CEO Capellas accepted 2009 Freedom Award in Washington, D.C.
ATLANTA - PIN Payments News Blog - SEPT. 17, 2009 - First Data Chairman and CEO Michael Capellas was presented with the 2009 Secretary of Defense Employer Support Freedom Award today at the annual awards banquet in Washington, D.C.
The award is the highest recognition given by the U.S. Government to employers for outstanding support shown to their employees who serve in the National Guard and Reserve. Editor's Note: KUDOS to First Data!
Rob Lawrence, Director of Vendor Relationship Management at First Data and Command Sgt. Maj. for the Colorado National Guard, nominated First Data for its efforts to support the National Guard and other military employees.
Capellas said, "I am honored to accept the Freedom Award on behalf of First Data's 26,000 employees worldwide. We are extremely proud to support our employees who serve in the National Guard and Reserves. They demonstrate their dedication every day whether it is serving our country or our company."
First Data offers a variety of benefits to employees and their families during military deployment. Some of these include providing differential pay between military pay and First Data salary and continuing family medical and life insurance benefits. Lawrence also cites Capellas' efforts to personally contact families of deployed service members as well as employees' activities such as sending care packages to deployed troops during the holidays and volunteering at local Veterans Hospitals.
"First Data has supported me since 1982 through an active duty leave of absence, three combat tours and more than 20 annual training periods," said Lawrence. "By nearly every measure, this company has gone to extraordinary lengths to support their guardsmen and reservists and their families."
The Freedom Award was instituted in 1996 under the auspices of the National Committee for Employer Support of the Guard and Reserve (ESGR) to recognize exceptional support from the employer community. More than 3,200 National Guard and Reserve members or their family members from across the country nominated their employers for the Award this year.
"In the eight years our nation has been at war, America's employers - almost universally - have done an outstanding job of supporting their Citizen Warrior employees," said Dennis M. McCarthy, Assistant Secretary of Defense for Reserve Affairs. "These fifteen employers are the 'best of the best' this year. They reflect the powerful synergy that exists between the men and women of the National Guard and Reserve, and their employers."
In the past, First Data also has received numerous Patriot Awards and the Pro Patria Award, including several awarded this year.
About First Data
First Data powers the global economy by making it easy, fast and secure for people and businesses to buy goods and services using virtually any form of electronic payment. Whether the choice of payment is a gift card, a credit, debit card or a check, First Data securely processes the transaction and harnesses the power of the data to deliver intelligence and insight for millions of merchant locations and thousands of card issuers in 36 countries. For more information, visit www.firstdata.com.
About ESGR
Employer Support of the Guard and Reserve (ESGR) is a Department of Defense agency established in 1972 that seeks to promote a culture in which all American employers support and value the military service of their employees. ESGR recognizes outstanding support, increases awareness of the law, and resolves conflicts through mediation. More information is available at www.esgr.mil.
Consumers to Retailers: Don't Make Us Pay Your Business Costs
Source: Visa Press Release: San Francisco, Sept. 17, 2009 -PIN Payments News Blog- Consumers believe retailers benefit far more from accepting credit and debit cards than they pay in costs, according to a new survey released today by Visa Inc. The survey also finds that consumers believe merchants see card cost acceptance as a part of doing business, much like paying for utilities such as electricity.
Retailers and their well-funded trade associations have filed lawsuits and are aggressively lobbying Congress to allow them to shift their business costs to consumers by allowing merchants to charge checkout fees whenever consumers use credit or debit cards. At the same time, national convenience store chains have launched misleading, in-store petition campaigns to cover for their checkout fee efforts.
"The response is loud and clear: consumers aren't buying the message convenience store chains and big retailers are selling," said Bill Sheedy, group president of the Americas for Visa Inc. "This research demonstrates that consumers are well aware that legislation is a Trojan horse that likely will lead to higher prices for cardholders while retailers pocket the savings."
Among the survey's findings:
By a 2-to-1 margin, consumers say retailers should pay the cost of accepting credit and debit cards.
78 percent of consumers believe the value and benefits retailers receive from accepting credit and debit cards outweigh the costs of accepting them.
83 percent of those surveyed believe that any savings retailers realize will be used to increase their own bottom lines and will not be passed on to consumers.
91 percent of consumers say they are more likely to shop at stores that accept credit and debit cards.
The research shows consumers understand that retailers benefit greatly from electronic payments whether it is through guaranteed payment, increased security, acceptance, innovation or even store-brand cards that help build customer loyalty.
"Retailers want the best of both worlds - the benefits of card acceptance without paying the costs," Sheedy added. "This research shows that retailers who are campaigning for checkout fees or uneven legislative schemes that shift the cost of doing business onto the backs of consumers are risking a customer backlash."
Currently ten states protect consumers from card checkout fees, also known as surcharging, and Visa has rules that prohibit retailers from penalizing consumers who use their branded credit, debit or prepaid cards. Unfortunately, a number of retailers are seeking to evade Visa rules and state laws by attempting to shift their cost of doing business onto consumers who use electronic payments through checkout fees.
DON'T PAY ADDITIONAL FEES AT CHECKOUT
Look for posted signs in stores (generally at the checkout counter) that advertise an extra fee for using a credit or debit card.
Check store receipts carefully for card checkout fees. They often appear after taxes on receipts, sometimes next to obscure descriptions.
Tell the checkout clerk or store manager that charging a checkout fee for using a credit or debit card is not permitted.
If cardholders experience a retailer who is charging checkout fees, they should call their card issuer (by calling the number on the back of their card) and provide the customer service representative with the name and location of the retailer.
Consumers who are subjected to payment card checkout fees in states where they are protected by law may report the retailer to their state attorney general's office.
About the Survey
The nationally representative telephone survey of 1,000 adult consumers was conducted by Fabrizio, McLaughlin & Associates from July 20-23, 2009 and has a margin of error of +/-3.1 percent at the 95 percent confidence level.
