All Top Banking


Posted on May 2nd, 2009 by David Navetta  InfoSecCompliance.com

The last two plaintiff-banks still breathing after 1st Circuit Appeal

Little know (or at least discussed) fact: despite announcing settlements with VISA and Mastercard in 2007, the TJX data security litigation is still going. In fact most of the issuing banks impacted by the TJX breach are no longer pursuing TJX and/or have settled via VISA and Mastercard dispute resolution processes.

However, two financial institutions (Amerifirst Bank and SELCO Community Credit Union - hereinafter “Issuing Banks” or plaintiffs) have pressed forward with an appeal of various dismissals and class certification motions to the U.S Court of Appeals for the First Circuit (the “Appellate Court”). The 1st Circuit’s opinion sheds some more (high level) light on the liability risk of payment card data breach security cases. Ultimately, the Appellate Court allowed three theories of liability to proceed, including a previously dismissed theory alleging that TJX’s inadequate security amounted to an unfair business practices under Massachusetts’s unfair and deceptive business practices law.

The main issue on appeal was the ruling on a motion to dismiss by the U.S District Court for the District of Massachusetts (the “District Court”). TJX and Fifth Third Bank (TJX’s merchant bank; collectively referred to as “defendants”) had asked the District Court to dismiss all of the counts alleged in the Issuing Bank’s complaint, including: (1) negligence; (2) breach of contract; (3) negligent misrepresentation; and (4) unfair or deceptive business practices under chapter 93A (Massachusetts’s consumer fraud statute). The District Court dismissed the negligence and breach of contract claim, but allowed the negligent misrepresentation claim and the 93A claim (which was based on negligent misrepresentation) to proceed.

Negligent Misrepresentation

The Appellate Court ultimately refused to dismiss the plaintiff’s negligent misrepresentation claim. However, the Court took a different path than the District Court. First, the court noted that the plaintiffs were not alleging any actual misrepresentation, but rather the plaintiff’s “negligent misrepresentation” was based purely on the defendants’ conduct in performing credit card transactions (in fact, the Appellate Court also referenced the defendants’ conduct in the form of entering contracts requiring certain credit card security measures). While conduct can be part of a misrepresentation, the link between the conduct and the implication must be “tight.” This link may be established by a combination of words and conduct concerning the alleged misrepresentation.


Continue Reading at InfoSecCompliance.com





Reblog this post [with Zemanta]

Way Systems Gains Momentum

Posted by John B. Frank 0 comments

Momentum Payment Systems Adds Way Systems' Mobile Transaction Terminal to Merchant Solutions Package
Download this press release as an Adobe PDF document.

Momentum Payment Systems recently announced a new strategic partnership with Way Systems Inc. and will now offer Way Systems' Mobile Transaction Terminal and Printer.

Houston, Texas (PRWEB) April 30, 2009-- Houston, TX based Momentum Payment Systems, www.MomentumPayments.com, a full service electronic payment processing provider, recently announced a new strategic partnership with Way Systems Inc. and will now offer Way Systems' Mobile Transaction Terminal and Printer.

The Mobile Transaction Terminal makes it possible to accept payments any time and anywhere by combining low-cost mobile phone technologies with the capabilities of a point-of-sale terminal. The terminal can process credit, pin-based debit and smart cards and can be paired with the mobile printer through its infrared wireless connection in order to print receipts quickly and easily. Unlike many other wireless units currently on the market they are easily portable. The printer and the terminal are small and lightweight, weighing only 5 and 8.8 ounces respectively.

"We believe that Way Systems' products will offer us another cost-effective and technologically-advanced wireless solution that we can offer our merchants in order to fit their payment processing needs," said Mark Harrelson, Chief Sales Officer.

About Momentum Payment Systems
Momentum Payment Systems, LLC is a fast growing merchant acquirer that specializes in providing small and medium-sized businesses throughout the United States with comprehensive electronic transaction processing solutions. Momentum offers traditional credit card, debit card, ATM card, gift card, prepaid card, EBT and check processing services. Momentum also proudly offers 24 hour customer service and technical support.

For further information, visit Momentum Payment Systems online at www.MomentumPayments.com

###


See the original story at:

http://www.prweb.com/releases/2009/05/prweb2378324.htm



Salesforce.com video: What is cloud computing?

From the Pardalis Data Ownership Blog

Traditional business applications and platforms are too complicated and expensive. They need a data center, a complex software stack and a team of experts to run them.This short video explains what Cloud Computing is and why it's faster, lower cost and doesn't eat up your valuable IT resources.


