Yesterday after three years in Montreal, HomeATM Chairman and CEO, Ken Mages, arrived back in his (and mine) hometown of Chicago. One of the first things he did upon arrival was return a phone call to John Stewart, Editor of Digital Transactionsto address the recent announcement by Acculynk that Accel Exchange has agreed to roll out a pilot.
They published the story late yesterday afternoon entitled: "Web Based PIN Debit Picks Up Momentum with Pilot and New Deals" (to read the whole story click the link at the bottom of this post) I found the story interesting on several levels. But my favorite quote is at the end of the story. (click any graphic to enlarge)
To surmise, it all comes down to whether PIN Debit for the Web should be Hardware or Software based. Our position is clear. Their's not so much. Here's an excerpt from the article with my thoughts in bold grey italics...
HomeATM’s Mages contends Acculynk’s product is vulnerable to hackers who could, for example, screen-scrape users’ sessions as they click on the floating PIN pad.
Editor's Note: Screen Scraping is oldhat to BlackHats. The real concern is the recent surge of a NEW generation of attacks, for example: SSL vulnerabilities, Trojans, (for example, Tigger...a new type of malware thatinjects code intouser-mode processes." "This component takes screenshots, hooks COM for spying on browser events, and exports passwords[from] protected storage, network and dial-up. It also steals webcookies, steals certificates, and puts the NIC in promiscuous mode tosniff FTP and POP3 passwords)" worms and man-in-the-middle attacks. But those were not addressed in this particular article. Screen scraping was touched upon...
With HomeATM’s product, cards are swiped and PINs entered only on the peripheral device, with all data encrypted from swipe to transmission to issuers. (Editor's Note: HomeATM also encrypts Track 2 data) “If I can see it on your screen, I can capture it,” Mages argues.
Without going into details, Acculynk’s CEO Ashish Bahl counters that each click is encrypted in ways intended to frustrate hackers. Editor's Note: That's an interesting one. No details I can understand, but when hackers get frustrated they get motivated. Frustrating hackers, in my mind is not the level of security I want associated with PIN Debit for the Web)...
At the same time, he adds, the resources necessary to predict when to start and stop screen scraping with each click would be cost-prohibitive even for determined fraudsters. Editor's Note: Cost prohibitive is relative to the potential return. Personal Identification Numbers are the "holy grail" for hackers. You have the PIN's and you the capability to empty bank accounts. So, in my humble opinion, there's no such thing as a "cost prohibitive" barrier when it comes to PIN's. Especially, if they're "determined." The "Holy Grail" is NOT a cost-prohibitive entity. It's something hackers would want to get their hands on "at all costs."
For now, Accel/Exchange is satisfied with the security of Acculynk’s system.Editor's Note: I would suggest that "for now" sends the wrong message. Yeah, it's good "for now" and we'll take a wait and see approach as to whether or not we're right? That's a pretty bold gamble. Too bold. Heartland's CEO thought the same thing...we're good for now...but then after what could be the biggest breach ever, he called for end-to-end encryption. Translation: It wasn't good enough.
“We did our own [investigative] work, then we sent in a third-party auditor,” says Kelly. “They approved it.” Editor's Note: Okay, so Accel Exchange is willing to take the risk that they could be forever remembered as "Accel Exchange for PIN's to Hackers" but WHO? is the 3rd party auditor? Why aren't they putting their reputation on the line as is Accel? Could it be TrustWave? They're the group that PCI certified Hannaford, RBS WorldPay and Heartland. Speaking of PCI certified...it's literally impossible to certify each and every PC that is used to enter the PIN's...so why was there no mention in this article on how they're going to address that issue?)
Kelly says he can’t predict which method (Hardware vs. Software) will ultimately dominate what is now a nascent business in processing Web-based PIN debit transactions. “Who knows who’s going to be the right solution?” he says. Editor's Note: Did he just really say that he can't predict which method is right and that he doesn't know if what he's doing is right? No...maybe I read that wrong...
“For us, Acculynk most accurately mimics the consumer experience at a grocery store.” Editor's Note: I KNOW I read that right: This is scary folks...he said, "most accurately "MIMICS the consumer experience at a GROCERY STORE? He did say that right? I hate to sound sardonic, but when was the last time you walked into a grocery store and used a floating PIN Pad? I go to the grocery store quite often and everytime...including the last time...there was a "HARDWARE" device. Maybe what he meant to say is that it mimics the grocery store experience in the sense that someone can look over your shoulder and watch you enter your PIN.
Sounds like Mr. Kelly is a bit confused. In order to make sure there is NO confusion, HomeATM's "Third Party" was Witham Laboratories, 1 of 8 approved by PCI to test...and they vigorously tested and found our hardware device to "meet or exceed" PCI PED 2.0 standards.
Furthermore, HomeATM's hardware device not only "accurately mimics" the consumer experience at the grocery store, it does it one step better. It "PRECISELY MIMICS" the consumer experience in the lobby of their bank. (not the satellite one down the street) The only difference is that(unless you install your own) there's no possibility of a hidden camerato record your PIN as you enter it, there's no possibility of askimming device, and even if someone were to break into your home,leave your 52' LCD on the wall and try and tamper with our device, itwould shut down, because it's literally "tamper proof."
