Verified by Visa "Fraught with Security Problems" say Cambridge Researchers

PC World (and other's) are reporting that (according to Cambridge researchers) both Verified by Visa and MasterCard Secure Code don't provide adequate security.  They also argue that for "buying" into the system, merchants are less liable for fraudulent transactions and that some banks, such as RBS are shifting the liability to consumers.  Nice.   Speaking of nice...The Register had this to say:

Verified by Visa bitchslapped by Cambridge researchers (go.theregister.com)

A widely deployed system intended to reduce on-line payment card fraud is fraught with security problems, according to University of Cambridge researchers.



The system is called 3-D Secure (3DS) but known better under the names Verified by Visa and MasterCard SecureCode. Implemented and paid for by e-commerce vendors, the systems require a person to enter a passwordor portions of a password to complete an on-line purchase.

As a reward for investing in the systems, merchants are less liable for fraudulent transactions and are stuck with fewer chargebacks. But banks such as the Royal Bank of Scotland are now holding consumers to a higher level of liability if fraudulent transactions occur using either system, said Steven J. Murdoch, a security researcher at the University of Cambridge.



That is despite what Murdoch and security engineering professor Ross Anderson contend are several flaws with 3DS. They wrote a seven-page paper on the topic, which Anderson presented on Tuesday at the Financial Cryptography and Data Security conference in Tenerife on Spain's Canary Islands.



One of their main points is how 3DS is integrated into Web sites during a transaction. E-Commerce Web sites display 3DS in an iframe, which is a window that brings content from one Web site into another. 



The e-commerce Web site connects directly to a bank, which solicits a person's password in the iframe. If the password is right, the transaction is complete. But the researchers argue that since there's no URL displayed with the iframe, it's difficult to tell whether it's genuine or not.

Continue Reading at PC World



Here's More: (gotta love the title)

Verified by Visa bitchslapped by Cambridge researchers

Secondary credit card security systems for online transactions such as Verified by Visa are all about shifting blame rather then curtailing fraud, Cambridge University security researchers argue.



The 3D Secure system - branded as either Verified by Visa or MasterCard SecureCode - has become a ubiquitous extra line of security for many online transactions, with over 200 million cardholders registered. The number of merchants who insist that users submit an additional password and re-submit a CVV code in order to authorise a transaction makes it hard to shop online without using the technology.

Related articles by Zemanta

• Verified by Visa bitchslapped by Cambridge researchers (go.theregister.com)

Lloyd Constantine Forbes Interview: Visa and MasterCard Case

Lloyd Constantine, of Constantine and Cannon, the law firm who sued Visa and MasterCard for Antitrust violations and author of Priceless: The Case that Brought Down the Visa/MasterCard Bank Cartel,  speaks with the Forbes Video network about the $3 Billion Visa and MasterCard Antitrust case. 

Lloyd Constantine Forbes Interview: The Modern Monopoly

Lloyd Constantine, of Constantine and Cannon, the law firm that brought down the Visa/MasterCard Bank Cartel speaks about "The Modern Monopoly"

No Major PCI DSS Revision Expected in 2010

By Robert Westervelt, News Editor 27 Jan 2010 | SearchSecurity.com PCI Security Standards Council general manager Bob Russo said the next revision of the Payment Card Industry Data Security Standard (PCI DSS), due in October, will contain clarifications but no major changes to the standard. End-to-end encryption is a catchphrase because at a certain point along the line, the data needs to be decrypted. Bob Russo, general manager, PCI SSC "There won't be any surprises," Russo said. "We're more likely to see guidance documents." Encryption, virtualization and the use of more secure payment terminals are expected to gain more attention. Those topics have been the focus of several special interest groups managed by PCI SSC and a study of emerging technologies to help shape future versions of the standard, Russo said. The organization is also ruminating Chip and PIN technology, though no PCI DSS revisions are anticipated on the issue in 2010. PCI DSS related information: PCI QSAs, certifications to get new scrutiny: The PCI Security Standards Council now has a team of five reviewing PCI assessments for inconsistencies and has increased funding for its QSA oversight program. PCI Council issues priority tool for compliance: A PCI compliance tool walks companies through the compliance process by meeting six milestones set by weighing risk and threat factors. Heartland breach highlights PCI limitations: The benefits of complete PCI and the necessity of full compliance are now being widely questioned, says Eric Ogren, principal analyst, The Ogren Group. PCI DSS changes take place on a two-year revision schedule, with the last major update released in 2008. The organization gathers about four months of feedback from council members followed by a meeting of its Board of Advisors in which any proposed changes are put in place. A draft revision of the new standard is due in May, and the organization will gather any remaining feedback at its community meetings in September. The updated PCI DSS standard would be finalized and made public by mid-October, along with any revisions made to the Payment Application Data Security Standard (PA DSS), Russo said. A revision to the PIN Entry Device Security Requirements, also maintained by the organization, is due in April. Rather than a major PCI DSS revision, this year the council expects to release guidance documents to help merchants being bombarded by vendors with new card data protection technologies. A topic deserving further study is end-to-end encryption, Russo said. Robert Carr, CEO of Heartland Payment Systems Inc., which announced last year that it suffered a massive breach as a result of a SQL injection flaw, has been pushing the industry to adopt more comprehensive encryption measures. Heartland has worked with Voltage Security Inc. to develop its E3 secure payment system. But Russo said the term "end-to-end encryption" hasn't been clearly defined and added that tokenization, a facet of a payment strategy being introduced by EMC Corp.'s RSA security division and payment processing giant First Data Corp., introduces similar security issues. "End-to-end encryption is a catchphrase because at a certain point along the line, the data needs to be decrypted," prompting key management questions, Russo said. "Key management introduces a whole new series of issues that could cause you to be less secure." Russo said he doesn't expect an end-to-end encryption special interest group will study the issue. Instead encryption within the payment process will be addressed when other technologies that affect the payment process are identified and studied. The Virtualization Special Interest Group, due to recommend guidance in March on protecting card data within virtualized environments, will address the role of encryption as well, Russo said. "Unfortunately there are so many different technologies that merchants may have started down the path with that we need to be careful and study them before prescribing them in the standard," Russo said. SearchSecurity radio: Chip and PIN technology is also gaining increased attention among the card brands, Russo said. A special interest group is studying Chip and PIN, which is popular in Asia, Europe and being phased in at payment terminals in Canada. The technology replaces the magnetic strip on the back of a card with an embedded microchip and adds a four-digit PIN to confirm a payment. The issue is being pushed by lawmakers. At a congressional subcommittee hearing on the adequacy of PCI DSS to protect cardholder data, several lawmakers called on the industry to move forward with Chip and PIN to reduce data theft and bolster the protection of transactions. "The rest of the world is using some form of Chip and PIN so we can't ignore it," Russo said. "It's an enormous endeavor and implementing this poses huge costs."

