropped $5.93 to close at $8.18.

That's a devastating 42% decline!

Can't say I didn't see it coming. Just didn't think it would happen this quickly. Maybe their attempt to sway exposure by announcing the hack on inauguration day backfired on them...big time. Here's a screen shot of the final day's numbers. (still dropping in after-hours trading) Click the graphic to enlarge.

In another development, one of our readers, the founder of a site called InsideIDTheft.info, (it looks like a great site, take a peek!) forwarded me a video his site put together, which criticizes Heartland, for releasing news of the breach on inauguration day.

As I mentioned in the Tuesday's afternoon post, entitled: Largest Breach Ever? Deception Involved?, some people questioned the inauguration day release of Heartland's breach, a simple 1 page news release. One even stated: "that seems very deceptive"

Apparently it seemed rather deceptive to the folks at InsideIDTheft as well. Here's their video, which puts a rather daunting perspective on the timing of the news release:

Enjoy, and thanks Keith for sharing!

PIN Debit Payments Blog

Heartland's Bad Ticker

We're going to follow Heartland's "Bad Ticker" from now until Valentines Day. Yesterday there was some murmur's, today started with some palpitations, and last time I looked, their was some severe chest pain. So there's definitely been a Heartland Attack.

As Sanford used to say, "Lizbith...it's the big one..." Rush them to the ER cause the last time I looked their stock was down $2.98 or 21.12%.

Update: 3.33 pm ET. Well it doesn't look like they're gonna make it. Stock is down $5.32 or almost 40%!

To make it easy to follow, I've placed Heartland's Bad Ticker, complete with bad news, just below the search button on the right.

The Bad Guys Are Very Good - Heartland President

Yes, that's what he said. I know what he meant, but nonetheless, it's the kind of line that both Norm Crosby and Yogi Berra would be proud of.

According to Newsday.com Heartland has closed the security hole that ultimately may lead their own extinction...especially considering how bad their ticker looks today.

I've posted comments throughout.

"Heartland says it has closed the security hole that allowed criminals to infiltrate their systems, but the matter is far from settled.

The company will likely have to pay big penalties to banks to reimburse the cost of issuing new cards, and analysts say the intrusion could even threaten the company's survival if the big card brands decide to cut off Heartland from connecting to their networks.

One big payment processor, CardSystems Solutions, went under after a 2005 data breach in which 40 million credit card accounts were compromised and the big card brands stopped doing business with CardSystems. Representatives for Visa Inc. and MasterCard Inc. declined to comment"

(Editor's Note: If Heartland was PCI certified, I highly doubt they'll be "cut-off" by Visa/MC, however, that's not to say that they won't lose a significant portion of their 250,000 member base, especially considering that these merchants may be subjected to very expensive fraud-related remedies. The merchant's will look to Heartland when the bills come. I was surprised Heartland is not offering free credit report monitoring, so I won't be when they tell merchants to "deal with it." Sounds like the clock is running for Heartland...also sounds like they've got a bad-ticker...)

Speaking of tickers...I see that HPS is down almost 20% today. (see live chart at end of this post)

Yesterday, I said in a post, "As people start to realize the magnitude of the breach, and therefore the losses associated with them, I expect HPS stock get "massacred" by...ironically, "Valentine's Day." Maybe that "Valentine's Day Massacre" might be come earlier than I thought...

Getting back to the newsday.com story, "the industry's security requirements call for payment processors to have separate networks — one for the financial transactions, and another for their general corporate tasks. Heartland wouldn't say how the malware got into the network that processes financial transactions or when it was planted there. (Why would that be?)

"If you're actually able to compromise that protected network, you're in, man — you have the keys to the kingdom," said Mike Rothman, senior vice president of strategy for security software vendor eIQnetworks Inc. "I presume they were able to sniff a large part of the payment traffic at the time the network was compromised."