I understand why Accel Exchange is willing to take drastic measures to increase their growth (see chart above left...they have the most minitesmal growth of any EFT Network in the Top 10) but this may be a bit TOO drastic. The only thing that's SAFE to say about this development is that since Accel is only in 6 out of 50 states, (Alaska, California, Idaho, Nevada, Oregon and Washington) 88% of the country will still have PIN security.
The HomeATM PIN Payments Blog has been honored with a "Best of the Best" classification from Alltop. We humbly accept. (Follow this blog on Twitter).
We've been placed in the "banking section" along notables such as Glenbrooks's Payments News, NetBanker, (the Finovate people) Bank Info Security and the New York Times Banking Section. (see graphic on right)
As long as I've started a post announcing our inclusion in Alltop's Best of the Best, let me clarify something that's been bothering me. We (along with a myriad of others) have been referred to as "an alternative payments company." Quite the opposite is true. HomeATM does not offer an alternative payment platform. We offer a mainstream platform for an alternative space. There are lots of "alternative payment" companies out there. In fact one seems to crop up every week. What makes HomeATM's PIN Payment platform DIFFERENT is this:
A PIN based payment is NOT an alternative payment at all. Debit recently overtook Cash as King, and PIN Debit is the most preferred form of payment by BOTH consumers and merchants alike. Our platform most accurately mimics the consumer experience at a grocery store. Swipe your card (more convenient than having to type a 14-16 digit number), and enter your PIN.
Therefore it is a "Mainstream" payment. The only difference is, with HomeATM's SwipePIN device, you would do it in the safety of your own Homethereby alleviating the risk of someone looking over your shoulder andstealing your PIN. Another big difference is that with your own "personal" swiping device, you know it hasn't been tampered with. In addition, the PIN is end-to-end encrypted.
The only thing alternative to PIN Payments is that there are "two" approaches (alternatives) towards providing a PIN Payment mechanism for the Internet. 1. Hardware 2. Software
When it comes to breaches, software is, well, "soft."92% of 500+ breaches were software related. 1% was Hardware. (Tampering caused the vast majority of Hardware breaches and ..our's is "tamper-proof."
Based on the logic exemplified from that statement, it's not surprising they've chosen Acculynk. Meanwhile, a much larger (10 times) EFT Network has already written off a software based solution as potentially dangerous to the whole ATM Debit ecosystem.
Speaking of "Confirmation we Kick Ass,"... for hundreds of years people have fought for what they believe to be right. But...we have yet begun to fight. HomeATM believes common sense will prevail. But first, here's a swift kick in the ass to a software based PIN application.
Without obtaining the PIN Offset, or the PIN Verification Value, which both reside on the magnetic stripe, your PIN can (we say...will) be compromised. Swipe...never Type. If your card information is going to be "swiped" anyway, should you be the one doing the "SwipePIN?"
If the transaction is a ‘card not present’ transaction then where isthe PIN Verification Value / PIN Offset stored? In a traditional PINDebit transaction it is resident on the magnetic stripe of the card. This has several benefits one of which is that it prevents a datathief from obtaining a PIN and only the primary account number andbeing able to conduct PIN based transactions. If the card is notrequired to be presented, it appears that this would allow fraudstersto obtain the PAN or other card data and the PIN and conducttransactions.
So where's the "logic" behind the Accel Exchange's decision to implement a software based solution which DOES NOT protect the PIN? One can only guess they're using the same logic they used when they said that a "floating PIN pad" most accurately mimics the consumer experience at the grocery store. (click picture to enlarge)
Forex bureaus face competition from ‘intelligent’ ATMs Written by Okuttah Mark March 9, 2009:
The roll out of new automated teller machines (ATMs) that can enable individuals to change foreign currency, deposit cash and checks will not only change how people transact business, but also poses a threat to forex bureaus.
The new development comes as some banks roll out mobile and Internet-based banking in a bid to cut costs, increase efficiency and reach a wider audience.
The first of its kind to be installed in Kenya, the new “intelligent” ATMs unlike those currently used, will enable users, both those with the bank accounts or without, to deposit cash or checks without having to put them in envelopes.
“Depositing cash through the ATMs while wrapped in envelopes requires that at least two tellers must be present to confirm the amount, while the client who deposits it after working hours must wait up to 11 a.m the following day before it reflects in his or her account,” said Wilson Kigwa, the marketing manager at NCR, an American company that provides technology solutions to financial institutions.
However with the new ATMs, the cash deposited is reflected in the account within minutes, thereby giving the client ability to withdraw the cash or part of it just immediately when need arises.
Visa's new Aquarium Television Commercial. More People Go with Visa.
