Tuesday, December 1, 2009

2009 Banking Identity Safety Scorecard: Banks Achieve Milestones in Prevention and Debit Card Guarantees but Fall Short in Alert Offerings

Research and Markets

Javelin’s 2009 Banking Identity Safety Scorecard ranks banks and credit unions on their customer-facing identity fraud Prevention, Detection and Resolution™ capabilities. Leveraging the nation’s most comprehensive study on identity fraud, Javelin updates the Prevention, Detection and Resolution™ criteria each year to show specific ways that individual financial institutions (FIs) can increase customer safety and loyalty through enacting comprehensive security measures and by partnering with account holders to fight identity fraud. Javelin uses a combination of mystery-shopper calls (averaging 6.2 per institution) and extensive website research to score the leading 25 U.S. FIs by gross annual deposit volume against relevant Prevention, Detection, and Resolution™ criteria; collectively this study represents approximately 50% of the U.S. market in 2009 by dollar value of deposits, according to the FDIC.

Financial institutions made significant strides in prevention, jumping 27 percentage points from last year, and also slightly improved in detection and resolution capabilities. With six new banks entering the top ten in overall rankings this year and seven new banks leading the pack in prevention, smaller banks have raised the bar in prevention, the most weighted safety area of the identity safety scorecard.

Primary Questions

How can banks and credit unions benchmark their efforts to battle against a $48 billion U.S. identity fraud problem?

Which financial institutions rank highest against Javelin’s customer-facing Prevention, Detection and Resolution™ criteria?

What type of account protection capabilities should banks and credit unions implement to increase customer safety through Prevention, Detection and Resolution™?

Within the U.S. banking industry, where is banking safety the strongest and where is it most vulnerable?

Which customer safety features will most differentiate financial institutions in the future?

Which key recommendations should banks prioritize to ensure customer safety?

Methodology

This study measures FIs based on customer-involved ID fraud capabilities that were selected based on Javelin’s annual Identity Fraud Survey Report, other consumer surveys that assess consumer propensity to adopt particular safety features, and ongoing dialog with industry experts. This report used phone-based mystery shopper investigations, as well as Javelin’s review of websites from the 25 selected financial institutions chosen for inclusion in the survey. Javelin selected these methods to ensure accurate findings that address all facets of customer security. The data was collected during August,

September and October 2009.

Using the mystery shopper approach, researchers called each bank or credit union’s customer service representative (CSR) in online banking, mobile banking, fraud prevention, and general customer service, requesting an experienced specialist. Researchers explained that they were consumers concerned about identity theft and had several specific questions about the FI’s identity theft prevention, detection, and resolution capabilities. In some cases, numerous customer service representatives were required to complete the survey, and whenever Javelin’s research specialists had reason to doubt the knowledge of a CSR the call was terminated and the process was repeated. The total quantity of required CSRs (on a per-FI basis) was recorded, along with the CSR’s name or employee number, when available, as well as the date and time of the call.

The required number of calls ranged from 4 to 7, with the average being just over six calls (6.2) to ensure reliable results. For an FI to receive credit for having a security feature the service must satisfy specific criteria; the service must be provided without a fee, except for selected criteria (credit reports and monitoring, partnerships with security vendors, and next-day replacement of debit card). In cases where a service is not provided to all of the FI’s customers, credit is given if the service

is provided to the majority of the customer base with a personal banking relationship.

FIs were scored according to their Prevention, Detection and Resolution™ capabilities.

The prevention category was weighted more heavily than detection and, in turn, more heavily than resolution, due to the greater potential cost savings associated with stopping fraud before it happens.1 Future versions of this report will build upon this research incorporating new capabilities and technologies as they become available.

Prevention:

FIs had the potential of scoring 45 points for prevention-related features, earning points for the following criteria: anti-phishing e-mail policies online, the prohibition of the use of the full Social Security number via phone, Internet, or mail transactions, the option to turn off paper statements, partnering with security vendors, the existence of multi-factor online and telephone authentication, mutual online authentication process online, having an extended validation certificate online at the user homepage (EV SSL), mobile banking access, review and release of suspicious transactions via online and mobile channels,

offering offline-only authentication for new accounts, mobile banking access without online banking sign-up, security education and tips for online and offline activities, vishing education, and offering user-defined limits (UDLAPS) on transaction size, card-not-present, and overseas transactions.

New scoring criteria for the 2009 prevention category included being able to enroll in mobile banking without online banking sign-up and providing a password manager (e.g., Trusteer or IDVault). Providing a password manager is a critical component for customer security because it prevents users from entering their login or password credentials at a fraudulent site.

Points were given for security information regarding online and offline activities that was readily accessible on the FI website. The preventative, educational tips must have been fairly easy to find and in a convenient place to keep consumers informed, thus keeping security top-of-mind. The same goes for partnering with security vendors – the link or information to do so must have been in a prominent location on the website.

Detection:

FIs surveyed had the potential or scoring 35 points for services that help customers detect identity theft and fraud. FIs earned points for offering the ability to order and pay for credit reports, credit monitoring services through the website, and for SMS and e-mail alerts. Account-related alerts included transaction size, online (CNP) purchases, overseas transactions, balance level alerts, online transfers, wire transfers, adding a new bill payments payee, new account setup, and statement notification. E-mail alerts that notify users of changes to their personal information included changes to PINs, login

passwords, physical addresses, e-mail addresses, and phone numbers, as well as the addition or subtraction of registered users.

Both SMS and e-mail notifications protect the safety of accountholders and give consumers warning about potential fraudulent activity, thereby assisting financial institutions, issuers, and consumers in the fight to reduce costs by mitigating fraud.