Robert Baldwin, Heartland's president and chief financial officer, said the thieves accessed a part of Heartland's network that handles transactions for 175,000 of the 250,000 merchants the company works with. He said the program slipped past Heartland's antivirus software and was able to read data in unencrypted form as it was passed from Heartland to the card brands. Baldwin said Heartland uses heavy encryption, which means its data is cloaked in special computer coding so unauthorized computers can't read it, but added that the data has to be sent in unencrypted form to the card brands, which is where the criminals were able to spot it. (Editor's Note: "and therein lies the problem)

"Baldwin emphasized that no PIN codes were believed stolen. Baldwin added that the company passed an industry-mandated security inspection in April." (about which much will be written in coming days/weeks/months)

"Unfortunately the bad guys are very, very good," he said. "The malware we encountered did not, and does not, get very well captured by antivirus software, (ya-think?)) so it's a challenge we're going to have to keep working as an industry to combat."

Continue Reading at Newsday.com

SUBASE Command Members Cloned

According to the SUBASE website, "The U.S. Navy's submarine force has the world's most capable submarines, manned by the world's best trained and motivated submariners. During a political or military confrontation, anypotential adversary must assume that United States Navy submarines "are present" and consider the consequences."

However, according to the story below, there's a different kind of adversary out there, and they count on them being "not present." You think some people were up in arms when Dolly was cloned...when they catch these guys, I don't think they'll be sending them up river...they are going "down."

The Dolphin - Credit card cloning on the rise

GROTON, Conn. - Over the last few months, SUBASE command members have reported unauthorized credit card purchases on their personal credit card accounts occurring at retail stores and service stations throughout the country.

None of the naval members were "physically present" in these states and all were in possession of their personal credit cards. Based on this information, it appears that the naval members had their credit cards skimmed and subsequently cloned. Although cloning of credit cards in not considered new, over the last several years, this type of fraud is becoming increasing common with numerous incidents being reported.

Cloning is accomplished by unscrupulous individuals using a cell phone-sized device known as a "skimmer" wherein they are able to swipe the credit card or the leaked credit card information which captures the data on the magnetic strip of the card. The criminal can utilize this information to transfer the data and create a "new" credit card or activate an expired old credit card. The skimming device, costing less than $300 can hold numerous credit card/debit card numbers allowing a thief to later make a duplicate version of the credit or debit card.

Continue Reading at the Dolphin

Canadian Payments Forecast

Technology Strategies International has released a report titled "Canadian Payments Forecast - 2009" forecasting that the Canadian debit and credit card market will be hit by the decline in personal expenditure on consumer goods and services as a result of the economic downturn, but over the long term both forms of payment will command a greater share of all consumer expenditure.

According to the report, "credit card payments will account for 38% of personal consumer expenditure by 2013, approximately double the share predicted for debit card payments."

“By 2013 we expect there to be about 130 million payment cards in circulation in Canada, with card based payments being accepted at about 720,000 merchants”, notes Christie Christelis, President of Technology Strategies International.

“There are a number of high growth segments in the Canadian payments market, the ones with the most promise being mobile contactless payments, cross-border debit and alternative methods for paying online,” he says.

Key findings of the study are:

The recession in Canada will result in lower growth for debit and credit card payments as consumers cut back on their expenditure
Credit card payments will be hit the hardest by the recession
Contactless payments will be the highest growth segment over the next five years, exhibiting phenomenal growth and encroaching on the areas currently dominated by cash and debit cards
Card issuers will use the EMV implementation card reissue cycle to issue cards with contactless payment functionality
Cross border payments will grow by 70% per year over the next five years
Alternative payment mechanisms for online payments (i.e. non-credit card payments) will account for one third of all online payments made by Canadians by 2013
Cash will remain the most frequently used form of payment in Canada

The 110 page report provides a comprehensive review, analysis and forecast of consumer payments in Canada. It identifies high growth segments in the Canadian payments market in the context of some important recent developments in the economy and the industry, including duality in the credit card market, the emerging battleground around merchant discount rates and Interac’s application to the Competition Bureau to convert to a for-profit organization. Detailed forecasts are presented for credit card payments, debit card payments, cash payments, cheque payments, contactless payments, cross-border payments, online payments, ABM installations and POS terminals.