Commercial versus Consumer Mobile Banking

Why banks should offer business customers a different mobile banking application than consumers

--(BUSINESS WIRE)--In today’s economic environment, it is critical for financial executives and business owners to have full access to financial information at all times and through multiple channels, including mobile. Many banks recognize commercial mobile banking as a growing trend, but are still slow to roll out the service to business customers. For banks offering mobile banking to businesses, most have simply re-packaged consumer applications for business use, but consumer applications do not provide businesses with the added functionality and enhanced security capabilities required.

Nick Holland, senior analyst with Aite Group, said in a recent report¹, “Small businesses are looking for a host of extra functionalities above and beyond the requirements of vanilla mobile banking, such as wire approvals and positive pay. Banks will be looking to monetize small-business mobile banking, and an offering that does not justify end-users paying for the service is unlikely to receive implementation.”



Online Banking Solutions (OBS) recently launched the industry’s first-ever commercial mobile banking offering, Messenger Mobile Service, a new mobile channel to support commercial banking transactions for banks’ business customers. In addition to TEXT/SMS notifications, users can view account balance, transaction information and special reports; initiate account-to-account transfers, pre-defined payments or payment batches; and receive service alerts, payment advices and urgent notifications. Messenger Mobile Services provides a mobile banking channel with applications for iPhone^tm and Blackberry^tm smart phones.

Who:		Joe Spatarella, VP Sales & Marketing for OBS, can discuss why banks should offer business customers more than a consumer mobile banking application, and explain what sets a commercial mobile banking application apart from one designed for consumers.
When:		Spatarella is available immediately for commentary.
Contact:		Mary York
		Media Contact for OBS
		678.781.7221

About Online Banking Solutions (OBS):

Founded in 2002 by a management team that pioneered Web cash management and business banking technology, launching two successful financial technology companies, Online Banking Solutions (OBS) provides next-generation Online Messenger multi-channel reporting, transaction and file delivery services to banks including seven of the top 50 U.S. financial institutions. Private, profitable and based on the philosophy of over servicing clients, OBS offers financial institutions the extensiveness of a large-scale technology provider, but the tenacity of an agile, service-driven organization. For more information, visit www.onlinebankingsolutions.com.

¹ Editor’s Note: “The ROI of Small-Business Mobile Banking,” September 2009, Aite Group

TIO Networks to Provide Bill-Pay Kiosks to Best Buy

Vancouver, British Columbia, -- TIO Networks Corp., (TSX.V-TNC), North America’s leading multi-channel expedited bill payment processor today announced a strategic alliance with Best Buy Co., Inc. (NYSE:BBY) to roll out self-service bill payment and financial service kiosks to Best Buy Stores across the United States.



The first kiosk systems have already been rolled out and activated in the Phoenix, Las Vegas, Atlanta, and Miami markets. Best Buy customers in these markets can now make expedited bill payments on their wireless, utility, cable and other accounts through the touchscreen and Internet enabled kiosks.



The cash and debit accepting kiosks are positioned strategically in each store to offer Best Buy’s wireless customers convenient access to wireless and other bill payment services.



TIO bill payment is a fast, secure and convenient way to access bill payment accounts, view balances without the need to have account information present and pay bills in cash. Payments are made by feeding the cash directly into the TIO terminal’s note acceptor. Once the payment is accepted, TIO uses an Internet link to ensure timely posting of the payment. Best Buy customers can navigate through TIO applications in either English or Spanish and complete financial transactions by either printing or emailing their receipt to an email address of their choice.



“We are thrilled to provide the retail chain with the largest volume of wireless customer activations the opportunity to offer bill payment services as an extension of the wireless services”, said Hamed Shahbazi, Chairman and CEO of TIO Networks. “Consumers who pay bills in person have traditionally tended to pay such bills in the same location where they acquired their phones. With this initiative, Best Buy now offers a full complement of expedited bill payment services for the nation’s largest wireless operators.”



About TIO Networks Corp.

TIO is the leading multi-channel expedited bill payment processor serving the largest Telecom, Wireless, Cable and Utility bill issuers in North America. With over 20,000 location endpoints to its processing network, TIO symbolizes fast, convenient and secure access to expedited payment services. www.TIOnetworks.com



Source: Company press release.

Online Banking Up 24% in Korea

Online banking up 24%

Use of Internet banking in Korea rose 24.8 percent in 2009 from a year earlier as more people went online for financial transactions, the central bank said yesterday.



Online bank transactions reached an average of 28 million per day last year, compared with 22.4 million in 2008, according to the Bank of Korea. The number is based on online users checking financial records, transferring funds or taking out loans.



The total value of Internet banking transactions came to 29.5 trillion won ($25.4 billion) per day, up 28.9 percent from a year earlier. The number of Internet banking subscribers registered online with 17 local banks, the state-run Korea Post and HSBC Holdings grew to 59.2 million as of the end of last year. The figure has grown by double digits since 2005, the BOK said.



The majority of transactions were conducted via computers, wireless handsets accounted for 6.1 percent of the total. Transactions via mobile platforms jumped 62.7 percent on-year to an average 1.72 million per day, the central bank said.



Nearly nine out of 10 households in Korea have access to cheap broadband Internet. The nation’s computer usage is among the highest in the world. Yonhap

Blippy: Do You Really Want Your Card Transactions Showing Up as a Blip on the Bad Guys Radar Screen

When Blippy, which lets you twitter credit/debit card purchases rolled out earlier this month, my eyes rolled as well. Maybe because I still don't get Twitter. Somebody Tweets "I'm at Peet's" and frankly, it won't be more interesting finding out how much they spent there and what card they used. Who cares? Answer: The bad guys!





Social networking sites have been identified as a nesting ground for purveyors of malware and phishing techniques, thus financial information gathering. It isn't difficult for them to round up needed information, but why make it easy for them by signing up to have your purchases show up as "blips" on the bad guys radar screens? I was waiting for someone else to see the naked emperor before saying anything. Cyveillance has spoken...



