Hi,

Your processor is raising your rates on April 13, 2007 and June 15, 2007. Have they told you yet?

We won’t which means now we can save you even more money!

Bill

n its first large-scale realigning of interchange rates, MasterCard Worldwide’s independent board of directors is wielding power to redress concerns of some of the most vocal merchants.

MasterCard will change many rates for its U.S. Consumer Credit cards. Most striking is a switch to two card types: Core Value and Enhanced Value (rewards) cards. New rates will take effect April 13.

“The Consumer Credit Enhanced Value program provides a new economic structure for meeting minimum rewards value requirements,” one processor noted in an interchange bulletin issued to its ISOs in early February.

MasterCard did not respond to requests for information.

Enhanced Value hikes in June

On June 15, the Standard rate for a MasterCard Consumer Credit transaction will rise from 2.75% plus $0.10 to 2.95% plus $0.10.

The difference between core and enhanced values is evident in the following categories, in which Core Value will drop from the current rate on April 13, but Enhanced Value cards will take a sometimes steep hike on June 15. All these rates will carry a $0.10 fee per transaction.

· Full Universal Cardholder Authentication Field (UCAF): Core Value will drop from 1.74% to 1.68%; Enhanced Value will rise to 1.83%.

· Key-Entered and Merit I: Core Value will drop from 1.95% to 1.89%; Enhanced Value will rise to 2.04%.

· Merchant UCAF and Merit 3 – Base: Core Value will fall from 1.64% to $1.58%; Enhanced Value will climb to 1.73%.

· Passenger Transport: Core Value will drop from 1.83% to 1.75%; Enhanced Value will rise to 1.90%.

· Travel Premier Service: Core Value will drop from 1.74% to 1.58%; Enhanced Value will rise to 1.90%.

On April 13, rates in the following three MasterCard Consumer Credit categories will drop. Come June 15, they will remain at these rates.

· Merit 3 – Tier 3 will decline from 1.58% plus $0.10 to 1.55% plus $0.10.

· Warehouse Base will fall from 1.48% plus $0.05 to 1.10%, with no flat fee per transaction.

· Warehouse – Tier 1 will drop from 1.27% to .90%.

World Elite rate increases

In April, MasterCard World credit card rates will remain flat or, in some cases, drop by up to three basis points. The World Restaurant rate will be an exception. It will increase from 1.64% plus $0.10 to 1.73% plus $0.10.

World Elite cards will show the biggest rate increases in the following categories:

• Standard
• Full UCAF
• Key-Entered
• Merchant UCAF
• Merit 1 and Merit 3 – Base
• Supermarket – Base
• T&E, which is rising 45 basis points.

The company is also creating a T&E Large-Ticket category.

4 new Commercial cards

In April, MasterCard will introduce several new U.S. Commercial credit card types: Corporate World, Corporate World Elite, Business World and Business World Elite.

Commercial, Corporate World and Corporate World Elite rates will remain largely unchanged from the current fees. However, MasterCard will introduce two new Large Ticket categories for all five cards.

The new Business World and Business World Elite card rates will all be 0.15% higher than the Commercial, Corporate World and Corporate World Elite card rates.

Petroleum windfall

Gas stations will enjoy the most beneficial changes. Since the dramatic rise in gas prices two years ago, gas station owners have been calling for a reduction in interchange rates.

Come April 13, MasterCard will cap its charges on individual petroleum sales.

The U.S. Consumer Credit Petroleum rates (Core and Enhanced) will be 1.90% with no flat fee per transaction. The Petroleum rate for World and World Elite cards will be 2%. The maximum charge per transaction on all MasterCard-branded cards will be $0.95.

The cap will benefit merchants on an interchange pass-through pricing model, according to Chad Lowrey of Chase Paymentech Solutions LLC. Petroleum merchants on a three-tiered pricing model will not benefit from the cap unless their ISOs pass that on. Many station operators are still on the three-tiered model, he added.

Dee Karawadra, Chief Executive Officer of Impact PaySystem, estimated 80% of the company’s petroleum merchants are now on pass-through pricing. He said with tiered-pricing merchants, ISOs can potentially earn quite a bit from the change.