Client: Visa Agency: TBWA/Chiat/Day, Los Angeles Executive Creative Director: Rob Schwartz Group Creative Director: Patrick O'Neill Art Director: John Dwight Copywriter: Paul Sincoff Agency Executive Producer: Guia Iacomin Agency Senior Producer: Veronica Beach Agency Producer: Aileen Baliat Production Company: foreignfilms Director: Matthias Zentner Executive Producer: Federico Fasolino Line Producer: Gustaf Richter Post Production: Velvet Post Executive Producer: Gustaf Richter Editor: Jochen Kraus Flame Artist: Sylvi Roessler Shake: Manuel Voss, Christian Stanzel, Viktoria Herbert, Tobias Wiesner CGI: Blackmountain VFX Supervisor: Abdelkareem Abonamous, Andreas Illenseer Director of Photography: Torsten Lippstock Underwater DOP: Didier Noirot Sound Design: Amber Music Executive Producer (Amber): Michelle Curran
Web.com and Chase Paymentech Form Alliance to Benefit Small and Medium-Sized Businesses
Joint Collaboration Provides Merchant Payment Processing Solutions to Web.com Customers
DALLAS, TX. AND JACKSONVILLE, FL. – March 9, 2009 – Web.com (NASDAQ:WWWW), a leading provider of online marketing for small businesses,announced today an agreement with Chase Paymentech to offer merchantpayment processing solutions to small and medium-sized businesses(SMBs). Chase Paymentech is widely-recognized as a leader in merchantacquiring and payment processing and provides SMBs with affordablemerchant payment processing and online marketing solutions.
Web.com customers will have access to multiple secure paymentprocessing services including all major credit, debit and customizablegift cards.
"This partnership is a natural fit matching two companies with asingular vision to assist small and medium-sized businesses to grow theprofits of their businesses," said Peter Gasparro, Group Executive forChase Paymentech. "Our merchants depend on our industry-leading paymentplatform, from stored-value solutions and point-of-sale payments, toonline transactions. Our commitment to excellence and staying ahead ofthe curve is what led us to partner with Web.com."
"To be able to offer our customers a full spectrum of secure andreliable payment processing solutions by an industry leader is anexciting development," said David Brown, Chairman and CEO of Web.com."Giving our customers innovative payment tools at the same paymenttransaction rates generally available to larger companies, gives them amuch needed advantage. We anticipate that this partnership willbenefit the vast majority of our customers presenting them withadditional ways to grow their business, save considerable costs andtake advantage of the latest merchant payment solutions."
Under this arrangement with Web.com, merchants will have access toChase Paymentech’s suite of electronic-payment solutions and will beeligible for a free rate analysis to understand their total cost ofaccepting electronic payments. SMBs interested in obtaining a free rate analysis, can call 866-550-6151. Additional information can be found at: http://www.web.com/landing/chase/default.aspx.
About Chase Paymentech Chase Paymentech, a business unit ofJPMorgan Chase, is a global leader in payment processing and merchantacquiring, capable of authorizing transactions in more than 130currencies. The company’s proprietary platforms provide access to awide variety of payment methods, such as credit cards, debit cards,prepaid stored value cards and electronic check processing. With alegacy of innovation and vision in electronic payments, ChasePaymentech promoted the growth of eCommerce worldwide. The companycontinues to fuel the success of the Internet's largest brands,currently processing more than 50 percent of all Internet transactions.Offering secure payment solutions, improving cash-flow management,mitigating risk and accelerating funding - Chase Paymentech'sconsultative approach helps today's small and emerging businessesbecome tomorrow's industry leaders. On the Internet or at the point ofsale, Chase Paymentech's unique combination of outstanding service,innovative solutions and financial strength offers solid benefits tocompanies both large and small. More information can be found at www.chasepaymentech.com.
About Web.com Web.com Group, Inc. (NASDAQ: WWWW) is a leadingprovider of online marketing for small businesses. Web.com offers afull range of online services, including Internet marketing andadvertising, local search, search engine marketing, search engineoptimization, lead generation, home contractor specific leads, websitedesign and publishing, logo and brand development and eCommercesolutions, meeting the needs of small businesses anywhere along theirlifecycle. For more information on the company, please visit www.web.com or call 1-800-GETSITE.
France Telecom's mobile network subsidiary Orange and Barclaycard are joining forces to develop new mobile payment technology for transactions under £10, the firms announced this morning.
The companies said 28 million customers in Londonwill be able to use their mobile phones to pay for goods and services at retailers simply by waving their handset against a reader.
Both are looking to expand the partnership to include other contactless services in ticketing, transport and rewards. MasterCard will provide the payment capabilities for the transactions.
This will be the biggest revolution in payments since plastic cards were introduced more than 40 years ago, they said.
The capacity to pay by mobile will emerge over the next few months from marketing schemes being set up by the firms. Orange UK CEO Tom Alexander said more companies were looking to the mobile industry "to evolve" the way they do business with their customers. "A key part of our strategy at Orange is to grow and evolve our business in order to provide people with services beyond talk and text."
Antony Jenkins, CEO of Barclaycard, said, "There has been a lot of talk about mobile payments and now it is going to become a reality for our customers because of Barclaycard's commitment to contactless technology. I believe that all our UK customers will be able to use their mobile phones to pay for everyday items within three years."
Because the individual obviously took some time to craft it, I decidedto share it by publishing it as a post. It doesn't take a genius tofigure out the analogies here, but it's all been crafted in purefun...albeit, some may consider it to be a "third-rate" attempt atcomedy.
