Category Archives: News Update

News Update

Attorneys specializing in credit card/payment processing

Article published in Issue Number: 070101

Forum

Merchant needs counsel

I’ve been a subscriber of your magazines since I began in the processing industry, and I have a question. What attorney can you recommend to defend a merchant in a large chargeback dispute?

Thanks, Bill Hoidas Matrix Payment Systems

Bill,

The Green Sheet Inc. does not recommend individuals or companies. However, following are some attorneys we know of (listed alphabetically by last name) who specialize in payments industry-related issues:

Adam Atlas
514-842-0886
atlas@adamatlas.com

Theodore F. Monroe
310-694-8161
monroe@tfmlaw.com

Anthony L. Ogden
661-775-8527
tony.ogden@bankcardlaw.com

Paul A. Rianda
949-261-7895
paul@riandalaw.com

Holli Targan
248-727-1460
htargan@jaffelaw.com

Editor

News Update

Payments 2006: A tumultuous, tantalizing mix


FFrom a temblor-like shakeup of card Association foundations to an enigmatic, grand-scale security breach, 2006 relandscaped the payments world.

As the card Associations shed old habits, national merchants and consumers alike tested new payments modi operandi: card waving instead of swiping; lattes bought on credit; Google as a payment vehicle; and loyalty cards multiplying like rabbits in wallets.

Changes were apparent in terminology, too. MasterCard International became MasterCard Worldwide and morphed into a corporation by taking itself public in May.

In October, Visa International said it would follow suit, announcing plans to unify its continentally partitioned organization and dissolve its current member-bank structure to become a corporation. Once this occurs, the term “Association” will be industry history.

Bleak house of bankcards

A class-action lawsuit filed by a coalition of convenience stores, drug stores and community grocers against card Association interchange fees lurched along. Pumped into action, Congress heard merchants’ complaints and convened committees. But lacking the political will to legislate interchange controls, representatives and senators simply harrumphed their views on rate-setting.

A sparsely attended post-Valentine’s Day House subcommittee session on interchange was anything but a love-in. “The success of the banks’ legally suspect practices has given them tremendous market power,” said Edmund Mierzwinski, Consumer Program Director at U.S. Public Interest Research Group.

Expressing the contrary view, lobbyists for the Electronic Payments Coalition and others urged lawmakers not to impose rate controls.

In July, bipartisan members of the Senate Judiciary Committee messengered engraved invitations to the legal counsels of Visa and MasterCard for a hearing on interchange policies.

Senators expressed displeasure with merchants’ powerlessness over bankcard acceptance terms and then held the attorneys’ feet to the fire.

While no legislative action was forthcoming, Congress’ sudden interest in rate-setting had the desired effect: The Associations did an about-face on some policies, making their interchange rates public shortly thereafter.

The long, unwinding road

In April, merchants added debit cards to their class-action lawsuit against Visa and MasterCard credit card interchange fees.

The Associations see unwinding their member board structures as a way to preempt future liability from merchant lawsuits. They will then strive for shareholder profits over bank revenue, liberating rate-setting in the process.

While most ISOs looked for cover in the spat between retailers and the card Associations, a few championed the former. In September, Bill Hoidas Sales Manager and Director of Product Development for Matrix Payment Systems http://paymentconsulting.net/ is one of the crusaders.

Some have suggested in a public forum that investors petition the card Associations “to drop interchange immediately.”

Meanwhile, merchants waited to learn whether the federal government will devour a chunk of their $3 billion proceeds from the Wal-Mart suit, settled in 2003. It threw out the card Associations’ “honor all cards” rule. Negotiations between the plaintiffs and the government, which filed a claim at the beginning of 2006, were set to conclude Dec. 22.

Approximately 1 million settlement checks have been sent to date, but many of those were divvied up among multiple merchants, such as franchisees, according to Lloyd Constantine, Lead Counsel for the plaintiffs.

Payouts averaged $1,000 per recipient, he added. Some have received millions of dollars, and 35,000 merchants are expected to receive less than $5 apiece. The actual number of merchants involved could be as high as 2 million.

—
Bill Hoidas
District Sales Manager
Larger B2B/MOTO/Internet Accounts
Product Development Manager
Matrix Payment Systems
(847) 381-3482 office
(847) 381-4289 fax
http://paymentconsulting.net
John 3:16 For God so loved the world, that he gave his only begotten Son, that whosoever believeth in him should not perish, but have everlasting life.

News Update

Fraud Update

Fraud
update

PCI compliance is a problem for more than 85 percent of merchants, according to Paul Giardina, Senior Vice President for marketing for Protegrity, Stamford, CT, a company that provides data protection technology.
Giardina, who discussed these security issues at the 2006 Teradata Partners Conference, in late September in Orlando, Fl, says that companies should pursue “defense in depth,” adding different layers of security as risk and the value of the data to be protected increases.
PCI is one of several new laws that businesses have had to concern themselves with the last few years, according to Giardina. It incorporates some of the elements of Canada’s PIPEDA, HIPAA, several state laws and other international regulations.
Even though Visa and MasterCard have required the compliance for more than 18 months in order for merchants to protect themselves from fines in the event of a data breach. But less only 15 percent had met PCI standards by January, according to a Visa survey. A Protegrity survey showed similar results.
According to the Protegrity survey, less than 5 percent of merchants had passed the PCI assessment and a little more than 30 percent had started their assessment. Nearly 20 percent failed their initial PCI assessment, about the same percentage that said they were just starting the PCI compliance process. Fully one-quarter of merchants had yet to start their PCI compliance process.
Even the percentage from Visa’s survey has doubled in the last nine months; the large majority is still short of the standard, which includes 12 different steps (for more information, see www.pcisecuritystandards.org/pdfs/ pci_dss_v1-1.pdf).
Giardina recommends prioritizing projects based first on which security holes present the highest risk to the company (i.e., adding firewalls for personal computers) and then using ease of implementation as a secondary prioritizing factor.
So firms should first test themselves for each of the 12 PCI requirements and rate the risk factor from 1 (low) to 5 (high), and do the same thing for the difficulty of fixing the security deficiency. “Go for the low-hanging fruit,” Giardina says.
Following this approach also shows that a firm is taking a methodical approach to data security, one of the factors that different regulatory authorities use in determining the liability of an organization.