Source: Company press release

Follow PIN Debit Payments Blog on Twitter

I still don't understand the Twitter thing, but what the heck, maybe you can "tweet" me and explain it's attraction. In the meantime, for those who partake, here's the new HomeATM PIN Debit Blog "Twit Cam."

I've also included it in the sidebar...didn't get prime time...down about 7 gadgets...

PIN Debit Payments Blog

Wednesday, January 21, 2009

In God We Trust...Visa/MC is Another Issue(r)

We're Not in Kansas Anymore...the Heartland has been breached and the ROI on PCI may be sucked up by the tornado that is hackers...

In fairness to Heartland Payment Systems, I want to add this addendum to my previous post. Unlike CardSystems, which PBT bought after their 40 million card breach, Heartland was PCI certified.

Then again, so was Hannaford at the retail level. So what does this mean? Since hackers have shifted their attention from retailers to, at least in this case, acquirers, where does it end? It doesn't end here, that's for sure.

I'll tell you where it ends...it "ends at the beginning", and the "beginning of the end" of a transaction is at the Visa/MC network level.

Therefore, Visa/MC and their PCI, which has cost retailers and processors over $2 billion dollars to implement...needs to take some of the blame. Heartland played by "their rules." The hackers were the ones that breached them. So who's really to blame? Sure the hackers would be the first answer, but second to none is Visa/MC.

After all, if you need to "unencrypt" encrypted information, which is where the HPS breach occurred, and it took 4+ months for Visa/MC to determine suspicious activity, then maybe the hackers have gotten to the Point of No Return.

The "Mother of All Hacks" will never be Heartland Payment Systems. It will be the electronic payments system at it's very core. Whether it's Visa, MasterCard or NACHA, if any of these systems are breached, it's the end of e-payments as we know it. Do they know it?

With TJ Max, it was the retailers fault (storage), with CardSystems, it was non PCI compliance. (Also storage anomalies) but with Heartland, where does the fault lie? Can it be a PCI certified acquirer's fault? They complied...yet they are going to take the fall. I say that unless new information comes forward...they shouldn't.

So the way I see it, PCI, not Heartland has been breached. And not for the first time.

Hackers may very well have gotten to the very "core" of payment transaction platforms...the point where encrypted info needs to be "unencryped" in order to complete authorization. I'm no security expert, but what good is encryption if it needs to be "unencrypted"...at ANY point in the process?

Does V/MC think their systems are beyond attack? If I was a hacker and I knew the weak point was where unencryption occurs, then it "occurs" to me that point should be the must vulnerable point of attack.

What if ,as I stated in a previous posts the bad guys (darkhats) Ireally know more than the good guys? (the whitehats) Then, is all the money spent to protect data at the "point of sale" morphing into a "point of no returrn" on the investment. If so, what's the point?

In God we Trust...but what about Visa/MC?

Want to "charge" something? Then use Visa/MasterCard. For secure payments, I'll continue to put my faith in the Debit/ATM networks. Heartland admitted, that although all the information on the magnetic stripe was hacked, no PIN's were. That seems to be something the hacker's can't quite PIN down.

PIN Debit Payments Blog

More on the Heartland Breach...a lot more...

Clarification: In a Monday post, "Hackers Affect Debit and ATM Networks" I alluded to the fact that 8500 debit cards were disabled by Forcht Bank because they were compromised. "The cards were comprised when a retail merchant’s computer system was hacked, Forcht's COO Eddie Woodruff said. The breach affected customers of multiple banks and multiple debit and ATM networks". Woodruff went on to say: “Our debit card processor, which is a company called STAR, they had a retail customer, we’re not exactly sure who the retail customer was, and the information we believe may have been compromised,” he said. Well this this is not entirely true.

In fairness, I also reported that First Data Corporation, which operates the STAR Debit and ATM Network, would not comment on how many other banks were affected, but did release in a statement Monday that "the debit card issue we were alerted to could affect not only STAR but also other debit networks." They also said: "this situation is not related to any First Data processing systems or practices."

It now seems like the "hackers affecting the debit and ATM Networks was related to the Heartland Payment Systems (HPS) breach.