Blippy, could be a valuable tool for cyber criminals, warns Cyveillance.



Blippy, a Spear Phisher’s Dream

This month, a service called Blippy was rolled out to the general public. In a CNN article this week, Blippy was described as a “financial version of twitter.com”, where users’ credit card transactions are posted to the internet much like the short tweets that people post to twitter.



On twitter, users post up to 140 characters on any topic they wish to discuss. On Blippy, a posting displays how much a person paid for a recent purchase. In the image below for example, we see that Michael Arrington of TechCrunch paid $112.64 at Amazon for a SanDisk 16GB 60MB/s Extreme Compact Flash Card.

Example of a Blippy transaction. Click the image to see a larger version or see the original here.

CNN reporter John D. Sutter asks Blippy cofounder Philip Kaplan whether there are any dangers in posting this sort of information:

CNN: Is there any potential that this would expose someone to an attack on their financial information, or that it could be used against them?





Kaplan: I don’t — we’ve all been taught that this is just something you don’t do. As an aside, when I was a kid, we weren’t allowed to tell anybody we were going out of town, and we had timers in the house that would turn the lights on and off so it would look like we were home. But now you tweet when you’re at dinner. … You put your whole schedule on Facebook so people can like plan their robberies ahead of time. And I think the pros far outweigh the cons in that scenario. … I think the risks in actuality are very small. Similarly, I think we have this engrained thing that we’re taught, which is to not share this [financial] information, and we don’t really know why.

That’s not the right answer to the question. Information found in Blippy postings (“blips”?) can be used against them.   Let’s go back to the example in the image above.



We find:

• a user’s name


• the name of a business with whom they had a financial transaction


• how much they spent


• for certain retailers, what they bought

Great. Now let’s examine what is presented to someone when they receive an email in a traditional phishing attack, which we know to be a very profitable endeavor for bad guys. (A recent study by Cyveillance found that average attacks can cost millions of dollars in losses). It really comes down to two things:

• The email is made to look like it comes from one’s bank or other business institution.


• A call to action, where the recipient is asked to follow a link to a website online.

Spear phishing takes things a step further by personalizing the email sent to the potential victim. The attack may address the victim by name or phone number (see example), lending credibility to the attack and greatly increasing the likelihood that the recipient becomes a victim.



From a cyber criminal’s point of view, Blippy currently offers great information to construct a highly targeted spear phishing attack. After examining the types of purchases Blippy shows for Best Buy, consider the spear phishing attack one could construct for a hypothetical Blippy user named Johann Gonzales:

Dear Johann Gonzales,

Thank you for your recent purchase of $52.99 at Best Buy. To receive credit for your purchase in our Best Buy Reward Zone program and receive valuable discounts on future purchases, click here…





Putting together such an email would require software to “scrape” information from Blippy that it would then use to send to an array of likely email addresses for Johann Gonzales, like jgonzales@gmail.com, jgonzales@hotmail.com, johanngonzales@gmail.com, johanngonzales@hotmail.com, and so on. Given that software needed to carry out such an attack is freely available online, it must be assumed that cyber criminals are preparing such an attack on Blippy users. Even if they are not yet preparing, for the sake of Blippy’s users, Blippy must plan ahead as if they are.



Conclusion



Currently banks reimburse users when they become victims of phishing attacks, but the financial industry often wonders at what point it becomes the victim’s responsibility for losses incurred during phishing attacks. The information that Blippy users currently provide to would-be cyber criminals gives businesses more leverage to say that they will not reimburse losses incurred in spear phishing attacks. After all, if the Blippy user practically hands the bad guys all the information they need to carry out an attack, how is it the bank’s fault? Blippy does hold promise as a way for consumers to gain information about the prices of goods and services. But it also currently provides a literal wealth of information for spear phishers. 

Related articles by Zemanta

• Blippy Shows Its Own Funding On Blippy. And Now Everyone Can See. (techcrunch.com)


• Blippy Makes All Your Credit Card Transactions Public (shoppingblog.com)


• Blippy tells the world what you buy (cnn.com)


• Are You Ready to Tweet Credit and Debit Card Purchases? (blogs.wsj.com)


• Quick thoughts on Blippy (daryn.net)


• Twitter Hacked, Defaced By "Iranian Cyber Army" (kureng.com)

Class Action Lawsuit Filed Against Citizens Bank, Alleging Bank Improperly Charges Overdraft Fees, Violating Federal Law, State Law, and Its Contract With Customers

Source: Press Release



A class action lawsuit filed yesterday would require Citizens Bank to refund hundreds of millions of dollars in unlawful overdraft charges -- which Citizens Bank often charged even when the customers had enough funds in their accounts to pay for the purchase.



The lawsuit was filed in federal court on behalf of Jessica Duval, of Goffstown, New Hampshire, and other bank customers who were unfairly and illegally charged overdraft fees by Citizens Financial Group Inc. ("CFG"), for charges she made on her ATM/debit card. CFG is the parent company of Citizens Bank and Charter One Bank.



The class action lawsuit alleges that these charges violate federal and state law, as well as the contractual relationship the bank has with its customers. The lawsuit seeks certification of a class action on behalf of Citizens Bank and Charter One Bank customers who were improperly charged overdraft fees or who received insufficient disclosures about such overdraft fees.



"While the federal government has begun to regulate overdraft fees, Citizens Bank and other banks continue to abuse customers and improperly charge overdraft fees. Moreover, customers must be compensated for bank practices that caused hundreds of millions of dollars in improperly charged fees," said Hassan Zavareei, a partner at the Washington, D.C.-based law firm Tycko & Zavareei LLP, which represents the plaintiff.



"Citizens Bank manipulates the posting of transactions to incur $37 overdraft fees on accounts, and customers cannot stop the bank from making arbitrary decisions that their accounts have been 'overdrawn.'



The bank punishes customers and their families with these charges, causing further pain for families already stressed by the poor economic situation," Zavareei said. Citizens Financial Group, Inc. ("CFG") is a $151 billion commercial bank holding company. It is headquartered in Providence, R.I., and, through its subsidiaries, has more than 1,500 branches and approximately 3,500 ATMs and approximately 22,600 employees. Its two bank subsidiaries are RBS Citizens, N.A. and Citizens Bank of Pennsylvania. They operate a 12-state branch network under the Citizens Bank brand in Connecticut, Delaware, Massachusetts, New Hampshire, New Jersey, New York, Pennsylvania, Rhode Island and Vermont, and the Charter One brand in Illinois, Michigan and Ohio.

