Payments Security

PCI DSS talking points from Arizona

The North American PCI SSC Community Meeting brings together vendors, assessors and other stakeholders from across the payments chain to discuss the implementation of PCI standards. This year’s meeting is in Scottsdale, Arizona and has hosted some lively debates on the future of PCI DSS. Although arguably PCI DSS has been more topical in North America in the past, the international representation of delegates and the issues that are being discussed this year do show that there is an increasing acknowledgement that PCI DSS is indeed a global standard.

So what has been on the agenda?

Chip and PIN Gains Momentum in the U.S.

Thales has previously noted in this blog as well as in the media about the US lagging behind the majority of the rest of the world when moving to Chip and PIN technology. Perhaps momentum is gaining for a change with JP Morgan Chase and Wells Fargo’s announcement last week that they will be testing Chip and PIN technology by mid-year.

We have discussed before that it would take some pretty big voices, either large issuers, a major retailer or the government, to make enough noise for change to the more secure payment card. Also, the increasing fraud rate is certainly a growing concern as consumers are starting to receive more letters in the mail about possible fraud these days than credit card offers.

The announcement last week shows that major players are now willing to dip their toe in the water and test the technology. The first audience being targeted is American travelers who can find it difficult at times to use their magnetic stripe cards overseas. The real question is whether or not this will be the catalyst to change the U.S. infrastructure over to Chip and PIN.

Regardless of the voice, reason or players involved, a global movement to improving payment card security is always a good strategy.

Jose Diaz

PCI DSS recognised as contributing factor to shrinking UK card fraud

The latest card fraud stats from the UK Cards Association show some good news for 2010.  Fraud losses on UK credit and debit cards were 17 per cent lower than the previous year and this is the lowest level at which such fraud has stood since 2000. There was a 15 per cent drop in card-not-present fraud (CNP) which, as stated in the report, may well be due not only to ‘the increasing use of sophisticated fraud screening detection tools’, but also increased use of 3DSecure schemes, such as Verified by Visa or MasterCard SecureCode.

Better consumer education could also be playing a part, because (according to the same report) despite a 21 per cent rise in the number of phishing attacks, the money lost to online banking fraud was in fact down by 22 per cent. This decrease is corroborated by the Fraudscape report, published recently by the UK’s fraud prevention service, CIFAS. This report noted that there was a decrease in use of the internet as a ‘bank account fraud facilitator’ from 33 per cent in 2009 to 19 per cent in 2010, and attribute this to “…the considerable efforts made by financial institutions to combat internet fraud, and an increasingly educated public who are less likely to respond to phishing attacks.”

3DSecure has helped stem the rising tide of CNP fraud, so perhaps it’s time to consider wider roll out of two-factor authentication. As long as there are online retail sites that don’t require it, or as long as the systems only request a password, attacks in this area can still happen.

Maybe in the future we will start to see the use of existing online bank card readers as two-factor authentication or mobile based authentication to further secure online shopping.

What was also interesting to see was that PCI DSS was picked out for the first time in the UK Cards Association findings as one of the factors that could have contributed to the decline in card fraud. Certainly, increasing numbers of retailers are now implementing the cardholder data protection processes required of them by version 2.0 of the standard (announced last year).

Protecting cardholder data is of crucial importance in protecting transactions against fraud and many retailers and acquirers are now adopting approaches that have been pioneered in the US, such as end-to-end encryption, where data is encrypted at source, allowing it to travel safely through vulnerable channels.

While there are no standards for end-to-end encryption yet, PCI SSC have an emerging technology white paper on the subject (called point-to-point encryption in the white paper - P2PE) and say they will provide more concrete guidance/requirements over the coming months. Meanwhile, others are working on standards, and this will be covered in another post.

Steve Brunswick

Eating the US EMV Elephant

Last week, Visa Inc announced that it would eliminate the requirement for eligible merchants to annually validate their compliance with the PCI DSS for any year in which at least 75 percent of the merchant's Visa transactions originate from chip-enabled terminals. Visa Europe also announced a programme to reward investment in EMV that reduces EMV chip merchants’ PCI DSS compliance resource requirements. Both programmes are aimed at providing a strong incentive for remaining magnetic stripe-only merchants to migrate to EMV chip acceptance technology. However, few merchants accept Visa cards alone. As a result, it’s hard to see how merchants will fully benefit from these incentives unless other card schemes follow suit.

Of course, the Visa Inc programme only applies outside the US.  Despite the US being extremely active in investing in end-to-end encryption, tokenisation and other measures to improve security, it remains stubbornly a magnetic stripe environment for lots of reasons (see comments on EMV and the US EMV environment here, here and here).

However, the amount of interest in when, whether and how the US may move to EMV grew exponentially last year. So the paper “Card Payments Roadmap in the U.S.: How Will EMV Impact the Future Payments Infrastructure?” released by the Smartcard Alliance (of which Thales is a member, and to which Thales contributed) is extremely timely. For the first time, here is a paper that looks comprehensively at the various roadmap options available for moving to EMV.