I would look for the Heartland breach to get bigger. From everything I've gathered, it looks to me like the malicious software went undetected for about 6 months.

Right now, the conjecture is that 100 million cards have been breached, making it the largest breach ever, blowing away TJ Max (45 million, later bumped to 92 million in court papers) and CardSystems. (40 million)

But 100 million is HPS' "monthly" volume. As I said, this went undetected for months. So, as did the numbers for TJX, expect that "100 million" number to rise.Heartland had 600 million cards go through from May through "late fall" when they discovered the breach. So the final numbers will come in between 100 and 600 million.

That's scary enough but what's really scary here is that Heartland got breached as they unencrypted the information to get authorization from Visa, MasterCard, American Express and Discover. Another words, encrypted information needs to be unencrypted in order to complete the transaction. Heartland's COO, Robert Baldwin stated, “We have industry-leading encryption, but the data has to be unencrypted to request the information, the sniffer was able to grab that authorization data at that point.”

So if that's the point that the sniffer was capable of sniffing, then this is nothing to sneeze at.. Hackers have taken another "giant step" for hack-kind... This very well may go down in the payments industry as "The Mother of All Hacks. Heartland is sure to take a huge financial hit.

"I'm shocked that their stock was only down 7 cents today. I really thought their "inauguration day" "non"-announcement would rub people the wrong way and it would be way down. As people start to realize the magnitude of the breach, and therefore the losses associated with them, I expect HPS stock get "massacred" by...ironically, "Valentine's Day."

And no...no...no...I'm not "heartless" just cynical...we (Pay By Touch) bought CardSystems after their humongous 40 million card breach and the aftermath, including, but not limited to expenses revolving around: losing customers, losing ISO's, dealing with FTC, Visa, MC, MasterCard and Discover bled us dry. Don't believe me? Ask anyone there. Acquiring CardSystems after the breach was a huge mistake. Dealing with the breach was expensive and time consuming. (Click here for FTC reports related to CardSystems)

Don't believe me...how about Avivah Litan?

Avivah Litan, a data security analyst, said that the Heartland breach could result in hundreds of millions in losses and other expenses. “If you add it all up, including legal costs, it could be as much as half a billion dollars in losses — or twice as big as TJX,” she said.

Heartland has a tough road ahead of them...wonder how many shares of HPS stock Bob Carr sold, if any, after May 1st and prior to yesterday...

PIN Debit Payments Blog

Safest Way to Pay Online...

In the wake of yesterday's announcement by Heartland, what some are calling the biggest card breach ever, I thought I'd bring you this.

A new web-site launched yesterday, www.JustAskGemalto.com is a place where people can go for expert advice on topics such as Internet security, online payment, password management, credit card fraud, cell phone usage, identity theft and more. Until now, no onesite has gathered all these different topics in one place. As the use of our digital information spreads, we as individuals have a role in safeguarding it more than ever.

The site answers questions such as:

What’s the safest way to pay online? http://www.justaskgemalto.com/en/buying/tips/what-safest-way-pay-online

Editor's Note: I'm going to share their answer right now, because it is exactly what we've been saying about our HomeATM SwipePIN device. This, from their JustAskGemalto.com:

What is the safest way to pay online?

"The safest way to pay online is with some sort of personal digital security device to prove it is really you making the purchase and that the site you are purchasing from is authentic." (Editor's Note: Touche!)

"This could be a smart bankcard you put into a small USB reader when you pay online." Editor's Note: Or it could be your own personal SwipePIN device, such as the SLIDER manufactured by HomeATM...

"This makes online payment much more secure, similar to when you make an ATM withdrawal, because it requires both a card and a PIN code."

Bankers call this “two-factor” authentication. One factor is something you know, the PIN, and the second factor is something you have, the card or token.

However, smart bankcards, like those used in Canada, Latin America, Europe and Japan, are not available in the United States. (Editor's Note: No, they're not, so if you want two-factor authentication, here in the U.S. you'll want to utilize HomeATM's SwipePIN device. Swipe your card (something you have) and Enter Your PIN, (something you know)

One example is how a leading U.K. bank, Barclays, used smart bankcards to stop online fraud. (Editor's Note: Yes, they used their PINSentry device, (click picture on left to enlarge and read) and according to Barclay's demand for the device was higher than expected, it cut fraud and is now asked for by name for new online users, thus generating online sales growth.) I would say it's safe to assume the same results for our SLIDER...thanks for the pilot Barclays!