The complaint alleges that Citizens Bank/Charter One manipulates debit transaction posting to cause overdraft fees even when there are sufficient funds to pay for a certain purchase. Citizens Bank uses several different methods to cause a customer to incur an overdraft fee even when her account has never been overdrafted.

The complaint also alleges that Citizens Bank directly violates the terms of its account agreement by allowing purchases and withdrawals even when a customer has an insufficient balance. For example, one contractual provision states that the bank will not allow withdrawals when there are insufficient funds. In fact, the class action alleges that the bank does allow withdrawals on insufficient funds even at its own ATMs -- and it does so without any prior warning to the customer. According to the complaint, the bank does this for the sole purpose of charging its own customers an overdraft charge.



The complaint also alleges that Citizens Bank has not allowed its customers to opt out of "overdraft protection," as recommended by Federal regulators.



The lawsuit is captioned Duval v. Citizens Financial Group, Inc. and has been filed in the Northern District of Illinois.



Copies of the complaint may be obtained from Hassan Zavareei at Tycko & Zavareei LLP.



SOURCE Tycko & Zavareei LLP

New Online Shopping Data Shows 23 Percent of Consumers Will Shop Online for Valentine’s Day

According to the eBillme Online Spending Index, 9 Percent of Consumers Will Spend More Online Than Last Year and 57 Percent Plan to Purchase Something Other Than Flowers or Chocolates

RYE BROOK, N.Y.--(BUSINESS WIRE)--Twenty-three percent of consumers plan to shop online for Valentine’s Day gifts, with 9 percent indicating they will spend more money online compared to last year. This represents an increase in online shoppers over the 2009 Valentine’s Day holiday. Further, the majority of consumers will shop for gifts other than the traditional flowers and chocolates.



This is according to the eBillme Online Spending Index, a quarterly survey conducted by Javelin Strategy and Research. The Index polls 1,200 consumers to measure projected online spending for the quarter and the influencing factors. According to the Q1 Index, consumers plan to spend an average of $236 online, which is in line with spending levels from Q1 2009.



This quarter, consumers were also asked if they have decided what purchases they will make for Valentine’s Day. Overall, 47 percent of respondents do not know what to purchase for their loved ones.

Fifty percent of males are unsure about Valentines Day gifts for her.

Forty-five percent of females are unsure about Valentines Day gifts for him.

Consumers who are married or living with their partners responded with more uncertainty.

Consumers become more certain about what to purchase with age. Consumers 65 years old and over responded with more certainty than consumers in the younger demographics.



“Valentine’s Day is an opportunity for retailers to build on holiday sales,” says Samer Forzley, Vice President of Marketing for eBillme. “The number of consumers planning to shop online for Valentine’s gifts and spend more than last year is encouraging news for the eCommerce industry. It’s interesting to see that consumers are looking towards more non-traditional gifts this year but are still in the dark about they will be purchasing. For e-tailers, this means there is still time to market and capture these undecided sales.”



The Online Spending Index is released quarterly by eBillme, the most secure payment option online that enables consumers to pay with cash using online banking and walk-in locations. eBillme offers consumers buyer protection features including satisfaction guarantee, best price, in-transit protection, and fraud protection, in addition to cash-back rewards through the eBillme Rewards program.



For more information or to receive the full findings from this quarter’s Index, please contact Samer Forzley at sforzley@eBillme.com.



About the Index



The Index is based on data collected from an online consumer survey deployed quarterly starting in August 2008, with a sample size of 1,209 respondents. The survey targeted U.S. adults (age 18 +) and was based on representative proportions of gender, ethnicity, and income as compared to the overall U.S. online population. Overall margin of sampling error is ±2.8 percentage points at the 95 percent confidence level.



The next Index will be released in April 2010. Data from the Index will be posted on the eBillme Web site at http://blog.eBillme.com.



About eBillme

eBillme™ is the most secure way to pay online and the only online payment solution that extends the convenience of online banking to the merchant’s checkout process. The service enhances security for online shoppers, and enables merchants to increase sales while reducing transaction costs. No financial data is exposed and the payment transaction is securely transferred from the customer’s bank to the retailer’s bank. Consumers can shop online, by catalog or through call centers, and pay for their purchases at their bank, credit union, or bill pay portal using the security and convenience of online banking or by paying the bill at over 75,000 walk-in locations. For more information, please visit www.eBillme.com or eBillme’s Online Debt-Free Shopping Mall at http://Shop.eBillme.com.