About Visa
Visa operates the world's largest retail electronic payments network providing processing services and payment product platforms. This includes consumer credit, debit, prepaid and commercial payments, which are offered under the Visa, Visa Electron, Interlink and PLUS brands. Visa enjoys unsurpassed acceptance around the world and Visa/PLUS is one of the world's largest global ATM networks, offering cash access in local currency in more than 170 countries. For more information, visit www.corporate.visa.com .
Discover Financial Services' (DFS) fiscal third-quarter earnings more than tripled on payments from an antitrust settlement along with a 14% drop in costs.
Meanwhile, the credit-card company saw charge-offs rise while 90-day delinquencies showed a rare pullback from the prior quarter.
Shares recently rose 4.37% premarket to $15.99. Having doubled from a low in March, the stock is down 12% from a year earlier through Wednesday's close.
The credit-card industry is reeling from credit losses as the recession pushes the U.S. unemployment rate to its highest level in a quarter century. Hoping to offset those problems, Discover has cut jobs and marketing spending.
For the quarter ended Aug 31, the company posted a profit of $577.5 million, or $1.07 a share, compared with a profit of $180.1 million, or 37 cents a share, a year earlier. The latest quarter included $287 million from the antitrust deal with Visa Inc. (V) and MasterCard Inc. (MA). Payments will continue for several more quarters.
Pretax earnings at the company's U.S. card segment more than tripled to $913 million amid the antitrust gain. On a managed basis, which includes securitized loans still managed, Discover's loan-loss provision was $924.4 million, down 17% from the previous quarter and up 23% from the prior year.
Charge-offs rose to 8.39% from 7.79% and 5.2%, respectively and the 30-day delinquency rate rose to 5.1% from 5.08% and 3.85%. However, the 90-day rate slipped to 2.6% from 2.73% last quarter, although it was up from 1.88% a year ago. A slowdown in credit-card delinquencies will likely encourage investors that late payments and write-offs will be reaching their peak soon.
Credit-card sales volume declined 7%, highlighting continued cutbacks in consumer spending.
In June, Fitch Ratings lowered Discover's individual rating, an assessment of intrinsic creditworthiness excluding any external support. By becoming a bank-holding company, Discover got $1.2 billion in funds under the Troubled Asset Relief Program; it hasn't said when it will pay the money back, but may use some funds from a $500 million stock offering in July.
-By Joan E. Solsman, Dow Jones Newswires; 212-416-2291; joan.solsman@dowjones.com
Websense revealed the findings from its bi-annual research report. Its security labs identified a 233 percent growth in the number of malicious sites in the last six months and 671 percent growth in the number of malicious sites during the last year.
In the first half of 2009, 77 percent of Web sites with malicious code are legitimate sites that have been compromised. This high percentage was maintained over the past six months due in part to widespread attacks including Gumblar, Beladen and Nine Ball which aimed to compromise trusted and known Web properties with massive injection campaigns.
According to the report, efforts to self police Web 2.0 properties have been largely ineffective...
Websense Security Labs report - State of Internet Security, Q1-Q2 2009
The first half of 2009 saw a number of big exploits and an escalation of attacks using the dynamic elements of popular Web 2.0 sites to infect users’ computers and perpetrate fraud. Additionally, the Websense Security Labs found a massive increase in the number of malicious sites which increased 233 percent over the six month period.
Attackers continued to use blended threats (spam emails with embedded URLs) to lure victims to spam and malicious Web sites with 85.6 percent of all unwanted emails in circulation during this period containing links to spam sites and/or malicious Web sites. The rise of blended threats illustrates that Web security intelligence is a critical component of any email and data security strategy.
Today’s threats are leading to the Web, whether as the vector of the attack or simply the route in which stolen, confidential data is transmitted. Further underscoring the growth of the Web as the primary threat vector, during the first half of 2009 Websense Security Labs discovered:
- 233% growth in the number of malicious sites in the last six months and a 671% growth during the last year.
- 77% of Web sites with malicious code are legitimate sites that have been compromised.
- 95% of comments to blogs, chat rooms and message boards are spam or malicious.
- 57% of data-stealing attacks are conducted over the Web.
- 85.6% of all unwanted emails in circulation contained links to spam sites and/or malicious Web sites.
These discoveries, along with details on other exploits and analysis of Web, email and data security trends during the first half of 2009 are explored in the Websense Security Labs “State of Internet Security” report.
Microsoft Announces Next-Generation Financial Messaging Solution to Simplify Payments Processing and Integration to SWIFTNet
New Microsoft offering lowers the cost of messaging for corporate treasuries and financial services firms.
HONG KONG, Sept. 17 /PRNewswire-FirstCall/ -- Microsoft Corp. today announced the Financial Messaging Service Bus, a componentized financial services industry integration solution built upon the highly acclaimed Microsoft BizTalk Server 2009. By providing pre-built service components, the Financial Messaging Service Bus simplifies mission-critical financial messaging for banks, payments processors and other financial institutions, and provides a solution platform for Microsoft technology partners. The Financial Messaging Service Bus not only applies to SWIFT or payments, but is extensible across all financial messaging systems as an integration framework allowing new solutions to be built and to co-exist with legacy applications as part of a technology renewal program. The Financial Messaging Service Bus supports Microsoft BizTalk Accelerator for SWIFT, which has been awarded the SWIFTReady Financial EAI 2009 label -- thereby achieving six consecutive years of SWIFT certification. The announcement was made at SWIFT's Sibos 2009, the industry's premier global financial services forum.
The Financial Messaging Service Bus cuts the cost of development, and speeds up the implementation process by providing reusable service-oriented architecture (SOA) components to simplify financial messaging integration, rather than requiring extensive onsite process engineering. It saves financial services industry clients and technology solutions partners substantial time and money in building and implementing payments and capital markets solutions.
