Mobile Payment Industry News

Monday, May 11, 2009

Heartland NOT PCI Compliant When Breached!

Both Visa and MasterCard have officially gone on the record saying the Heartland Payment Systems was NOT PCI compliant at the time of the breach.

When you take that into account and add the following 9 items, things don't look so good for Heartland Payment Systems:

MasterCard has levied a $6 million dollar fine against the company
Visa has not yet announced the amount of their fine.
The breach (so far) has cost Heartland $12.6 million dollars
HPY has seen a $100+ million drop in their market cap
Shareholders have filed a class-action lawsuit
Consumers have filed class-action lawsuit
Banks have filed a class-action lawsuit
Robert O. Carr is being investigated by the SEC for possible stock trading improprieties
The last processor (CardSystems) to be breached went belly-up

Heartland wants to talk about "end-to-end-encryption" (E2EE) but it's too late. If they were NOT PCI compliant, the end-to-end is over...what begins now is the "beginning of their end. Any guesses as to how they'll end up? Hint: This does not get categorized as "Tales from Encrypt." Back to plain ol' Crypt.

Here's why they are dead in the water. Attorneys fees and potential for treble damages on not one, not two, but THREE class-action lawsuits will "definitely" take their toll. But, of more immediate concern is the cost to reimburse the banks for having to reissue all those new bank cards. Some have estimated that cost is upwards of $200 per replacement. Some have estimated that 100 million accounts were breached. One-million reissued cards would cost Heartland $200 million.

But is Robert O. Carr done? At least Bobby O. made millions from the sale of his shares between the time the breach occurred and the time it was announced. (To refresh your memory, Heartland displayed the utmost in transparency when deciding to announce the "biggest breach" in the history of the United States during Barrack Obama's inauguration.

Gee, what a coincidence, eh? As coincidental as selling hundreds of thousands of shares of stock after the breach occurred.

Some of you might be wondering why I'm so hard on poor poor Robert (Bob) O. Carr. I know it's noticeable to those who read my Heartland posts, but I'm not quite sure if I ever did explain my sarcastic disdain.

Let me tell you about the time I met Bob Carr face to face. It was down in St. Louis, in 1997 I believe, the weekend he was recruiting his initial influx of ISO's for Heartland Payment Systems. I talked with him about 15-20 minutes and stood around for another 25 or so listening to him talk to others and...suffice it to say that he was one of the most brutally arrogant SOB's I've had the displeasure to meet in my life. Now let me be clear. I don't mind the "self-confident" arrogance. I'm talking the condescending, "I'm better than everybody" arrogance. You know, the kind of arrogance that permeates the room with my shit don't stinkedness? The kind of arrogance that screams"rules don't apply to me?" Speaking of which, I for one, won't be surprised in the least if the SEC investigation turns up evidence of "rules don't apply to me" behavior.

He may have changed since 1997 however...Press Releasing the breach on Inauguration Day says differently. Where was the end-to-end-encryption before the breach? Too late now. You've lost millions Bobo...and in my humble opinion, it couldn't have happened to a better (than everybody) guy!

Heartland Data Breach: Is End-to-End Encryption the Answer? (Editor's Note: Not if the question is "Will Heartland Survive?

Experts Say New Measure is a Start, but Industry Standards are Needed

The announcement by Heartland Payment Systems (HPY) that it will offer its merchants end-to-end encryption capabilities is seen as a positive step by industry experts. Yet, these same experts also warn that this measure will not solve all of the security issues that Heartland and other payment processors face from hackers.

In Heartland's first-quarter earnings call last Thursday, company officials said so far last year's well-publicized data breach has them $12.6 million. The amount includes legal costs and fines from Visa and MasterCard, both of which have stated the payment processor wasn't compliant with PCI standards at the time of the breach.

Read Entire Article

Twitter This...Twitter That...

twitter.com/homeatmTwittering is all the rage, and many banks have taken note. But is there a business case behind Twittering?

Twitter now ranks as the third most trafficked social networking site, behind Facebook and Myspace, and has achieved a certain cultural stature. With that said, FaceBook and Myspace still don't really have a business model either.

American Banker reports than more than a dozen banks have set themselves up on Twitter. Right now it's a hot commodity. Think about it. It's very name, like Google, is now a verb! I have to admit. I don't get it. Sure I "tweet" these blog posts, and have watched in amazement as people start "following," but I still don't get it.