22nd Annual Card Forum and Expo

	Events over the last year changed the entire payments industry landscape — regulatory and legislative activism, shifting consumer attitudes and behaviors, extraordinary loss rates, and the corresponding need to reduce expenses and increase productivity. But change is inevitable. Organizations have been presented with business model overhauls before, often times stimulating new opportunities. This year's 22nd Annual Card Forum & Expo, May 16-18, 2010 at the Hyatt Regency Grand Cypress in Orlando, FL, features advice and lessons learned from industry veterans, carving a path for both recovery and growth following one of the industry's greatest upheavals.	REGISTER TODAY! Special Limited- Time Offer: SAVE $200 off the current rates if you register by February 5th and use PROMO CODE: SAVE200 REGISTER TODAY!
	FEATURED SESSION: Our Keynote Panel Session will feature seasoned executives who have successfully led companies through tremendous change and who will share lessons learned, the challenges each has faced over the course of their careers, and how lessons from the recent past can help the industry adapt to the new environment. What We've Learned from the Great Recession, and Challenges Past Panelists: Daniel J. Frate Executive Vice President, Retail Banking PNC Financial Services Daniel J. Frate leads the Products and Alternative Channels group for the Retail Banking business line. This includes consumer and business deposit products, consumer and business lending products, the online channel and emerging technologies, payment products and telephone banking. His experience of more than 20 years in the banking industry includes serving as President of U.S. Bancorp's payment systems business and as the company's senior consumer risk officer. Prior to his current position at PNC, he served as vice chairman and executive vice president of National City Corporation, leading the Retail Banking business line, including the branch network, direct lending, deposits, retail services, direct banking, credit card, insurance, customer strategy, channel management, business banking and National City Mortgage. Siddharth N. "Bobby" Mehta CEO & President, TransUnion & Former Chairman and CEO, HSBC Finance Corporation Siddharth N. “Bobby” Mehta is CEO and president of TransUnion and brings more than 20 years of financial services experience to the position. Before TransUnion, Mehta was chairman and CEO of HSBC Finance Corporation, one of the world's largest banking and financial services organizations. He was also the group managing director of HSBC Holdings plc, with responsibility for the strategic management of the consumer finance customer group and credit cards throughout the HSBC Group. David D. Wesselink former Chairman & CEO Metris Companies Inc. Mr. Wesselink is the retired Chairman and CEO of Metris Companies, a consumer financial services company that was acquired by HSBC in December, 2005. He joined Metris as chief financial officer in 1998, was promoted to vice chairman in 2000, and was appointed CEO in 2002. Before coming to Metris, Wesselink was with Advanta Corp., which he joined in 1993 as senior vice president and chief financial officer. Prior to Advanta, he spent 23 years at Household International. He was named HFC’s chief financial officer in 1982 and a senior vice president in 1986. This Keynote Panel will be moderated by Mark Van Ert, Managing Director, FG Solutions. Mr. Van Ert is a 20-year veteran of the card industry, and currently acts as the Managing Director of FG Solutions, a strategic consulting firm that focuses on the needs of consumer financial services firms. Please check the conference website for agenda updates, news on the latest keynote speakers and sessions you won't want to miss. Register by February 5th and save additional $200 off the current conference rates! Use PROMO CODE: SAVE200 when registering online or mention this code when you call our customer service representative at 212.803.8348. We look forward to seeing you in Orlando in May. Best Regards, Emily Otani Manager, Conference Program Development, Payments SourceMedia

MANA President Pushes For Interchange Fee Reform

Says rising interchange fees are hurting consumers, particularly in challenging economic times

WASHINGTON, Jan. 26 /PRNewswire-USNewswire/ -- Following yesterday's California General Assembly's hearing on interchange fees, Alma Morales Riojas, President of MANA, A National Latina Organization headquartered in Washington, D.C., issued the following statement pushing for interchange fee reform.  Riojas says that excessive interchange fees hurt businesses but they also hurt consumers -- because many businesses are forced to pass along the fees to their customers in the form of higher prices.

"I'm encouraged that the California General Assembly is examining an issue that affects us all -- rising interchange fees.  Credit card companies and their issuing banks charge businesses, and anyone else who accepts credit and debit cards, a fee every time plastic is accepted as a form of payment.  At first glance, this hidden expense seems innocuous, but there is more to the issue than the surface reveals.

"As consumers, it's important that we have the option to use plastic.  However, the fee merchants are currently charged to offer this convenience has been steadily increasing and merchants say the fee has long passed the point of being excessive.  As a result, all consumers are paying the price, literally.  



"Conservative estimates from the Hispanic Institute report that lower income Americans transfer billions of dollars to higher income Americans every year because of hidden credit and debit card fees on goods and services of every type, including necessities of life such as gas, groceries and clothing.  



"This has gone on for far too long.  Credit card companies need to charge merchants an interchange fee rate that is more reflective of the true cost of transaction processing.



"While these fees have gone relatively unnoticed by Congress to date, I believe this issue must be addressed immediately. I urge our Senators and Representatives to take note of the issue that is being recognized in California and urge them to reform interchange fees. It's not just businesses being harmed -- it's all of us."

MANA, A National Latina Organization, is a nonprofit advocacy organization headquartered in Washington, DC.  With chapters across the country, it is the oldest national Latina membership organization in the United States.  MANA, whose mission is to empower Latinas through leadership development, community service and advocacy, envisions a national community of informed Latina activists working to improve the quality of life for all Hispanics.  MANA also has the only national Latina mentoring program for girls 11-18, HERMANITAS®, which brings over 100 girls each year to a Washington, DC, Latina leadership institute that includes educational activities at the White House, on Capitol Hill, and at the Pentagon.

SOURCE MANA: A National Latina Organization

Open Solutions and ISS Informant Announce Alliance Partnership to Provide Fraud Detection Services

GLASTONBURY, Conn.--(BUSINESS WIRE)--Open Solutions Inc.®, a leading provider of integrated enabling technologies for financial services providers throughout the United States, Canada and other international markets, has signed a strategic partnership agreement with Richardson, Texas-based Innovative Support Solutions (ISS), by which ISS will supply its Informant fraud detection solution to Open Solutions’ core clients. The two companies have completed a commercialization process that enabled seamless integration of Informant with Open Solutions’ premier core platform, known as DNA.



The ISS Informant product is a comprehensive suite of flexible and highly customizable components. These components are specialized for real-time monitoring of security and risk management solutions for financial institutions and their clients. Informant components monitor and report on areas of government regulation and compliance, database system intrusion, internal audit policies and transaction based fraud across all member accounts. Every component is customizable to the specific requirements of the financial institution and is kept current with developing trends in fraud and identity theft.



Eric Anderson, Open Solutions’ vice president of Strategic Alliances, said, “We’re very pleased to have formed this strategic alliance with ISS and to be able to offer Informant as a DNA-integrated solution. It’s an excellent solution that offers around-the-clock protection against fraudulent transactions, and knowing it’s been through a rigorous commercialization process with DNA will provide our clients with even more peace of mind.”



“Open Solutions has a reputation for innovative technology and we’re happy they recognized the innovation at work in Informant,” said Ray Seefeldt, president of ISS. “Both companies — and our clients — will benefit from the alliance, and that’s more important than ever. Gartner Group estimates that fraud losses represent roughly seven percent of a financial services institution’s gross revenue. This amount and the instances of financial fraud continue to rise more than 10 percent annually. Transaction analysis, in real-time, is a key component in reducing fraud.”



About Innovative Support Solutions (ISS)



Innovative Support Solutions (ISS) is a tactical services credit union service organization (CUSO) fully owned by Texans Credit Union. ISS provides risk management and fraud protection, operations and consulting services to financial services and related industries.



About Open Solutions Inc.