"Financial messaging and integration are becoming commoditized -- and should be," said Andy Schmidt, research director for Global Payments at TowerGroup. "Banks need a simpler, more cost-effective way to re-engineer payments processes but should be ensuring that they don't reinforce silos. There is a real need to use out-of-the-box components that reduce the complexity of integration, and that both build on and with existing technology, to avoid building costly technology islands."
The Financial Messaging Service Bus utilizes the Microsoft BizTalk Server Enterprise Service Bus (ESB) Toolkit for data transformation and transaction workflow management, and extends the standard ESB to add audit trail and business activity monitoring specific to financial services. Furthermore, Financial Messaging Service Bus components can be integrated easily with Microsoft Office products, including Excel and SharePoint, for a complete operations management and business intelligence solution.
Financial messaging is the cornerstone for technology renewal in banks and other financial services firms," said Susan Hauser, vice president of Worldwide Financial Services at Microsoft. "Secure and reliable transaction delivery is essential to financial services firms, but technology solutions must also be cost-effective to implement and manage. Our long-standing partnership with SWIFT, and our commitment to support technology partners, uniquely positions us to provide these reliable and cost-effective solutions to all financial institutions."
In the past year Microsoft has added BizTalk Server support for Alliance Lite, thereby enabling SWIFTNet connectivity across the Internet.
"This new Microsoft financial messaging solution offering underscores the continuing strength of our global partnership," said Gottfried Leibbrandt, head of markets for SWIFT. "With this announcement, Microsoft demonstrates its continuing commitment to SWIFT clients and the global financial services community."
"Financial messaging is the basis for interoperability among banks in the global financial services community," said Darrell Cavens, director for BizTalk Server at Microsoft. "Microsoft is pleased to advance its relationship with SWIFT to bring world-class products to an industry that demands mission-critical, standards-based solutions."
The Financial Messaging Service Bus is currently available to all customers through select Microsoft financial services community partners. Zlatko Jegdic, eBusiness director of Saga, a longstanding partner of Microsoft in Europe, commented, "As a Gold Certified Microsoft partner, we look to leverage the technology stack for client solutions. The components delivered with the Financial Messaging Service Bus allow us to allocate more resources to developing value-add solution functionality and spend less time on messaging integration for our clients."
"Customers can lower the cost of financial messaging by simplifying the way payments processes are developed," said Andy Orent, director, Banking and Capital Markets, Financial Services Industry, HP. "Microsoft's platform aligns with HP's payments architecture, known as Integration Framework for Payments (IF4P), which allows customers to help manage cost and accelerate growth."
Financial messaging is a commodity service within payments and capital markets processing, and the Financial Messaging Service Bus is designed to provide a simpler, configurable approach to messaging that delivers significant implementation and operational efficiencies for financial institutions.
"One consistent challenge we see across the securities industry is streamlining the workflow and mapping between FIX and SWIFT messages," said Kevin Houstoun, chairman of Rapid Addition Ltd. and co-chairman of the Global Technical Committee for FIX Protocol Ltd. "Technology such as Microsoft's Financial Messaging Service Bus middleware and Rapid Addition's FIX Shortcut for Financial Messaging Service Bus holds great promise in overcoming this challenge, as it allows banks and brokers to automate these processes at a lower total cost than traditional software."
With the Financial Messaging Service Bus, Microsoft addresses the need for a systemic approach to messaging integration across the financial services industry. As a result, banks now can further leverage an investment in BizTalk Server as an infrastructure for payments and SWIFT messaging -- and extend that to support new financial applications in any geographic location.
Microsoft's Financial Messaging Service Bus delivers a number of benefits that lower the cost of messaging for corporate treasuries and financial services firms:
By providing pre-built service components, Financial Messaging Service Bus simplifies mission-critical financial messaging for banks, payments processors and other financial institutions, and provides a solution platform for Microsoft technology partners.
Financial Messaging Service Bus leverages the BizTalk Enterprise Service Bus (ESB) Toolkit data transformation and transaction workflow management, and extends the standard ESB to add audit trail and business activity monitoring specific to financial services.
Financial Messaging Service Bus greatly improves time to market for many complex solutions in the banking and capital markets industries.
Although applicable in many financial messaging scenarios, one key area is simplifying the integration to SWIFT for payment and FIX applications.
Microsoft's Financial Services Group provides software that helps financial firms transform the customer, employee and operations experience so they can maximize opportunities for increased market share and profitability. Microsoft software helps empower people and IT staff within financial firms -- and across key focus areas such as advisor platforms, channel renewal, insurance value chain, enterprise risk management and compliance, and payments. Through a combination of Microsoft- and partner-provided solutions, customers enable their employees to turn data into insight, transform ideas into action and turn change into opportunity. More information about Microsoft's Financial Services Group can be found at http://www.microsoft.com/financialservices.
About Microsoft
Founded in 1975, Microsoft (NASDAQ:MSFT) is the worldwide leader in software, services and solutions that help people and businesses realize their full potential.
Supports financial institutions in commercial rollout of mobile NFC payment services
Amsterdam, The Netherlands and Taipei, Taiwan, September 17, 2009 – PIN Payments News Blog - Gemalto, the world leader in digital security, today announced it has achieved MasterCard certification for its TSM (Trusted Services Management) offer. The achievement demonstrates Gemalto’s readiness for supporting commercial launches of mobile contactless payment programs, according to MasterCard’s security requirements. This certification immediately applies to Gemalto’s Taiwan-based data center and enables the company to support financial institutions in the deployment of their Near Field Communications (NFC) services on mobile phones. NFC technology is the wireless connectivity standard endorsed by the industry for data transfer over the mobile phone.
Gemalto's services allow for the secure deployment and management of contactless mobile payment. The certification establishes that MasterCard recognizes and endorses the company’s ability to manage personal user information for banking transactions. For financial institutions, this is assurance that they can rollout their payment services on mobile phones with the highest level of security and data confidentiality.