Reblog this post [with Zemanta]

Heartland Reinstated to Visa's List of PCI DSS Providers

Posted by John B. Frank Sunday, May 3, 2009 0 comments

PRESS RELEASE

Heartland Payment Systems Returns to Visa's List of PCI DSS Validated Service Providers

PRINCETON, N.J., May 01, 2009 (BUSINESS WIRE) -- Following the completion of its annual Payment Card Industry Data Security Standard (PCI DSS) assessment, Heartland Payment Systems has successfully validated its compliance with PCI DSS. As such, Heartland is returning to Visa's List of PCI DSS Validated Service Providers. According to Visa, Heartland will appear on the list - which can be found at www.visa.com/cisp -- on Monday, May 4.

About Heartland Payment Systems

Heartland Payment Systems, Inc., a NYSE company trading under the symbol HPY, delivers credit/debit/prepaid card processing, payroll, check management and payments solutions to more than 250,000 business locations nationwide. Heartland is the founding supporter of The Merchant Bill of Rights, a public advocacy initiative that educates merchants about fair credit and debit card processing practices. For more information, please visit www.HeartlandPaymentSystems.com and www.MerchantBillOfRights.com.

SOURCE: Heartland Payment Systems
Picture Compliments of the PIN Payments Blog, Clockwork Orange and Milk

Heartland Payment Systems Jason Maloni, 202-973-1335  jason.maloni@e-hps.com




Reblog this post [with Zemanta]

Mastercard Incorporated (NYSE: MA) reports Q1 EPS of $2.80, 19 cents better than the analyst estimate of $2.61. Revenue for the quarter was $1.2 billion, versus the consensus of $1.21 billion. Shares have dipped over 7% in Friday's trading session.

Highlights From MA's Q1 Conference Call:

  • (CEO) While our net revenues for the quarter declined 2.2% on an as reported basis, net revenue grew 1.8% on a constant currency basis.
  • We have taken considerable cost reduction actions to deliver a strong operating margin of 48.6%, an improvement of 5 percentage points over Q1 of 2008 and the highest quarterly margin to-date that we recorded as a public company.
  • (CFO) Q1 net revenues of 1.2 billion declined 2.2% over the comparable period last year. This decline was primarily driven by the unfavorable impact of foreign exchange and higher rebates and incentives partially offset by pricing, increased process transactions and increases of other payment related services.
  • Worldwide debit GDV grew 10.7% for the quarter. This compares to about 17.8% growth in worldwide debit in the first quarter of last year, but is more inline with the growth on a sequential basis.
  • The decline in gas prices on a year-over-year basis accounted for approximately 40% of the decline in U.S. purchase volumes. Gross dollar volumes were down 0.7% on a local currency basis or approximately 14% on a U.S. dollar converted basis.
  • Looking now to process transactions, they increased 5.8% compared with the year ago quarter to 5.1 billion in the first quarter.
  • The number of MasterCard's branded cards worldwide grew 4% to 967 million in the quarter and excluding the U.S., the rest of the world card issuance grew 12.1%.
  • Cross-border volume fees decreased by11.3% versus Q1 '08. While cross-border volumes were essentially flat on a local currency basis, they declined by 14% on a U.S. dollar basis which impacted this revenue line.
  • We generated $416 million in cash from operations and ended the quarter with cash and cash equivalents and current investments of 2.3 billion.
MasterCard Incorporated, together with its subsidiaries, provides transaction processing and related services to customers principally in support of their credit, deposit access, electronic cash and automated teller machine payment card programs, and travelers cheque programs.





Reblog this post [with Zemanta]

BofA Targeted by Malicious Code Phishing Attack

Posted by John B. Frank Saturday, May 2, 2009 0 comments


I have been, and will continue to, blog about the enormous risk involved with "typing" vs. "swiping."  Here's yet another recent example (the phishing story below) of why I do what I do.   It shows how obsolete the "Username: Password:" authentication is.  It simply "amazes" me that financial institutions in the USA continue to use them for logging on to their websites.  

Again...here's a common-sensical approach to protecting both the bank and bank customers from phishing attacks, DNS Hijacking, Cloned Websites, and more.  The best part is it's easy as one-two-three, and two of them are already in place!

1. The "bank" issues a "bankcard"  the customer "possesses" the bankcard.

2. The"bank" issues a "PIN" the customer "possesses" the PIN

There's only ONE step missing:

3. The "bank" issues a SwipePIN device and the customer "possesses" it. 

Thus, in order to provide a "secure" 2FA (two factor authentication) encrypted log-in environment all they need is one more piece of the puzzle.  A PCI 2.0 Certified Magstripe Reader with PIN Entry Device.  So send them one, along with a note that says: 

"In a move designed to protect the financial information of our valued customers, we have vastly upgraded the security of our online banking website.  Enclosed you will find a PCI 2.0 Certiified Magnetic Card Reader with a Built-In PIN Pad.  It simply plugs into your USB port and is immediately ready for use.  No software or drivers are needed.