Next thing you know Twitter will be everywhere. I can see it now...

Twitter me This!

Is is true that the script for the new Batman Forever movie calls for plans to introduce a new character called "The Twitterer"

Scary! Speaking of which, come next October are kid's going to come to our door and say Trick or Tweet?

Will people then develop a Tweet Tooth?

God I hope not. Nobody asked, but here's my opinion: "If I was the "King Tweety Bird" I'd take $700 million for that business in a "heartbeat"

I heard from a little birdy that's what they were offered. If so, it's not worth it to place a $700 million bet on whether or not this is a passing fad. Banking $700 million is all the rage. Speaking of Facebook, does anybody know their business model? How about myspace? YouTube's business model is apparently to lose 2 million per month.

If you're "bent" on following breaking payments industry news, sign up for our newsletter...or visit often. If you are hell bent on Twitter and want to follow the PIN Payments News Blog (even if it's just for the pictures) click the graphic above right!

Getting back to business models: If you're King Tweety Bird, (a.k.a. Jack Dorsey) either sell it for $700 million...or call HomeATM to discuss your payments idea...which you aptly code-named "Squirrel." It's a good idea. It can make Twitter a ton of cash. So call us...we can help!

But be aware...we had previously code-named that very same idea "patent pending". Let's compare notes!

Heartland Starts It's Slow Climb Off the Canvas

Bank Technology News contributor, John Adams, writes that Heartland is still reeling from the left hook thrown by Hackers:

Heartland Starts its Slow Climb
off the Canvas

Bank Technology News | May 2009
By John Adams

Heartland Payments Systems is still taking its standing eight count after one of the worst data breaches in history, but with its Visa PCI DDS validation restored, the firm hopes to emerge with a sober lesson it can share with other firms to prevent future breaches.

“We now we have a greater appreciation for how brazen some of these organized cybercriminals are,” says Jason Maloni, a spokesman for Heartland in Princeton, NJ.

Count that as at least $12.5 million in appreciation—the amount the breach has cost the company thus far, including legal costs and fines from MasterCard and Visa. Heartland successfully completed its annual Payment Card Industry Data Security Standard (PCI DSS) assessment and has returned to Visa’s list of validated service providers. Visa had suspended Heartland, placing it on probation, though the firm was still allowed to process credit card transactions. Heartland, which reported a $2.5 million first quarter loss last week compared to net income of nearly $9 million in 2008, also faces a handful of class action suits connected to the breach.

Continue Reading at Bank Technology News via American Banker

Hackers on Campus

Who’s doing it and what’s being done to prevent it

by Zack Martin, Editor, Avisian Publications

Hacking can mean many things. The image it conjures for most is that of a young man in a dark room lit by nothing more than the glow of a computer monitor, trying to break into some top-secret government system or steal credit card numbers.

On college campuses hacking can mean a number of different things and threats can come from students as well as outsiders. Hackers attack university databases and systems but they also are targeting the student ID card.

Several high-profile incidents have hit close to home with the campus card community, but securing cards isn’t enough. Universities need to secure payment and IT networks as well or risk data falling into the hands of hackers.

What happened at Harvard is just about a campus card director’s worst nightmare. In July 2008 a Harvard undergraduate student was caught making fake Harvard University ID cards. Not just any cards, but duplicate cards of those belonging to the University President Drew G. Faust, Assistant Dean of the College Paul J. McLoughlin II, and Dunster House Superintendent H. Joseph O’Connor, according to the Harvard Crimson.

The student was able to replicate the magnetic stripe on the back of the card and gain access to buildings and gates across campus with only knowledge of the individual’s university ID numbers and a $200 card reader purchased on eBay. He was also able to make purchases using the individual’s Crimson Cash accounts, which are used to pay for items on and off campus.

The hack was the impetus for Harvard to launch new IDs for the students, faculty and staff in the Faculty of Arts and Science. The university rolled out iClass contactless smart cards from HID Global for physical access to facilities. The new card has two magnetic stripes on the back that are used for payments and other functions, according to the Harvard Crimson.

Mag stripe has its uses

At George Washington University in Washington DC, Ken Pimentel’s biggest fear is someone copying the mag stripe on the card and using it to gain access to a dorm or somewhere else they should not go. “There’s nothing wrong with mag stripe at the point of sale,” says Pimentel, director of the university’s GWorld Card Program.