Other questions currently addressed at the site include:

What is a hotspot and is it safe to use my laptop at the airport?
How does music and video file sharing work?
I hear about 3G networks in iPhone ads, what is that?
If I have a secure connection to a Web site, does that mean I can trust the site?
Do U.S. electronic passports use RFID? http://www.justaskgemalto.com/en/tips/do-us-epassports-use-rfid-technology
Can my neighbor steal data from my Wi-Fi network?
How do I get an emergency replacement passport if I am traveling?
I want to get a phone that works outside the U.S., what should I look for?
Five things you should do when traveling abroad

The Web site also presents informative articles and short videos. www.JustAskGemalto.com is part of a broader business and consumer education initiativeundertaken by $2 billion digital security leader Gemalto, to help guideinformed choices and practices.

Tuesday, January 20, 2009

Largest Breach Ever? Deception Involved?

Brian Krebs, writing for the Washington Post, covered this morning's announcement that Heartland Payment Services was breached. He is calling it one of the largest breaches ever, and according to him, Avivah Litan, a distinguished analyst from Gartner criticized and questioned as deceptive, the "Inauguration Day" release, apparently suggesting that it wouldn't get the coverage it would otherwise.

Payment Processing Breach May Be Largest Ever

A data breach last year at Princeton, N.J., payment processor Heartland Payment Systems may have led to the theft of more than 100 million credit and debit card accounts, the company said today.

If accurate, such figures may make the Heartland incident one of the largest data breaches ever reported.

Robert Baldwin, Heartland's president and chief financial officer, said the company, which processes payments for more than 250,000 businesses, began receiving fraudulent activity reports late last year from MasterCard and Visa on cards that had all been used at merchants which rely on Heartland to process payments.

The data stolen includes the digital information encoded onto the magnetic stripe built into the backs of credit and debit cards. Armed with this data, thieves can fashion counterfeit credit cards by imprinting the same stolen information onto fabricated cards.

"The nature of the [breach] is such that card-not-present transactions are actually quite difficult for the bad guys to do because one piece of information we know they did not get was an address," Baldwin said. As a result, he said, the prospect of thieves using the stolen data to rack up massive amounts of fraud at online merchants "is not impossible, but much less likely."

Avivah Litan, a fraud analyst with Gartner Inc., questioned the timing of Heartland's disclosure -- a day in which many Americans and news outlets are glued to coverage of Barack Obama's inauguration as the nation's 44th president. "This looks like the biggest breach ever disclosed, and they're doing it on inauguration day?" Litan said. "I can't believe they waited until today to disclose. That seems very deceptive."

Biometric PIN Debit for M-Commerce?

World's first biometric, waterproof mobile surfaces

Fujitsu has launched what it claims is the world’s first waterproof handset with an embedded biometric sensor. Fujitsu's F-01A: waterproof and secure.

The Symbian-based F-01A supports e-Wallet transactions.

Combine this AND our PIN debit mobile platform and there would be triple-authentication protection for the m-commerce sector...

Biometric sign-in (who you are) authorizes and activates use of our SwipePIN device, which verifies card present (what you have) by swiping said card, and triple-authenticates the transaction by asking the user to enter their PIN. (what you know)

For more information on the biometric sensor manufacturer visit: Authentec

Credit Card Fraud Up Down Under

Credit Card fraud rates are "jumping" faster than ever, not just here, but around the globe. In this article, the APCA announced that there's been huge rises in CNP transactions and that credit card fraud spiked to 50.2 cents per $1000, or almost 7 times higher than debit's 7.4 cents per $1000 transacted. Here's the article from Karen Dearne, who writes for Austrailian IT.

Credit card fraud spikes | Australian IT

CREDIT card fraud in Australia jumped to $233 million in the last financial year, up from $157 million in 2006-07, according to the Australian Payments Clearing Association.