Beginning June 1st, online banking customers will be required  to log-in by swiping your bank issued ATM Debit card and entering your PIN.  This device provides our customers with 100% end-to-end encryption of your cardholder data and in addition to logging on to our site, this device will also enable you to securely transfer money from your account to any other account (see money transfer instruction, included) and purchase items online by simply swiping your card and entering your PIN
just as you do in a retail environment.

That's it.  Simple as one-two-three. The missing piece of the puzzle.

Think about it.  Why do banks issue a card and a PIN?  So you can swipe it and enter the PIN.  So what's with the Username Password stuff?  It needs to change.

Until then, you'll continue to read posts like the one below.  Oh, and did I mention that the average phishing attack comes at a cost of $350.00 and ours costs $12? (see below at end of article or in a post entitled:  Something Phishy About Banks Not Using 2FA from HomeATM)

One thing is for sure...(see graphic below right) Malicious Code isn't going away...

Banking / Finance Alerts
Scam / Fraud / Hoax Alerts
Source: TrendMicro

Complete item: http://blog.trendmicro.com/invoice-spam-finds-new-target-worldpay/

Description: After spam runs related to UPS, FedEx, and Western Union, another form of invoice spam strikes again!


We caught a new invoice spam that is purportedly from WorldPay, a division of the Royal Bank of Scotland that specializes in handling secure online payments from all over the world.

The spammed email message informs users that their transaction with Amazon Inc. has been successfully processed by WorldPay.   The said email contains a .ZIP file, which holds a malicious file named WorldPay_NR9712.exe. This file is detected by Trend Micro as TSPY_ZBOT.BEO through the Smart Protection Network. TSPY_ZBOT.BEO downloads a configuration file from a remote site. This file contains a list of bank-related Web sites, which the spyware monitors in the Internet browser address bars.

The URLs listed in the downloaded configuration file may change at any time. As of this writing, the file contains links to the legitimate sites of Bank of America.

When a user accesses any of the listed banks site URLs, the spyware logs keystrokes to capture data entered in login boxes, including sensitive banking information such as user names and passwords.

The gathered information is saved in a file, which is then sent to a remote site through HTTP post.

Editor's Note:  One more thing.  Our device would cost banks $12.00 and save them $100's "per" phishing attack.

This from Gartner Research:


According to research firm,Gartner, banks, online payment organizations and other financialinstitutions are bearing most of the financial cost of phishingattacks.  (A survey of nearly 4,000 US consumers revealed a 40% increase in the number of phishing victims in 2008 over the year before to five million.) 

The average loss was $350 per phishing attack, but consumers said they had recovered 56% of their losses from the financial institutions involved.  (That's $196 to the banks and $154 to the consumers)  "The findings underline the fact that the war against phishing is far from over," said Avivah Litan, analyst at Gartner.  (Yes, the very same Avivah Litan who says "never" enter your PIN on the Internet unless it's hardware based)
Guess what?  The HomeATM "SafeTPIN" device would not only eliminate "phishing attacks" but it would also eliminate the threat of "cloned cards," "cloned bank sites", AND provide "True 2FA." for online banking customers. 

Additional benefits include empowering online banking customers with the ability to perform:

  • Person to Person Money Transfers,
  • Bill Payment Online (with "True PIN" vs. PINless Debit)
  • Secure online transactions with online retailers.
As I said, I don't mean tooversimplify WHY they banks should investigate our solution further,but sometimes the simplest things in life are the best...aren't they?  Where am I wrong here?


E-Secure-IT
https://www.e-secure-it.com

 Related articles by the PIN Payments News Blog


USPS Probes Security Breach - CBS News


Data Companies Issue New Warnings About Breach That Could Lead To Potential Compromise Of Credit Cards

(CBS) CBS News has learned of another data breach potentially compromising the personal information of thousands of people. Companies Lexis Nexis and Investigative Professionals have notified up to 40,000 people whose “sensitive and personally identifiable” information may have been viewed by individuals who should not have had access.

The United States Postal Inspection Service is investigating a data breach at both companies that resulted in sensitive information being used in a crime. Those individuals have been notified.

Sources tell CBS News that the data breach is linked to a Nigerian Scam artist who used the information to incur fraudulent charges on victims’ credit cards.

Peter Rendina, a spokesman for the Postal Inspectors Service said that of the 40,000 individuals whose information was accessed, up to 300 were compromised and used to obtain fraudulent credit cards
.