With half of all fraud being discovered by the fraud victims themselves (51%)2 and the cost of fraud equalling $48 billion in losses,3 it is critical to empower consumers to self-detect and self-monitor their accounts. This year, credit monitoring services and the ability to order and/or pay for credit reports were separated into two different categories, allowing FIs to receive more points for credit detection. Javelin recommends that customers review their credit information regularly, ensuring that all the accounts listed are their own.4 The importance of credit monitoring and being able to access credit information prompted the separation and increased scoring opportunities by FIs in this area.

Resolution:

FIs had the potential to earn 20 points for identity theft resolution capabilities. FIs earned points for offering 24-hour, seven day- a-week account suspension, providing immediate access to funds not compromised by an identity fraud attack, providing a dedicated resolution team (or outsourcing to ITAC), access to identity theft assistance online and over the phone, a 48-hour follow-up policy from CSRs, a zero-liability policy for funds lost to fraud by online banking, wire transfers, checks, and debit card transaction (by signature, PIN, or online), for next-day availability of stolen funds (provisional credit), and for providing a data breach resolution plan. No new scoring criteria was modified or added this year.

Other Surveys Incorporated:

Consumer data from Javelin’s annual Identity Fraud Survey was also used in this report. The survey is conducted each year using computer-assisted telephone interviewing (CATI) via random-digit dialling (RDD). The total number of respondents was 4,784 in 2008; 5,075 in 2007; 5,006 in 2006; 5,003 in 2005; 5,004 in 2004; and 4,000 in 2003. The survey targeted respondents based on representative proportions of gender, age, and income compared to all U.S. adult consumers. For questions answered by all 4,784 respondents, the maximum margin of sampling error is +/- 1.4% at the 95% confidence

level.

For questions answered by all 487 identity fraud victims, the maximum margin of sampling error is +/- 4.4% at the 95% confidence level. For questions answered by a proportion of all identity fraud victims, the maximum margin of sampling error varies and is greater than +/- 4.4% at the 95% confidence level. Additionally data was taken from a report on data breaches published in 2008. The report collected data from an online survey of a random-sample panel of 441 data breach victims in May 2008. The overall margin of sampling error is ±4.67 percentage points at the 95% confidence level.

Data was also taken from a Javelin report on personal finance management published in June 2009. This report used data from a survey collected from executives with each of the seven online-banking platform vendors.

Additional information was solicited during interviews with executives from the vendors, banks and credit unions and web-based start-ups. To evaluate products, Javelin asked each vendor to answer nearly 125 questions that delved into the availability of specific features and functionality.

The report also included data collected online from a random-sample panel of 2,714 respondents in March 2008 from Javelin’s report on mobile banking security standards. The survey targeted respondents based on representative proportions of gender, age and income compared to the overall U.S. online population. Overall margin of sampling error is ±1.88 percentage points at the 95% confidence level.

Finally, data was taken from the 2008 Financial Alerts Forecast, which was based on data collected online from several different surveys:

A random-sample panel of 2,350 respondents in March 2008. The overall margin of sampling error is ±2.86 percentage points at the 95% confidence level.

A random-sample panel of 3,367 respondents from August 2008. The overall margin of sampling error is ±1.70 percentage points at the 95% confidence level.

The surveys targeted respondents based on representative proportions of gender, age and income compared to the overall U.S. online population. Secondary data from public sources such as the U.S. Census Bureau and the Bureau of Labour Statistics was incorporated into the forecast.

A sample for this product is available. Please Login/Register to download this sample.

Ordering: Order Online - http://www.researchandmarkets.com/reports/1134411/

More on Radiant Systems Breach and Analysis from Gartner

Last week I blogged about seven restaurants filing a lawsuit against Radiant Systems after the recent breach. (Radiant Systems Sued Over Data Breach - Million$ $ought)

Here's some more on the subject: The overview below is from Wired and the analysis is from Avivah Litan, distinguished analyst at Gartner...

"Seven restaurants have sued the maker of a bank card-processing system for failing to secure the product from a Romanian hacker who breached their systems.

The restaurants, located in Louisiana and Mississippi, have filed a class-action suit against Georgia-based Radiant Systems for producing a point-of-sale (POS) system that they say was not compliant with payment card industry security standards and resulted in an undetermined number of customers having their debit and credit card numbers stolen.

The suit alleges that the system stored all of the data embedded on the bank card magnetic stripe after the transaction was completed — a violation of industry security standards that made the systems a high-risk target for hackers. Also named in the suit is Computer World, a Louisiana-based retailer, which sold and maintained Radiant’s Aloha POS system."

Continue Reading at Wired

Meanwhile, Gartner has published an analysis of the Radiant Systems/ComputerWorld breach and ramifications thereof:

Lawsuit Highlights the Hidden Risks of PCI 'Compliance'

Avivah Litan

A lawsuit serves as a reminder that card-accepting businesses can be held liable for Payment Card Industry security compliance failures, even when they have been told their vendors or service providers are fully compliant.

News Analysis

Event

On 23 November 2009, a law firm representing seven restaurants in Louisiana and Mississippi announced that it has filed a class-action lawsuit against Radiant Systems, an Alpharetta, Georgia-based maker of point-of-sale (POS) systems, and Computer World Inc., a Scott, Louisiana-based POS system distributor. The suit alleges that Radiant Systems and Computer World sold the restaurants Aloha POS systems that were incorrectly described as compliant with Payment Card Industry (PCI) related security standards, despite having been informed by Visa that they were not. The suit further alleges that these systems and related poor business practices contributed to major data security breaches that resulted in multiple cases of identity theft and some of the restaurants being fined by credit-card issuers or required to submit to forensic audits.

Analysis

Gartner is not a law firm, and makes no judgment as to the merits of this or any other lawsuit. However, these allegations — whether or not they are ultimately upheld in court — point to serious, long-standing problems with the PCI compliance process. Card brands such as Visa and MasterCard typically send alerts about noncompliant products or services to their member banks, not to card-accepting businesses and other direct purchasers of these technologies. For this reason, it is unfair for the card brands and processing companies to penalize end users who are unaware of problems with the technology. POS system purchasers — particularly small businesses — cannot be expected to be experts in the credit card processing certification process, especially when they don’t necessarily have access to the communications surrounding the process.