MasterCard U.S. Consumer Debit Petroleum rates will remain at 0.70% plus $0.17, but will operate on the $0.95 cap.

—
Bill Hoidas
District Sales Manager
Larger B2B/MOTO/Internet Accounts
Product Development Manager
Matrix Payment Systems
(847) 381-3482 office
(847) 381-4289 fax
http://paymentconsulting.net
John 3:16 For God so loved the world, that he gave his only begotten Son, that whosoever believeth in him should not perish, but have everlasting life.

There’s no reason to suffer unjustified chargebacks. Only a liar would tell you that if you switch to us that your chargebacks will cease but I will give you advice on how to avoid them and if you do suffer them we work closely with attorneys that specialize in the credit card industry and also a firm that deals only with chargebacks. The fees can be very reasonable and on a contingency basis. And no-we don’t get a referral fee. We just like to help our merchants in any way we can.

‘ve researched the class action and here’s my findings. This is a very famous suit in our industry. Walmart was the leader because when debit cards first came out the rates were the same as regular cards and there were no options for PIN pads. The MC/Visa pirates and their member banks ripped merchants off big time. It covers the time period you were accepting between 10/25/1992 and 06/21/2003. The first point is you are entitled to money The second point is you should make a claim as it’s easy and free (except for the in place lawyer fees). Many merchants are receiving their claim forms. If you have not received yours or have misplaced it no problem just go to http://inrevisacheck-mastermoneyantitrustlitigation.com/

Merchant claims still accepted, feds to receive over $7 million

ligible merchants can still file claims to receive their fair share of the settlement in the class-action “Visa Check/MasterMoney” antitrust case, according to Lloyd Constantine, Partner with the law firm Constantine Cannon, the lead counsel for the plaintiffs.

Also called the Wal-Mart suit for its lead plaintiff, the case, which concluded in 2003, threw out the card Associations’ honor-all-cards rules. It also established a settlement fund with nearly $3 billion in damages from the card Associations.

The law firm has not yet decided when to close the class. “If and when it’s our recommendation to the court that we end that, we will give public notification well in advance,” Constantine said in an interview.

U.S. merchants who accepted cards from Visa U.S.A. and MasterCard Worldwide between October 1992 and July 2003 are eligible for an award.

Making a federal case out of it

In recent weeks, the law firm has mailed checks to most class members (see “Industry Update” in this issue) and reached a settlement with the federal government.

In early 2006, the Justice Department sought to become a member of the merchant class. The government estimated its signature debit, credit and PIN debit claims at up to $11 million.

Counsel for the merchants asserted the government could sue the card Associations on its own behalf and had no standing in the merchant class. Negotiations led to the following compromise in December:

The merchant settlement fund will pay approximately one-third the amount ($3.7 million), Visa and MasterCard will pay about one-third, and the government has agreed to forego about one-third. Visa will pay $2 million and MasterCard will pay $1.5 million.

The compromise was the best course, Constantine said, because the government’s claim was 1) not a significant portion of the proceeds, and 2) hampering efforts to award funds to class members.

“While this dispute was pending, it was … casting a shadow over the settlement fund,” he said. The government’s claim prevented the fund from making final estimations of awards.

Given that the U.S. District Court had not ruled on the government’s claim, a compromise was preferable to waiting out the estimated two-year appeals process that would have followed a court decision.

Facing the music

As part of their 2003 settlement with merchants, Visa and MasterCard agreed to label debit cards as such on their face. The deadline for complying was Jan. 1, 2007. Member banks have re-issued their more than 250 million Visa- and MasterCard-branded ATM/debit cards with the word debit on the front.

“I was pleased to see that [issuing banks] were ahead of schedule in doing that,” Constantine said. Banks appear to have fully complied, but the firm has issued advisories to consumers asking them to report any failure to distinguish debit cards from credit.

Also part of the 2003 settlement: Merchants accepting the brands would now be allowed to ask for another form of payment when either type of card is offered for payment.

The card Associations agreed to pay $250 million annually into the settlement fund for 10 years.

From this, the fund will pay new claimants and, in 2007, make a major distribution to class members who accepted PIN debit during the period covered by the lawsuit.

Although merchants have generally been given one-time payments of all damages to which they are entitled, any money left over at the end of the fund’s life will be distributed as residual payments.