The losses are due to increased fraud across borders, and huge rises in card-not-present (CNP) fraud involving online, phone or mail transactions. Editor's Note: Huge rises in card-not-present fraud can be eliminated by morphing them into card-present transactions with the HomeATM SwipePIN device...)

Total fraud on Australian credit cards amounted to $132 million; of this, $73 million was obtained by criminals using the cards in other countries. More than $63 million was lost to CNP scams ($22 million within Australia and $41.6 million on locally-issued cards used overseas).

Skimmed and counterfeit cards accounted for $42 million in losses ($18 million within Australia, and $24 million on locally issued cards used overseas).

For the first time, losses due to fraud on cards originally issued overseas topped $100 million; criminals using foreign cards within Australia reaped almost $101 million, up from $66 million in 2006-2007. The number of local cases involving skimmed or counterfeit cards from overseas almost doubled: more than 155,000 incidents were reported, resulting in total losses of $65 million, compared with 82,000 and $40 million the previous year.

At the same time, fraudsters used overseas cards to steal nearly $25 million through CNP transactions locally, up from $16.5 million.

APCA chief executive Chris Hamilton said credit and charge fraud now cost 50.2 cents in every $1000 of payments transacted, up from 38.6 cents previously.

Debit card fraud increased only slightly, from 7.1 cents to 7.4 cents in every $1000 transacted, reflecting the greater security of Eftpos and ATM networks.

Fraud in the Heartland

In yesterday's last post: "Hackers Affect Debit and ATM Networks" I provided information from a story published by "The Times Tribune" that the STAR debit network had seen some suspicious activity and in a response to the situation, STAR said "the debit card issue we were alerted to could affect not only STAR but also other debit networks."

Earlier this morning, came news that one of the nations bigger processors, Heartland Payment Systems has been breached. Are they related or was Avivah Litan, distinguished analyst with Garnter spot-on when she said, "payments and funds transfer processors, rather than retailers are now the one's being targeted by hackers."

Is the "Mother of All Hacks" coming? In that post, when speaking of the recent Royal Bank of Scotland breach, I said: "There is a disturbing development brewing in the payments world. It's bad enough when a retailer's computer security is breached but now we've got us a completely different ballgame. When hackers penetrate the computer systems of major acquirers and processors, well to use a famous quote, "We've got a problem Houston."

This could turn out to be a "Royal pain in the ***" for Visa and Mastercard themselves because acquirers like Royal Bank of Scotland link directly into their networks. On the surface, this appears to be "one small step for hackers but it's "one giant step" for hack-kind."

In that post I quoted Ms. Litan as saying:

“It’s very bad news,” says distinguished analyst Avivah Litan. Unlike retailers’ computer systems, processors’ systems connect directly to the networks of Visa Inc. and MasterCard Inc. “An attacker that breaks into a processor conceivably can get into the heart of the system,” and attacks on acquirers and processors are increasing."

Did she say "get into the Heart of the system?..." Man, she's like the Nostradamus of the payments world...stay tuned...

Heartland Payment Systems Uncovers Malicious Software In Its Processing System
No merchant information or cardholder Social Security numbers compromised.

PRINCETON, N.J., Jan. 20 /PRNewswire-FirstCall/ -- Payments processor Heartland Payment Systems has learned it was the victim of a security breach within its processing system in 2008. Heartland believes the intrusion is contained.

"We found evidence of an intrusion last week and immediately notified federal law enforcement officials as well as the card brands," said Robert H.B. Baldwin, Jr., Heartland's president and chief financial officer. "We understand that this incident may be the result of a widespread global cyber fraud operation, and we are cooperating closely with the United States Secret Service and Department of Justice."

No merchant data or cardholder Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers were involved in the breach. Nor were any of Heartland's check management systems; Canadian, payroll, campus solutions or micropayments operations; Give Something Back Network; or the recently acquired Network Services and Chockstone processing platforms.

After being alerted by Visa(R) and MasterCard(R) of suspicious activity surrounding processed card transactions, Heartland enlisted the help of several forensic auditors to conduct a thorough investigation into the matter. Last week, the investigation uncovered malicious software that compromised data that crossed Heartland's network.