“MasterCard works alongside vendors to offer secure NFC payment solutions to its issuing banks,” commented Andrew Smith, vice president, Mobile Center of Excellence, Asia/Pacific, Middle East & Africa, MasterCard Worldwide. “We are pleased to collaborate with technological enablers like Gemalto that will allow financial institutions to rollout NFC MasterCard® PayPass™ mobile services safely, adding ease to Taiwanese consumers’ fast-paced lifestyles and spurring the growth of contactless payments in the market.”
“The role of the Trusted Services Manager is to provide independent, secure channels for service providers to conveniently engage their customer base into the mobile world,” added Tan Teck Lee, president of Gemalto Asia. “It is a role built on security, interoperability and trust, which facilitates business between mobile network operators and service providers. We are very proud to receive this certification from MasterCard, which acknowledges Gemalto’s ability to fulfill this role.”
About Gemalto
Gemalto (Euronext NL 0000400653 GTO) is the world leader in digital security with 2008 annual revenues of €1.68 billion, and 10,000 employees operating out of 75 offices, research and service centers in 40 countries.
Gemalto is at the heart of our evolving digital society. The freedom to communicate, travel, shop, bank, entertain, and work—anytime, anywhere—has become an integral part of what people want and expect, in ways that are convenient, enjoyable and secure.
Gemalto delivers on the growing demands of billions of people worldwide for mobile connectivity, identity and data protection, credit card safety, health and transportation services, e-government and national security. We do this by supplying to governments, wireless operators, banks and enterprises a wide range of secure personal devices, such as subscriber identification modules (SIM), Universal Identity Circuit Cards (UICC) in mobile phones, smart banking cards, smart card access badges, electronic passports, and USB tokens for online identity protection. To complete the solution we also provide software, systems and services to help our customers achieve their goals. As the use of Gemalto’s software and secure devices increases with the number of people interacting in the digital and wireless world, the company is poised to thrive over the coming years.
The International Payments Framework (IPF), an industry group aiming to simplify cross-border payments, is set to go live with the first stage of its payments plan in January 2010.
Once live, the framework will connect the payment processes of Federal Reserve Banks in the US and IPF member banks in Europe through the use of a transfer protocol based on the ISO20022 standard. The resulting link between domestic and international ACH systems will make it possibel to send pounds sterling to GBP accounts and USD dollars to USD or euro accounts help in Europe...
The International Payments Framework (IPF) provides rules, standards, operating procedures, and guidelines to improve cross-border payments. And because globalization is driving a broader base of clients who demand a more cost-effective, less complex, and more certain payment service with a wider reach, standardization is more important than ever.
In 3 to 5 years, this membership driven organization is expected to enable multi-currency, non-urgent payments to any other member organization; whether through a clearing and settlement mechanism or directly through member banks, utilizing the same standardized process and operating procedures. This will allow member organizations to offer their clients payments to new countries and/or currencies in a quick and efficient manner, lowering processing costs and eliminating the complexities in international non-urgent payments.
Education is the key to protecting yourself against employee deception, identity theft and phishing attacks. All of these attack vectors are widely used by malicious social engineers.
Brooklyn, PA (PRWEB) September, 2009 - Social Engineering is defined as the manipulation and deceiving of people into giving up valuable information.
Education is the key to protecting yourself against employee deception, identity theft and phishing attacks.
As security technologies advance, malicious hackers are turning to social engineering as it often provides the path of least resistance to their victims. Malicious social engineers will employ phishing, telephone attacks, as well as dumpster diving and physical security attacks to infiltrate their targets. A recent report by Symantec indicates a 52% increase in phishing attacks in the month of July 2009 alone.
As a countermeasure, a community of experts have come together to build the webs first solid framework for social engineering. These experts come from industries such as deception detection, neuro-linguistic programming, psychology, government officials, penetration testing and professional social engineers.
A lack of awareness is the main reason social engineering attacks are so successful. Social-engineer.org aims to create a cornerstone of the Internet for people to learn about social engineering and how to identify, avoid and protect themselves from such attacks. In today's economy, protection from social engineering attacks is of vital importance. According to Gartner, in 2007, $3.2 billion dollars were lost in phishing attacks alone.
The social-engineer.org website hosts a multitude of educational materials including tools, scripts, videos and podcasts to help keep the community and those interested informed. The monthly featured podcasts will feature different aspects of social engineering, ranging from interrogation tactics, micro expressions, deception detection, penetration testing, pretexting and more.
Social Engineer.org has joined forces with sponsors like John E. Reid and Company, Humintell, Offensive Security and many more to provide the most up-to-date and cutting edge information on all aspects of social engineering.
Chris Nickerson, famous for his social engineering endeavors as well as his role on the TV Show Tiger Team, said, "Social-Engineer.org (www.social-engineer.org) is a living, breathing entity that will keep on growing...."
About social-engineer.org
social-engineer.org is a online security community that provides an educational framework for those who can use social engineering in their life, work or hobbies. It is headed up by Chris Hadnagy, Jim O'Gorman and Mati Aharoni but backed up by a strong community of professionals who have devoted countless hours and talent to make this happen. Visit the social engineering website at social-engineer.org and get protected today.
The number of people buying products online will grow by more than five million between 2009 and 2013, according to digital intelligence group eMarketer.
Perhaps highlighting the importance of being optimized online, the firm expects that the number of online buyers in 2013 will total 31.8 million.
Developing strong e-marketing strategies and working on search engine optimization(SEO) could benefit companies which want to tap into this growing internet-based consumer market.
Meanwhile, eMarketer states that some 72.5 per cent of UK internet users will purchase at least one item via the web in 2009.
Karin von Abrams, senior analyst at the digital intelligence group and author of the report UK E-Commerce: Fighting the Downturn, claims: "The growing ranks of online buyers are prompting many UK [e-retailers] to raise their game ... despite pressure on budgets."
Search engines remain the best source of traffic for ecommerce websites, according to Screen Pages, which indicated that 63 per cent of traffic came through this route between January and June 2009.