The court agreed in December to Constantine Cannon’s proposal that the 35,000 claimants who were owed less than $5 apiece be paid amounts of approximately $12 each.

The larger payment compensated them in full for any future residual distributions, to avoid sending checks for miniscule amounts at a later date, Constantine said. Those checks were part of the most recent distribution.

Article published in issue number 070102

Robbery on the Electronic Highway ONLINE BROKERAGE FIRMS: THE NEWEST TARGET

The age of electronic information, for all of its upside, does have a downside – it takes something extremely valuable and turns it into something incredibly portable. This makes electronic information not only the best thing to happen to business since the telephone, it also makes it the perfect target for thieves. Information theft, particularly identity theft, is a fast-growing problem that affects millions of people around the world. It takes many forms, from “phishing” schemes targeting individuals with online shopping accounts, to mass information theft from large databases where sensitive consumer information is stored. But there’s a new game in town for information thieves – a sophisticated fraud scheme that has been targeting some of the world’s largest online brokerage firms.
In recent months, overseas hackers broke into customer accounts at major U.S. online brokerages and made trades worth millions of dollars. Ameritrade Holding/TD Ameritrade, the third largest online broker, reported that this new form of online fraud cost them $4 million in Q3 2006. E*Trade Financial Corp, the fourth largest online broker, reported that fraud losses increased by $18 million in that same quarter. Both companies reimbursed customers for losses despite the fact that brokerage accounts are not protected by the Federal Deposit Insurance Corporation (FDIC) and other rules that protect banking customers. The Federal Bureau of Investigation (FBI), National Association of Securities Dealers (NASD) and the U.S. Securities and Exchange Commission (SEC) are working to determine the cause of the fraud, which is being classified as a “pump and dump” scheme – one of the several increasingly popular information theft scams, often initiated from locations like Eastern Europe and Thailand.
In a pump and dump scheme, information thieves steal passwords for victims’ online brokerage accounts, then use this information to purchase stocks using the hijacked accounts. In recent cases, thieves purchased a large number of shares of small-cap low-volume stocks using an existing brokerage account, then liquidated the assets of the hijacked account and used the proceeds to purchase the same small-cap stocks. This drove up the price of the original shares so that the thieves made a profit when they sold the previously purchased stock. Not only was this very profitable for the thieves, it was a clean theft since the stock market essentially laundered the proceeds. In addition, pump and dump schemes may go unnoticed at the brokerage firms because funds are not withdrawn; they’re used to purchase stocks.
Regulators say they’ve seen an increase in pump and dump schemes over the last few months, along with another type of brokerage scam where thieves fraudulently obtain a customer’s log-in credentials, liquidate the account and wire the proceeds to offshore banks.
The experts believe that in recent cases, the passwords were acquired by installing keystroke-logging software on public-access computers, located at Internet cafés or hotels, or by tricking users into installing keystroke-logging software on their own computers. Once the software was installed, the thieves waited until the user typed their user name and password. The software then sent the information to the thieves via the Internet.
Thieves are also obtaining passwords and other sensitive personal information by using “screen-scraping” software. This technology captures whatever is on the screen and sends it to the perpetrator. “Phishing” is another popular method for obtaining account information. It uses e-mails that appear to be from trusted institutions to get users to visit bogus Web sites, where they are encouraged to log in, thus revealing sensitive information. Thieves will also use phishing scams to encourage people to unknowingly download keystroke-logging software.
With the number of incidents rising over the last year, it’s clear that this problem is only getting worse. At an industry conference in Phoenix on October 5, John Walsh, chief counsel in the SEC’s office of compliance inspections and examinations, publicly recognized this growing trend and acknowledged that hackers’ attacks have grown in sophistication.
While brokerage firms are responsible for protecting the sensitive information in their care, some of the responsibility for keeping personal account information safe lies with consumers. According to John Gannon, vice president of investor education for the NASD, consumers should be monitoring their accounts for any unauthorized trades. It’s likely that consumers will start feeling some of the heat generated by these fast-growing crimes as the industry may be looking to consumers to share the burden of protecting their sensitive information.
There are several things consumers can do to help keep thieves out of their online accounts. The SEC has published a guide called Online Brokerage Accounts: What you Can Do to Safeguard Your Money and Your Personal Information. You can find it online at www.sec.gov/investor/ pubs/ onlinebrokerage.htm. This guide provides helpful information on scams and how to avoid them, and includes tips on how to protect yourself online and how to know if your identity has been stolen.
But while consumers are the first line of defense, they are not the only factor in preventing online fraud. Although the online brokerage firms have demonstrated exemplary behavior towards their customers over the last few months – reimbursing them for the losses they incurred – it’s obvious from the attacks that the fraud monitoring systems that these firms have in place can be circumvented.
Fortunately, there are a host of security technologies, including new data activity monitoring and behavioral analysis solutions, that can be added to the lines of defense already in place at many firms to identify suspicious activity. It’s safe to say that reputable online brokerage firms will do everything in their power to avoid future mishaps. Breaches such as these are very expensive. Beyond the obvious losses they incur when they reimburse millions of dollars to customers affected by fraud, this is also a customer-retention and a brand equity issue.
Ultimately, the solution to brokerage fraud lies in consumers and institutions working together to address the problem. Consumers must stay informed and take the necessary precautions to protect account information and passwords, as well as closely monitor the activity in their accounts. Institutions must make sure that the layers of technology are in place to know what’s really going on with the valuable assets in their care. There will always be bad guys to be dealt with where valuables are concerned, but despite malicious hackers and information thieves, the upside of the electronic information age still far outweighs the downside.