Continue Reading at CR80News.com

Editor's Note: In a developing and related story 160,000 University of California-Berkeley students and alumni have had their university records stolen by Hackers: (See below)

DATA THEFT -- U.S.
160,000 University Records Stolen
Hackers have stolen the personal information of 160,000 current and former University of California-Berkeley students, reports the San Jose Mercury News. Health center records from as far back as 1999 were breached over several months, exposing names, Social Security numbers, immunization histories and other information. Associate Vice Chancellor for Information Technology Shelton Waggener said the thieves got in through the university's Web site. "You should think of it as a public building," he said. "They got into the building properly, but then they broke into secure areas." One law student said: "We're all young people and we don't have a lot of credit established. That's really frightening..."
Full Story

Payments News with Legal Ramifications

Week of May 4th - May 8th

Anti-Money Laundering (AML) Compliance — United States

The Financial Action Task Force (FATF) recently released a white paper on the vulnerabilities of casinos and the gaming industry. (click graphic on left to enlarge)

This APG/FATF report considers casinos with a physical presence and discusses related money laundering and terrorist financing methods, vulnerabilities, indicators to aid detection and deterrence and international information exchange. The report considers vulnerabilities from gaps in domestic implementation of anti-money laundering/ combating the financing of terrorism measures. Online gaming and illegal gambling are beyond the scope of the linked study. The report is 1.20 MB pdf and requires Adobe Acrobat to view. There is a special section that covers credit and debit card usage. I will follow up with a post regarding that section later today...

Anti-Money Laundering Compliance — International
Canadian regulators have stated that financial services firms should maintain their efforts to fight money laundering despite the global recession and intense pressure to reduce expenses, according to an linked article on Investment Executive.

An article at ThisDay reports that the Bank of Tanzania lacks adequate strategies to combat terrorist funding and money laundering activities despite the existence of laws expressly prohibiting such activities in the country.

A French magistrate has recently opened an investigation against the leaders of Gabon, the Republic of Congo and Equatorial Guinea, in relation to a complaint filed by Transparency International, an international watchdog group, regarding investment derived from embezzled funds in property and other goods located in France. Apparently this has given Transparency the legitimacy it needs in order to press other claims against corrupt leaders, wherever they may be in the world.

Asset Forfeiture Watch reports that the U.S. Department of State has released its Country Reports on Terrorism for the year 2008. The overview which was made public last week praised Mexico’s President Felipe Calderón Hinojosa and his administration for demonstrating “an unprecedented commitment to address national security concerns” but criticized Mexico’s recent terrorist financing law for its lack of asset forfeiture provisions.
Identity Theft and Data Security

A feature article on Dark Reading demonstrates how researchers were able to hijack a notorious botnet in January for about 10 days, only to discover that it was even more dangerous than previously thought.

On May 5, 2009, the U.S. Government Accountability Office released a report on cyber threats and vulnerabilities that place federal systems at risk. This was in response to testimony before the Subcommittee on Government Management,
Organization and Procurement of the House Committee on Oversight and Government Reform.

MX Logic has released a new report that alleges the probability that Waledac and Conficker are working together to create a megabotnet, one that will contain tens or hundreds of millions of infected computers worldwide.

An organization that develops technical standards for the financial industry is working to develop a standard for protecting sensitive payment card data in transit as it moves from the point of sale terminal to the payment processor, according to this article on SearchFinancialSecurity.com. The organization in question, Accredited Standards Committee X9 Inc. is based in Annapolis, Maryland and is accredited by the American National Standards Institute. It has developed industry security standards for ATMs and other financial systems.

Digital Transactions Magazine
The May 2009 issue of Digital Transactions magazine is now available online. The magazine is 6.46 MB and requires Adobe Acrobat to view. Some articles that may be of interest include: (1) a field guide to alternative payments systems, (2) how health care payments could be more like retail payments, (3) how financial institutions are prioritizing payments management more cost-efficiently and (4) an in-depth look at how electronic payments are being integrated in mass transit systems across the United States.

Credit Cards
MasterCard Inc. is getting a big boost from The Travelex Group, a multinational distributor of travel-related prepaid cards. Under a recently announced deal, Travelex will convert its payment card network brand to MasterCard and process card transactions on MC’s year-old debit processing platform called Integrated Processing Solutions, or IPS.

Gaming
Spencer Bachus (R-AL), the ranking Republican member on the House Committee on Financial Services released a statement on May 6, 2009 on illegal Internet gambling legislation currently being considered by the House of Representatives.