Merchants are ultimately responsible for validating vendors' and service providers' claims, but the card brands should implement proactive awareness programs when they know that vulnerable payment technologies are in active use. They should also provide standard contract language that card-accepting businesses can insert into contracts with vendors or service providers to ensure that their products or services are compliant with PCI-DSS or PA-DSS, and that forces the vendors or service providers to assume liability for breaches resulting from deficiencies in their hardware, software or processes.

Recommendations

Card-accepting businesses:

Ensure that your payment application suppliers or service providers are listed on Visa's rosters of certified providers (see http://usa.visa.com/merchants/risk_management/cisp_payment_applications.html and http://usa.visa.com/download/merchants/cisp-list-of-pcidss-compliant-service-providers.pdf). (Note: The PCI Security Standards Council will take over maintenance of these lists after the first quarter of 2010.)

Demand in contracts with these technology suppliers that they remain PCI- or PA-DSS compliant throughout the life of the contract, and that they assume liability for any breaches of customer data that occur because of security holes in their software or services.

Card brands:

Communicate alerts directly and proactively to card-accepting companies, and issue guidance to these companies on how to manage contracts and liability issues with technology and service suppliers.

Recommended Reading

"Where Does End-to-End Encryption for PCI End?" — U.S. payment processors are introducing proprietary end-to-end encryption services to their retailer customers in an attempt to strengthen security for card data in transit. By Avivah Litan

"Using Tokenization to Reduce PCI Compliance Requirements" — “Tokenization” of cardholder data can be used to reduce the scope of PCI compliance audits, but the available products and services are still limited and immature. By Avivah Litan and John Pescatore

(You may need to sign in or be a Gartner client to access the documents referenced in this First Take.)

Veritec to Offer Consumers Secure Prepaid Debit Cards Issued from Kiosks

This Program Provides Secure Prepaid Cards to Consumers in Retail and Other Locations

GOLDEN VALLEY, Minn.--(BUSINESS WIRE)--Veritec, Inc. (OTCBB: VRTC.OB), a developer of mobile banking debit card solutions and a pioneer and developer of proprietary two-dimensional matrix technology, today announced that its subsidiary, Veritec Financial Systems, Inc. (“VTFS”), entered into a memorandum of agreement with Cities in Touch (“CIT”) of Hot Springs, Arkansas to integrate VTFS’ mobile banking software platform with CIT’s ATM and debit card issuing kiosk systems.

VTFS markets and sells prepaid card programs and provides back-end prepaid card processing services on behalf of Security First Bank to card sponsoring organizations. VTFS markets its prepaid card programs under its MTC and Blinx On-Off brands. In addition to serving as an ATM machine, CIT’s kiosk systems enable consumers to securely cash checks, pay bills, transfer money and obtain pay day loans. By integrating VTFS’ and CIT’s respective systems, consumers will benefit by being issued secure reloadable debit cards that may be used at most ATM machines and when making retail purchases. VTFS’ debit cards are more secure than cash in that consumers will be able to turn their debit cards “on” and “off” with their mobile phones.

“Veritec is very pleased to enter into this agreement with Cities in Touch,” said Van Tran, Executive Chair of Veritec. “CIT provides convenient as well as special and important services to members of our community, and Veritec is able to help these consumers by providing a reloadable and highly secure financial product that is a better and safer alternative to cash.”

“Veritec’s prepaid card products and services will enable CIT to be in a position to offer new and exciting products and services to its customers,” said Randy Dodd, President of CIT. “It has also provided CIT with a service that helps us reduce the need for keeping a significant amount of cash in our kiosks and this helps make CIT’s operations and the kiosk owners’ operations more secure.”

The parties expect to conclude the terms of a definitive agreement during the month of December, 2009.

About Veritec, Inc., VTFS and Security First Bank

Veritec, Inc. is a pioneer and developer of proprietary two-dimensional matrix technology. The company’s portfolio of products includes its proprietary VeriCode® and VSCode® 2D matrix symbology solutions, BioID - VSCode® multi-purpose card solutions, and suite of products known as PhoneCodes™ for delivering electronic tickets, coupons and gift cards to mobile devices (www.veritecinc.com). Veritec Financial Systems, Inc. is a wholly owned subsidiary of Veritec, Inc. VTFS develops and licenses mobile banking debit, gift and prepaid card solutions and serves as a third party processor to banks for debit card transactions on the company’s mobile banking platform (www.vtfs.com). Security First Bank of Fresno, California is a California commercial bank authorized to engage in the commercial banking business. Deposits are insured by the FDIC up to the applicable limits of the law (www.securityfirstfresno.com).

About Cities in Touch

Established in 1996, Cities in Touch is a Hot Springs, Arkansas company. CIT’s goal is to furnish a state of the art kiosk which houses an ATM and provides bill payment, wire transfers, check cashing, payday advance, prepaid phone, wireless PIN, wireless recharge, prepaid debit cards and advertising, all in one unit that can be installed in a user friendly atmosphere, offering all of these services through the technology of a touch screen monitor. CIT’s ability to provide information through public access terminals offers resources for people everywhere, anytime. We customize ads, logos, animations and graphics. CIT is, in effect, a partner with the merchant for the full term of an agreement and therefore has a financial interest in the success of every Kiosk/ATM terminal. Our software has been designed in-house and allows us to write plug-ins to adapt to most environments. We pride ourselves in being a total turn-key company with the ability to build our own enclosures and provide the hardware, software and other peripherals that can take a project from start to finish (www.citiesintouch.com).