MANY,many breaches ago lived a wealthy emperor, who thought so much ofshopping that he spent all his money in order to obtain clothes; hisonly ambition was to be always well dressed. He did not care for hissoldiers, and the theater did not amuse him; the only thing, in fact,he thought anything of was to drive out and show a new suit of clothes.He had a coat for every hour of the day; and as one would say of a king"He is in his cabinet," so one could say of him, "The emperor is in hisdressing-room." The emperor always prided himself on paying with cashand he guarded the PIN to his ATM card vigorously.
The great Georgia city where he resided was very gay; every day manystrangers from all parts of the globe arrived. One day two swindlers (Editor'sNote: he/she apparently wanted to stay as close to the original storyas possible, so anyone in Georgia, please don't be offended by the"gay" term. It meant bright/happy as in "Don we now our GayApparel...fa la la...fa..la..la, fa la lol) came to this citycalled Duluth; they made people believe that they were weavers, anddeclared they could manufacture the finest cloth to be imagined. Theircolors and patterns, they said, were not only exceptionally beautiful,but the clothes made of their material possessed the wonderful qualityof being invisible to any man who was unfit for his office orunpardonably stupid. In addition, they told the emperor they couldaccept payments on the Internet with his PIN ATM card!
"That must be wonderful cloth," thought the emperor. "If I were to bedressed in a suit made of this cloth I should be able to find out whichmen in my empire were unfit for their places, and I could distinguishthe clever from the stupid. I must have this cloth woven for me withoutdelay." And he promised a large sum of money to the swindlers, inadvance, that they should set to work without any loss of time. Heagreed to pay with his ATM PIN card on their website.
Theyset up two looms, and pretended to be very hard at work, but they didnothing whatever on the looms. They asked for the finest silk and themost precious gold-cloth; all they got they did away with, and workedat the empty looms till late at night. They also created a website sothat the emperor could easily use his PIN ATM card to pay for thepurchases he so coveted.
"I should very much like to know how they are getting on with the clothand the website," thought the emperor. But he felt rather uneasy whenhe remembered that he who was not fit for his office could not see it.Personally, he was of opinion that he had nothing to fear, yet hethought it advisable to send somebody else first to see how mattersstood. Everybody in the town knew what a remarkable quality the stuffpossessed, and all were anxious to see how bad or stupid theirneighbors were.
"I shall send my honest old minister to the weavers," thought theemperor. "He can judge best how the stuff looks, for he is intelligent,and nobody understands his office better than he. Also, he is anaccredited third party who can judge the security of this new PINwebsite."
The good old minister went into the room where the swindlers sat beforethe empty looms. "Heaven preserve us!" he thought, and opened his eyeswide, "I cannot see anything at all," but he did not say so. Bothswindlers requested him to come near, and asked him if he did notadmire the exquisite pattern and the beautiful colors, pointing to theempty looms. The poor old minister tried his very best, but he couldsee nothing, for there was nothing to be seen. "Oh dear," he thought,"can I be so stupid? I should never have thought so, and nobody mustknow it! Is it possible that I am not fit for my office? No, no, Icannot say that I was unable to see the cloth. Nor could he see how theemperor would enter his PIN safely into this invisible website!"
"Now,have you got nothing to say?" said one of the swindlers, while hepretended to be busily weaving and pretending to build the payment page.
"Oh, it is very pretty, exceedingly beautiful," replied the oldminister looking through his glasses. "What a beautiful pattern, whatbrilliant colors! I shall tell the emperor that I like the cloth verymuch and that the PIN entry website is very safe."
"We are pleased to hear that," said the two weavers, and described tohim the colors and explained the curious GUI floating PIN pad pattern.The old minister listened attentively, that he might relate to theemperor what they said; and so he did.
Now the swindlers demanded more money, silk and gold-cloth, which theyrequired for weaving. They kept everything to themselves, and not athread came near the loom, and not a real transaction went through thefake website but they continued, as hitherto, to work at the emptylooms and blank website.
Soon afterwards the emperor sent another honest courtier to the weaversto see how they were getting on, and if the cloth was nearly finished.Like the old minister, he looked and looked but could see nothing, asthere was nothing to be seen. Neither could he see or use themysterious floating PIN pad.
"Is it not a beautiful piece of cloth and don't you love the website?"asked the two swindlers, showing and explaining the magnificent GUIpattern, which, however, did not exist.
"I am not stupid," said the man. "It is therefore my good appointmentfor which I am not fit. It is very strange, but I must not let any oneknow it;" and he praised the cloth and the website, which he did notsee, and expressed his joy at the beautiful colors and the finepattern. "They are very excellent," he said to the emperor.
Everybody in the whole town talked about the precious cloth and magicPIN website. At last the emperor wished to see it himself, while it wasstill on the loom and the PC. With a number of courtiers, including thetwo who had already been there, he went to the two clever swindlers,who now worked as hard as they could, but without using any thread orHTML.
"Is it not magnificent?" said the two old statesmen who had been therebefore. "Your Majesty must admire the colors and the GUI pattern." Andthen they pointed to the empty looms and the blank screen, for theyimagined the others could see the cloth and the magic GUI PIN pad.
"What is this?" thought the emperor, "I do not see anything at all.That is terrible! Am I stupid? Am I unfit to be emperor? That wouldindeed be the most dreadful thing that could happen to me."