The following articles and presentations may also be of interest:
* Here is a video presentation by 60 Minutes on the prevalence of such sites;
* Here are two reports each containing writeups that detail investigation on illegal offshore gaming websites.

Supreme Court Cases
By now you may have heard of the Court’s ruling in Flores-Figueroa v. United States (08-108) wherein the issue being argued before the Court was whether an individual who used a false means of identification without knowing it belonged to another person can be convicted of “aggravated identity theft” under 18 USC 1028A(a)(1). You can read the 8th Circ. opinion here, the petition for certiorari here, the brief for the United States here and the petitioner’s reply here. A New York Times article published on October 21, 2008 on this case can be read here.

On Monday, May 4, 2009, the Court issued its opinion in Flores.
The case called upon the Court to resolve a circuit split over the scope of the mens rea requirement in the federal aggravated identity theft statute, 18 U.S.C. A§ 1028A(a)(1), which imposes a mandatory two-year sentence on anyone who, during and in relation to certain predicate offenses, “knowingly transfers, possesses, or uses, without lawful authority, a means of identification of another person.” The Court unanimously agreed with Flores-Figueroa that, to obtain a conviction under A§ 1028A(a)(1), the Government must show that the defendant knew that the “means of identification” he unlawfully transferred, possessed, or used, belonged to a real person.

FDIC Hearing
Here is a formerly live account of the hearing that took place on the morning of May 6, 2009 in front of the Senate Banking Committee.

Witnesses included: FDIC chairperson Sheila Bair, Federal Reserve Bank of Minneapolis President Gary Stern, American Enterprise Institute’s Peter Wallison, University of Chicago Finance Professor Raghuram G. Rajan and The Brookings Institution’s Martin Baily.

You can read Part 1 here and Part 2 here.

Upcoming Legislation

Rep. Barney Frank (D-MA) released a statement on Thursday, May 7, 2009 relating to passage of HR 1728, the Mortgage Reform and Anti-Predatory Lending Act of 2009. The bill was approved by a vote of 300 to 114. A summary of the bill can be viewed here.

In addition, Rep. Frank issued a press release in relation to consideration of HR 2267, the Internet Gambling Regulation, Consumer Protection and Enforcement Act and HR 2266, the Reasonable Prudence in Regulation Act.

The first bill regulates Internet gambling while the second bill delays implementation of regulations pursuant to Unlawful Internet Gambling Enforcement Act of 2006 for one year.

Congressional Hearings/Reports

The Congressional Oversight Panel issued a report entitled “Reviving Lending to Small Businesses and Families and the Impact of TALF” on Thursday, May 7, 2009. This report looks at the state of lending for small businesses and then examines the Term Asset-Backed Securities Loan Facility (TALF), which Treasury and the Federal Reserve established to improve access to credit for families and small businesses by supporting the issuance of asset-backed securities collateralized by credit card loans, student loans, auto loans and loans guaranteed by the Small Business Administration.

Compiled by Stan Santos

After Data Breach Heartland Comes Out Swinging

Heartland Comes Out Swinging After Data Breach - Business Center - PC World

"In the months following the disclosure of what may be the largest data breach in US history, Robert O. Carr, chairman and CEO of Heartland, has come out swinging. Instead of going into a near-death spiral of damage control mitigating the revelation that 100 million customer records leaked during 2008, Carr has been pointing the finger at the payment industry itself for not going far enough with best practices. Heartland has taken advantage of several merchant associations to promote new initiatives that could revolutionize the payment card industry beyond PCI DSS compliance.

Carr has been quite frank when talking about the breach itself, as opposed to the relative silence from TJX after its data breach back in 2007. Heartland said early on that they believed someone placed a listener program in the stream where data in motion was not encrypted. When the Payments Processing Information Sharing Council (PPISC) met for the fist time this week in St. Pete Beach, Florida, Carr took the unusual step of handing out USBs with the malware code found on the Heartland system at the time of their breach as well as malware discovered through other data breach investigations in 2008 and 2009 so other payment processors could look for malware on their own systems. Carr said in his Q1 2009 Earnings Call on Thursday that other industries share security information like this, why can't the card processors?

Additionally, Heartland is in the process of developing a true end-to-end (E2E) encryption solution for its merchants. What's different is that Heartland wants to be the first payment processor to ensure that data remains encrypted all the way from the point of sale through the processing by the card company."