ATM, Debit & Prepaid Forum Sessions Available for Purchase

17th Annual ATM, Debit & Prepaid Forum

“The topics this year were very diverse and covered many relevant topics.

I didn’t want to miss any sessions.”

Jill Weber, ATM Network Manager, Citizens Bank

On October 18-20, 2009, more than 650 payment industry players gathered in Las Vegas for the 17th Annual ATM, Debit & Prepaid Forum. We are sorry that you were not able to attend this year. Based on feedback from conference attendees, the quality of information presented by speakers, the level of detail, the industry expertise, the depth and breadth of information was unparalleled!

Here’s your chance to access twenty-two sessions* from the 17th Annual ATM, Debit & Prepaid Forum in webcast format. The webcasts of 22 conference sessions are available for purchase for only $99.

	To preview the session webcast, click here.
	To purchase the webcast package, click here.

Click here for a preview of the session webcast:

KEYNOTE ADDRESS:

Creating a Framework for Payments Innovation

Dominic Venturo, Chief Innovation Officer

Retail Payment Solutions, U.S. Bank

These webcasts provide you with audio, and the accompanying session slides, plus the interactive Q&A at the end of the sessions.

Purchase NOW!

*Only sessions with speaker authorization are available for purchase. Individual sessions are not available for purchase. All 22 sessions are sold as one webcast package for $99.

Cardinal Commerce Hires New Executive

MENTOR, Ohio, Dec. 1, 2009 (GLOBE NEWSWIRE) -CardinalCommerce, the worldwide leading enabler of payment brands, today announced the hiring of Charles R. Vojtas, an IT veteran with front line retail eCommerce and mobile Commerce experience. Vojtas will serve as CardinalCommerce's Vice President of Design and Development.

Charles Vojtas brings over 13 years of Information Technology experience and expertise and has held key positions including Manager of Corporate Development and Director, Development at Footlocker.com/Eastbay. His hands-on experience within the eCommerce retail world in design and development, quality control, mobile commerce implementations and overall eCommerce strategy have allowed him to successfully establish a proven track record of success in the direct to consumer marketplace.

Mr. Vojtas will be responsible for managing the ongoing development of Cardinal's product suite including: Cardinal Centinel(R), the worldwide leading technology which enables over 25 eCommerce payment brands through one integration; Cardinal MAX, the mobile platform allowing merchants to expand into mobile commerce, banking, marketing, and payments; and 2IDENTIFI, authentication solutions for financial institutions.

All Cardinal platforms have experienced significant growth in 2009.

"The experience and knowledge that Mr. Vojtas brings to his role is timely with the current and expected growth all of our products and services," said Michael A. Keresman, III, Chief Executive Officer, CardinalCommerce. "We welcome Mr. Vojtas on board and look to strengthen all of our offerings as a result."

Charles Vojtas stated: "First, I'm truly grateful to have worked for a company like footlocker.com/Eastbay.

"I learned Customers demand security, payment options, and portability. Now, at Cardinal, I recognize the tremendous growth potential for our eCommerce and mobile commerce platforms with CardinalCommerce solutions delivering on all three, providing easily integrated tools to answer these demands. I am particularly excited about the opportunity I will have to engage companies directly, partnering with them to integrate these solutions, and seeing the benefit it will bring to their platforms and to their Customers."

About CardinalCommerce

CardinalCommerce Corporation is the global leader in enabling authenticated payments, secure transactions, and alternative payment brands for both eCommerce and mobile commerce.

Cardinal Centinel(R)* enables payment brands such as Verified by Visa, MasterCard(R) SecureCode, Amazon Payments, Bill Me Later(R), ClickandBuy(R), Cred-Ex(R), Ebates, eBillme, eLayaway, Google Checkout, Green Dot(R) MoneyPak(R), JCB J/Secure, Mazooma, Moneta(R), MyECheck, NACHA(R) Secure Vault Payments (SVP), OneTouch Online Purchasing, paysafecard, PayPal, RevolutionCard, SafetyPay, TeleCheck(R), Ukash, and more to a network of thousands of merchants and merchant service providers.

Our mobile commerce platform, Cardinal MAX, makes it simple for retailers to sell and market products through the mobile channel. Cardinal's proprietary and easily deployable technology provides consumers, merchants, credit/debit card issuers, and processors the ability to conduct authenticated Internet, wireless and mobile transactions safely and securely. Our bank authentication platform, 2IDENTIFI, offers authentication solutions for financial institutions and processors.

Headquartered in Cleveland, Ohio, with facilities in the United States, Europe, and Africa, Cardinal services a worldwide Customer base. For more information, visit www.cardinalcommerce.com

Tiger Woods Car Accident Exploited by Hackers

Cybercriminals plant poisoned webpages which install malicious Trojan horse

Here's the Warning from Sophos:

IT security and data protection firm is warning computer users keen to read the latest developments in the story about the Tiger Woods car accident that they may be walking straight into a trap set by hackers.

Sophos discovered that hackers were not slow to take advantage of the breaking news story, and by early Saturday morning had created webpages which claimed to contain video footage related to the incident, but that were really designed to spread dangerous malware.

By using content related to the top golfer's mysterious car accident and his alleged relationship with New York party girl Rachel Uchitel, the cybercriminals have made their attack timely and ensured that it will feature high up in search engine results, increasing the chances of unsuspecting victims visiting the site.

"The Tiger Woods story has been one of the top news stories around the world this weekend, and search engine statistics show that many people have been hunting for developments via the web. Hackers don't waste any time jumping on the coat-tails of a hot news story like this, in their attempt to infect as many computer users as possible," said Graham Cluley, senior technology consultant at Sophos. "Foolhardy internet users who believe they are about to watch video footage related to Tiger Woods's current troubles may find the website is trying to surreptitiously install a Trojan horse onto their computer, handing control over to cybercriminals."