Continue Reading at CBS


Reblog this post [with Zemanta]

The total dollar volume of purchases made with Visa debit cards at the end of 2008 was larger than the amount spent on credit card purchases -- the first time debit purchases surpassed credit. Visa's 2008 fourth-quarter debit card transactions made up more than 50 percent of Visa's volume.

"The reality is that the vast majority of consumers want to pay as they go," said Stacey Pinkerd in a press release. Pinkerd oversees Visa's debit-card business.

Visa's growth in its debit card segment far exceeded analyst's predictions. (Editor's Note:  Not the analyst I know.  See Debit is King, Replaces Cash on Throne  So that I'm on the record for future developments when they occur:

  • PIN Debit will increase it's margin on signature debit,
  • eCommerce will "eventually" overtake Brick and Mortar
  • Hackers will continue to outsmart and their attacks will continue to breach software applications, until we finally realize that:
  • Hardware is the only tried and true method to conduct secure online transactions, (and a 2FA 3DES E2EE PCI 2.0 PED that encrypts Track 2 data and utilizes DUKPT does it best).
  • Analysts will realize and start writing that Software PIN Debit is not really True PIN Debit especially when:
  • Online Merchants Start Demanding Card Present and TRUE PIN Debit Interchange Rates which they cannot derive from a software based POS solution.
  • True PIN Debit will become ubiquitous on the web by 2014.
There, I'm on the record.  I'm already on the record stating that HomeATM engineered, designed and manufactured the FIRST and ONLY PCI 2.0 Certified PIN Entry Device specifically designed for eCommerce, right?   

MasterCard also witnessed a major shift toward debit cards, reporting its debit card transactions rose 13 percent last year while credit card purchases dropped more than 2 percent.

Payment cards have long been the preferred purchase method for American consumers, with credit and debit card purchases for retail goods and services outmatching cash and check payments since 2003. Debit cards have slowly approached the levels of credit card use in the 21st century, according to a release by the Nilson Report.

The switch in payment cards is reflected in debt levels and types of accounts nationwide, with the U.S. government reporting in March that personal saving rates rose to 5 percent in January, the highest in 14 years. Meanwhile, revolving debt from credit cards plummeted more than 9 percent, said the Federal Reserve.

However, the Nilson Report projected debit cards will also eventually be reined in, with the buildup in both credit and debit spending slowing to single digits after five consecutive years of double-digit growth.







Reblog this post [with Zemanta]

FIS Reports Strong Earnings Growth | PIN Payments News Blog

Adjusted EPS of $0.31, up 19.2%/Adjusted EBITDA margin of 22.7%, up 100 basis points

Free cash flow increases to $119 million

JACKSONVILLE, Fla., May 1st, 2009 PIN Payments News Blog -- Fidelity National Information Services, Inc. (NYSE: FIS), a leading global provider of technology services to financial institutions, today reported financial results for the quarter ended March 31, 2009.

Consolidated revenue of $797.8 million declined 3.9% in U.S. dollars and increased 0.3% in constant currency compared to $830.3 million in the first quarter of 2008. Non-GAAP adjusted net earnings increased 19.2% to $0.31 per share in U.S. dollars, compared to $0.26 in the prior year, and increased 23.1% in constant currency. The increase is attributable to improved operating performance, lower interest expense and a lower share count, partially offset by a slightly higher tax rate. GAAP net earnings from continuing operations attributable to common stockholders totaled $34.3 million, or $0.18 per share compared to $0.06 per share in the prior period. Free cash flow (cash from operations less capital expenditures) was $119.2 million compared with $4.9 million in the prior year quarter.

"FIS's strong first quarter performance in the midst of ongoing economic uncertainty reflects the continued solid execution of our business plan and the strength of our operating model," stated William P. Foley, II, executive chairman of FIS.

"We are very pleased with the strong growth in earnings, profit margins and free cash flow," stated Lee A. Kennedy, president and chief executive officer. "Despite very difficult market conditions, our disciplined focus on improving efficiency and managing costs drove a 100 basis point improvement in our EBITDA margin, and contributed to the 19.2% increase in earnings per share. Although we expect challenging market conditions to persist throughout 2009, we remain confident in our ability to achieve solid earnings growth and strong free cash flow."

Supplemental Information

Consolidated revenue in the first quarter of 2009 was $797.8 million, compared with $830.3 in the prior year quarter, a decrease of 3.9% in U.S. dollars. Excluding a $34.9 million unfavorable impact of foreign currency resulting from a strengthening of the U.S. dollar, consolidated revenue increased 0.3% driven by strong growth in International.