Visa USA and the U.S. Chamber of Commerce recently listed the following as the five top causes of data breaches and protection solutions:

Storage of magnetic stripe data

The most common cause of data breaches occurs when a merchant or service provider stores sensitive information encoded on the card’s magnetic stripe in violation of the PCI Data Security Standard. This can occur because a number of POS systems improperly store this data, and the merchant may not be aware of it.

Missing or outdated security patches

In this scenario, hackers are able to penetrate merchant or service provider’s systems because they have not installed up-to-date security patches, leaving their systems vulnerable to intrusion.

Use of vendor supplied default settings and passwords

In many cases, merchants receive POS hardware or software from outside vendors who install them using default settings and passwords that are often widely known to hackers and easy to guess.

SQL Injection

Criminals use this technique to exploit Web-based applications for coding vulnerabilities and to attack a merchant’s Internet applications (e.g. shopping carts). According to Protegrity’s Giardina, (see above item) SQL injection is one of the new popular security intrusion methods that hackers are using today.

Unnecessary and vulnerable services on servers

Servers are often shipped by vendors with unnecessary services and applications that are enabled, although the user may not be aware of it. Because the services may not be required, security patches and upgrades may be ignored and the merchant system exposed to attack. As part of its effort to help businesses keep their data secure, the U.S. Chamber is distributing the Visa security alert to its full membership of small and mid-sized businesses nationwide. In addition, the chamber will also be working with its national network of local chambers of commerce to further ensure this valuable information reaches as many businesses as possible. The Visa alert along with helpful answers to data security questions can be found at the Chamber’s web page www.uschamber.com/sb/security.

The Global ATM Security Alliance and the ATM Industry Association recently released “Best Practices for Protecting the Customer’s Personal Bank Account and Identity.” This international manual brings together best practices for both multichannel security for financial services and the prevention of identity theft. The publication represents the minimum security guidelines for fraud management within the retail banking environment.
The idea for the best practices arose when cross-channel fraud increased markedly last year, with compromises at one delivery channel, whether on POS devices or during Internet banking, leading to fraud committed at, say, the ATM. In 2005, for example, well over 50 percent of ATM fraud in the US originated in POS compromises.

News Update

It’ 2007 (Almost) Is Your Data Secure Yet?

It’s 2007
(Almost.)
Is Your Data Secure Yet?

by Heather Mark

From a security and privacy perspective, the payment services industry has seen a number of dramatic changes this year. From a new iteration of the Payment Card Industry Data Security Standards and the creation of the Payment Card Industry Security Standards Council to the increasingly active enforcement on the part of the Federal Trade Commission, the industry has had a number of new developments with which to contend. From a security practioner’s perspective, perhaps one of the most significant changes, if not the most apparent, has been growing focus on information privacy, rather than on security alone. The issue of information privacy has been prominently featured in the headlines of 2006. According to the Privacy Rights Clearinghouse (www.privacyrights.org/ar/ chrondatabreaches.htm), more than 93 million records containing personal data have been exposed since the beginning of 2006. The types of data compromised run the gamut from research study results to customer records.
Privacy of personal data has garnered so much media attention that one might be led to believe that data privacy is an issue completely removed from more traditional conceptions of privacy. As Justice Brandies defined it in 1890, the right to privacy is the “right to be let alone”. That definition has been further refined throughout the years to include, among other aspects, control over personal information. The issue of controlling personal information, though, has been a long-standing tenet of privacy, deriving from case law dating back to the late 19th century. The advent of technologies such as the internet and e-commerce has sped the proliferation of personal information and made the control of such information far more problematic than in years past.
In addition to the technological innovations that have made the sharing and dissemination of information easier, the development of new business models, affiliations, partnerships, joint marketing agreements and similar arrangements have made the sharing of customer information far more desirable than it may have been previously.
The terms information privacy and information security are frequently, and erroneously, used interchangeably. A previous article (April 2005) expanded on the differences between the two concepts. To reiterate the main differences security is largely concerned with the appropriate access to data using administrative, technical and physical protections, while privacy is primarily concerned with the appropriate uses of data given the circumstances. Certainly the two are related: one cannot have comprehensive privacy practices without a sound information security program to form the foundation. To use the terms interchangeably, however, is to potentially expose your company to extensive liability.
Just as ensuring security of information does not ensure privacy, securing the Primary Account Number (PAN) does little to ensure the protection of privacy. The Payments industry has made great strides in recognizing their obligation to protect sensitive data such as credit card account numbers. But that component may be only one facet of the sensitive information that is collected and stored by companies throughout the industry. Consider gift cards and loyalty programs. The amount of personal data that is stored in order to facilitate those programs goes beyond an account number. Frequently, service providers hold not just the account number, but name and address as well. That data must also be protected from unauthorized use and disclosure.
Most companies are by now familiar with the questions to ask to determine their level of security. Those same companies, though, may be much less familiar with the questions to ask to determine the level of privacy afforded by their information practices. Following is a brief list of questions that one can ask to gauge corporate privacy practices.
What data is collected and stored? Surprisingly, though many companies have addressed their PCI compliance obligations, they are still unsure as to the extent of personal information that resides within their network. Understanding exactly what data is stored is essential to ensuring the privacy of that data.
Is this data strictly necessary for the provision of services or products? Many companies collect more data than is strictly necessary to facilitate the business relationship. Though this may be convenient to enabling market research, direct marketing efforts and other secondary uses, it may expose the company to liability if that data should be compromised.
Who has access to the data in question? This question is essential to both security and privacy. Again, access to data should be granted only on the basis of “need-to-know.” Many companies have been negatively impacted by disgruntled employees that had been granted privileges that were not commensurate with their roles and responsibilities. In addition, employees should be trained on both security and privacy policies with respect to the data in question. There should be no ambiguity regarding their specific responsibilities to the data.
How does the data flow within my organization? Understanding your data flow can help you identify and remediate potential points of “data leakage,” or points at which unauthorized disclosure or access is most likely to occur.
With whom is the data shared? In today’s environment, companies have developed all manner of relationships with other companies. Inherent in those relationships is some level of data-sharing. Before sharing data with affiliates and partners, though, companies should contractually ensure that their partners will ensure a comparable level of security and privacy. If possible, companies should understand the roles and responsibilities of the individuals within those companies that will have access to the data. Does the publicly available Privacy Policy match actual practice? Most companies have posted a privacy policy on their website. It is vitally important that those policies match the actual practice of the company. In order to achieve a privacy policy that is consistent with the company’s practices, cooperation among all the teams that access and use the data is of paramount importance.
The above list is certainly not exhaustive, but does provide a starting point to begin evaluating privacy practices. In addition to asking these questions, and those in the same vein, a Privacy Impact Assessment may also be appropriate.
A Privacy Impact Assessment (PIA), according to the e-Government Act of 2002 which makes PIAs a requirement for government agencies, is defined as “an analysis of how information is handled: (i) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy, (ii) to determine the risks and effects of collecting, maintaining and disseminating information in identifiable form in an electronic information system, and (iii) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks.” Privacy Impact Assessments, though mandated for government agencies, can also be extremely useful in the private sector.
A PIA can help companies understand both their current privacy practices and be used to determine the impact of changes to the system. A PIA not only assures organizations as to the impact of change on their privacy practices, but through conducting a PIA organizations ensure that they have formalized a comprehensive privacy program. A typical PIA may include the following elements:

  • Responsibility for the data
    What roles and individuals are responsible for the systems containing private information? (i.e. Chief Privacy Office, Security Manager, IT Manager, etc.)

  • Information about the systems
    What are the methods and applications used to collect and store the information? What business functions or departments are supported by these systems?
  • Description of the types of information held
    Does it pertain to customers, employees, or other individuals? Does the individual have the ability to “opt-out” of the data collection? Are the requirements to opt-out reasonable?
  • Description of the controls used to protect data
    This includes a description of the security controls that are in place to protect against a breach of the data.
  • Access to the data
    Which individuals or applications have access to the data and why? How is the access determined (i.e. role-based access controls)? What other agencies or entities have access to the data and why?
  • Attributes of the data
    Is the data accurate, timely and reliable? Is the data relevant?

Increased privacy awareness on the part of the consumers is going to have an immeasurable impact on the information practices of those companies in the payments industry. In 2007, companies should expect to look on privacy the same way that they have looked upon data security for the past several years. Helping your customers ensure consumer privacy can become an important competitive differentiator. I’ve stated previously that the focus on security denoted an important paradigm shift for the industry as a whole. That shift, rather than being disrupted, is only complemented by the focus on privacy. In fact, the focus on privacy is a logical conclusion to the shift. Marrying the concepts of security and privacy is a business and regulatory inevitability.

News Update

The skinny on chargebacks and disputes – Part III

By Ross Federgreen

When a company receives a chargeback or a dispute, a record of this event is maintained within the payment system. Many merchants do not realize the ratio of disputes and credits is also monitored.

Contracts today often contain the 1-3-7 rule. This means over a given period – usually one month – the percentage of chargebacks cannot exceed 1%; the percentage of disputes cannot exceed 3%; and the percentage of credits cannot exceed 7% of a merchant’s total transactions during that period.

Visa U.S.A. guidelines recommend that merchants continually monitor and track these and other ratios. Specifically, Visa suggests taking the following steps in monitoring chargebacks: 1) Track chargebacks and re-presentments by reason code; 2) include initial chargeback amounts and net chargebacks after re-presentment; and 3) track card-present and card-not-present chargebacks separately.

The orderly approach

The key to helping merchants successfully respond to chargeback notices is organization. Strongly encourage merchants to treat each notification seriously. As we discussed in the first part of this series, each response is driven by a specific time element. In addition, for each chargeback, merchants should know the jurisdiction responsible for the notification, the specific dispute code, the specific issuance bank and the specific request being made.

Here are 15 steps to take when looking at a chargeback notification:

  1. Verify that the notification is addressed to the correct merchant.
  2. Identify the jurisdiction.
  3. Note the due date.
  4. Note the case number.
  5. Note the adjusted transaction amount.
  6. Note the reason code.
  7. Note the dispute type.
  8. Review the case summary.
  9. Note the issuance bank.
  10. Review the original transaction detail information.
  11. Review all attachments, including affidavits.
  12. Determine if you have responded previously to the inquiry or taken action.
  13. Decide if you want to accept or contest the adjustment.
  14. Review required actions.
  15. Complete the chargeback response.

Merchants should keep data organized so they can discern patterns and trends. The point is to reduce future chargebacks and disputes by analyzing the information to recognize emerging patterns. Issues that might surface include problems with fulfillment, problems with issued credits, customer service difficulties and a multitude of other concerns, including the possibility of fraud.

The analytical angle

Trend analysis is critical. It provides merchants a view of not only a single chargeback in isolation but also, more importantly, an overview of the status of merchants’ specific operations. Frequently updating trend information with the knowledge of specific circumstances, such as seasonal variations, will provide merchants with a growing platform of reference data.

At the very minimum, merchants should track and understand the implications of the following on a monthly basis:

  1. Number of chargebacks/total number of transactions
  2. Number of chargebacks per card brand/total number of transactions per brand
  3. Number of chargebacks per month
  4. Number of disputes/total number of transactions
  5. Number of credits.

Why bother with trend analysis? By establishing baselines of behavior you can more readily recognize aberrations. It’s far better to take action related to a predicted increase in chargebacks than react to a situation identified by an outside source.

Many merchants will ask you if there are resources that will provide these services. The short answer is yes. But you, as the ISO or merchant level salesperson, must be well informed about the quality of the provider.

The diligent defense

Do not rely entirely on information provided by a given merchant’s processor/acquirer. The information these entities provide doesn’t account for the critical needs of a successful chargeback defense. The issuance bank is focused on accounting for the specific dispute or chargeback code or identifying specific credit cards that have been used to defraud the merchant in question.