Heartland immediately took a number of steps to further secure its systems. In addition, Heartland will implement a next-generation program designed to flag network anomalies in real-time and enable law enforcement to expeditiously apprehend cyber criminals.

Heartland has created a website - www.2008breach.com - to provide information about this incident and advises cardholders to examine their monthly statements closely and report any suspicious activity to their card issuers. Cardholders are not responsible for unauthorized fraudulent charges made by third parties.

"Heartland apologizes for any inconvenience this situation has caused," continued Baldwin. "Heartland is deeply committed to maintaining the security of cardholder data, and we will continue doing everything reasonably possible to achieve this objective."

Monday, January 19, 2009

Hackers Affect Debit and ATM Networks

TheTimesTribune.com, Corbin, KY - Hackers affect debit and ATM networks

Forcht Bank disabled 8,500 customer debit cards this week after learning they could have potentially been hacked into by persons creating duplicate cards.

Eddie Woodruff, chief operations officer for the bank, confirmed that 8,500 of the bank’s roughly 22,000 total debit cards had been deactivated, but the move was primarily a precaution.

“Right now, none of our customers have reported any fraudulent activity on the cards,” Woodruff said. “We’re just trying to take every precaution.”

The cards were comprised when a retail merchant’s computer system was hacked, Woodruff said. The breach affected customers of multiple banks and multiple debit and ATM networks.

“Our debit card processor, which is a company called STAR, they had a retail customer, we’re not exactly sure who the retail customer was, and the information we believe may have been compromised,” he said.

First Data Corporation, which operates the STAR Debit and ATM Network, would not comment on how many other banks were affected, but did release in a statement Monday that "the debit card issue we were alerted to could affect not only STAR but also other debit networks."

The STAR system is used by 2 million ATM and retail locations across the country, according to its Web site.

“While we do not comment on specific matters pertaining to our customers, we can tell you this situation is not related to any First Data processing systems or practices,” stated Nancy Etheredge, spokesperson for First Data. “We are working with our clients, the card associations and card issuing and acquiring banks to monitor and help mitigate the issue and protect consumers.”

Money Transfer Network adds 33,000 locations

Minneapolis, Jan. 19, 2009 -- MoneyGram International (NYSE: MGI) today announced that in 2008 the company added 13 countries and territories and more than 33,000 locations to its global network, helping people and communities around the world by providing more convenient choices for safe and reliable money transfer services.

"Our continued growth--both international and domestic--is a reflection of growing consumer demand, fueled by ongoing global migration trends and our ability to deliver value to our customers and agents across the globe," said Tony Ryan, MoneyGram chief operating officer and executive vice president.

"MoneyGram's diverse, global agent network is our competitive advantage," said Ryan. "We will continue to invest in strategic growth by adding agent locations in key growth areas as well as expanding existing agent relationships, and growing our owned-retail presence."

In 2006, in response to business and market needs, MoneyGram launched its owned-retail strategy in France and Germany, and today operates more than 50 stores and kiosks in high-traffic areas in immigrant communities. Half of the countries joining MoneyGram's network last year are French-speaking, reflecting the company's commitment to serving the needs of France's large immigrant population. According to the World Bank, France is a top-five immigration country with 6.5 million immigrants.

"Our growth in France was vital to adding Algeria, which according to the World Bank, produced the largest influx of immigrants into the country," Ryan said. "Today, we have stronger prospects in the country for expansion through more traditional agent locations."

Germany is a similar success story for MoneyGram. The company established service to Serbia this year, which produces a high volume of immigrants to the country. MoneyGram has 30 owned locations strategically located in Germany.

"Network breeds network and feeds both expansions to new countries and increased locations in key areas around the globe," Ryan said. "The more we grow, the more interested retailers, post offices and financial institutions are in seeking our service to expand and grow their own businesses and offer more services to their customers."

Countries and territories added to MoneyGram's global network include the French-speaking Algeria, Central African Republic, Comoros, French Polynesia, Gabon, Madagascar and New Caledonia. Other countries include Angola, Bermuda, Bhutan, Czech Republic, Serbia, and Slovenia.