  • Financial Solutions revenue declined 3.2% to $271.3 million compared to $280.4 million in the prior period, as increased demand for risk management and commercial outsourcing services was offset by lower software license and professional services revenue;
  • Payment Solutions revenue declined 2.3% to $364.7 million compared to $373.3 million in the 2008 quarter, due primarily to a $9.7 million decline in the company's retail check guarantee business. Excluding Check Services' revenue from both periods, Payment Solutions revenue increased 0.4%;
  • International revenue declined 8.3% to $162.3 million in U.S. dollars, compared to $176.9 million in the prior year quarter.
  • International revenue increased 11.5% in constant currency, driven by 16.3% growth in payments and 4.5% growth in financial solutions.
  • Adjusted EBITDA increased 0.7% to $181.2 million in the first quarter of 2009 compared to $180.0 million in the 2008 quarter. The adjusted EBITDA margin improved 100 basis points to 22.7% compared to 21.7% in the prior-year quarter, driven by increased operating leverage and ongoing expense management.
  • Financial Solutions EBITDA declined 2.9% to $102.0 million, due primarily to a decline in high margin software sales. The 37.6% margin was comparable to the prior period;
  • Payment Solutions EBITDA increased 11.5% to $95.2 million, and the margin increased 320 basis points to 26.1%. The improvement is attributable to increased operating efficiency;
  • International EBITDA decreased 8.6% to $23.4 million due to a $5.2 million unfavorable currency impact. The International margin of 14.4% was comparable to prior year.
The effective tax rate in the first quarter of 2009 was 34.5% compared to 33.1% in the first quarter of 2008.

Balance Sheet

FIS had $272.0 million in cash and cash equivalents at March 31, 2009. The company repaid $54.0 million of debt during the first quarter, reducing total debt outstanding to $2.46 billion, of which $2.1 billion has been swapped to fixed interest rates. The effective interest rate was 5.2% as of March 31, 2009.

Continuing an intensive focus on capital spending, capital expenditures totaled $45.3 million in the quarter, which is a 42% reduction from the $78.3 million spent in the prior year.

Acquisition Update

On April 1, 2009, FIS announced plans to acquire Metavante Technologies, Inc. (NYSE: MV). The transaction is subject to approval by FIS and Metavante shareholders, receipt of regulatory approvals and the satisfaction of customary closing conditions. Subject to receiving the required approvals, FIS expects to complete the transaction in the third quarter of 2009.


2009 Outlook

FIS reaffirmed its full year outlook for adjusted net earnings of $1.60 to $1.66 per share. This guidance does not reflect the proposed acquisition of Metavante. FIS will update its fiscal 2009 guidance to include Metavante's results following the completion of the transaction.

Use of Non-GAAP Financial Information

Generally Accepted Accounting Principles (GAAP) is the term used to refer to the standard framework of guidelines for financial accounting. GAAP includes the standards, conventions, and rules accountants follow in recording and summarizing transactions, and in the preparation of financial statements. In addition to reporting financial results in accordance with GAAP, the company has provided non-GAAP financial measures which it believes are useful to help investors better understand its financial performance, competitive position and prospects for the future. These non-GAAP measures include earnings before interest, taxes and amortization (EBITDA), adjusted net earnings, and free cash flow. Adjusted EBITDA excludes the impact of merger and acquisition and integration expenses, LPS spin-off related costs, certain stock compensation charges and certain other costs. Adjusted net earnings exclude the after-tax impact of merger and acquisition and integration expenses, LPS spin-off related costs, certain stock compensation charges, acquisition related amortization and certain other costs. Any non-GAAP measures should be considered in context with the GAAP financial presentation and should not be considered in isolation or as a substitute for GAAP net earnings. Further, FIS's non-GAAP measures may be calculated differently from similarly-titled measures of other companies. A reconciliation of these non-GAAP measures to related GAAP measures is included in the press release attachments.

Conference Call and Webcast

FIS will host a call with investors and analysts to discuss first quarter 2009 results on Wednesday, April 29, 2009, beginning at 8:30 a.m. Eastern daylight time. To register for the live event and to access a supplemental slide presentation, go to the Investor Relations section at www.fidelityinfoservices.com and click on "Events and Multimedia." A webcast replay will be available on FIS' Investor Relations website, and a telephone replay will be available through May 13, 2009, by dialing 800-475-6701 (USA) or 320-365-3844 (International). The access code will be 996633. To access a PDF version of this release and accompanying financial tables, go to http://www.investor.fidelityinfoservices.com.

About Fidelity National Information Services, Inc.