"49% of consumers across eight countries would consider switching or definitely switch banks if theyorsomeone they knew was hit by card fraud"
I'd say it's time for banks to ditch the username/password/20 questions game and start "genuinely" authenticating online banking sessions by requiring users to swipe their card and enter their PIN. You know, the same way their customers access cash at an ATM.
The current system benefits only the bad guys.
Banks cannot continue on their current path. Asking questions such as: What's your mother's maiden name,
What's the make of your first car, What is the First Letter of the Middle Initial of your Second dog...all that kinda stuff, is not secure...it's either accessible at social networking sites or available by simple keylogging schemes.
But converting customers to Swiping vs. Typing, that's genuine authentication. Especially the way HomeATM instantaneously encrypts the cardholder data. Financial institutions would enhance their image by providing their customers with an encryption enabled online banking log-in. There's proof of this. Look to Barclays who has already distributed well over a million of their PINSentry devices.
It's not a coincidence that Barclays bank was recently rated #1 for providing the most secure online banking application in the U.K. Why? Because they require their online banking customers to use their PINSentry device for two-factor authentication.
"Barclays was the only one of the 10 banks surveyed to get a rating of 'excellent'. The company requires all its online customers to use a "two-factor authentication" (2FA) system involving a PINsentry device which generates a one-time password for each session".
"HomeATM is far more useful than the PINSentry device. It provides not only two-factor authentication log-in, but it does it without generating a one-time password (OTP) which have been recently exposed as hackable. Once the PINSentry device authenticates the user, it's usefulness is done until the next time the user logs in...whereas with HomeATM's device, logging in is only the beginning of what it enables the consumer to do.
Our Slim or SafeTPIN device can be further utilized for online bill payments, (online bill payment customers increase bank profitability by 15%...google it) person to person money transfers (in real time) secure Internet End-to-End Encrypted Card Present transactions, peace of mind, loyalty, image and brand enhancement and so much more.
So the bottomline is: Would banks prefer risking the loss of 49% of their customers, or would they prefer to provide their customers with a free PCI 2.x Certified PED along with the peace of mind, safety and security of a 2FA 3DES E2EE PCI 2.x "certified" (not compliant, certified) solution which their customers can use in the privacy of their own home. Hmmmm.....
A recent survey by ACI Worldwide of consumers around the world found that one in five have been hit by debit or credit card fraud in past five years. The research, of more than 2,400 consumers across eight countries, also found that if an individual or someone they knew was hit by card fraud:
22 per cent would change financial institutions, and a further
27 per cent would "consider" changing financial institutions.
Jill Aitoro writes that without International cooperation, the war against cybercrime, is in essence, a losing battle...
Outlook dim for international cooperation to fight cyber attacksBy Jill R. Aitoro
Protecting sensitive computer systems and networks from cyberattack requires international standards, but limited experience with Internet crime in developing countries and a reluctance from some nations to participate have stalled cooperation, said a panel of security experts on Monday.
"It's one grid, one global network, and we're all stuck in the same boat," said James Lewis, director of the technology and public policy program at the Center for Strategic and International Studies. "We need to establish some rules."
President Obama's cybersecurity plan, released in May, stated that "the United States needs to develop a strategy . . . to shape the international environment and bring like-minded nations together on a host of issues, including acceptable norms regarding territorial jurisdiction, sovereign responsibility and use of force." The plan also included among its 10 near-term priorities the development of a framework for international cybersecurity policy.
The obstacle, however, is convincing countries to cooperate with the international effort, including the prosecution of cybercriminals...
The NACS (National Association of Convenience Stores) is in the midst of it's battle over high interchange fees. As part of their ongoing PR program to fight these fees, they use Aldi as a poster boy...saying they never did take credit cards, and only accept PIN Debit Cards. Here's their story:
Nearly all of the grocer’s locations accept only cash and PIN debit cards.
September 16 - NACS - BATAVIA, Ill. – When most supermarket chains started accepting credit cards in the 1990s, Aldi stood firm. With around U.S. 1,000 stores in 29 states, the grocery chain mostly accepts only cash and PIN-based debit card transactions, Digital Transactions reports.
The only exception is a group of 49 stores in Oklahoma that accept the Discover credit card, charging customers a quarter “convenience” fee for the privilege. “We have no plans to expand that,” said Aldi Vice President Mark Bersted.
Aldi refuses to take credit cards to control costs, given that retailers have to pay interchange fees to process credit card charges. PIN-based debit cards do not have as high a fee associated with it.
“People not using credit cards would be paying for people who do want to use them,” said Bersted. “Because of the very high fees with credit cards, we would be unable to keep our prices as low as they are.” Visa and MasterCard have made it virtually impossible for merchants to add a surcharge to credit-card transactions, but Discover and American Express Co. have been a bit more flexible in allowing retailers to recoup some of the interchange fees. Last year, Aldi started allowing payments with Visa and MasterCard signature debit cards at its stores in Florida, Minnesota and Oklahoma because of the underdeveloped PIN-debit merchant base, Bersted said.
LAS VEGAS, NV -- (Marketwire) -- 09/15/09 -- Shift4 Corporation, a leading developer of enterprise payment solutions, reports strong increase in merchant demand for Card Information Replacement Technology(SM) (CIRT).
Shift4's DOLLARS ON THE NET(TM) payment gateway is fully integrated with CIRT to deliver fast, reliable and secure electronic transactions for merchants of all sizes while greatly simplifying PCI Compliance.
"Shift4 is pleased and encouraged to see others in the payments industry introducing new technologies that may hold the promise of protecting cardholder data (CHD) throughout the entire transaction lifecycle. The market is showing strong demand for technologies that remove sensitive cardholder data from the merchant's payment system and replace it with something that merely represents the real numbers. At this critical point in the vetting of these new technologies, it is essential that merchants seek out and understand the differences between true tokenization and other offerings, which may be called tokenization but are in fact, encryption. Shift4 has been providing true tokenization to our merchants since 2005," said Dave Oder, President and CEO, Shift4 Corporation.