A number of innovative programs have been developed in recent years that attempt to help merchants respond appropriately to chargebacks. Crucial to success is the development of custom responses, which are tied to three variable factors: the specific dispute code, the issuance bank and the specific elements the merchant can use when responding to the chargeback.

For example, it does no good to develop a response that requires merchants to use proof of delivery in the MO/TO or e-commerce space if they, for whatever reason, cannot do so. However, it’s always important to provide this type of information so the most-informed business decisions can be made.

The reliable response

Merchants ask many questions about chargeback and dispute regulation. The primary concern is consequences: What happens if they fail to respond or do not respond in a timely manner?

The simple answer is that all merchants should be taught to respond to all requests. Failure to respond is not prudent, except in cases in which the merchant accepts the account adjustment given in the chargeback notification.

Many merchants ask if there is a criminal component to a chargeback. Chargebacks are not, in themselves, evidence of criminal activity. However, patterns of chargebacks can lead to criminal prosecution after an investigation.

Reasons include evidence of the following: intentional failure to deliver product, delivery of banned items, intentional failure to issue refunds or other illegal activity.

The rules that govern chargebacks are set and governed by the card Associations. Through their corporate governance, new rules can be set or existing rules and regulations can be modified. This process is normally driven by the evolution of payment modalities due to the development and modification of platforms.

The arguable advantage

As an ISO or MLS, it behooves you to be knowledgeable about the chargeback process and its governing rules and regulations. You can enjoy a very significant competitive advantage if you offer your merchant base meaningful and knowledgeable assistance in this area.

A word of caution: Do not offer advice if you are not familiar with the subject. Help your merchants obtain qualified help instead. Remember, if your merchants cannot get paid, they cannot survive.

News Update

Conquering chargebacks

Last month I wrote about the importance of merchant education, emphasizing that proper merchant training can reduce chargebacks .Remember that a card issuer must meet all requirements for the MasterCard Worldwide and Visa U.S.A. chargeback reason code it is using.

Otherwise, the chargeback can be re-presented by the merchant or acquirer, shifting the burden of loss back to the card-issuing bank or cardholder. You may find the examples below helpful in further understanding the chargeback process and certain chargeback reason codes.

MasterCard Reason Code 4860

A card issuer initiated a chargeback for MasterCard Reason Code 4860 (credit not processed) after receiving a letter from a cardholder who was dissatisfied because a merchant issued her an in-store credit for returned merchandise.

The cardholder stated she had no use for the in-store credit and was not advised of the merchant’s in-store credit policy at the time of purchase. She wanted a credit on her card account.

The card issuer processed the chargeback because 1) the in-store credit confirmed the merchant’s acceptance of the returned goods, and 2) the credit was not issued in accordance with MasterCard’s disclosure requirements.

The requirements allow merchants to impose specific transaction terms by printing them on an invoice or sales draft near the cardholder signature line before presenting it to the cardholder for signing.

Transaction limitations may also be disclosed by other means, such as signage or literature, provided they are sufficiently prominent and clear to cardholders. Examples of allowable wording for transaction limitations are “exchange only,” “in-store credit only,” and “original packaging required for returns.”

In this case, the merchant would lose because he did not give the cardholder proper notice of his in-store credit policy. Reason Code 4860 is applicable only if the merchant accepts returned merchandise or service cancellation and issues an in-store credit (or partial credit) without proper disclosure, as specified under the rules. If you help to properly set up your merchants, this chargeback situation can be prevented.

Visa Reason Code 85

The card issuer initiated a chargeback for Visa Reason Code 85 (credit not processed). It attached a copy of the cardholder’s statement with a circle drawn around the merchant’s $59.95 transaction and “canceled” written next to it.

In this case, the merchant can have his ISO re-present this chargeback because the card issuer failed to indicate the reason for cancellation. Reason Code 85 requires the card issuer to provide: 1) the date the merchandise was returned or the services were canceled; 2) proof that the cardholder made an attempt to resolve the dispute; and 3) a reason for the cancellation or return.

Many credit-not-processed chargebacks can be re-presented due to failures to meet these three requirements. I usually find merchants are not even re-presenting chargebacks in situations in which they have already issued credits/returns to cardholders.

Merchants should check every incoming chargeback to see if a credit has already been issued. It’s easy to re-present a chargeback for credit issued.

Visa Reason Code 53

The card issuer initiated a chargeback for Visa Reason Code 53 (not as described or defective merchandise) in which the cardholder attempted to return merchandise purchased at an auction.

At the time of the transaction, the merchandise was represented as a genuine, signed memorabile, but it was actually only a laser copy.

The ISO’s chargeback department re-presented the chargeback with a merchant letter stating the merchandise was clearly described, the cardholder had the winning bid and the cardholder agreed to the merchant’s terms and conditions.

The merchant also provided a signed agreement that stated he would not accept the return of disputed merchandise and all sales were final.

The merchant won this chargeback for three reasons: 1) The language in his paperwork reduced chargeback exposure; 2) the cardholder failed to prove the merchandise sold was not as described; and 3) the cardholder failed to provide documentation from the merchant that guaranteed the merchandise’s authenticity.

These examples show that by paying close attention, a merchant and his ISO’s chargeback department can lessen the cost of chargebacks.

Many issuing banks have large chargeback centers that send improper chargebacks to the same merchants routinely. They will continue to do so for as long as they get away with it. When they know a merchant re-presents invalid chargebacks, they are much more careful about sending chargebacks to that merchant.

Visit the card Associations’ public Web sites for more chargeback resources: usa.visa.com and www.mastercard.com You’ll be better able to serve and properly set up your merchants. You can also provide much card Association information directly to targeted merchants; with e-mail it’s easy to distribute new and updated materials.

David H. Press is Principal and President of Integrity Bankcard Consultants Inc. Call him at 630-637-4010, e-mail dhpress@ibc411.com or visit www.ibc411.com

News Update

Visa issues new alert, identifies leading causes of data breaches

Hackers target vulnerable POS systems they suspect store card data, Visa U.S.A. recently warned, and, in conjunction with the U.S. Chamber of Commerce, stated the five leading causes of data breaches and specific prevention strategies for each.