Open Solutions Inc. offers a fully-featured strategic information management product platform that integrates core processing applications built on a single centralized Oracle relational database, with Internet banking, cash management, CRM/business intelligence, financial accounting and management tools, profitability tools, wealth management, imaging, digital documents, interactive voice response, technology services, HSAs, payments and loan origination solutions. Open Solutions’ full suite of products and services allows banks, thrifts, credit unions and financial services providers in the United States, Canada and internationally to better compete in today’s aggressive financial services marketplace, and expand and tap their trusted financial relationships, client affinity, community presence and personalized service.



For more information, visit www.opensolutions.com.



Open Solutions Inc. is a registered trademark of Open Solutions Inc. All other company and product names may be trademarks of their respective owners. Copyright 2010 Open Solutions Inc. All rights reserved.

VoiceCash Forges Links with Dubai Based Newboard Capital

 Future Focused Firmly on Pakistan, India and Bangladesh



MUNICH--(BUSINESS WIRE)--The UAE remittance market has a volume of about $10 Billion a year. The workforce of the country includes numerous migrants from India, Pakistan and Bangladesh. To cater to them, VoiceCash Group has announced a new service to enable these expatriates to send money home more quickly and safely in comparison with existing channels.



In autumn 2008 VoiceCash received a full European SEPA Banking license establishing VoiceCash Bank in Malta. As money transfers across international borders are one of the biggest growth markets and are emerging worldwide as a significant part of the economic development process, VoiceCash Bank is an important step forward towards providing world-wide access to mobile banking.



To build and provide this service VoiceCash has retained Dubai based Newboard Capital as a strategic advisor. VoiceCash is an associate company of VoiceTrust, the global market leader in the field of authentication through biometric voice verification. It is also the main technology partner for the VoiceCash enterprises.



Newboard Capital has already structured a 17 million Euro buyout for VoiceTrust in 2007 when Dutch investor Marcel Boekhoorn acquired a majority stake in the group by buying out the original German venture capitalists.



Michael Kramer CEO of the VoiceCash Group and Corné Melissen, CEO of Newboard Capital both expressed their firm belief that the new cooperation between the companies will bring serious competition to the UAE remittance market.



About VoiceCash:



VoiceCash specializes in International Mobile Money Transfer. The VoiceCash services enable mobile users to share money with family members or friends abroad without a credit check. VoiceCash issues the first prepaid twin-card for electronic payments, a Prepaid MasterCard twin-card, in Germany. Thus VoiceCash enables cross-border mobile payment services and provides access to 28 million locations, where MasterCard is accepted. Cash withdrawals are possible at 1.5 million ATMs worldwide. The VoiceCash Prepaid MasterCard twin-card can be managed online via Internet, via mobile phone SMS commands or using VoiceTrust’s innovative and certified voice verification system. This also increases the safety level of existing user facilities. VoiceCash Bank has a European banking license. Thus VoiceCash appears as a turnkey supplier for money transfer services offering mobile operators, banks and other service providers a central processing system for worldwide mobile transactions. VoiceCash Bank is the leading service provider for International Mobile Money Transfer in Germany and one of the key players worldwide. For more information, see http://www.voicecash.com

VoiceCash Services GmbH & Co. KG

Geisenhausenerstr. 15

81379 Munich, Germany

Parent company:

VoiceCash Holding B.V.

PO Box 30010

6803 AA Arnheim

The Netherlands

Trade register: Arnhem, Niederlande: 09178615

CEO: Michael Kramer

VAT: NL818929492B01

Online Fraud #1 Threat to UK Merchants, According to CyberSource Fraud Report

Survey Reveals 1.8% of Online Revenue Lost to Payment Fraud

READING, England--(BUSINESS WIRE)--UK merchants say online fraud is the greatest threat they face, according to the Sixth Annual UK Online Fraud Report, an independent survey undertaken by CyberSource Ltd, the UK-based CyberSource (NASDAQ: CYBS) subsidiary. Merchants stated that they lost an average of 1.8% of online revenue to payment fraud in 2009.



Based on the survey results, on average 1.6% of orders accepted proved to be fraudulent, although rates under 1% were common. The rate at which orders are rejected due to suspicion of fraud remains high at an average of 4.6%. This figure has been relatively consistent over the years and points to a continuing challenge for eCommerce merchants, since some of the rejected orders are likely to be valid, resulting in lost revenue.



“Online fraud represents a significant revenue loss for merchants,” said Dr. Akif Khan, co-author of the Fraud Report and Head of Client and Technical Services at CyberSource Ltd. “It’s not just the cost of fraudulent orders that needs to be considered, but also the additional costs of rejecting valid orders, administration of fraud claims and paying for the maintenance of internal systems.”



The survey indicates one of the most dramatic shifts in recent years has been the increased awareness and concern about the theft of customer data. In 2007, just 6% of merchants ranked it as a serious threat. Over the past two years this figure has jumped to over half of merchants. It now ranks second only to online fraud in importance.



Manual Review Represents Profit Leakage



Merchants continue to rely on manual review. Over 70% of merchants surveyed manually check orders as part of their fraud management process; 5% manually review every order. Sixty-nine percent of manually checked orders are ultimately accepted, with one-third of merchants accepting more than 91% of reviewed orders.



Khan continued, “These figures haven’t changed significantly over the last year and it’s a cause for concern that so many manually reviewed orders are actually accepted. Manual review represents a critical area of profit leakage. If not managed effectively it can be expensive, limit scalability and impact customer satisfaction. Merchants should focus on improving the accuracy of their initial automated screening so that only truly suspicious orders are subject to this additional layer of authentication.”



On a positive note, 23% of merchants surveyed use a case management system to support their manual review process; not surprisingly, usage is higher amongst larger organisations (33%). These systems help to make fraud teams more productive by consolidating order information and accelerating the review process. This is particularly important given that 67% of merchants plan to make no changes to the size of their review teams in 2010.



International Expansion Planned



A high proportion of UK merchants already accept orders from mainland Europe, the Americas and Asia Pacific. France, Germany, Italy and Spain are each served by over half of the merchants accepting international orders. In addition, 49% serve the US and 35% Australia. In 2010, merchants are planning to add a number of countries, with China being number one on the list.



Merchants should be vigilant when considering growth strategies. According to the survey, one in four UK merchants that accept international orders stopped serving certain countries due to high fraud levels – with 60% of respondents citing Nigeria as an example.



Optimism for 2010



For 2010, 69% of merchants are expecting their online revenue to grow year-on-year, up from 51% previously. As eCommerce sales continue to grow, and some resources remain relatively fixed, merchants will face the challenge of accepting more online orders, whilst keeping rejection and fraud rates low.