Continue Reading at PC World

The only way for TRUE end-to-end encryption to occur is for Visa and MasterCard to change the way they process transactions entirely. This is probably just a legal maneuver on Heartland's part (MasterCard recently hit them with a multi-million dollar fine) and certainly a PR move.

For example. On Telephone-Order transactions the consumer provides their credit card number and expiration date to the operator. Where's the encryption? For e-commerce the consumer "types" their credit card number, expiration data AND CVV into boxes and presses submit. Where's the encryption? And don't tell me the HTTTPS BS.

The only 3DES End-to-End Encrypted Transaction protected by DUKPT and PCI 2.0 certified solution for eCommerce in the world comes from the engineers at HomeATM. How's that for some PR?

Sunday, May 10, 2009

Torpig: "One of the Most Advanced Pieces of Crimeware ever Created”.’

Banking / Finance News
Source: spamfighter
Complete item: http://www.spamfighter.com/News-12340-Researchers-Took-Control-of-Torpig-Botnet-Stealing-Financial-Data.htm

Description:
Security researchers at the University of California report that they took over a botnet earlier this year (2009) and retained its control for full ten days. During the period, they exposed 70GB of stolen financial data from it that included bank account details and payment card numbers.

According to the researchers, the malware that builds and controls the botnet is known as Torpig, also called Mebroot or Sinowa, a program designed to "track" and collect financial and other personal information from users of Windows computers.

In order to take control of the Torpig botnet, the researchers exploited a flaw in the bots' manner of finding the servers that command-and-control them. Subsequently, they established the domains for the bots to resolve them, after which they established servers to which the bots would link up with to receive the commands. This method was executed for a full ten-day period after which the controllers of Torpig made the system up-to-date and reduced the extent of observation.

While the botnet was under the control of the researchers, nearly 300,000 distinct login data was seized including 56,000 passwords collected over just one hour. In the research, it was discovered that many victims (28%) used personal credentials more than once to access 368,501 websites, helping scammers to easily harvest more information.

Security researchers also reveal that within only those 10 days, Torpig gathered credentials of 8,310 financial accounts from institutions like Capital One, Chase, E*Trade and PayPal among many. Further, almost 40% of the data seized by Torpig was stolen from managers of browser passwords instead of original log-in sessions. Researchers also speculated that the controller of Torpig might have netted $83,000 to $8.3 Million through the exploitation of the stolen credentials.

E-Secure-IT
https://www.e-secure-it.com

What are Trojans?

First, from Wikipedia:
‘Torpig, also known as Sinowal and Mebroot, is a type of Trojan horsewhich can affect computers using Microsoft Windows as their operatingsystem. Torpig turns off anti-virus applications, allows others toaccess the computer, modifies data on the computer, tracks and steals confidentialinformation (such as user passwords) and installs more malware on thevictim’s computer.

As of November 2008 it has been responsible forstealing the details of about 500,000 online bank accounts and creditand debit cards and is described as “one of the most advanced pieces ofcrimeware ever created”.’

The quote, by the way came from a spokesperson at security companyRSA, UK. Wonder what the cybercriminals are working on today...for tomorrow.

Question: What value would "username/ password have to cyberbadmen if bank's didn't use them? What value would being in possession of a card number have if the card had to be swiped to prove its' presence? Therefore, if banks made it mandatory to "swipe your card" and "enter your PIN" then what value would sniffers, trojans, phishers, etc have?

"Card Present 2FA Online Banking" empowered by HomeATM would eliminate the threat of phishing, trojans, botnets, etc.

But first banks need to eliminate "username/ password's" and replace them with Real-Time "Card Present" 2FA. As I stated yesterday... (see previous post) ...two of the three steps are already in place:

1. Banks Issue Card to Cardholder
2. Banks Issue PIN Code to Card Holder
3. Banks Issue our PCI 2.0 Certified PED ($12 or less in quantity)

The benefits to our device DO NOT STOP after log-in. In fact it actually ENABLES the online banking user to more securely pay bills online, transfer money from savings to checking, even transfer money from ANY US Bank Card to ANY OTHER US Bank Card in real time using email. (get in the remittance game) and securely conduct transactions online.

I cannot stress enough how much of a value proposition there is in this for banks. As always, feel free to contact me with any questions, to see a demo or to talk more at length about the benefits of HomeATM's PCI 2.0 Certified Card Present 2FA Online Banking Program.