Given the elephantine size of the US payment industry, changing to EMV is still not a walk in the park. However, the report concludes that the wide availability of EMV technology and products means that migration will be less complicated than it would have been a decade ago.

If fraud increases further in the US and criminals take advantage of the country as a softer target than the EMV-enabled rest of the world, a US move to EMV may become more likely.

Many acquirers/processors have already put in place the EMV infrastructure to support customers in Canada and other countries, and many new POS terminals are now EMV compatible as standard. These factors mean that the US payments industry is in fact already beginning to eat the EMV Elephant, a piece at a time, and may find that should it decide to migrate, it is not quite such an insurmountable task after all.

Steve Brunswick

Chickens, eggs and gorillas are red hot

The world of NFC and contactless payments is getting red hot.  The first month of 2011 has seen a slew of announcements and rumours relating to this topic.

I have written before about what I believe will drive NFC mobile and contactless cards payment forward. Well, many of them now seem to be well under way. Firstly, both contactless cards/phones with NFC and the terminals in shops need to be widely available (see The chicken and egg of contactless payments). Many card issuers have either already issued or in the last year announced they plan to issue contactless cards, and for phones, there are lots of rumours around Apple (see Apple: the 800 pound gorilla of mobile payments) and the upcoming Nokia E7 building NFC into the phone. There are even signs contactless terminals in shops are gaining momentum. McDonald’s move to equip all 1200 of its UK outlets for contactless payments could for example be a tipping point for the UK market.

So all is set for card schemes and issuers to corner the market for contactless payments. Right? Well maybe not. It seems there may be some truth to my previous prediction that Apple might blaze their own trail, with Bloomberg reporting Apple has already built a prototype payment terminal intended for small businesses. It’ll be hard for Apple to replicate the ubiquitous acceptance and usage that card brands have for payments, and that’s probably not their goal. Never the less, this does show that card brands will not be alone in trying to build a contactless payments network, and their competitor is one who  is already a trusted brand with a reputation for security, a prerequisite for widespread consumer adoption.

Steve Brunswick

Chip and PIN impacts Australian card fraud

The latest figures from Australia released today show the impact that Chip and PIN can make on fraud, as skimming attacks committed domestically and overseas on Australian cards both fell. The number of skimming attacks committed in Australia on overseas cards also fell significantly. As was the case when Chip and PIN was introduced in the UK, fraudsters are now targeting Card Not Present (CNP) fraud. The Australian Payment Clearing Association highlights the importance of PCI-DSS and of 3D Secure (MasterCard SecureCode and Verified by Visa) as being critical to reducing CNP fraud.

Steve Brunswick

A step forward in payment security but an end to universal card usage?

Speaking at the Next Generation Cards & Payments Conference held in Brussels late last week, Gertrude Tumpel-Gugerell, a member of the Executive Board of the European Central Bank, made several New Year's resolutions.  One of them highlighted a section of the 7th SEPA progress report, published in October, which for the first time contains a whole chapter on the security of retail payments.

Latest P2P payments statistics for the US

Javelin Research has published some interesting findings of a US-based poll on P2P payments. Just eight percent of US consumers with a mobile phone plan to make a P2P transaction in the next year. The report contrasts the US findings with strong mobile P2P adoption in emerging markets where there is a lack of banking infrastructure and of competing P2P payment alternatives. 

Steve Brunswick

Apple: the 800 pound gorilla of mobile payments

To date, the poor availability of phones with NFC technology has been one of the factors holding back the use of this technology to enable wave-and-pay mobile payments in a shop or peer-to-peer payments by touching phones together. It seemed earlier this year that bridging technologies may provide the kick start needed for contactless payments to really take off, but now there’s another contender for moving things forward, and one that is renowned for ‘game changing’ the market: Apple.

The rumours around Apple’s  interest in NFC technology and mobile payments have been growing for some time now – filing patents, hiring product managers, working with Gemalto on SIMs (see appleinsider for numerous reports), and now they are alleged to be in a bidding war with Google for Boku . It seems increasingly likely that the “iPhone 5” will come with NFC built in, and some kind of mobile payments.  But what would this mean for the market? Smartphones are an increasing proportion of new phone sales. Apple is number 3 in smartphone sales behind RIM and Android phones, but they do grab the headlines, and other phone vendors seem to follow. So we could see all smart phones NFC and mobile payments enabled. Now that would move the mobile payment market forward. But I wouldn’t bet on Apple following the emerging standards. They seem to blaze their own trail and I expect they’ll want a piece of the transaction to fuel their burgeoning revenue.

Steve Brunswick

Kroll report shows financial services hardest hit

The recent Kroll Global Fraud Report highlights that for the first time, theft of information and data has surpassed all physical theft. What’s more, financial services and professional services are the most vulnerable sectors to information theft, with four out of ten companies reporting some sort of loss or attack in the last 12 months. For more information on the report, visit our Key Management site and read Jon Geater’s analysis.

Steve Brunswick