The five leading causes of card-related data breaches

  1. Storage of mag stripe data – The most common cause of data breaches occurs when a merchant or service provider stores sensitive information encoded on the card’s mag stripe in violation of PCI. This can happen because a number of POS systems improperly store this data, and the merchant may not be aware of it.
  2. Missing or outdated security patches – In this scenario, hackers are able to penetrate merchants’ or service providers’ systems because they have not installed up-to-date security patches, leaving their systems vulnerable to intrusion.
  3. Use of vendor supplied default settings and passwords – In many cases, merchants receive POS hardware or software from outside vendors, which install them using default settings and passwords that are often widely known to hackers and easy to guess.
  4. SQL injection – Criminals use this technique to exploit Web-based applications for coding vulnerabilities and to attack a merchant’s Internet applications (e.g. shopping carts).
  5. Unnecessary and vulnerable services on servers – Vendors often ship servers with unnecessary services and applications enabled, although the user may not be aware of it. Because the services may not be required, security patches and upgrades may be ignored and the merchant system exposed to attack.


Source: Visa U.S.A. and the U.S. Chamber of Commerce

Visa is aware of credit and debit card account information compromises occurring from improperly stored magnetic stripe, or track, data after transaction authorizations are completed. Track data refers to the information encoded in Tracks 1 and 2 of the mag stripe.

The card Association has also observed compromises involving improperly stored card verification value 2 (CVV2) data, PINs and PIN blocks.

To guard against compromises, Visa advised merchants to implement the following strategies:

  • Ask their POS or payment software vendor (or reseller/integrator) to confirm their software version does not store mag stripe data, CVV2, PINs or encrypted PIN blocks. If it does, they should have these elements removed immediately.
  • Ask their payment software vendor for a list of files written by the application and a summary of the content to verify prohibited data is not stored.
  • Review custom POS applications for any evidence of prohibited data storage. Eliminate any functionality that enables storage of this data.
  • Search for and expunge all historical prohibited data elements that may reside within their payment system infrastructure.
  • Confirm that all cardholder data storage is necessary and appropriate for the transaction type.
  • Verify that their POS software version has been validated as compliant with the Visa Payment Application Best Practices. A list of PABP-compliant applications is available at www.visa.com/cisp

Merchants are permitted to store only specific data elements from the mag stripe to support card acceptance, according to Visa. This data includes cardholder’s name, primary account number, expiration date and service code. However, merchants should store this data only if needed, and they must protect it as required by the Payment Card Industry (PCI) Data Security Standard.

Merchants can limit damage from a compromise by not storing track data, CVV2, PINs and PIN blocks. Merchants sometimes store track and other data in the mistaken belief they need it to process merchandise returns and transaction reversals. Acquirers should ensure their merchants have proper processes for each type of transaction, Visa stated.


Merchants who have made improvements to protect customer data

The most-effective weapon

The findings on data breaches came from a detailed review of the card security environment, including common fraud techniques, potential areas of weakness by card-accepting merchants and emerging threats.

“The single most effective weapon in the battle against today’s data theft is education,” said Sean Heather, Executive Director of the U.S. Chamber of Commerce, which, with Visa, conducted a survey of 600 small merchants in 12 target areas.

The survey of businesses accepting credit cards for payments revealed:

  • 64% accept PIN debit.
  • 42% do not worry about securing customer information.
  • 5% have had an incident of lost, hacked or stolen customer data.
  • 29% made improvements to protect customer information, including card data, within the previous three months; 63% did so within the previous year.
  • The top three improvements (14% each) included 1) securing information physically or by adding password-protection; 2) identifying account numbers by the last four digits only; and 3) shredding or eliminating storage of customer information.

An astounding 82% did not know what mag-stripe data is. More businesses (34%) spend a greater share of their resources preventing theft of products and cash than in securing customer data (20%). Some 69% handle data security in-house.

The Visa alert, along with answers to data security questions, can be found at the Chamber’s Web site: www.uschamber.com/sb/security More information is also available at www.visa.com/merchant

News Update

Visa PCI security update

Visa U.S.A. announced today that it is expanding the criteria of its merchant validation levels for compliance with the Payment Card Industry Data Security Standard (PCI DSS). Visa’s move is designed to decrease the risk of data compromises by shifting higher-volume merchants across all payment channels into a more rigorous compliance validation category.

The most significant modification involves the Level 2 merchant category, which previously only applied to merchants processing between 150,000 and 6 million Visa e-commerce transactions per year. Level 2 has now been broadened to include all acceptance channels and applies to any merchant processing 1 million to 6 million Visa transactions per year.
While none of the validation requirements themselves have changed, merchants moving into a new validation level will be responsible for complying with that category’s validation responsibilities. For example, merchants moving from Level 4 to Level 2 must now have quarterly network security scans performed by a qualified independent scan vendor.
The revised criteria impact a relatively small number of merchants. Less than 1,000 Level 4 merchants are expected to move into the Level 2 category, while an equal number of former level 2 merchants processing fewer than 1 million e-commerce transactions per year will move to level 3.
Within the next two months, acquirers will identify any merchant changing levels. These merchants are required to validate PCI compliance with their acquirer by Sept. 30, 2007, generally 12 months from the date of identification.
Compliance with the Payment Card Industry Data Security Standard (PCI DSS) is required of all merchants and any entity that stores, transmits or processes cardholder data. Validation of compliance is part of that process, with validation requirements varying for merchants based on factors such as transaction volume.
A summary of the changes are listed in the chart below:
New Merchant Levels Defined
Merchant Level
New Criteria
Prior Criteria
Required Validation Action

Merchant Level 1
No change
Any merchant processing over 6 million Visa transactions per year or compromised in the past year, regardless of acceptance channel. No change to validation action for this level. Annual onsite audit and quarterly scans required.

Merchant Level 2
Any merchant processing 1 million to 6 million Visa transactions per year, regardless of acceptance channel. Any merchant processing between 150,000 and 6 million Visa e-commerce transactions per year. No change to validation action, but new definition expands the number of level 2 merchants to include former level 4 merchants. Annual self- assessment questionnaire and quarterly scans required.