Saturday, May 9, 2009

Nothing Phishy About PCI 2.0 Certified "Card Present 2FA"

Attn: Banking Institutions: The phishing problem can be immediately solved with "Card Present" Two Factor Authentication. And two of the steps are already in place.

1: Bank issues Card,

2. Bank Issues PIN,

3. Bank Issues HomeATM's iSwipe. ($12.00...less in quantity)

A: Customer Swipes Card

B: Customer Enters PIN.
C: Log-in authenticated, phishing problem solved.

Description:
The growing popularity and success of Internet banking has brought on unprecedented attacks from gangs of well organized cybercriminals, according to AIB today.

For example, the number of phishing attacks on AIB in April 2009 surpassed the total number experienced in the whole of 2008, it said.

Online banking is growing in Ireland with AIB's Internet Banking service showing continued growth with over 570,000 customers (up 18pc) now regularly banking online. The number of transactions completed online also continues to grow strongly (up 27pc) in 2008.

HomeATM eliminates phishing attacks completely because the user MUST authenticate themselves by 1. swiping their bank issued card and 2. entering their bank issued PIN. So even if the phisher obtained the Primary Account Number (PAN) and the Personal Identification Number (PIN) they would still be unable to log-in without physically swiping the card. (Editor's Note: It is highly unlikely anyone could obtain both the PAN and the PIN, I just use that to demonstrate how secure our 2FA log-in is. It's not only two-factor-authentication, it's "card present" 2FA. What the world needs now is "Card Present in a Card Not Present World." It really is that simple. See "Something Phishy About Bank's not Using Card Present 2FA"

Friday, May 8, 2009

CNBC Video: Should Online Gambling be Legal?

Editor's Note: Click the Title of this post, it will refresh and you may leave and/or read some of the comments re: this post.

On the right is a videotaped debate from CNBC on whether legalizing online gambling is a good idea. Sorry about the commercial!

The reason I'm posting it is because I

found it rather entertaining. There's a guy named Les Bernal, (the bald dude)from

Stop Predatory Gambling and

when he's done with his rant, the CNBC announcer actuallykind of makes a little

fun of him,asking him if a PR firm came

up with the name "predatory" gambling

("you make it sound like like "child

porn," he says at one point)

Later he starts questioning his statistics

saying it sounds as if he just made

them up off the top of his head.

When Les (the bald dude) says

he got the statistics from a study done

in Canada, the announcer actually says,

"Avoid Canada Joke Here". Funny stuff.

He then goes on to tell the bald dude

that he's so extreme and that his

"bible toting" is hurting his case.

The only case I can make is that "Les is NOT more." As I said, this is some pretty funny stuff...especially considering it's on CNBC and not YouTube.com

For those unaware, on Wednesday Rep. Barney Frank, D-Mass., introduced a bill to legalizeInternet gambling. I think it's H.R. 2268. Harrah's today said it supports it. So did MGM. Oh, and YouBet.com too. Surprise!Supporters say it could yield billions in taxrevenue, but others say it could raise gambling addiction. What are your views? As always, feel free to comment. Just click the title of this post and the comment box will be at the bottom of the post.

Informal Chit Chat Opens Window for Metavante Acquisition

Informal CEO talks led to Metavante deal

The Business Journal of Milwaukee - by Rich Kirchen

While Fidelity National Information Services initiated formal merger talks with Metavante Technologies Inc., Metavante’s chairman and CEO actually started the conversation by informally contacting Fidelity National’s top executive.

That’s a different perspective on the genesis of the deal than the way it was portrayed April 1, the day both companies disclosed the transaction.

At the time, Don Layden, senior executive vice president of Brown Deer-based Metavante (NYSE: MV), said Metavante executives weren’t looking to sell, but were open to discussing the possibility when Fidelity National approached them about nine months earlier. However, in an interview last week with the Jacksonville (Fla.) Business Journal, Metavante chairman and CEO Frank Martire said he began the conversation with Lee Kennedy, president and CEO of Jacksonville-based Fidelity National.

“I gave Lee a call one day and said it would be interesting to see if there is some synergy” between the two companies, Martire said.

Metavante has agreed to a $3 billion acquisition by Fidelity National (NYSE: FIS) in a deal that is expected to result in the loss of hundreds of jobs as the companies look to cut $260 million in annual costs. Job cuts will be announced within the next two months, Metavante executives said. The company has about 2,700 employees in metro Milwaukee.