About MoneyGram International, Inc.

MoneyGram International, Inc. is a leading global payment services company. The company's major products and services include global money transfers, money orders and payment processing solutions for financial institutions and retail customers. MoneyGram is a New York Stock Exchange listed company with approximately 176,000 global money transfer agent locations in 180 countries and territories. For more information, visit the company's website at www.moneygram.com .

Source: Company press release.

Dilllard's to Use "Planet Payment" Service

Edited Press Release

LONDON -(Dow Jones)- Planet Payment, a multi-currency and data processor, announced Monday that its Pay in Your Currency service, known in the industry as Dynamic Currency Conversion, is now being offered at Dillard's, a fashion apparel and home furnishings retailers in the United States.

The Pay in Your Currency service provides international shoppers paying for their purchases with Visa or MasterCard payment cards with the choice to pay in their home currency at the point of sale, rather than allowing their issuing bank to perform the conversion after the sale has been completed. The service provides greater clarity and certainty to international purchases by allowing the customer to pay in the currency that he or she knows best - their own. The service is being offered through Fifth Third Processing Solutions, (Cincinnati, Ohio) Dillard's current credit card acquirer.

(END) Dow Jones Newswires
01-19-09 0327ET
Copyright (c) 2009 Dow Jones & Company, Inc.

Battle Against Card Fraud Heats Up

In an effort to reduce credit card fraud, HSBC announced it is going to analyze each and every transaction. This will result in both consumer frustration and inconvenience because a higher percentage of legitimate transactions will be declined. In addition, further inconveniences include the fact that consumers need to provide travel plans to banks, and banks are recommending the use of cash and travelers checks along with credit cards when traveling. It certainly appears that convenience has taken a back seat to security and our so-called "cashless society" has been put on hold a while. This from the BBC over the weekend....

BBC NEWS | Business | Card fraud crackdown accelerated

Card fraud crackdown accelerated - Holiday makers are advised to take several different payment methods

A leading bank is introducing new technology which will mean that every credit card transaction will be scrutinized for fraud. HSBC is introducing the program, which will affect 10 million card accounts and millions of transactions. The banking industry has warned that more legitimate transactions will be queried or canceled as a result. Card fraud is rising - up 14% in the first half of 2008 - and fraud abroad now accounts for 40% of all card crime.

Travelers are being advised to take several different payment methods, including cash, credit cards and travellers' cheques when they go abroad. After several years of falling numbers, card fraud started rising again in 2007. Latest figures show that card fraud could have exceeded £600m in 2008, and banks are using increasingly sophisticated systems to try to outwit fraudsters.

HSBC previously checked 25% of card transactions but is currently rolling out a system that means all card transactions will be screened in real time, with a decision made in a fraction of a second. Bart Patrick of SAS UK, which is providing the software system for HSBC, said: "When you put your card in the machine it's carrying out an automatic check against your pattern of normal use - and making a decision about whether that is real or fraudulent."

He said banks were constantly battling with fraudsters to reduce the levels of crime. "Card fraud is an arms race. The banks will come up with one way of dealing with it, the fraudsters will come up with a way round it."

"What we have seen with chip and pin - it was successful for 18 months, two years - the fraudsters have worked a way round it, so we are now looking at more sophisticated means."

However as the banks become more proactive in targeting fraudsters, more people could find their legitimate transactions are declined or queried. When Sally Wiber went on holiday to Borneo, she followed industry advice and told her bank where she was going. (See: Wanna Get Away?)

But her credit and debit cards were blocked when she tried to use them on her first day. "I spent much of the first day trying to deal with my bank and getting internet access, and then had a rather frustrating phone call trying to make sure that I could use my cards for the rest of my holiday," she said.

Continue Reading at BBC Watch Video at BBC

Friday, January 23, 2009

Thursday, January 22, 2009

Wednesday, January 21, 2009

Tuesday, January 20, 2009

World's first biometric, waterproof mobile surfaces

Monday, January 19, 2009

Disqus for ePayment News