“Protecting against online fraud must be a priority for merchants. Though we are making life more difficult for fraudsters, no organisation can afford to become complacent,” said Khan.



To obtain a copy of the report, please visit www.cybersource.co.uk/ukfraudreport. Journalists or analysts please contact Danielle Cook or Sarita Sawhney on +44 (0)1628 628080 or cybersource@noiseworks.com.



The sixth annual UK Online Fraud Report survey was conducted by research group Vanson Bourne and was commissioned by CyberSource Ltd. The survey was fielded 15 September – 9 October 2009 and yielded 204 qualified responses. The sample was drawn from a database of companies involved in eCommerce activities. Incentives to respondents included entry into a prize draw for one of two iPod touch devices.



About CyberSource Ltd.



CyberSource Ltd is a wholly-owned subsidiary of CyberSource Corporation (NASDAQ: CYBS). CyberSource solutions enable electronic payment processing for web, call centre, and POS environments. CyberSource also offers industry-leading risk management solutions for merchants accepting card-not-present transactions. CyberSource Professional Services designs, integrates, and optimises commerce transaction processing systems. Approximately 284,000 businesses use CyberSource solutions, including half the companies comprising the Dow Jones Industrial Average. The company is headquartered in Mountain View, California, and has sales and service offices in Japan, Singapore, the United Kingdom, and other locations in the United States including Bellevue, Washington and American Fork, Utah. For more information on CyberSource please visit www.cybersource.co.uk or email uk@cybersource.com.



©2010 CyberSource Corporation. All rights reserved. CyberSource is a registered trademark in the U.S. and other countries. All other brands and product names are trademarks or registered trademarks of their respective companies.

Related articles by Zemanta

• CyberSource eCommerce Fraud Report (pindebit.blogspot.com)


• CyberSource Payment Tokenization Now Includes Automated Account Updating (pindebit.blogspot.com)


• UK e-tailers losing £400,000 a year in fraud (v3.co.uk)


• CyberSource 11th Annual Online Fraud Report (pindebit.blogspot.com)

NRF Testifies that Credit Card Swipe Fees ‘Take a Bite’ Out of California Sales Taxes

SACRAMENTO, Calif.--(BUSINESS WIRE)--With California already facing a $20 billion budget deficit, the National Retail Federation warned legislators today that the state’s economy is also taking an increasing hit from hidden “swipe fees” charged every time a credit card is used to make a purchase.

“The credit card companies not only take a piece of every retail transaction, they also take a bite out of sales taxes,” NRF Senior Vice President and General Counsel Mallory Duncan said. “When a card is used, the card companies assess their fee on the final register price. That means we have to pay them 2 percent of the amount we collect for the state. Members of the committee, the sales tax is not our money. It’s not the credit card companies’ money. It’s the people’s money. Californians are hurting, so why should businesses have to pay credit card companies a fee to collect money for the state?”

Duncan testified before the state Assembly Banking and Finance Committee during a hearing held today on credit card interchange, a fee averaging about 2 percent that Visa and MasterCard banks charge merchants each time one of their credit cards is swiped to pay for a purchase. “Swipe” fee collections totaled $48 billion in 2008, triple the $16 billion collected when NRF began tracking the fees in 2001.



Duncan explained how Visa and MasterCard rules effectively force merchants to pass the fees on to consumers by requiring them to be included in the advertised price of merchandise and making discounts for cash, checks or cheaper forms of plastic difficult. As a result, a shopping bag of goods that could be sold for $99 has to be priced at $101 on the assumption that the customer might pay by credit card, he said. Nationwide, the average household paid an estimated $427 in higher prices in 2008, up from $159 in 2001.



“That’s a remarkably anticompetitive rule,” Duncan said of restrictions on discounts for less-expensive forms of payment. “It’s like Pepsi and Coke telling stores they could be fined if they charged people less for other soft drinks. Its effect, of course, is to discourage the market from moving toward cheaper forms of payments.”



“Regardless of whether one uses cash, check or food stamps, we all end up paying the credit card company price,” Duncan said. “In effect, interchange acts as a privately imposed sales tax on U.S. commerce. Experience has shown that when you hide the true price of credit, it doesn’t matter if it’s a subprime loan or sneaky piece of plastic, the public gets rooked.”



“Gold,” “silver” and “platinum” cards with rewards programs cost merchants even more than the average 2 percent. Duncan said they “operate like a reverse Robin Hood,” charging “the poor more in order to deliver rewards to the wealthy.”



In addition to today’s examination of interchange by the California Legislature, bills pending in Congress would require the card industry to negotiate with merchants over interchange and give the Federal Trade Commission authority to prohibit interchange practices that violate consumer protection or anti-competition laws. A Government Accountability Office study commissioned by Congress last year found interchange fees have risen despite Visa and MasterCard claims to the contrary, that the fees drive up prices for consumers, and that prices could be lowered if the fees were lowered.



The National Retail Federation is the world's largest retail trade association, with membership that comprises all retail formats and channels of distribution including department, specialty, discount, catalog, Internet, independent stores, chain restaurants, drug stores and grocery stores as well as the industry's key trading partners of retail goods and services. NRF represents an industry with more than 1.6 million U.S. retail establishments, more than 24 million employees - about one in five American workers - and 2008 sales of $4.6 trillion. As the industry umbrella group, NRF also represents more than 100 state, national and international retail associations. www.nrf.com.



Contacts



National Retail Federation

J. Craig Shearman, 202-626-8134

shearmanc@nrf.com

Major Smart Card Market Players Join Forces to Advance Open and Secure Public Transport Smart Card Applications

Smart Card Makers Giesecke & Devrient and Oberthur Technologies, and Chip Providers Infineon and INSIDE Contactless Launch Initiative to Establish Open Standard



LONDON--(Marketwire - January 26, 2010) - TRANSPORT TICKETING 2010 Conference & Expo -- Smart card manufacturers Giesecke & Devrient GmbH (G&D) and Oberthur Technologies S.A., and chip suppliers Infineon Technologies AG (FRANKFURT: IFX) (OTCQX: IFNNY) and INSIDE Contactless S.A. today announced they have launched an industry initiative to provide a new security solution for next-generation smart card based public transport applications. The solution will build on an open standard now being implemented by the four partner companies, which will eventually be governed by an independent body. Companies active in the smart card arena -- providers of chips, smart cards, application-specific operating software, reader devices and transportation systems -- are invited to join the initiative for the advancement of more secure public transportation applications.