Martire told the Jacksonville Business Journal he always admired Fidelity National Information Services as one of his closest competitors. By the end of the year, Martire will move to Jacksonville to run the company from its Jacksonville headquarters. The deal is expected to close in the third quarter.

Metavante spokesman Chip Swearngen said Tuesday that the difference between the Martire and Layden statements is that Martire was discussing an informal initial exploratory contact with Fidelity National and Layden referenced the official contact by Fidelity National that led to the deal.

Continue Reading at Milwaukee Biz Journal

PayPal Blog: New P2P Application for Android

New PayPal Application for Android

Hi blog readers! I’m Eric Duprat from PayPal’s mobile team. For all you Androidlovers out there, we’ve got a special treat for you today. We’ve nowlaunched a PayPal app just for you. This application will give youeasy access to your PayPal account right from your Android phone.
With this application, you’ll get:

Direct integration with the contact list. You won’t need toremember people’s numbers or emails anymore to send them money! Justselect their name from your list of contacts, and we’ll make sure theyget paid.

Recent history. You can use your phone to look at your transactionsover the last couple of months. So if you ever need to check whetheror not a payment has come through, it’ll be simple to find out.

Balance checks. We show you all your balances in any of the currencies you hold.

And, of course, all your mobile payments are kept safe using thesame start-of-the-art technology we use on paypal.com. So, if you havean Android phone, visit the Android Market to download the app and try it out. Let us know what you think!
Update 5/6/09: Just to clarify, here is how you can download the PayPal Android Application on your G1 phone:

Click on the Android Market
Search for “PayPal” (or scroll through the finance category)
Click install

This entry was posted on Wednesday, May 6th, 2009 at 10:12 am and is filed under Innovation at PayPal. You can leave a comment, or trackback from your own site.

Web Retailers Increase Quarterly Web Sales

From: IRNewsLink (click to enlarge pic)

Web retailers increase their quarterly web sales

Even in the current recession, people are still shopping online and more so than one year ago. The combined web sales of 13 retailers that broke out quarterly web sales in early April through early May increased year over year by 14.1% to $6.15 billion from $5.39 billion. Six web retailers posted quarterly gains year over year in e-commerce sales while seven others showed a decrease. Amazon.com continued to show its outsized influence on the web retailing market by posting an 18.4% increase in Q1 2009 web sales to $4.89 billion from $4.13 billion in the first quarter of 2008. Without Amazon, the remaining 12 retailers increased their quarterly sales year over year by 0.2% to $1.267 billion from $1.264 billion. Six other web retailers also finished out 2008 with higher e-commerce sales, increasing their combined total by 11.2% to $1.39 billion in 2008 from $1.25 billion in 2007.

Show Me Your ATM Card

PNC Bank has signed a banking contract with Marymount University, marking its first university deal in the Washington, D.C. area.
Under the five-year contract, the university’s 3,600 students and more than 400 employees will get access to PNC’s personal banking products and services.

Marymount users will have the option of tying their school ID card to PNC accounts to make it an ATM card, as well.

“The partnership with PNC Bank will...enable parents to transfer funds easily to their student’s account and provide students, faculty, and staff with easy access to financial services,” said a spokeswoman for Marymount.

The Washington Business Journal is a sister publication to the Pittsburgh Business Times.

Prey: It Does Happen (Bait and Switch)

Students Become Prey for Cards Charging 18% After Free Lunch - Bloomberg.com

Irena Cabrilo got a free lunch during her freshman year at the University of North Texas in exchange for signing up for a credit card from Bank of America Corp. Eight months later, she was carrying a $1,500 balance and struggling to pay an 18 percent interest rate.

“They made it sound so easy,” said Cabrilo, now a senior majoring in marketing and advertising. “Just sign up, you’ll get approved and have access to money. They don’t talk about interest rates and what will happen to your credit history.”

Average credit-card debt among graduating college seniors increased to more than $4,100 last year from $2,900 in 2004, according to a study by SLM Corp.

Editor's Note: The worst part is that of the $4100, usually more than half ($2000) was put on the card when the interest rate was low (2.9% for example) then suddenly it becomes 18%. If that's not a classic case of "bait and switch" I don't know what is.