Card Information Replacement Technologies from Shift4 include: 4Go SafeSwipe(TM), i4Go(TM), and tokenization. These offerings safeguard the merchant payment environment by removing and replacing sensitive CHD from the payment process before it enters the Point-of-Sale (POS) system, Property Management System (PMS), or in the world of the Internet, the merchant's site or hosting provider's environment. CIRT simplifies the process of securing sensitive information by preventing it from being stored, processed, or transmitted in the merchant environment, which greatly reduces the cost and complexity of Payment Card Industry (PCI) compliance. Essentially, merchants utilizing CIRT are much more likely to be able to achieve and maintain a state of PCI compliance while concurrently removing all cardholder data from their payment environment.
"As the industry continues to acknowledge and adopt technologies that address Real Security issues, it is important to understand the differences between true tokenization and offerings that are tokenization in name only. There are a lot of adaptations that use the name only but are, in fact, various encryption key handlers, hashing schemes, and 'at-once' transaction schemes. Many of the new end-to-end encryption schemes limit merchants' choices regarding which bank or processor they will be able to work with. By working with Shift4, merchants retain the power of choice and can work with any bank or processor they see as most beneficial to their business," said Steve Sommers, Senior Vice President, Applications Development, Shift4 Corporation.
Tokenization was defined for the first time in the Payment Industry in 2005 at a Security Conference in Las Vegas, Nevada. Shift4's tokenization replaces a card number with a randomly generated unique alphanumeric value that represents the card information for a particular transaction and merchant, used mostly, but not exclusively, for post authorization data retention. In some tokenization in name only adaptations, which use keys or partial keys, a key being compromised would have to be reported as a breach. Since, by definition, Shift4 tokens are not CHD and there are no keys associated with the true token, they have no value if stolen and do not need to be protected under PCI rules.
The power of the true tokenization is the token provider's system. The system must be robust and feature rich to provide the merchant with all the capability they would have if they had retained the card number, including reporting, retrieval, and chargeback defense. Shift4's token is not a key, a partial key, a hash, or any 1-to-1 relationship with a card number and can be stored up to 24 months or as long as the merchant's retention period dictates. This way, the token can be used in any check-in/check-out scenario like hotel and auto-rental, a book and ship scenario of Mail-Order/Telephone-Order (MOTO) and eCommerce, or other scenarios such as "card-on-file" and recurring billing scenarios.
About Shift4 Corporation
Shift4®, a leading developer of secure financial transaction processing software and services, provides web-based, real-time enterprise payment solutions for leaders in the hospitality, retail, food services, auto rental and eCommerce markets. Through connectivity to most major processors, DOLLARS ON THE NET provides both high-speed and low-cost authorizations and settlements for credit, debit, check, private label and gift card transactions. DOLLARS ON THE NET also includes the ability to access, review and edit transactions prior to settlement, as well as a searchable, 24-month archive of transactions for reporting and chargeback defense. For more information, please contact our sales department at (800) 265-5795 or visit www.shift4.com.
Two risks dwarf all others, but organizations fail to mitigate them
Featuring attack data from TippingPoint intrusion prevention systems protecting 6,000 organizations, vulnerability data from 9,000,000 systems compiled by Qualys, and additional analysis and tutorial by the Internet Storm Center and key SANS faculty members. - September 2009
Critical Controls - As Applied to HTTP Server Threats
Executive Summary
Priority One: Client-side software that remains unpatched.
Waves of targeted email attacks, often called spear phishing, are exploiting client-side vulnerabilities in commonly used programs such as Adobe PDF Reader, QuickTime, Adobe Flash and Microsoft Office. This is currently the primary initial infection vector used to compromise computers that have Internet access. Those same client-side vulnerabilities are exploited by attackers when users visit infected web sites. (See Priority Two below for how they compromise the web sites). Because the visitors feel safe downloading documents from the trusted sites, they are easily fooled into opening documents and music and video that exploit client-side vulnerabilities. Some exploits do not even require the user to open documents. Simply accessing an infected website is all that is needed to compromise the client software. The victims' infected computers are then used to propagate the infection and compromise other internal computers and sensitive servers incorrectly thought to be protected from unauthorized access by external entities. In many cases, the ultimate goal of the attacker is to steal data from the target organizations and also to install back doors through which the attackers can return for further exploitation. On average, major organizations take at least twice as long to patch client-side vulnerabilities as they take to patch operating system vulnerabilities. In other words the highest priority risk is getting less attention than the lower priority risk.
Priority Two: Internet-facing web sites that are vulnerable.
Attacks against web applications constitute more than 60% of the total attack attempts observed on the Internet. These vulnerabilities are being exploited widely to convert trusted web sites into malicious websites serving content that contains client-side exploits. Web application vulnerabilities such as SQL injection and Cross-Site Scripting flaws in open-source as well as custom-built applications account for more than 80% of the vulnerabilities being discovered. Despite the enormous number of attacks and despite widespread publicity about these vulnerabilities, most web site owners fail to scan effectively for the common flaws and become unwitting tools used by criminals to infect the visitors that trusted those sites to provide a safe web experience.
Operating systems continue to have fewer remotely-exploitable vulnerabilities that lead to massive Internet worms.
Other than Conficker/Downadup, no new major worms for OSs were seen in the wild during the reporting period. Even so, the number of attacks against buffer overflow vulnerabilities in Windows tripled from May-June to July-August and constituted over 90% of attacks seen against the Windows operating system.