Sophos notes that if computer users do visit the poisoned webpages, a malicious Trojan horse known as Troj/Proxy-JN can be installed on their computers, allowing hackers to relay spam via the victim's PC without their knowledge.

"This is a threat both for home users and companies. Many people may return from the weekend and use their office PCs to find out the latest news this morning - only to have their computers silently infected," continued Cluley.

More information about this threat, including images of an infected webpage, is available on Graham Cluley's blog

Leading Keynote Speakers Highlight MRC’s 2010 e-Commerce Payments and Risk Conference

Bill Kurtis, Wayne Best and Bob Carr to Address Global Electronic Commerce Leaders

(Seattle, WA—December 1, 2009) The Merchant Risk Council (MRC) is excited to announce the Keynote Speakers for the MRC’s 2010 Annual e-Commerce Payments and Risk Conference at the Wynn Las Vegas Resort on March 16-18, 2010.

Wayne Best, economist from Visa, Inc. will deliver the opening keynote address, while Bob Carr, founder and CEO of Heartland Payment Systems and Bill Kurtis, investigative reporter and television personality, provide the conference’s closing keynote speeches.

“We are thrilled to have Wayne, Bob and Bill join us in Las Vegas for our annual conference,” said Tom Donlea, MRC Executive Director. “These speakers, as well as the other scheduled conference presenters, will give our attendees a panoramic view of the issues that most affect e-Commerce security and profitability.”

The 2010 Annual Conference and MRC Platinum Meeting will include more than 50 speakers and panelists, 40 unique sessions, and more than 45 payment and risk industry exhibitors – all delivering unique and valuable insight and information on the growth, diversity and risks associated with global online payment trends and strategies, managing and reducing chargebacks, identifying global cyber threats, and utilizing the newest fraud prevention tools.

“The electronic commerce industry is becoming increasingly diverse,” said MRC Board Chairman, Tom Sullivan, Sr. Director, Global Payments & Risk, Expedia, Inc. “There are so many new players providing products and services that are fundamentally changing how the world communicates and does business.” Sullivan adds, “The MRC conference has evolved into the premier annual event, where a wide variety of e-Commerce and multi-channel merchants share payments, security and fraud best practices.”

Over the past decade, the MRC has evolved from a select group of merchants, networking about online fraud prevention, into the world’s foremost organization dedicated to educating the industry on issues relating to e-Commerce risk and payments. The 2010 Annual Conference unites the world’s top internet and multi-channel merchants, credit card brands, electronic payment processors and providers, risk management providers, law enforcement agencies and various consultants and educators in discussing how to make shopping on the internet easier, safer and more efficient for all involved.

Those scheduled to participate in the 2010 Annual e-Commerce Payments and Risk Exhibit Hall include: Accertify, American Express, Bill Me Later, Chase Paymentech, ClearCommerce, CyberSource, Digital River, Discover, Ethoca, Experian, 41st Parameter, GlobalCollect, iovation, JCB, Kount, LexisNexis, Litle & Co., Quova, Retail Decisions, RSA, Trustwave, Verifi and Vindicia.

For registration or exhibition information for this conference, or to receive MRC membership information, please visit the MRC’s website at www.merchantriskcouncil.org.

About the Merchant Risk Council

The Merchant Risk Council (MRC) is a merchant-led trade association focused on electronic commerce risk and payments globally. The MRC leads industry networking, education, benchmarking and advocacy programs to make electronic commerce more efficient, safe and profitable.

Today, with the power of its member-base, the MRC is the leading trade association for managing payments, preventing online fraud and promoting secure e-Commerce. The MRC is dedicated to working with e-Commerce and multi-channel merchants, payment processors, credit card issuers, credit card companies, alternative payment providers, risk management experts, and law enforcement to make the Internet a safer and more profitable place to conduct business.

The MRC Board of Directors and Advisors includes: Accertify, Apple, Chase Paymentech, CyberSource Corporation, Dell Inc., Discover, Expedia Inc., Gap Inc. Direct, GlobalCollect, Linden Lab, Microsoft, Neiman Marcus Direct, PayPal, Trustwave, Visa Inc. and Wal-Mart.

The MRC is headquartered in Seattle, Washington.

CLICK HERE for Information and Registration for the MRC's 2010 Annual e-Commerce Payments and Risk Conference

March 16-18, 2010 at Wynn Las Vegas

# # #

Fiserv Believes Visa Cardholders are a Vertical Market

Fiserv, Inc.now offers the new vertical-format Visa card - an innovative design option that displays all card information vertically rather than horizontally. According to Fiserv, this "breakthrough look" supposedly captures cardholder interest and provides a new way to showcase an issuer's logo. Newer, but not new. (see Garanti's version below right)

Fiserv Takes an Innovative Turn on Visa Cards

New vertical format captures cardholder attention

Brookfield, Wis., December 1, 2009 - Fiserv, Inc. (NASDAQ: FISV), the leading global provider of financial services technology solutions, now offers the new vertical-format Visa(R) card ? an innovative design option that displays all card information vertically rather than horizontally. This breakthrough look captures cardholder interest and provides a new way to showcase an issuer's logo.

"Fiserv is continually innovating to deliver product and service enhancements that help clients differentiate their card offerings and grow transaction volumes," said Jorge Diaz, division president, Output Solutions, Fiserv. "Our clients are looking for creative ideas that stimulate card activation rates. Vertical cards have visual uniqueness to attract cardholders and encourage increased usage."

The vertical cards are one of several innovations from Fiserv. Others include:

The Card Collection(TM) is an exclusive offering of 78 card designs that reflect a broad range of lifestyle themes, money motifs and regional images. Pay-as-you-go ordering eliminates inventory carrying expense and risk of obsolescence.

MyCardCreation(SM) makes it simple and affordable for cardholders to create cards with their own pictures on them.