Merchant Level 3

Any merchant processing 20,000 to 1 million Visa e-commerce transactions per year. Any merchant processing 20,000 to 150,000 Visa e-commerce transactions per year. No change to validation action, but new definition expands level 3 to include merchants formerly in level 2 processing fewer than 1 million e-commerce transactions per year. Annual self-assessment questionnaire and quarterly scans required.

Merchant Level 4

Any merchant processing less than 20,000 Visa e-commerce transactions per year, and all other merchants processing up to 1 million Visa transactions per year. Any merchant processing less than 20,000 Visa e-commerce transactions per year, and all other merchants processing up to 6 million Visa transactions per year. No change to validation action, but new definition reduces the number of level 4 merchants. Annual self-assessment questionnaire and quarterly scans may be required as specified by the member.

Mercator Advisory Group issued a new report, “Extending The PIN: Evaluating The Growth of EFT Networks Into New Markets.”
The debit industry has seen significant growth over the last eight years, while signature debit growth is down ever so slightly from 21 percent in 2003 to 18 percent in 2005. PIN debit has more than compensated with growth rates between 35 to 38 percent in the same time period. As a result of these two spectacular increases, debit transactions either already have, or will very soon, exceed credit transactions.
Despite debit’s incredible growth in volume terms Mercator Advisory Group believes that the EFT networks that enable PIN debit are approaching a critical juncture. Signature debit, while currently facing a slightly slowing growth rate, is also the only debit solution fully enabled and successfully entering several new emerging markets, such as eCommerce, recurring bill payments, and those markets where cash is being displaced using Contactless and signature- less solutions. Left unchecked the increased growth in internet and mobile payments and cash replacement will occur primarily at the expense of growth in EFT transactions. This will be of some concern if these new markets grow as quickly as proponents hope. It is important to note that we are talking about future markets and the relative market share of transaction types in these emerging environments.
This report evaluates the consumer preference for debit instruments today, how these preferences can be shifted by the popular press and the payment industry itself, the targeting of three new markets by card associations for future growth: 1) online transactions, 2) recurring bill-pay environments, and 3) Contactless/signatureless environments intended to displace low- value cash transactions, and issues that make it difficult for EFT network operators to react unilaterally to enter these same evolving markets; and therefore, make co-operative plays related to technology standards and implementation a real consideration.
Tim Sloane, Director of the Debit Service for Mercator Advisory Group and the author of the report, indicates that despite strong growth rates across the board for debit, EFT network operators may need to start establishing plans to target these same markets.
“While predicting overall growth of all three evolving markets may be difficult, it is clear that internet payments will continue to grow significantly. If the recurring bills and cash replacement market segments also experience high growth, then EFT operators may find themselves facing a growing barrier to market entry not unlike that experienced when they had to deploy key pads on POS devices to enable PIN-based debit at the POS.”
The report contains 26 pages and 12 Exhibits.

NYPay announced today its formation as New York City’s premiere networking forum for professionals in the payments industry. The organization conducted its initial launch meeting on June 15th, hosted by co-founding member Hughes, Hubbard & Reed, and attended by dozens of its charter members. The meeting focused on the theme “The Future of Payments” with a presentation made by the Mercator Advisory Group on “Driving Payment Trends through POS Technologies.” NYPay co-founding members from Edgar, Dunn & Company (EDC), TransUnion, CashEdge, and Hughes, Hubbard & Reed moderated the event.
NYPay is designed to provide a professional networking forum for the exchange of views and ideas among active professionals within the payments industry that are located in the New York City metro area. The group interacts via an online user group and at regular face-to- face functions that will focus on current payments trends and issues. Anita Boomstein of Hughes, Hubbard & Reed provides the association’s legal representation and expertise on laws relating to payment systems.
“NYPay brings together professionals in a collegial setting to network and dialogue on relevant issues in the dynamic payments industry,” said Ronald Mazursky, Director, Edgar, Dunn & Company. “The model for this professional forum is based on the successful West Coast association, BayPay, which EDC co-founded in 2005 with membership now in the hundreds of active professionals.”
“NYPay provides a much needed opportunity for payments professionals to stay current on industry developments while connecting with colleagues from various institutions. CashEdge is pleased to be involved as a founding member,” said Demetris Papademetriou, Director, CashEdge, Inc.
Based on NYPay’s stated membership profile, the association is seeking active professionals involved in the Financial Services Industry payments field who can contribute to the forum’s regular discussion groups. Membership is by invitation only.

The National Association of Payment Professionals recently completed its first member survey. With an above-average response from its members, NAOPP gained valuable information on the needs and interests of its members.
The survey contained 26 questions on topics including educational needs, benefits, liaison/representation, and certification along with demographic information needed to assist with negotiating benefits, etc.
The survey revealed: 1) NAOPP’s membership is overwhelmingly male; 2) 66.6 percent of NAOPP’s members have been engaged in the industry for five years or greater; 3) 68.4 percent of the members are 45 years or age or older; and 4) 49 percent earn greater than $100,000 per year.
In addition, members indicated they are interested in educational programming including training at the regional acquirer’s meetings as well as other types of training such as teleseminars and webinars. Members indicated they are interested in information on interchange, ethics, ISO registration and regulation, marketing via the Internet, new types of loyalty programs, and marketing and sales training.
Members further indicated they are interested in the following additional benefits:

  • UPS/FEDEX/DHL mailing service or plan,
  • Professional liability insurance,
  • Long- and/or short-term disability insurance,
  • Rental car discounts,
  • Cellular telephone plans, and
  • Discounted books or magazines.

The Benefits Committee continues to seek members to help identify and negotiate additional benefits identified in the survey.

More than 100 million Americans would use contactless cards to pay for inexpensive, everyday items such as fast food, convenience store items and transit fares, according to a comprehensive new survey released today. A large number of consumers would also use contactless cards to pay for parking, video games and vending items, the survey found.
The survey, conducted by Ipsos Insight and Peppercoin, was a scientific, random sample telephone survey of 1,001 Americans ages 18 and older and has a margin of error of plus or minus three percentage points. Specific survey responses include:

  • Broad willingness to use contactless cards.