"Really," he said, turning to the weavers, "your cloth and website haveour most gracious approval;" and nodding contentedly he looked at theempty loom and blank screen, for he did not like to say that he sawnothing. All his attendants, who were with him, looked and looked, andalthough they could not see anything more than the others, they said,like the emperor, "They are very beautiful." And all advised him towear the new magnificent clothes at a great procession which was soonto take place and to pay online with his PIN ATM card. "They aremagnificent, beautiful, excellent," one heard them say; everybodyseemed to be delighted, and the emperor appointed the two swindlers"Imperial Court weavers and webmasters."
The whole night previous to the day on which the procession was to takeplace, the swindlers pretended to work, and burned more than sixteencandles while capturing PINs with the floating GUI PIN pad. Peopleshould see that they were busy to finish the emperor's new suit. Theypretended to take the cloth from the loom, and worked about in the airwith big scissors, and sewed with needles without thread, and said atlast: "The emperor's new suit is ready now. Let us pay for it with hisATM card and PIN!"
The emperor and all his barons then came to the hall; the swindlersheld their arms up as if they held something in their hands and said:"These are the trousers!" "This is the coat!" and "Here is the cloak!"and so on. "They are all as light as a cobweb, and one must feel as ifone had nothing at all upon the body; but that is just the beauty ofthem and the fact that you can pay for the clothes with just your PINATM card and our magic GUI floating mouse-clickable PIN pad makes thisall the better."
"Indeed!" said all the courtiers; but they could not see anything, for there was nothing to be seen.
"Doesit please your Majesty now to graciously undress," said the swindlers,"that we may assist your Majesty in putting on the new suit before thelarge looking-glass and before collecting your money?"
The emperor undressed, and the swindlers pretended to put the new suitupon him, one piece after another; and the emperor looked at himself inthe glass from every side.
"How well they look! How well they fit!" said all. "What a beautifulpattern! What fine colors! That is a magnificent suit of clothes!"
The master of the ceremonies announced that the bearers of the canopy, which was to be carried in the procession, were ready.
"I am ready to pay," said the emperor. "Does not my suit fit memarvelously?" Then he turned once more to the looking-glass, thatpeople should think he admired his garments.
The chamberlains, who were to carry the train, stretched their hands tothe ground as if they lifted up a train, and pretended to holdsomething in their hands; they did not like people to know that theycould not see anything.
The emperormarched in the procession under the beautiful canopy, and all who sawhim in the street and out of the windows exclaimed: "Indeed, theemperor's new suit is incomparable! What a long train he has! How wellit fits him!" Nobody wished to let others know he saw nothing, for thenhe would have been unfit for his office or too stupid. Never emperor'sclothes were more admired.
"Buthe has nothing on at all," said a third grade child at last. "Goodheavens! listen to the voice of an innocent third-rate child," said the father,as one whispered to the other what the child had said. "But he hasnothing on at all," cried at last the whole people.
That made a deep impression upon the emperor, for it seemed to him thatthey were right; but he thought to himself, "Now I must bear up to theend." And the chamberlains walked with still greater dignity, as ifthey carried the train which did not exist. The swindlers were joyousfor not only had they stolen the emperor's dignity, they had alsostolen his precious PIN.
Twitter Users - Want to Tweet a Post from the PIN Payments Blog? Feel free...and now it's easy! Just look for the "Twit This" Icon located at the bottom of each and every Post and Simply Click to Tweet!
EAST COUNTY – A man suspected of trying to break into an ATM with a blow torch was arrested Thursday after a high-speed chase and crash, authorities said.
Sheriff's officials received a report about 6:20 a.m. that a man was trying to get into an ATM in front of a liquor store on Woodside Avenue and Channel Road in Lakeside, said sheriff's Sgt. Tom Poulin.
Smoke could be seen billowing from the machine.
About four hours later, a deputy spotted the suspect's vehicle, a white Chrysler PT Cruiser with blue rims, and tried to stop him. A chase ensued and wound through Lakeside, La Mesa and El Cajon on Interstate 8, reaching speeds as fast as 90 mph at times, Poulin said.
The 15-minute pursuit ended when the suspect crashed into a light pole at the corner of Fletcher Parkway and Cuyamaca Street in El Cajon. He then tried to run from deputies, but a sheriff's dog bit him on the arm.
The 52-year-old San Diego man was taken to a hospital to be treated for the bite wound and will be booked into jail, authorities said.
Deputies found a blow torch, a pellet gun, tools and marijuana in the car. Investigators are also looking at a series of similar blow torch cases that have been reported throughout the county in the past week, Poulin said.
I've posted quite a few times that we're in the midst of a major Paradigm Shift. (use the HomeATM search bar on the right and "enter paradigm shift" to read) I took a moment to outline (see graphic on left) some of the finer points which provide e-vidence of this impending shift.
I am positive that convenience will be forced to take a backseat to security which is clearly going to be in the drivers seat.
Likewise, I am more confident that in order to secure a transaction it has to be done by Hardware. No predictions there...just fact. To the engineers at HomeATM...it's a foregone conclusion. It doesn't matter what anyone says today... tomorrow always shows us the truth.
One doesn't need to be Einstein to figure out that if something is breached 92 times more than something else, then the "something else" MUST be more secure.