Contactless Cards can speed up checkout and maximize convenience by enabling a cardholder to simply hold the card near a terminal or tap the terminal instead of swiping the card.

"The key to increasing transaction revenue is giving cardholders the kinds of cards they'll reach to use over and over," said Diaz. "Fiserv continues to add equipment, processes and technology to provide innovative solutions - like the exciting new vertical cards - to please cardholders and help our clients achieve their card program goals."

Output Solutions from Fiserv is a leading provider of business-critical communications to the financial services, healthcare, telecommunications, investment services and retail markets. Fiserv offers the industry's most complete and secure card-production services, including design, production, embossing, personalization and encoding capabilities. Reinforcing the company's core competency in payments, Output Solutions was ranked first in the last three Madison Advisors Print Industry Best Practices Studies, when measuring the business practices associated with the manufacturing and delivery of personalized documents such as statements, transaction confirmation and checks for print/mail and electronic delivery.

About Fiserv

Fiserv, Inc. (NASDAQ: FISV) is the leading global provider of information management and electronic commerce systems for the financial services industry, driving innovation that transforms experiences for financial institutions and their customers. Ranked No. 1 on the FinTech 100 survey of top technology partners to the financial services industry, Fiserv celebrates its 25th year in 2009. For more information, visit www.fiserv.com.

# #

Monday, November 30, 2009

86 Character Password or "Eighty-Six" Passwords Completely?

Help Net Security talks with an IT expert about what makes a strong password. They conclude that it should be no shorter than 86 symbols. So the way I see it, we have two choices.

1. Create your 86 character password now. Here's an example:

3sqk3hvo9xa

wk3n4ffsiUfxk

wpx92skgnns

w1qQ2hdMjLg

^9T%dsqwdK2

6aZdgvo95d02

kfoeNsPsWau

Us4J3S

2. Eighty-Six (Eliminate) Passwords Completely

That's the one that gets my vote. Think keyloggers care if they have to cut and paste 4 digits or 86? We need to "get smart"...we need to swipe, encrypt, transmit.

From HNS: What makes a strong password?

In 1948 an American mathematician and engineer Claude Shannon entered information entropy term (measurement of uncertainty) in his work "A Mathematical Theory of Communication". If we take, for example, English text, it takes 8 bit (one byte) to represent one symbol. Eight bit allow encoding 256 different symbols. However, there are only 26 characters in English alphabet and they can be easily represented by five bit (32 possible combinations). Consequently, uncertainty of one symbol of an English text makes not 8, but less than 5 bit.

In addition, some symbols and combinations are considerably more frequently used than others. A letter “E” is encountered hundred times more frequently than “Z”, and “U” always follows “Q”. Such peculiarities allow reducing uncertainty even more. According to mathematicians’ evaluation it makes around 1.5 bit per symbol for texts in English.

This means that if information is protected by encryption with 128-bit encryption key, and a password will be an English phrase (without space characters, punctuation marks, and in one register), a really strong password (an oxymoron) should be no shorter than 128/1.5 = 86 symbols.

Speaking about the Internet in general - we won’t escape from passwords in the nearest future. They are habitual and their usage doesn’t require special equipment.

Editors Note: That may be true when it comes to accessing email, but when it comes to securing financial transactions, we can't afford to be messing around with passwords...anymore.

Especially when our device costs less than most "useless" bank promos.

BTW: Did you know that the "P" in Passwords is silent?

Keep It Smart, Swipe!

"However, in business segment passwords will continue to get substituted by two-factor authentication (e.g. smart card/USB Token + password/PIN code).

Though such means of authentication require financial expenditures, they should be paid. (they can afford it...vs. the alternative)

They will guarantee a significantly higher security level

than the one provided by using only passwords."

Out of Band Authentication Compromised

Fraudsters Find a Flaw in Elite Authentication

American Banker | Monday, November 30, 2009

by Rebecca Sausner

Banks in the U.K. are battling fraudsters who have found a way to compromise out-of-band authentication — widely considered one of the strongest security formats...

Continue Reading at American Banker

(subscription required)

Will the UK Abolish Check Clearing?

UK May Abolish Check Clearing

Bank Technology News | November, 2009

by John Adams

The trend toward cards and electronic payments has become strong enough that the largest banks in the United Kingdom are scheduled to vote soon on whether to stop clearing checks.

Members of the United Kingdom’s Payments Council, consisting of banks, are scheduled to vote in Dec. 16, with an announcement on the vote scheduled for January. A deadline for the end of check clearing was not announced, but 2018 has been floated by the Council as a possible deadline during past deliberations on the subject.

Continue Reading at BTN

eBillme Announces Revenue Sharing Program for FI's

Image via CrunchBase

Today eBillme™, the most secure payment option online that enables consumers to use online banking and bill pay services to pay now, pay securely, and use available funds, announces a new revenue sharing program for financial institutions, bill pay portals, and walk-in networks. As part of this new program, eBillme will offer a revenue share for every eBillme transaction generated by the third party, which is an opportunity for financial institutions to leverage their investment in online banking, expand their online bill pay offerings, and generate new revenue.

“eBillme leverages online banking for eCommerce checkout to give consumers a secure way to pay with cash online,” says Marwan Forzley, President and CEO of eBillme. “Consumers bank and pay bills online because they trust their financial institution. This new program is an opportunity for financial institutions to give customers that same sense of security and confidence while shopping online and to finally be able to turn a profit in this sector of their business. And for merchants, this program will bring cash-paying customers to the eCommerce sector at a time when the consumer demand for ways to pay with cash is at an all-time high. We are looking forward to welcoming more financial institutions into this program to make eBillme valuable to them and their customers.”

The pilot program, which began over the summer, included some of the nation’s top banks and walk-in providers leveraging their online, e-mail, and print channels to offer the eBillme credit card alternative to their customer base.