—
Bill Hoidas
District Sales Manager
Larger B2B/MOTO/Internet Accounts
Product Development Manager
Matrix Payment Systems
(847) 381-3482 office
(847) 381-4289 fax
http://paymentconsulting.net
John 3:16 For God so loved the world, that he gave his only begotten Son, that whosoever believeth in him should not perish, but have everlasting life.

Merchant needs counsel

I’ve been a subscriber of your magazines since I began in the processing industry, and I have a question. What attorney can you recommend to defend a merchant in a large chargeback dispute?

Thanks, Bill Hoidas Matrix Payment Systems

Bill,

The Green Sheet Inc. does not recommend individuals or companies. However, following are some attorneys we know of (listed alphabetically by last name) who specialize in payments industry-related issues:

Adam Atlas
514-842-0886
atlas@adamatlas.com

Theodore F. Monroe
310-694-8161
monroe@tfmlaw.com

Anthony L. Ogden
661-775-8527
tony.ogden@bankcardlaw.com

Paul A. Rianda
949-261-7895
paul@riandalaw.com

Holli Targan
248-727-1460
htargan@jaffelaw.com

Editor

From a temblor-like shakeup of card Association foundations to an enigmatic, grand-scale security breach, 2006 relandscaped the payments world.

As the card Associations shed old habits, national merchants and consumers alike tested new payments modi operandi: card waving instead of swiping; lattes bought on credit; Google as a payment vehicle; and loyalty cards multiplying like rabbits in wallets.

Changes were apparent in terminology, too. MasterCard International became MasterCard Worldwide and morphed into a corporation by taking itself public in May.

In October, Visa International said it would follow suit, announcing plans to unify its continentally partitioned organization and dissolve its current member-bank structure to become a corporation. Once this occurs, the term “Association” will be industry history.

Bleak house of bankcards

A class-action lawsuit filed by a coalition of convenience stores, drug stores and community grocers against card Association interchange fees lurched along. Pumped into action, Congress heard merchants’ complaints and convened committees. But lacking the political will to legislate interchange controls, representatives and senators simply harrumphed their views on rate-setting.

A sparsely attended post-Valentine’s Day House subcommittee session on interchange was anything but a love-in. “The success of the banks’ legally suspect practices has given them tremendous market power,” said Edmund Mierzwinski, Consumer Program Director at U.S. Public Interest Research Group.

Expressing the contrary view, lobbyists for the Electronic Payments Coalition and others urged lawmakers not to impose rate controls.

In July, bipartisan members of the Senate Judiciary Committee messengered engraved invitations to the legal counsels of Visa and MasterCard for a hearing on interchange policies.

Senators expressed displeasure with merchants’ powerlessness over bankcard acceptance terms and then held the attorneys’ feet to the fire.