About 85 percent of students have at least one credit card, according to the study, conducted every four years by Reston, Virginia-based SLM, also known as Sallie Mae, the largest lender to U.S. students.

Continue Reading at Bloomberg.com

Underbanked Financial Services Forum: June 1st-3rd Dallas

The 4th Annual Underbanked Financial Services Forum presented with the Center for Financial Services Innovation will be held this year June 1-3 in Dallas, TX at The Westin Galleria.

This year's forum will be exploring multiple perspectives on serving the underbanked in today's climate. As awareness of the potential value and demographic diversity of the underbanked market continues to grow, the Underbanked Financial Services Forum remains the best single place to learn from and connect with the people transforming the financial services landscape.

* Understand the attitudes, needs and behaviors of the underbanked
* Learn innovative ideas for these challenging times
* Gain further insight on the global perspective

Back by popular demand...

Underbanked Xtreme Networking is back by popular demand! Borrowed from the idea of speed dating, this networking event delivers an accelerated meet and exchange between industry leaders and innovators. Pre-register before the event to receive an optimized schedule tailored to fit your specific networking needs.

Who are the underbanked?

Since 2006, this annual gathering has become the premier event for players across the financial services spectrum:

* Financial institutions and credit unions
* Technology and service companies
* Retailers and other providers
* Nonprofit organizations
* Government agencies

Get the latest information from industry experts and case studies from on the ground and across the globe on the best strategies and offerings to achieve profitable growth and long-term success.

REGISTER EARLY & SAVE!

*offer valid for new registrations only and cannot be combined with any other offers

Data Sniffing Costs Heartland Bigtime

Source: The Register
Complete item: http://www.theregister.co.uk/2009/05/07/heartland_breach_costs/

Description:
Electronic payments processor Heartland Payment Systems said Thursday it has allocated $12.6m to cover a security breach that exposed sensitive card holder data crossing its network.

More than half that amount involves a fine MasterCard has assessed banks that did business with Heartland, said company CEO Robert Carr, according to this conference-call transcript. The remainder covers legal costs and other expenses related to the breach, which was discovered in January.

Carr said the company plans to roll out a new security system designed to encrypt payment card transactions from their point of origin with merchants to their final destination with the card issuers. The mechanism would go well beyond so-called PCI DSS, or payment card industry data security standards, which are mandated on merchants, processors, and banks that work with credit and debit cards. Heartland is still working with card companies such as Visa and MasterCard to see if they will be able to accept the encrypted data.

Currently, the vast majority of transactions transmit data that is sent in the clear, except for personal identification numbers.

"We are in a cyber crimes arms race, and we need to stay ahead of the bad guys who never rest and do not call committee meetings to update their malicious tools and attack vectors," Carr said.

Heartland hopes to put the system in place by the third quarter, a time line that may be overly optimistic. That's because there are a lot of players in the payment card industry, and for the system to work, each will have to upgrade their equipment to deploy the new mechanism.

"For this to really be effective, the banks need to participate and so do Visa and MasterCard and American Express," said Avivah Litan, a security analyst with Gartner. Right now, a small number of processors offer end-to-end encryption, but none of them are among the top 10 players, she said. Editor's Note: Buy we try harder!

The breach occurred when criminal hackers managed to sneak malware onto Heartland's network that sniffed card data that was stored there. The company has yet to provide basic details about the intrusion including how long it lasted, how the software was able to penetrate the company's defenses or how many cards were intercepted. At least 160 banks in the US, Canada, Guam, and elsewhere have been affected, the BankInfoSecurity.com news portal said in February.

Besides expenses in excess of $12m, the breach has been costly to Heartland in other ways. Among other things, it has distracted company employees and been used as a scare tactic by competitors, who tell Heartland customers they could be held liable if they continue to use the processor, Carr said. (The claims are false, he added).

It also likely played a role in Heartland being removed from Visa's list of processors that are in good standing with industry-mandated standards for data security. Heartland late last week was reinstated.

Given all the pain, it's understandable Heartland wants to put the breach behind. And that means moving to beyond PCI DSS, which many security experts say is insufficient to protect card data.

Heartland executives "don't want to wait until the industry figures this out," said Gartner's Litan. "They're pushing the industry into this encryption."

E-Secure-IT
https://www.e-secure-it.com

Monday, May 11, 2009

Sunday, May 10, 2009

What are Trojans?

Saturday, May 9, 2009

Friday, May 8, 2009

Disqus for ePayment News