Interpreting and applying technology and controls to the Payment Card Industry Data Security Standard (PCI DSS) can be confusing. Ed Moyle, Manager, CTG, outlines the common mistakes organizations make when trying to meet a PCI DSS audit and how to avoid them. He also outlines the key areas companies need to focus on when dealing with an assessment, including:
Impact of scope
Authentication data, and requirements if you encrypt the PAN
Issues related to application lifecycle management
Areas where documentation is often insufficient
Speaker Ed Moyle Manager, CTG
Ed Moyle is currently a manager with CTG's Information Security Solutions practice, providing strategy, consulting, and solutions to clients worldwide. His previous positions include VP and ISO with Merrill Lynch Investment Managers, Department of Defense JCALS consultant with CSC, and lead developer and manager of Research and Development at ICT. He is also the founding partner of compliance and information security consultancy Security Curve.
Hamilton, Bermuda and London, Sept. 16, 2009 -PIN Payments News Blog- First Atlantic Commerce (FAC), a leading, international, multicurrency online payment and risk management solutions provider, and Ukash, a leading online cash payment solution, have teamed up to offer Ukash payment options to FAC’s merchants in the Latin American Caribbean Region, UK and Europe.
Ukash, which is regulated by the UK Financial Services Authority (FSA), combines the timeless simplicity of cash with the benefits of the internet to create a simple and unique payment solution that allows consumers to buy securely, anonymously and privately online.
FAC, a secure, PCI certified payment gateway that offers a range of payment options to its merchants including Visa, MasterCard, American Express and PayPal, has added Ukash to its payments platform, which means that FAC merchants can now easily accept riskfree cash payments on their website.
The move gives merchants access to, and retention of, new consumer markets including customers that do not want to disclose their financial details online, and those that do not have access to credit and debit cards.
Ukash has become a globally recognized payment method that enables online transactions using cash. Merchants benefit from accepting Ukash because the system opens up new consumer markets, while offering freedom from credit and debit card fraud, repudiations and chargebacks.
FAC merchants can now access Ukash together with PayPal and a range of card brands for credit card processing through a single interface.
Andrea Wilson, FAC’s Chief Executive Officer, said: “We are excited about the addition of Ukash to our payments platform. First Atlantic Commerce continually strives to add value for our merchants, and this integration will give them an additional option for their customers to make online payment for goods and services. It also enables merchants to access additional and alternative payment options in emerging markets like Brazil, Uruguay, Russia and Poland.”
Mark Chirnside, Chief Executive Officer at Ukash, said, “The mission for Ukash is to make online shopping available to anybody, anywhere in the world and this deal with FAC is the next step towards realizing that goal. FAC works across a broad range of exciting sectors on a truly global scale so being added to FAC’s payment platform will make Ukash available to thousands of new merchants who can then enable their customers to enjoy the benefits of using cash to shop, pay and play online.”
For more information on how you can start accepting Ukash via FAC’s platform, contact FAC at info@fac.bm or visit Ukash at http://www.ukash.com/business/contact.aspx .
About First Atlantic Commerce
First Atlantic Commerce (FAC) is a leading Internet, multicurrency payment and fraud risk solutions provider. Headquartered in Bermuda, and established in 1998 to create secure cardbased payment solutions for ebusinesses, FAC’s cGate® technology offers service, flexibility and security to adapt to many business and bank acquirer requirements.
FAC provides merchants with multicurrency payment solutions in addition to fraud and data management services including AVS, CVV2/CVC2/CID, 3D
Secure™ and IP Geolocation in multiple jurisdictions across Europe, Asia and the Latin American Caribbean Region. For more information, please visit www.firstatlanticcommerce.com .
About Ukash
Ukash® is a globally recognised ecommerce payment method to enable online purchases using cash, providing freedom from credit and debit card fraud, repudiations and chargebacks, and protecting personal identity.
Ukash® is regulated by the UK Financial Services Authority (FSA) and operates as one of only a small number of Electronic Money Institutions, a status that allows a single maximum online cash payment transaction of up to £500/€750.
Uniquely numbered Ukash® vouchers are widely available through payment terminals in retail outlets across Europe, South Africa and Australia. From spring 2009, Ukash vouchers have also been issued online from the company’s website in most European territories.
The technology behind Ukash is protected by several patents registered across the Smart Voucher database and functionality and is, as such, protected by Patent Law in all the major economies of the world. Ukash® is a registered trademark of Smart Voucher Ltd.
In 2008, Ukash® established a strategic partnership with South African payments giant Blue Label Telecoms to develop the brand’s services. For more information please visit www.ukash.com .
Monett, Mo., Sept. 16, 2009 -- Jack Henry & Associates, Inc. (Nasdaq: JKHY), a leading provider of integrated technology solutions and data processing services for financial institutions, today announced that CornerStone State Bank has selected Jack Henry Banking’s Core Director core processing system to provide enterprise-wide automation. This Minnesota-based bank, which has more than $95 million in assets, will implement Core Director in-house.
According to Chad Olness, president of CornerStone State Bank, “Technology is a key component in a bank’s ability to continually enhance the levels of service and convenience it delivers, aggressively and successfully compete, increase profitability and operating efficiencies, and contain operating costs. After a strategic evaluation of our current and long-term technology requirements, we evaluated multiple technology platforms and companies with several fundamental goals. We wanted to streamline our operations and the ongoing support process with a single vendor relationship. We wanted a technology partner that has a large and loyal customer base. We wanted to improve operating efficiencies and reduce our silos of technology with a fully integrated technology platform. And we wanted a core system that has the vendor’s long-term commitment. We believe we met each of these goals and can support our aggressive technology plan and high expectations through our technology partnership with Jack Henry Banking and the operating infrastructure based on Core Director.”
Core Director is a Windows®-based, client/server system that provides banks ranging from de novo institutions to those with assets exceeding $2 billion with enterprise-wide automation. The system leverages the industry’s most cost-efficient operating platform, can be installed in-house or implemented through Jack Henry Banking’s OutLink Data Centers™, and is fully integrated with more than 50 complementary products and services. Core Director provides intuitive point-and-click operation and customizable functionality, and supports unique user preferences and specific functional requirements with an extremely flexible browser user interface that can be easily customized and continually modified for every system user.