While no legislative action was forthcoming, Congress’ sudden interest in rate-setting had the desired effect: The Associations did an about-face on some policies, making their interchange rates public shortly thereafter.

The long, unwinding road

In April, merchants added debit cards to their class-action lawsuit against Visa and MasterCard credit card interchange fees.

The Associations see unwinding their member board structures as a way to preempt future liability from merchant lawsuits. They will then strive for shareholder profits over bank revenue, liberating rate-setting in the process.

While most ISOs looked for cover in the spat between retailers and the card Associations, a few championed the former. In September, Bill Hoidas Sales Manager and Director of Product Development for Matrix Payment Systems http://paymentconsulting.net/ is one of the crusaders.

Some have suggested in a public forum that investors petition the card Associations “to drop interchange immediately.”

Meanwhile, merchants waited to learn whether the federal government will devour a chunk of their $3 billion proceeds from the Wal-Mart suit, settled in 2003. It threw out the card Associations’ “honor all cards” rule. Negotiations between the plaintiffs and the government, which filed a claim at the beginning of 2006, were set to conclude Dec. 22.

Approximately 1 million settlement checks have been sent to date, but many of those were divvied up among multiple merchants, such as franchisees, according to Lloyd Constantine, Lead Counsel for the plaintiffs.

Payouts averaged $1,000 per recipient, he added. Some have received millions of dollars, and 35,000 merchants are expected to receive less than $5 apiece. The actual number of merchants involved could be as high as 2 million.

—
Bill Hoidas
District Sales Manager
Larger B2B/MOTO/Internet Accounts
Product Development Manager
Matrix Payment Systems
(847) 381-3482 office
(847) 381-4289 fax
http://paymentconsulting.net
John 3:16 For God so loved the world, that he gave his only begotten Son, that whosoever believeth in him should not perish, but have everlasting life.

It’s 2007 (Almost.) Is Your Data Secure Yet?