“As the payment preferences of our clients continue to evolve, we are always looking for innovative ways to meet their needs, and this is especially true for online commerce transactions,” says Steve Karp, Senior Vice President of Enterprise Payments Strategy for SunTrust. “Security, convenience, and ease of use are very important to our clients when it comes to making purchases online, and we feel that eBillme brings tremendous value in these areas. This relationship allows SunTrust to extend the value and utility of our online bill payment service, while at the same time providing our clients with unique discounts and incentives at the more than 800 online stores that accept eBillme.”

Matt Frye, Vice President of Product Development for PreCash, says: “We are thrilled to offer cash-paying consumers a way to shop online and pay with cash at our walk-in bill payment locations. Additionally, adding eBillme as a payment option for our Vision Premier® Visa® Prepaid cardholders offers them another secure way to pay when shopping with their card online. eBillme offers our customers the ability to shop online and take advantage of unique offers and discounts within their growing network of online retailers.”

The program brings a significant increase in new customer acquisitions for the more than 800 eBillme merchants.

“eBillme has been a solid performer bringing new customers and a high AOV to our checkout,” says Jeff Wisot, Vice President of Marketing for Buy.com. “eBillme has delivered a 70 percent higher ticket value than our site average, and more than 70 percent of eBillme users were new customers to Buy.com. This program is further evidence that eBillme can deliver a great ROI to online retailers.”

The revenue sharing program has also launched on community sites and will be expanded to include more banks, bill pay portals, and walk-in providers. Companies interested in becoming a part of this program, or learning more about the benefits are encouraged to contact eBillme at sales@ebillme.com.

About eBillme

eBillme™ is the most secure way to pay online and the only online payment solution that extends the convenience of online banking to the merchant’s checkout process. The service enhances security for online shoppers, and enables merchants to increase sales while reducing transaction costs. No financial data is exposed and the payment transaction is securely transferred from the customer’s bank to the retailer’s bank. Consumers can shop online, by catalog or through call centers, and pay for their purchases at their bank, credit union, or bill pay portal using the security and convenience of online banking or by paying the bill at over 75000 walk-in locations. For more information, please visit www.eBillme.com or eBillme’s Online Debt-Free Shopping Mall.

About SunTrust

SunTrust Banks, Inc., with total assets of $172.7 billion on September 30, 2009, is one of the nation's largest and strongest financial holding companies. Through its banking subsidiaries, the company provides deposit, credit, trust, and investment services to a broad range of retail, business, and institutional clients. Other subsidiaries provide mortgage banking, brokerage, investment management, equipment leasing, and capital market services.

Atlanta-based SunTrust enjoys leading market positions in some of the highest growth markets in the United States and also serves clients in selected markets nationally. The company operates 1,690 retail branches and 2,807 ATMs in Alabama, Arkansas, Florida, Georgia, Maryland, Mississippi, North Carolina, South Carolina, Tennessee, Virginia, West Virginia, and the District of Columbia. In addition, SunTrust provides customers with a full range of technology-based banking channels, including Internet, PC, and Automated Telephone Banking.

About PreCash

PreCash provides convenient, real-time payment solutions that convert cash into electronic payments for consumers who do not use traditional payment methods such as credit cards or bank accounts. PreCash offers the Vision Premier Prepaid Visa® card and other prepaid Visa and MasterCard® products, prepaid debit card program management services, real-time cash bill payments, prepaid wireless refills, payroll card products, and more. The company places more than 30,000 prepaid debit cards in the market monthly and services more than 30,000 national retail, wireless dealers and independent retail locations nationwide. Founded in 1998, PreCash is headquartered in Houston, Texas, with additional offices in Portland, Oregon. For more information, visit www.precash.com or www.visionprepaid.com.

PRESS RESOURCES

eBillme Website: http://www.eBillme.com

eBillme Blog: http://blog.ebillme.com/

@eBillme on Twitter: http://www.twitter.com/eBillme

Marwan Forzley: http://www.ebillme.com/about/management-team/

Visa Europe Predicts Busiest Ever ‘Mega Monday’ for Online Shopping

Visa Europe predicts that Monday November 30 will be the busiest ever day for online shopping in Europe and over 3,000 transactions carried by cardholders of Visa cards set to take place every minute on a Visa card across Europe.

Visa Europe says over €318 million is likely to be spent by European cardholders of Visa cards in Europe, with two thirds taking place on Visa debit cards. The volume of transactions is also expected to increase thus by 13% compared with the same day of last year.

Around 4.5 million transactions will take place on November 30, with the busiest period for online sales predicted to be around lunchtime with another peak around 7pm. This will represent a year on year growth of 16%. Over the course of the day, approximately €220,000 will be spent on Visa cards every minute.

Last year, December 1 was the busiest day for online sales with over €280 million spent on Visa cards across Europe. The continued growth in online spend is further shown by the fact that spend on Visa cards has already surpassed 2008’s peak on November 2, 2009.

Visa bases its predictions on up to the minute spending data and previous years’ Christmas spending trends. Over €1 in every €9 spent in Europe is on a Visa card, making this data one of the most reliable indicators of trends in consumer spending, Visa said in a release.

“In the past year, we’ve seen a continued increase in online spend on Visa cards, despite the recession. In fact on November 2, 2009, we surpassed our busiest day for spend in 2008 in Europe. Consumers are becoming increasingly confident shopping online and appreciate the security and convenience of doing so with a Visa card,” said Steve Perry, Commercial Director at Visa Europe.

On the High Street, the last Friday or Saturday before Christmas is usually the busiest shopping day but with Christmas falling on a Friday this year, Visa Europe predicts the busiest day will actually be Wednesday, December 23. Visa expects to process over 27 million transactions across Europe worth around €1.4 billion on this day alone. This represents a 9% growth in spend on 2008. The busiest time is expected to be from 11am to 12pm on Thursday, December 24 when Visa will process up to 850 transactions per second, compared to 731 in 2008.