Fidelity National Information Services, Inc. (NYSE: FIS), a member of the S&P 500 Index, is a leading provider of core processing for financial institutions; card issuer and transaction processing services; and outsourcing services to financial institutions and retailers. FIS has processing and technology relationships with 40 of the top 50 global banks, including nine of the top 10 and was ranked the number one banking technology provider in the world by American Banker and the research firm Financial Insights in the 2008 FinTech 100 rankings. Headquartered in Jacksonville, Fla., FIS maintains a strong global presence, serving more than 14,000 financial institutions in more than 90 countries worldwide. For more information on Fidelity National Information Services, please visit www.fidelityinfoservices.com.






Reblog this post [with Zemanta]

Debit Card Skimming Scams

Posted by John B. Frank 0 comments


Debit-card 'skimming' scams

Three steps to take to protect your account data from getting into the wrong hands


VIDEO:
Debit Card Theft
 
Whetherby choice or necessity, American consumers are increasingly relying ondebit rather than credit cards. Debit purchases for 2008 are expectedto have increased by 13 percent, to a total $1.2 trillion. Thatcompares with a rise of only 3 percent, to $1.9 trillion, for creditcards over the same period, according to the Nilson Report, anewsletter that tracks the consumer payment industry.
Whenyou use a debit card, the money is immediately taken from your checkingaccount. While using debit guarantees you that pay as you go, thesecards have downsides, including a growing appeal to thieves. "Aseconomic conditions have worsened, there's been a noticeable increasein all types of card fraud," says Avivah Litan, an analyst specializingin fraud detection and prevention at Gartner Research in Stamford,Conn. "But ATM and debit-card fraud is the top area of concern we'rehearing about from banks all over the world."

Unlikecredit-card thieves, who usually charge merchandise and then resell itto come up with money, people who create counterfeit ATM or debit cardsby stealing your PIN and other account data can simply pull cold cashfrom your bank account. Using a technique known as skimming, they setup equipment that captures magnetic stripe and keypad information whenyou input your PIN at ATM machines, gas pumps, restaurants, orretailers.

Here's how you can protect yourself:

Don't type in your PIN at the pump (or into a web browser!)

Beespecially vigilant at gas stations, Litan says. "Gas pumps arenotorious for skimming because they're produced by only a couple ofdifferent manufacturers, and if someone gets the key to one from adisgruntled employee, they can insert a skimming device inside the pumpwhere it can't be seen," she says. She recommends using a credit cardrather than a debit card when you fill your tank.
Ifyou must use a debit card at the gas pump, choose the screen promptthat identifies it as a credit card so that you do not have to type inyour PIN. The purchase amount will still be deducted from your bankaccount, but it will be processed through a credit-card network, whichwill give you greater protection from liability if fraud does occur.This is because card issuers typically have "zero liability" policiesfor both debit and credit cards, but sometimes exclude PIN-basedtransactions from that protection.

Editor's Note:  As the PIN Payments News Blog reported last January, (Triple DES for GASVisa has mandated that all new gasdispensing machines must support Triple DES effective January 1st.  Forexisting machines, Triple DES must be implemented into pay at the pumpstations by July,  2010.  So, if your gas station has NEW gas dispensing machines, your good to go...otherwise heed this advice until 7/10!

Visa'snew requirement calls on gas retailers to ensure that all new pumpscapable of processing debit card purchases are equipped with anencrypting PIN pad, or EPP, that supports 3DES


Continue Reading at Consumer Reports
Reblog this post [with Zemanta]

Banking / Finance News
Source: ComputerWorld
Complete item: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9132420

Description:
The same organization that led the development of security standards for payment-card magnetic stripe data and PIN-based transactions will soon begin work on a new specification for encrypting cardholder data while it is in transit between systems during the transaction process.

And among the companies in the forefront of the effort is Heartland Payment Systems Inc., the Princeton, N.J.-based payment processing firm that announced in January what some analysts think could end up being the largest data breach involving credit-card information thus far.The Accredited Standards Committee X9, which is accredited by the American National Standards Institute, is set to launch an initiative formally known as the Sensitive Card Data Protection Between Device and Acquiring System program. ASC X9 develops and maintains numerous standards for the financial services industry in the U.S., and participants said this week that the goal of the new effort is to develop a data encryption standard to protect information from the moment a card is swiped at a payment register to the end of the transaction chain at a so-called acquiring bank.

The need for such "end-to-end" protection has become increasingly apparent within the payment card industry in the wake of the continuing breaches at companies such as Heartland and RBS WorldPay Inc., another payment processor that disclosed a system intrusion last December.

But while proprietary tools are available from a few vendors for achieving that type of protection, there currently is no standard approach
, said Sid Sidner, director of security engineering at ACI Worldwide Inc., a vendor of payment processing software in New York.