Question: If something is breached 1% of the time vs. 92%, then wouldn't it be at least 92 times easier to to "fix" what causes 1% of breaches? In the case of hardware being breached, tampering was virtually to blame everytime. So we made our SwipePIN device tamper proof. We're done.
When you consider new cracks in Secure Socket Layer(SSL) websites , DNS hijacking, Man-in-the Middle Attacks (MITM) Malware, bots, and combine that with the fact that there's been3 Major Processor Hacks in 3 Months, these are indeed dangerous times. This doesn't even take into account the YTBD hacks which will occur in the near future.
We're all at risk for loss if we believe that a PIN Based solution can be peripheraless. Once again, Hardware is not an option. IBM came to the same conclusion whilst looking at how to best secure online banking. See: IBM Agrees with HomeATM....Hardware Required.
Information security will become the number one priority for EVERYONE, and the ONLY way to securely transact an e-commerce transaction is via hardware. There is NO other way. Besides...what's the anti-convenience rhetoric about Hardware anyway? Doesn't it make it more convenient when you don't have to type in a bunch of digits, expiration dates or CVV's.
Besides...we're used to hardware...don't you have to plug a cigarette adapter into your iPhone or Blackberry to charge it? How hard is that? Well, in addition to processing PIN Debit, you can plug in the HomeATM SwipePIN device and "charge it." What's the difference? Plug in cell-phone to charge it...Plug in SwipePIN device to charge it. (Don't forget about our PIN my Card application which allows you to securely assign a PIN number to your credit card, providing a more secure dually-authenticated transaction)
The Internet is demonstrating significant power to provide "Net"profit", Cash has been replaced as King, having being "overthrone" by King Debit, and information security is more important than ever. It doesn't take Nostradamus to write a quatrain predicting that EFT Networks will want their piece of the PIN Debit/Credit Internet Pie. And rightly so! Why should they be "shut out" from Internet transactions?
PIN Debit leads Signature Debit 45%-35% in the physical world, but doesn't yet exist in the virtual one. Can you possibly disagree that the paradigm shift will contribute towards bringing PIN Debit to the web? Problem is...in the past retailers were the focal point of hackers. Got the Personal Account Numbers but never the PIN. Now it's processors. 100 Million Personal Account Numbers...Zero PIN's. PIN's are the Holy Grail to Hackers. Doesn't ANYONE SEE (beside's Avivah Litan, HomeATM and IBM) what's going to happen if we attempt to secure them in a software environment?
Nostra(para)digmus predicts that no matter what we see today, tomorrow will show us the truth.
OTTAWA — A leading business organization is calling on Finance Minister Jim Flaherty to use "moral suasion" to block credit card companies from entering the debit market so shoppers are shielded from higher price tags.
And if public pressure doesn't work, the Retail Council of Canada says Flaherty should exercise his power to regulate the payment system to protect retailers from seeing a "very substantial increase" in merchant costs, which would be passed on to consumers.
Interac has already applied to the Competition Bureau to restructure from a low-cost non-profit organization to a for-profit operation in anticipation of Visa Canada and MasterCard's move into the debit market.
"If government were to indicate that it was concerned about this, it was concerned about the cost this would impose on small businesses and on customers, I think the large banks would think very long and very hard before they bought in to the Visa and MasterCard model," said Peter Woolford, the retail council's vice-president of policy and research.
"Moral suasion has a role, so Visa and MasterCard might continue to try and sell their product, but the banks might look at it and say, 'Do we really want to infuriate all of our customers in order to make some money when we're already making money on the product we use today?'
"They might think twice before they say, 'We've got this great new product where we get to gouge you.'"
The retail council estimates merchant fees could more than triple if banks sign up with the debit systems of Visa or MasterCard. Currently, Interac fees for retailers range from about three to seven cents per transaction, depending on the size of the retailer. The fee does not change if the total bill for the transaction is higher, as is the case with credit-card transaction fees set by credit-card companies and paid to the issuing banks. Continue Reading
Revenue loss from ecommerce fraud rose 8 percent in 2008 to $4 billion, matching the overall growth in online sales, according to a new study.
Although ecommerce fraud as a percentage of total sales was flat at1.4 percent in 2008, total online sales actually grew so that theabsolute revenue lost increased from $3.7 billion in 2007 to theaforementioned $4 billion in 2008, according to the Mindwave Research study conducted for the Merchant Risk Council, a merchant-led trade association focused on electronic commerce risk and payments globally, and sponsored by CyberSource.
The survey also sought to compare Merchant Risk Council members'rates of fraud loss and transaction acceptance to the rates fornon-members.
Things going from bad to worse for Bob Carr as now he's been forced to sell almost 700,000 shares of his stock. That constitutes more than one-sixth of his holdings and the reason was to meet loan obligations for which the stock was pledged as security.
The balance of his shares continues to be subject to pledges under the loan and although it's likely he'll have to sell more shares to meet those pledges, this is the last time we're going to hear anything about it.
Last week, a class-action lawsuit was filed against Heartland on behalf of banks who were forced to issue new cards. (see related stories below)
A breach can be a messy thing. Hope the EFT networks are taking notice when they decide to go with either a hardware or software approach to bringing PIN Debit to the web. In the Heartland breach, although 100 MILLION Personal Account Numbers (PAN's) were obtained...the total number of PIN's lifted was ZERO. Let's keep it that way.