    • More than 50 percent of respondents, which translates into more than 100 million Americans, would use contactless cards to buy gasoline, items from fast food restaurants or corporate cafeterias, or groceries. More than 40 percent would use contactless cards to pay for convenience store items and transit fares (subway and bus fares and tolls). Almost 40 percent would use contactless cards to buy coffee or pay for parking, and 30 percent (60 million Americans) would use contactless cards for video games or at a vending machine or kiosk.

  • Greater acceptance with young consumers.

    • More than 50 percent of survey respondents between the ages of 18 and 24 indicated they would use contactless cards to buy a range of goods, including gas, groceries, fast food, coffee, convenience store items, transit fares and video games.

  • High income consumers more likely to use contactless cards.

    • Consumers in households with incomes greater than $50,000 indicated they were more likely to use contactless cards than those with income less than $50,000.

  • Security and ease of use are top concerns

    • Concerns about security and ease of use are the two main obstacles facing contactless card acceptance. Depending on the specific market, between 13 and 22 percent of respondents indicated security concerns would keep them from using contactless cards. The data indicates a need for companies leading contactless roll-outs to educate consumers about the cards’ safety and how easy they are to use. “Contactless payments represent a significant opportunity for the payments ecosystem. Consumers benefit from the increased convenience while merchants gain speed at the point of sale,” said Mark Friedman, President and CEO of Peppercoin. “In addition, when combined with Peppercoin’s Virtual Prepaid and Merchant Loyalty offerings, contactless payments encourage consumers to return more frequently and spend more when they do — translating into increased revenue for merchants.”

The long-touted “paperless society” is still a long way off when it comes to consumer banking statements. Financial institutions continue to spend millions of dollars annually on the printing and postage of periodic, paper-based account statements. Today less than 10% of deposit and 20% of loan accounts in the United States have been migrated to an electronic format.
In addition to an ongoing expense line, many banks, thrifts, credit unions, and finance companies continue to regard account statements as a legal or regulatory obligation – rather than a strategic communications vehicle that affects customers’ perceptions of the institution. New research from TowerGroup notes that while bank statements are unarguably a requirement of law, they are all too often underestimated and underutilized by banks.
Perhaps the most important aspect of bank or finance company statements is that customers frequently open them. While not all consumers read their statements rigorously, they are far more likely to open and read an account statement than they are other pieces of mail received from their bank. At the very least, consumers tend to save their statements – making receipt and retention of the information they contained more assured.
New technologies and techniques designed to enhance the presentation of account-related information have been around for a decade and are gaining ground. According to TowerGroup, as packaged software for statement creation becomes more widely used, both electronic and paper based statements will become increasingly viewed as strategic communications vehicles whose key role is to shape and direct the customer experience. TowerGroup anticipates consumer expectations of how information is presented to them from their bank to continue to increase, as consumers become more familiar with the Web and personalization capabilities available online.

Having the option to make payments via PIN or signature debit increases the number of transactions consumers make monthly, according to a recent survey released by First Data Corp.
The STAR(R) Consumer Payments Usage Study, conducted by an independent research firm, found that consumers who use both PIN and signature debit at the point-of-sale (POS) conduct an average of nearly 23 transactions per month versus 14 for those who solely use signature and 10 for those using only PIN.
The 2005/2006 survey data also points to the continued growth of debit activity at the POS. Over the past five years, consumers’ average POS debit activity has grown from less than eight transactions a month to more than 11. The average total number of debit POS transactions made monthly has increased 21 percent in the last year, from 15 to 18 transactions per month.
Although PIN and signature debit both demonstrated transaction growth, preference of PIN debit over signature debit was 45 percent to 33 percent. Security was the leading response for choosing PIN debit as reported by 48 percent of respondents. Additionally, 57 percent of PIN-secured debit users reported that having the choice to receive cash back at the POS resulted in more usage of their cards.
PIN and Signature Debit Work Best Together

  • 62 percent of ATM/debit cardholders reported using their ATM/debit cards at the POS in the 30 days prior to the survey. Over the past five years, consumers’ average POS debit activity has grown from less than eight transactions a month to more than 11.
  • Among all card users, 45 percent of consumers report using both PIN and signature methods, an increase from last year’s 39 percent. The number of respondents using both is significantly greater than those who report utilizing a single method.
  • Using both methods has a major effect on transaction volume: Those who use both PIN and signature debit account for 75 percent of all debit POS transactions made. Consumers utilizing both methods conduct an average of 23 transactions a month versus 14 for those who solely use signature and 10 for those using only PIN.
  • The expanding number of locations accepting debit, particularly for small-ticket purchases, underscores the value of promoting both PIN and signature debit to consumers. Among respondents, PIN debit is the preferred debit option at discount stores, convenience stores, drug stores and do-it-yourself stores, while signature debit leads in food categories and specialty retail locations.

The National Clearing House’s (NCHA), the single largest settler of clearinghouse check volume in the United States, reported record image volumes of more than 88 million items totaling $56.5 billion for second quarter 2006, more than doubling the organization’s first quarter numbers.
NCHA’s June 2006 image exchange volumes escalated 12.5 times over the organization’s June 2005 volumes. Image exchange items soared from 2.7 million last June to 33.7 million just one year later. Image exchange dollars showed explosive growth climbing from $962.8 million last June to $25.2 billion in June 2006. Year-to-date numbers show that 2006 will be a banner year with 123 million image exchange items totaling more than $78.4 billion.
News Update

Taking advantage of lower rates with purchasing cards

Hi,

We program all of our terminals, software and gateways to do the necessary prompts to take advantage of the lower rates purchasing cards offer.

Purchase Cards have been used by government agencies and corporations to streamline their buying processes for 20 years now. The last ten years has seen tremendous growth beyond the initial “early-adopter” and “getting it figured out” phases, and has grown into an established and growing market segment for enterprise payments. In fact, survey data reports that the annual U.S. Purchase Card spending grew from $80 billion to $110 billion between 2003 and 2005.
However, in order for purchase cards to be used by business and government buyers, they must be accepted and processed by merchants.
This article answers some basic questions regarding the use and characteristics of Purchase Cards to help merchants better understand the market context.