MasterCard to Host Investment Community Webcast at the Goldman Sachs U.S. Financial Services Conference 2009

PURCHASE, N.Y., Nov. 30 -- On Tuesday, December 8, Tim Murphy, Group Executive, Core Products for MasterCard (NYSE: MA), will participate in the Goldman Sachs U.S. Financial Services Conference 2009 in New York City. The discussion will begin at 3:30 p.m. (Eastern) and last for approximately 40 minutes.

A listen-only live audio webcast will be accessible through the Investor Relations section of the MasterCard website at www.mastercard.com. An audio replay of the session will also be available for 30 days at the same website location.

About MasterCard Incorporated

MasterCard Incorporated advances global commerce by providing a critical economic link among financial institutions, businesses, cardholders and merchants worldwide. As a franchisor, processor and advisor, MasterCard develops and markets payment solutions, processes approximately 21 billion transactions each year, and provides industry leading analysis and consulting services to financial-institution customers and merchants. Powered by the MasterCard Worldwide Network and through its family of brands, including MasterCard® Maestro® and Cirrus® MasterCard serves consumers and businesses in more than 210 countries and territories. For more information go to www.mastercard.com.

SOURCE MasterCard Incorporated

75% of Consumers Feel Online Shopping Less Safe than Retail Shopping

Is Online Shopping Safe for the Holiday Season?

New Study Shows Consumers May Be Misinformed Regarding Identity Theft Risks

IRVINE, Calif.--(BUSINESS WIRE)--Consumers may have incorrect perceptions regarding identity theft while shopping for the holidays, according to a study commissioned by ProtectMyID.com™, the multilayered identity theft detection, protection and fraud resolution product.1

According to the survey, nearly 75 percent of all consumers feel that shopping online instead of at a retail location leaves them more vulnerable to identity theft.

However, these sentiments are contrary to data showing that only one in 10 cases of identity theft occur as a result of online activity.2

Editor's Note: That doesn't preclude the fact that 75% of consumers feel online shopping is unsafe compared to shopping at a retail location...perception is reality. Here's another reality. When consumers shop at a retail location they "swipe" their card vs. type their card number into a box on a website. Therein lies the problem. If consumers were to be equipped with their very own personal point of sale device, such as HomeATM's PCI certified PIN Entry Device, the risk of fraud would be dramatically decreased.

The data also reveals that shoppers’ fears regarding identity theft are heightened during the holiday season, as more than half of respondents felt that the time of year contributed to a greater all-around risk. This heightened fear combined with the busiest shopping period of the year underscores the need for education and awareness surrounding identity theft.

“No one wants to have to deal with the damages caused by identity theft, especially around the holidays,” said Jennifer Leuer, general manager of ProtectMyID.com. “Fortunately, there are simple things people can do now to protect themselves while shopping, and there are products such as ProtectMyID.com that provide a layered defense against this crime.”

Even leading industry organizations, such as the Identity Theft Resource Center®, are urging consumers to be cautious and alert this holiday season.

“As we have seen year after year, the holiday time frame always yields a higher rate of identity theft and related frauds,” said Linda Foley, founder of the Identity Theft Resource Center. “At times like these, it is important to protect yourself from the many individuals looking to take advantage of vulnerable targets both out in public and online.”

To aid consumers in this regard, ProtectMyID.com and the Identity Theft Resource Center have compiled a list of top tips to help protect against identity theft this holiday season:

Beware of shoulder surfers. Protect credit cards, driver’s licenses and checks from wandering eyes.

Beware of skimmers. Skimming occurs when a clerk slides your credit card through a second machine to download its information onto a counterfeit card. Remember to keep your eyes on your cards at all times.

Be aware of your surroundings. Pay extra attention in crowded malls, as pickpocketing numbers noticeably increase during the holidays.

Minimize purse/wallet contents. Carry only the cards you know you will use.

Secure your cards. Never leave your purse/backpack/bag unzipped, and keep a hand on it when in crowded stores.

Use your online shopping smarts. Keep printouts of information detailing your Web purchases. Use a credit card instead of a debit card if possible, and make sure the company’s Website is on a secure server.

Visit trusted sites. Shopping at trusted Websites or those recommended via secure comparison shopping sites, such as PriceGrabber.com^®, can be a good way to reduce online shopping risks.

Be careful with personal items when shopping. Don’t leave your laptop; purse; or any item with credit cards, checks, driver’s license or Social Security numbers visible in your car.

Several other interesting statistics from ProtectMyID.com’s consumer survey include:

Seventy-six percent of the tech-savvy age 18 to 24 demographic expect to do their holiday shopping in-store.

A noteworthy 74 percent of respondents age 55 to 64 feel that in-store shopping is safer than purchasing online.

More than half of individuals age 18 to 24 and older than 65 claim to know someone who has been a victim of identity theft. Forty-four percent of overall respondents make the same assertion.

Overall, nearly two in 10 people surveyed have personally been victims of identity theft.

About ProtectMyID.com™

ProtectMyID.com is a leading, full-service provider of identity theft detection, protection and fraud resolution. ProtectMyID.com offers comprehensive identity theft protection products supported by experienced identity theft resolution professionals who deliver personal attention that customers can rely on. ProtectMyID.com is a Website owned by ConsumerInfo.com Inc., an Experian company. For more information about how ProtectMyID.com helps consumers protect themselves against identity theft, please visit http://www.protectmyid.com/.

About Experian

Experian^® is the leading global information services company, providing data and analytical tools to clients in more than 65 countries. The company helps businesses to manage credit risk, prevent fraud, target marketing offers and automate decision making. Experian also helps individuals to check their credit report and credit score and protect against identity theft.