Here's the press release:
Click to Enlarge
Princeton, NJ – March 2, 2009 – Heartland Payment Systems, Inc. (NYSE: HPY) announced today that Robert O. Carr, chief executive officer, and his wife, Jill A. Carr, were subject to the forced sale of an aggregate of 692,412 shares of the company’s common stock to meet obligations under a loan for which the shares were pledged as security. The proceeds of the loan were used to refinance prior loans, a portion of the proceeds of which were expended by Carr in connection with the acquisition of approximately 1.75 million additional shares of Heartland Payment Systems stock by the exercise in 2006 of options granted by two large institutional stockholders. The balance of the common stock of the company owned by the Carrs, approximately 4.3 million shares, continues to be subject to pledges under the loan, and it is likely that additional shares will be sold.
Carr commented, “I am extremely disappointed about this involuntary sale of my stock. This forced sale is precipitated by the mix of extraordinary circumstances confronting Heartland and the recent drop in its stock price. Unfortunately, I had no ability to stop the sales by my lender. Together, with my wife, I have been one of the company’s largest shareholders since its inception, and I acquired additional shares of stock in 2006 as an expression of my confidence in the company’s potential. This sale initiated by my lender does not in any way reflect my view of the company’s value and future performance potential. My confidence in Heartland remains strong, and I am enthusiastic about reestablishing my ownership position in the company over the months and years to come.”
The company has also been advised that Sanford C. Brown, chief sales officer, is expected to be subject to a forced sale of shares of the company’s common stock to meet obligations under a loan for which the shares were pledged as security.
The company does not undertake to provide further updates concerning future forced sales of shares owned by the Carrs or Brown.
If you're interested in learning how to protect your business against card-not-present fraud, Quova's new white paper, "Geolocation - Knowing Your Enemy," may be of interest.
This paper addresses how Quova's customers are using IP geolocation technology to minimize fraudulent online orders, limit manual reviews and reduce false positives by:
Recognizing mismatches between credit card billing locations and IP locations
Blocking orders from specific "high risk" countries
Flagging orders with problematic domain name extensions
Identifying and declining or reviewing orders forwarded by anonymous proxy servers
Detecting uncharacteristic behavior from analysis of user profiles
Establishing unlikely time patterns for location or frequency of shopping activity
The Ukash, Wallie or Ticket surf payment orders allow customers to purchase virtual services within online games, pay for top-ups for VoIP and settle subscriptions on social networking websites.
Leading Biometric Check Cashing Company Changes Name to AllTrust Networks
Trusted Data Network and New Service Offerings, Prepaid Card and Bill Payment, Drive Name Change
HERNDON, VA – (March, 2009 (AllPayNews.com) – The leader in biometric check cashing, formerly know as BioPay Paycheck Secure, announced its new company name, AllTrust Networks. Still under the same ownership and management, the name change is part of the company’s overall strategy to position itself as the leading provider of “decisioning” data in the alternate financial service market. Its customers, retailers who are part of the AllTrust network, benefit from this “trusted” data source, receiving valuable check recommendations based on transaction history – from both the check issuer and the check casher. Transactions that begin with a biometric identification are faster and more secure than traditional check authorization systems. AllTrust leverages its network of over 5-million enrolled consumers and thousands of retail locations to dramatically reduce the fraud risks of payroll check cashing.
The name change also reflects the expansion of the company’s service offerings and the added value created for both retail clients and consumers. Prepaid card issuance and bill payment services complement the base check cashing system, and enable retailers to more efficiently fulfill their customers’ needs by using one system to perform multiple financial services. In addition AllTrust Networks has enhanced existing features of the check cashing product including electronic deposits and check maker research, to improve the overall retailer experience.
“Our client base, comprised of grocery, c-store and financial service centers, uses our check cashing system to drive in-store traffic, reduce losses from bad checks and grow their businesses by efficiently serving underbanked individuals,” said Jon Dorsey, CEO of AllTrust Networks. “We are proud of our ability to service this market through our trusted data network, and strongly believe that the name change more clearly defines our commitment to both retailers and consumers.”
About AllTrust Networks
With more than five million registered consumers, AllTrust Networks, formerly BioPay Paycheck Secure, is the most widely used biometric check cashing system in the nation. Thousands of retail locations across 46-states are using the Paycheck Secure system to quickly, safely, and easily identify customers and process financial transactions. Designed to stop fraud and speed check cashing transactions, the payroll check cashing solution, now offers retailers and banks full MSB compliance, embedded Check 21 processing, prepaid card and bill payment services. For more information on AllTrust Networks, visit www.alltrustnetworks.com
VI All card, personal, and key information shall be encrypted in volatile siliconand/or memory prior to transmission.