Tony Wormington, president of Jack Henry & Associates, said, “We are excited that CornerStone State Bank has joined the more than 230 banks that have already entrusted their ability to process financial transactions, automate business processes, and manage their mission-critical information to Core Director. We believe our proven ability to provide the integrated business tools that banks need to execute and maximize their business strategies and to capitalize on the dynamic trends shaping customer expectations and the financial services industry will enable us to establish a long and successful technology partnership with this progressive bank.”
In addition to Core Director, CornerStone State Bank will initially implement an array of Jack Henry Banking’s complementary solutions including Core Director® Teller, the InTouch Voice Response® telephone banking solution, NetTeller Online Banking™, NetTeller Cash Management™, the NetTeller Bill Pay™ solution, Electronic Statements—Interactive, components of the modular Synergy™ Enterprise Content Management (ECM) solution, and the 4|sight™ Item Imaging platform.
About CornerStone State Bank
Chartered in 1974, as one office in Le Sueur, Minnesota, now CornerStone State Bank has grown into five communities; Le Sueur, Cloquet, Belle Plaine, Montgomery, and Green Isle, Minnesota. As an independent locally owned bank, all staff at CornerStone State Bank is committed to hometown service and the growth of our customers and communities. Additional information is available at www.CornerStonestatebank.com .
About Jack Henry Banking
Jack Henry Banking, a division of Jack Henry & Associates, Inc., is a leading provider of integrated computer systems for banks ranging from de novo to mid-tier institutions. Jack Henry Banking currently serves approximately 1,500 banks as a single source for integrated, enterprise-wide automation and as a single point of contact and support. Additional information is available at www.jackhenrybanking.com .
About Jack Henry & Associates, Inc.
Jack Henry & Associates, Inc. (Nasdaq: JKHY) is a leading provider of computer systems and ATM/debit card/ACH transaction processing services primarily for financial services organizations. Its technology solutions serve more than 9,800 customers nationwide, and are marketed and supported through three primary brands. Jack Henry Banking supports banks ranging from de novo to mid-tier institutions with information processing solutions. Symitar™ is the leading provider of information processing solutions for credit unions of all sizes. ProfitStars® provides highly specialized products and services that enable financial institutions of every asset size and charter, and diverse corporate entities to mitigate and control risks, optimize revenue and growth opportunities, and contain costs. Additional information is available at www.jackhenry.com .
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vLfb4i0c_EdfTEZuEf9vNYWHultd4XLZgYDOemkIZu_HEch8Cn7tYmGEMt-5Mn4C1hkKaAHddbqjGva6m8vfbbakpvtqiL4uufQQ53vpVoU8qIO5glDoYkBmOH1FSsqJeFsZnr2ZQsitw8jXAAHhzs=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tdt019iwhLl-vVT3HsOYcF7F5YTjO9LyxYiRxZTDJ6WBK6szsS7Zygsw8f4gDF6FK8p4CSfsJ7Lkw9ICGxvRmGgvGsYeydsYS951PXlVUi5EyA2aEf3Een-dYUwvvkpgak-ZvNEJ-33-6EANqFCfbV=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tCDexj6H2bIjSR9YK8guNgjh7q4yMs27_a5rfH3K_Pbml45lvujsnQHgyj4cmjB96KtNlR2NWwxchFXa5RPQNGYJGY4Mu3_8F9LjwOgdGpcngML9abdb4UFJ7gMjTG3MC-HmbUDB5m2r3lei9y-2tb=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tqsV2y0acIcfEyCBbIksB-ROS9QRScynFNxhkf_NFahKtRmw9m05ro_qSlA_zT1aGoN19sQ_gjopTu67G0ZAnO5me0pNzd6CBCBUqmFFVZKXfOkdN0W6lFtiqSq_PcpwI6dP465uZE44eOXcYixwk=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vp6OKBuvwoH2GbgQsHTuu1_5mcirTUjCuH0OC1ojHZLC_1QutsZSGChkjdPbv1hT1CnshJQqmknIGWDJVwOtP5zCUv11SVIvpyDGDRdGhsf0wW20Oqi5I77P-b74N-4PMXr4A81hfktYLjx9DC5M3E=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t-ugodVWnZJKs0rAu2dcXCqa5C2zQ9OWNK39e0jXtAn7l3uHibg_4csldTlUFJhWujkCVR4idgOPPM_zg7q2k9MOErOniP2SbyLoIgHlCXOP7j5h1fPFexSeuZDEGYNf1SKU-crbeYKl-_oVUX3meg=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vZiekguk7hklFgX4TBfYNPXUzU3XZEenFR9rj3bch_BvTtOnni2g_hDqTgUM4W7pZafKVXSkES9VE-dp746u00FAb3--IVTnTQ7DQG5zIbmQCxOySMEMWOTv9gdPfHr3IQ3nVRt5akrR_7fhvwOWu1=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u8MCvmUMPtTlx2nyauRIJAfWnHOHCwlWgc7pEvg1WesW7CzT0VCt5SOBjdfn6JHzKMZ37VF3XDixDbUUdzZyQ_jSBK2dl-UnL8Bbp_oRKsKcIeu-gU-O-MHC49L7FFMV2R4fTXpGYHtBDy1aCF_5YX=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_salRKp5B-V3FNLja5C0Skoz2_YSMcwLeI3LnTAJhgy0gI9XwPfe91eJ4_MvwlBHc0_DFG7lO54FnHQUdwOEONjmOleElUvEjfiK31EUj4aE64G2B6wPkjysaDnmloOge8vpfpthMuCgI8XNcQLrdHT=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vtJFYscV8heJtInUSKjZR3ekYSaBd1ebDMUbPtDwopMgieO7xxa3easzkyM61lFvUjCE_hATQkCJzurQpiegLbkJ0XMbxHNwvgJ09767wUIMB6UBuDwc9y8cJeCfll8JHaFg6b_YJG3_QNxQKYV5g=s0-d)