The new standard promises to bring a number of key benefits to both public transport agencies and smart card industry players, including higher performance and advanced system security for public transport applications, as well as the availability of multiple sources for chip products. Through independent testing, the open standard will also provide optimized interoperability to enable simple and fast integration into public transport schemes. The first emulation chips and transportation smart cards using this standard are scheduled to be available by the end of 2010.



The industry initiative is based on groundwork performed by Infineon, the world's number one chip card IC (integrated circuits) provider. Infineon has developed a hardware-based security system specifically suited for public transportation smart card applications. It is comprised of a specific authentication scheme using the open and well-accepted Advanced Encryption Standard (AES) with 128-bit key length and file types and command sets based on the ISO/IEC 7816 standard. Employing AES, an encryption algorithm also used for commercial transactions, will significantly increase security over less-robust security schemes widely used in current public transportation systems. Using the encryption and secure messaging scheme for authentication, data encryption and Message Authentication Coding (MACing) allows high flexibility and fast adoption for different applications. Infineon, which has already started its own chip development based on the open standard security system, has verified the feasibility of the authentication scheme, enabling the other manufacturers to start their development work immediately.



The fabless semiconductor company INSIDE Contactless, the world's largest chip provider for contactless payment cards, has already signed an agreement with Infineon to implement the security scheme for its chip platforms. In addition, two of the world's top three card manufacturers, G&D and Oberthur Technologies, have already agreed to develop public transport applications based on the scheme.



"INSIDE Contactless is proud to be among the initial partner companies of this new initiative, and we are eager to contribute our experience and develop products for this effort as an advanced, open standard is very much needed especially for higher value transport smart cards, which might eventually converge with payment cards," said Remy de Tonnac, CEO at INSIDE Contactless. "With the convergence of contactless payments and transit fare collection in contactless smart cards and NFC enabled mobile phones, INSIDE envisions implementation to the open security standard across all our product lines."



"We see a strong trend towards convergence of secure solutions for transit, between tickets and mobile phones with NFC, and between transit and other payment schemes. As a major player in all these markets, G&D is committed to play a key role in achieving open standards needed to support this convergence. This initiative provides an attractive alternative to existing technologies, and G&D will fully support it with its application security expertise," said Willem Bulthuis, CTO and Group Vice President of Giesecke & Devrient.



"Oberthur Technologies has always supported open standards. As a major actor in the public transportation market segment, we will actively participate in this initiative which aims at delivering increased interoperability and security at lower cost. This open standard will facilitate the deployment of transit systems using multiple end-user devices including multi-application payment cards and NFC phones," said Frédéric Chevreton, General Manager of the Payment and Transport Product Line at the Card Systems Division of Oberthur Technologies.



"This initiative of four smart card heavyweights sets forth a new open platform with enhanced security compared to current solutions in public transportation, one of the fastest growing smart card segments," said Dr. Helmut Gassel, President of the Chip Card & Security Division at Infineon Technologies. "Open systems provide global interoperability of reliable components from multiple sources under fair and reasonable business terms. Infineon contributes contactless excellence and tailored security with the right level of security at best cost-performance ratio to help to advance both current and future transportation applications."



About INSIDE Contactless



INSIDE Contactless is the global leader in open-standard contactless payment and Near Field Communication (NFC) semiconductors and software that power the next generation of payment, transit, identity and access control applications. The company's intelligent, microprocessor-based platforms offer the flexibility to be embedded in smart cards, mobile phones and other consumer electronic devices, documents, badges and other items to support a wide range of innovative contactless applications and bring new levels of convenience to users. INSIDE has delivered more than 350 million contactless platforms worldwide to customers and partners that include many of the leading payment card and mobile phone manufacturers, systems integrators and financial institutions. With a portfolio of 60 families of patents, including several essential NFC patents, the company has played a leading role in NFC and contactless innovation. INSIDE is headquartered in Aix-en-Provence, France, with offices in Shanghai, Singapore, Warsaw, Seoul and Silicon Valley. For more information, please visit www.insidecontactless.com



About Giesecke & Devrient



Giesecke & Devrient (G&D) is a leading international technology provider headquartered in Munich, Germany. With a headcount of around 10,000 employees, the Group generated sales of EUR 1.7 billion in fiscal 2008. Founded in 1852, G&D is a global market leader and pioneering innovator in banknote production and processing, smart card solutions for telecommunications and electronic payment, and security documents and identification systems. 49 subsidiaries and joint ventures across more than 30 countries ensure customer proximity worldwide. For more information, visit our website at: www.gi-de.com.



About Oberthur Technologies



With sales of 882 million Euros in 2008, Oberthur Technologies is a world leader in the field of secure technologies. Innovation and high quality services ensure Oberthur Technologies' strong positioning in its main target markets:



-- Card Systems: The world's second largest provider of security and

identification based on smart card technology and associated services for

mobile, payment, transport, digital TV and convergence markets.

-- Identity: Leading international supplier for the manufacture and

personalization of secure identity documents such as passport, identity

card, driving license or health care card -- traditional and electronic --

and associated services for both governmental and corporate markets.

-- Security printing: World's third largest private security printer

specialized in high security for the production of banknotes, checks and

other fiduciary documents in more than fifty countries.

-- Cash protection: World leader in the emerging market of intelligent

systems to secure cash-in-transit and ATM.



Close to its customers, Oberthur Technologies benefits from an industrial and commercial presence across all five continents.



For further information, visit our website www.oberthur.com



About Infineon



Infineon Technologies AG, Neubiberg, Germany, offers semiconductor and system solutions addressing three central challenges to modern society: energy efficiency, communications, and security. In the 2009 fiscal year (ending September), the company reported sales of Euro 3.03 billion with approximately 25,650 employees worldwide. With a global presence, Infineon operates through its subsidiaries in the U.S. from Milpitas, CA, in the Asia-Pacific region from Singapore, and in Japan from Tokyo. Infineon is listed on the Frankfurt Stock Exchange (ticker symbol: IFX) and in the USA on the over-the-counter market OTCQX International Premier (ticker symbol: IFNNY). Further information is available at www.infineon.com This news release is available online at www.infineon.com/press/