From a security and privacy perspective, the payment services industry has seen a number of dramatic changes this year. From a new iteration of the Payment Card Industry Data Security Standards and the creation of the Payment Card Industry Security Standards Council to the increasingly active enforcement on the part of the Federal Trade Commission, the industry has had a number of new developments with which to contend. From a security practioner’s perspective, perhaps one of the most significant changes, if not the most apparent, has been growing focus on information privacy, rather than on security alone. The issue of information privacy has been prominently featured in the headlines of 2006. According to the Privacy Rights Clearinghouse (www.privacyrights.org/ar/ chrondatabreaches.htm), more than 93 million records containing personal data have been exposed since the beginning of 2006. The types of data compromised run the gamut from research study results to customer records.
Privacy of personal data has garnered so much media attention that one might be led to believe that data privacy is an issue completely removed from more traditional conceptions of privacy. As Justice Brandies defined it in 1890, the right to privacy is the “right to be let alone”. That definition has been further refined throughout the years to include, among other aspects, control over personal information. The issue of controlling personal information, though, has been a long-standing tenet of privacy, deriving from case law dating back to the late 19th century. The advent of technologies such as the internet and e-commerce has sped the proliferation of personal information and made the control of such information far more problematic than in years past.
In addition to the technological innovations that have made the sharing and dissemination of information easier, the development of new business models, affiliations, partnerships, joint marketing agreements and similar arrangements have made the sharing of customer information far more desirable than it may have been previously.
The terms information privacy and information security are frequently, and erroneously, used interchangeably. A previous article (April 2005) expanded on the differences between the two concepts. To reiterate the main differences security is largely concerned with the appropriate access to data using administrative, technical and physical protections, while privacy is primarily concerned with the appropriate uses of data given the circumstances. Certainly the two are related: one cannot have comprehensive privacy practices without a sound information security program to form the foundation. To use the terms interchangeably, however, is to potentially expose your company to extensive liability.
Just as ensuring security of information does not ensure privacy, securing the Primary Account Number (PAN) does little to ensure the protection of privacy. The Payments industry has made great strides in recognizing their obligation to protect sensitive data such as credit card account numbers. But that component may be only one facet of the sensitive information that is collected and stored by companies throughout the industry. Consider gift cards and loyalty programs. The amount of personal data that is stored in order to facilitate those programs goes beyond an account number. Frequently, service providers hold not just the account number, but name and address as well. That data must also be protected from unauthorized use and disclosure.
Most companies are by now familiar with the questions to ask to determine their level of security. Those same companies, though, may be much less familiar with the questions to ask to determine the level of privacy afforded by their information practices. Following is a brief list of questions that one can ask to gauge corporate privacy practices.
What data is collected and stored? Surprisingly, though many companies have addressed their PCI compliance obligations, they are still unsure as to the extent of personal information that resides within their network. Understanding exactly what data is stored is essential to ensuring the privacy of that data.
Is this data strictly necessary for the provision of services or products? Many companies collect more data than is strictly necessary to facilitate the business relationship. Though this may be convenient to enabling market research, direct marketing efforts and other secondary uses, it may expose the company to liability if that data should be compromised.
Who has access to the data in question? This question is essential to both security and privacy. Again, access to data should be granted only on the basis of “need-to-know.” Many companies have been negatively impacted by disgruntled employees that had been granted privileges that were not commensurate with their roles and responsibilities. In addition, employees should be trained on both security and privacy policies with respect to the data in question. There should be no ambiguity regarding their specific responsibilities to the data.
How does the data flow within my organization? Understanding your data flow can help you identify and remediate potential points of “data leakage,” or points at which unauthorized disclosure or access is most likely to occur.
With whom is the data shared? In today’s environment, companies have developed all manner of relationships with other companies. Inherent in those relationships is some level of data-sharing. Before sharing data with affiliates and partners, though, companies should contractually ensure that their partners will ensure a comparable level of security and privacy. If possible, companies should understand the roles and responsibilities of the individuals within those companies that will have access to the data. Does the publicly available Privacy Policy match actual practice? Most companies have posted a privacy policy on their website. It is vitally important that those policies match the actual practice of the company. In order to achieve a privacy policy that is consistent with the company’s practices, cooperation among all the teams that access and use the data is of paramount importance.
The above list is certainly not exhaustive, but does provide a starting point to begin evaluating privacy practices. In addition to asking these questions, and those in the same vein, a Privacy Impact Assessment may also be appropriate.
A Privacy Impact Assessment (PIA), according to the e-Government Act of 2002 which makes PIAs a requirement for government agencies, is defined as “an analysis of how information is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy, (ii) to determine the risks and effects of collecting, maintaining and disseminating information in identifiable form in an electronic information system, and (iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.” Privacy Impact Assessments, though mandated for government agencies, can also be extremely useful in the private sector.
A PIA can help companies understand both their current privacy practices and be used to determine the impact of changes to the system. A PIA not only assures organizations as to the impact of change on their privacy practices, but through conducting a PIA organizations ensure that they have formalized a comprehensive privacy program. A typical PIA may include the following elements:

• Responsibility for the data
  What roles and individuals are responsible for the systems containing private information? (i.e. Chief Privacy Office, Security Manager, IT Manager, etc.)
• Information about the systems
  What are the methods and applications used to collect and store the information? What business functions or departments are supported by these systems?
• Description of the types of information held
  Does it pertain to customers, employees, or other individuals? Does the individual have the ability to “opt-out” of the data collection? Are the requirements to opt-out reasonable?
• Description of the controls used to protect data
  This includes a description of the security controls that are in place to protect against a breach of the data.
• Access to the data
  Which individuals or applications have access to the data and why? How is the access determined (i.e. role-based access controls)? What other agencies or entities have access to the data and why?
• Attributes of the data
  Is the data accurate, timely and reliable? Is the data relevant?

Increased privacy awareness on the part of the consumers is going to have an immeasurable impact on the information practices of those companies in the payments industry. In 2007, companies should expect to look on privacy the same way that they have looked upon data security for the past several years. Helping your customers ensure consumer privacy can become an important competitive differentiator. I’ve stated previously that the focus on security denoted an important paradigm shift for the industry as a whole. That shift, rather than being disrupted, is only complemented by the focus on privacy. In fact, the focus on privacy is a logical conclusion to the shift. Marrying the concepts of security and privacy is a business and regulatory inevitability.

http://www.hallmark.com/ECardWeb/ECV.jsp?a=5593422091740M144474695Y&product_id=