And yes, HomeATM's proprietary approach to securing online transactions is way ahead of the game.  Not only do we provide end-to-end protection, but we also encrypt the Track 2 data, which is what they are talking about here.  Furthermore, we utilize DUKPT key-management to provide an enhanced layer of security for PIN entry, something that CANNOT be done with a software based approach to PIN Entry, and are the "first and only" company to engineer, develop and manufacturer a PCI 2.0 Certified PIN Entry Device specifically designed for eCommerce use.  So is HomeATM ahead of the game?  We're the only end-(to-end) game in town!  Let me provide more information on DUKPT key managment (from Wikipedia)


In cryptography, Derived Unique Key Per Transaction (DUKPT) is a key management scheme in which for every transaction, a unique key is used which is derived from a fixed key. Therefore, if a derived key is compromised, future and past transaction data are still protected since the next or prior keys cannot be determined easily. DUKPT is specified in ANSI X9.24 part 1.

DUKPT allows the processing of the encryption to be moved away from the devices that hold the shared secret. The encryption is done with a derived key, which is not re-used after the transaction. DUKPT is used to encrypt electronic commerce transactions. While it can be used to protect information between two companies or banks, it is typically used to encrypt PIN information acquired by Point-Of-Sale (POS) devices.


DUKPT is not itself an encryption standard; rather it is a key management technique. The features of the DUKPT scheme are:

  • enable both originating and receiving parties to be in agreement as to the key being used for a given transaction,
  • each transaction will have a distinct key from all other transactions, except by coincidence,
  • if a present key is compromised, past and future keys (and thus the transactional data encrypted under them) remain uncompromised,
  • each device generates a different key sequence,
  • originators and receivers of encrypted messages do not have to perform an interactive key-agreement protocol beforehand.

Continuing on with the story:

As a result, ACI, which is a member of the ASC X9 group, wrote up a "work request" in February suggesting the development of a standard. According to Sidner, the effort will focus on the formatting of "cryptographic payloads" to carry sensitive data over transaction networks. The goal, he said, is to create something akin to the level of standardization that exists now for protecting PIN data. Although numerous messaging formats are used to transport cardholder data over a transaction network, the cryptographic blobs that protect the PIN data itself in each message looks exactly the same.

A similar encryption standard would require few or even no tweaks to the existing payment systems infrastructure, claimed Sidner, who is chairing the working group set up to carry out the project. As part of the standards effort, ASC X9 may also look at the viability of using the same security-key management mechanism that is currently used for PIN security, he said.

E-Secure-IT
https://www.e-secure-it.com





Reblog this post [with Zemanta]

Hacker Targets Twitter

Posted by John B. Frank 0 comments


By Steve Evans - CBR security

Twitter, the phenomenally popular micro-blogging site, faces more question about its security procedures after a French hacker claimed he accessed the account of a Twitter employee with administrative rights.

The hacker claimed that this enabled him to access Twitter accounts belonging to US president Barack Obama and singers Britney Spears and Lily Allen. He posted screenshots taken during the break-in on a hacker forum.

The screenshots appeared to show email addresses, mobile phone numbers and information about other Twitter accounts that had been blocked by the user.

This is the latest security setback for Twitter, which has seen huge growth during 2009. Over the Easter weekend the site was hit by a malware attack that resulted in Twitter identifying and deleting almost 10,000 tweets that could have continued to spread the worm.

Graham Cluley, senior technology consultant at security firm Sophos, said: “This is just the latest in a string of security issues at Twitter in recent months, and the website is surely in danger of losing the confidence of its users who will be rattled by yet another breach.

“Just like with the recent Twitter worm outbreaks, this is not so much a case of Twitter raising awareness amongst its many users about sensible online security, but learning a few lessons itself. Careless security by the micro-blogging site could potentially put millions of Twitter users at risk.”

Recent research from Sophos revealed that two thirds of businesses think social networking is a security risk, as IT admins believe that employees share too much personal information via their social networking profiles.




Reblog this post [with Zemanta]

Facebook beefs up security with MarkMonitor - Security : News   By Steve Evans

Social networking site hit by another phishing attack

Facebook has expanded its use of MarkMonitor’s AntiFraud Solutions to cover malware attacks, after it was revealed on Wednesday that users of the social networking site were the victims of another phishing scam.

Facebook’s users were sent an email claiming to be from the site, but redirected users to FBaction.net where they were asked to enter their username and password. Their details were then stolen by the fake website.

Facebook was already using MarkMonitor’s technology to protect users from potential phishing attacks but has now extended that to cover malware as well.