Understanding Purchasing Cards and Their Use: What is a Purchase Card?

On the surface, a Purchase Card may look like your average business or consumer credit card, but a closer examination reveals that Purchase Cards possess more features, capabilities and controls. A typical Purchase Card can be setup to control:

  • Number of monthly transactions
  • Number of daily transactions
  • Total monthly spend
  • Daily spend
  • Amount per transaction
  • Where the card may be used based on merchant MCC code (MCC restriction)

These extra control features help buying organizations manage their purchasing policies and processes.
One of the most differentiating characteristics of Purchase Cards is that their transactions can be processed with the same level of information normally found on an itemized invoice. This is called “Level-3” line item detail transaction data. Level-3 information contains information about the items purchased such as Item Part Number, Description, Quantity, Unit of Measure, Price and more. Level-3 data must come from the merchant and be submitted with the card transaction.
The following chart compares the levels of some of the information that is delivered with Level-1, Level-2 and Level-3 transactions:

ISO Opportunity:

Merchants are being asked to supply Level-3 transactions and need help selecting payment solutions capable of meeting their needs.

Why are Purchase Cards Used?

Purchase Cards are used by buying organizations to streamline their purchasing and payment processes. Cards may be used a variety of ways, but for routine purchases they are issued to authorized cardholders so they can place orders and make payments directly and efficiently on behalf of the buying organization.
In other cases, Purchase Cards are used to make large purchases and payments and are used with Purchase Order and e-procurement systems. As the value of the transactions increase, so does the need to have accurate and detailed information about the purchase or payment.
Because of the increasing transaction value and need for financial accountability, Purchase Card use is often accompanied by the need for the merchant to provide Level-3 line-item detail, which defines exactly what is being purchased, with the payment transaction.
The Level-3 payment detail is delivered electronically to the buying organization’s Purchase Card reporting system where it can be reviewed on a daily basis and automatically entered into their accounting and finance systems.
Purchase Card transactions have tiered interchange rates and are priced differently compared to standard consumer or business card transactions. MasterCardTM and VisaTM have created special interchange rates to encourage supplier participation and support of Purchase Card programs by reducing the supplier’s transaction costs if Level-3 line item detail information is transmitted with the financial settlement.

The key to obtaining the best rates for these transactions is to include line-item detail, also known as “Level-3.” Payment processors can bring substantial value to the merchant by helping them qualify for the lower-cost Level-3 rates. This is even more important if the transaction sizes are large.

Who is Using Purchase Cards and How Much?

Purchase Card use is widespread, even if it is not highly visible. Most midsize and larger corporations have Purchase Card programs in place. Federal, state and local government agencies have multi-year contracts with their purchase card-issuing banks. Universities and utility groups have systems deployed. Purchase Card systems are offered by many commercial banks and other financial institutions.
As noted, the annual U.S. Purchase Card spending grew from $80 billion to $110 billion between 2003 and 2005 – of greater importance is that recent studies suggest that this volume could increase eightfold if all transactions below $2500 were paid with Purchase Cards.
Federal procurement guidelines already mandate Purchase Card use for all spending under the $2500 level. Since 1998 (when a new 10-year contract was issued), the program has increased more than 100% in dollars expended and 60% in transactions. In fiscal year 2005, 301,216 Federal Purchase Card cardholders spent $17.4 Billion dollars via about 26 million transactions for goods and services. See www.gsa-smartpay.com for more information.

Why Merchants Care About Purchase Cards

As more businesses and government users migrate to using purchase cards, merchants who accept purchase cards also benefit. Merchant benefits include:
Faster payment cycle – receive payment in two-to-three days, as opposed to the 30-, 60-, or 90-day wait commonplace with many corporate purchases and traditional payments.
Lower interchange rates. Interchange qualification savings of 30 Basis Points or more are possible for providing Level-3. Greater savings are also possible depending on transaction size.
Level-3 data can help a merchant with transaction documentation or responding to chargeback requests (all the transaction detail is in one place).
Preferred status with their customers. Some buying organizations have mandated use of Level-3 with some or all of their transactions.

Finding Balance for the Merchant

Merchants want to obtain these benefits, but they are also have issues that they need to balance. These include:

  • They need their solutions to be within their capability to use and to support reduced total cost.
  • They would like to lower credit card transaction processing costs. Again the best way to do this is by ensuring proper interchange qualification.
  • Ease of use and deployment. The system should be intuitive and capable of supporting their business processes – as an example, a merchant might need to process transactions manually by a field sales office, electronically from an e-commerce website, and from a back- office accounting system.
  • Their system should afford the ability to integrate data back into their internal systems or offer management reports and inquiry capability to manage business volumes.
  • Migration path for future development
Understanding your Merchant Business: A Solutions-oriented Approach

Merchant processing requirements and solution selection may be influenced by their…

  • Business size: Is the merchant’s organization large, small, or midsize?
  • Typical customers (doing business with the merchant): Are they consumers / corporations / government (Federal, state, local). Are the customers repeat or random?
  • Type of sales: What is being sold – goods, services or both?
  • Sales channels: How are the sales made – MO/TO / Website / E- commerce / Card present?
  • Timing of sale: Are sales made with real-time or non-real-time requirements?
  • Monthly dollar and transaction volumes: How many transactions will be made across the sales channels – 1 or 100,000?
  • Number of locations: Single or multiple?
Transaction/business processes: Is a stand alone solution appropriate or one that can integrate into the merchant’s ordering or finance system needed?

IT infrastructure/systems in use: What systems does the merchant currently have and are they planning for change in the near future? What application software is used – SAP / Oracle / Quickbooks / etc.
Communication options: What communications does the merchant have – Dial, Frame Relay or broadband Internet options?
Security requirements: What information security capacities does the merchant have and are they aware of the Payment Card Industry data security (PCI) requirements? What type of system would be best to reduce their exposure?

Select the Right Payment Service to Process Purchase Cards

Accepting purchasing cards allows merchants to stay competitive and become a strategic supplier to corporate or government purchasing card users. These customers often require enhanced purchasing information beyond the standard financial information provided by most other card processing solutions.

by Aaron Bills