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uHAXQD_531j6pP1f7RxZwbYrxyh7MTKADCGfzg-zdA7gv9Cd8An901oUWb8lekRz8ahSEfgC4ppV5vPD4RBFgRUg_uQ4o-I52Jf29YV7m_xJHjML_YbZGswLEJ7UagIM_th9iIGwrAL_BHZbjsLtT0=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u2GD8tyrZsB0TsIUsJtwC_NTTKwizFcWl-OShV4JYNlcjMhMBgeCZI5aSw9GK9-wzptlOjga5I0dvEdHflcaw6QCTqtepCT6CkIsD0gsa0nUfU9x3vZxxC6mn5f_ghO1aWhDsWfSUUSZ-2nTuxsGE=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vJsEUhG7MiOo_iE7U32misLu5Rox-aSuM-vcfKWX_dOUKdflJw6gl_AG-GH6hcG1GTTxBWUXBsDrplAF2HucsvCME77RHvwTveLJyVpTYaIbE17VtdP6Hx2oVXR2U2CWE6OGrzGPrVtTd26w2HiNg=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vQpJP4LIgG89lwc4G1wCnzhb9rLMOZxXo2hkfFo5T81LqF-j6h0TvelMzokL4lM4fpJiP7eZm5g-GRebfQUTEGmPU6BNdC3FR4w3qpA5J_HWaDJ-1aEyc2J4WVJ0GmCCsSZPY3TuYjkKQ88i0vcO0=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tifV3Fg3GXv4R7STks20eYZVxkLLMN7WlzMaktKyYYUHU3aCilrm6hiTkbF4Q8gCm3eMUgdsYpss9hXDbBaSbYV4cycmiJ-b8dxfthjjKXGPue66ITQ2QGrr9XXdD8tacaarkQ7SUWdP-DeZjng8Jt=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v8xIQ-CJ0oQJ2aQSBt6-G4K6xOlOCkwyeE5P4cCR3DE2JPT-E3GGgnkqFbFouSlVDDqAH582OzfoMnSpXOPlekNGgkkHllEwK1gxQj-J2zifvYtRSp8KMEkNprfCx-kCHLGvYcsD3DVvsmWpIg45cI=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sjUzD83dr73IiljhzF4tc1fYgvW703ExlAWVLZB3UOAIBbeMUU90qnBhjiNXBrs7xzbM3pMoGXvGIMC0abtvKPG2Cq8OLnbzbquIx93N_k5OB22dXQhmeV6g0mpWIsC1xKlPHp0vBEPSpt-MLyoT7A=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vtd6eBUQkCCCs8Lf_8PQ1pDzYsVLKPl8KEiCf8LqsoxNIRAJCzZgs4xSq-ibiXKXQqdzoYRbosKPtoAS5fJt9OZYx2dUsHt_qtFficnN1Hc_4AOc8Jzf7E7QZgPamOHiDr3tL7YlKjlmDEksdCWlrc=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_utVoxcpw_h3m6tySvrqowcBGbPNb46GiTEqFyA3vrLemzojkst5plC7rpk_0TI5Pw0TnMSQpXCjyt0Re6U6OWYtu1ecN2lwcIs4BUaRJBkRtXcfuNPxk-qVwYKKCHFUzawTWOEfJmWq0E4QfKnUDP-=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sG3bisFeE9D3aj-Tsl7oLyl8fW9GeTz4SKv7YzVsHuUYeFwilXSAvlC2CeuS-sLRwMO5G5SnBtcZEys-42cmyCjz1aypdnYWZ-s1EF3KWTN3TgT_hQgq5lnF_7lgiBOQmWAOkGO7tmF8fAr6LazvF7=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vD-4qplbRBhxY6Qava5DMibrZY0-HdvfN5DCb1N3QA3Xa6eDbvrw_KV2W16P8Madh2EjziJ_YbJGvqV_Krz112fxFCTJmVkBcMgVSsn6bL4-X4e_-7UUd-7hV34Jb--ORxrv9_DJeva78rApGrZi8=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sldBax6oY6_H85cgX_hmkG-PcPHKTxxc6PHTOQXpQSBEWrYVTTxLKrASAQii75ZvlpquJIx7kPLolVgE0L139cn4v2eZYQ5uPDMinM8-ptpbW-gS4LAeXvuwjt2N6Zs35PFSLMtXpeFjQTgGNSps2f=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t-qJ9NNw2zaw0XKZysf-ywojvVHdXli_ME1ff9KRL0G0svj4SR6QoIPd81R1YKMwozNEmAK7XPt78HIY03jJxI9RzkhPVeAZU-kCq96u_M-12TW9iuEmMgw0fsHi6eSBabEWC79axNOriAh2XuGERH=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tZ6iFs2dEXx2Kh4bwMwVZ9-KvWsYPXvEHT4l63J-ok4qyLbNhWMnJfGSw-xmKVGFgYceaT6VoCEdf_AkzJ2JJH3cYRr2mRsROL-COGum4C1Uy1CI1I_CiWDPE8IP0iWqKwRIvB-ZnhLbx0kvIm9UE=s0-d)
Leading Biometric Check Cashing Company Changes Name to AllTrust Networks![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_utLm9yxwn78e7UiId64b3LhqNgwHiPiW6sj7-RGma8vbV3TlzRyp_Msf8844jM4UB9TjSd0gSuT_yLF0U7QooaPthocP0uRBI2E_5Y1yhIrsKL3jXrHDGHDQKSRG9fXCsmM0EEHjr_KSeyKj9UxEs=s0-d)