Facebook has often found itself the target of malware attacks due to its strong brand name and number of users. The impact of malware on a user’s PC can range from deleting important files to capturing personal information such as usernames, passwords and other login information that can be used for identity theft.

Continue Reading at CBR
I do believe we're starting to see a "trend" here.  What's Next?  Is Twitter going to be targeted by a Hacker?  If so, I would say that social networking sites protect their user's data, or, who knows...they could wind up in jail.  (see previous post)

Reblog this post [with Zemanta]

Two thirds of businesses say social networking is security risk - Security : News
Security firm Sophos said its latest research into social networking found that 63% of system administrators worry that employees share too much personal information via their social networking profiles, putting their corporate infrastructure – and the sensitive data stored on it – at risk

The findings also indicate that a quarter of businesses have been the victim of spam, phishing or malware attacks via sites like Twitter, Facebook, LinkedIn and MySpace.

With social networking now part of many computer users' daily routine – from finding out what friends are up to, to viewing photos or simply updating their online status – Sophos experts note that unprecedented amounts of information is updated every minute.

Frequent use of social networking sites makes them a prime target for cybercriminals intent on stealing identities, spreading malware or bombarding users with spam, Sophos said.

So I guess what they are also saying is that applications such as TwitPay need to be enhanced.  I think we can help Amazon with that. 

Keep in mind, just because Sophos is warning about the security risks of social networking sites doesn't mean they are going to be targeted by Hackers or utilized for phishing attacks. 

Does it?  We'll see.  Stay tuned.  I've got some insider information that both incidents will be covered by the PIN Payments Blog within the next hour and a half!  Click the "Follow Me on Twitter" graphic above right to stay up to date.

Until then, you may read the above article in it's entirety here


Data breach CEOs should face jail: survey - Security : News

A new survey of security executives has revealed that they believe CEOs and board members should face imprisonment for exposing consumers’ confidential data.

The survey, carried out on behalf of Websense at this year’s e-Crime Congress, found that 30% of the 104 respondents believe jail time is a suitable punishment for security breaches that result in the loss of confidential data.

Negligent security procedures should also result in a fine for the guilty company, 62% of respondents believed.

Compensation for consumers whose data had been compromised was favoured by 68% of respondents.

The tables are turning.  If security executives feel that strongly about the crime, then it's time for CEO's to start seriously looking at protecting cardholder data. 

Here's my "hard cell" ... CEO's now have a choice! 


1 PCI 2.0 Approved PED with 3DES End to End Encryption with DUKPT (pronounced DUCK PUT) key management or...
2.  Get PUT away and throw away the key?  (no key management)


I do know that 10 out of 10 people surveyed would rather have HomeATM Monitoring than go to Jail.

Read the Entire Article




Reblog this post [with Zemanta]

Newsflash from Finextra.com.  01/05/2009 15:19:00
FRANCE DELAYS SEPA DIRECT DEBIT LAUNCH

French banks have pushed back the date for implementation of the Sepa Direct Debit scheme by a year to November 2010, setting the stage for a confrontation with the European Central Bank and the European Commission.

More on this story: http://www.finextra.com/fullstory.asp?id=19990

'Phantom' withdrawal case concludes in U.K. court

A Halifax bank defends chip-and-PIN, while the plaintiff argues his cash card could have been cloned
By Jeremy Kirk , IDG News Service , 04/30/2009

A one-day trial that raises questions about the security of cash cards used in the U.K. and Europe concluded Thursday, with a decision expected in about a month.

Alain Job sued U.K. bank Halifax in March 2007 over eight withdrawals made from his account in February 2006. Job maintains he did not withdraw a cumulative £2,100 ($3,100). He also maintains he did not authorize anyone else to withdraw the money.

Job decided to sue after the Financial Ombudsman Service (FOS), which mediates disputes between banks and customers, sided with Halifax.

Job is the first person to sue a U.K. bank over a phantom withdrawal and believes one possibility is that his card was cloned. Halifax maintains that it was his exact card that was used to perform the withdrawals and that either Jobs is knowingly trying to defraud the banks or was grossly negligent in handling his card and PIN (personal identification number).

Job admitted at one point during testimony to putting his cash card in his garden outside one night for some inexplicable reason, according to Alistair Kelman, an attorney who watched the proceedings in Nottingham County Court.

Stephen Mason, an attorney who specializes in the collection of digital evidence and has written about case law involving disputed cash-machine transactions is representing
Job is "pro bono" i.e. "he's doing Job for Free"

Continue Reading at NetworkWorld


Reblog this post [with Zemanta]

AmEx, Visa Gift Card Claims Construction Upheld

On April 17th I blogged about a lawsuit filed by Actus (a Texas hold'em, make that "holding" company against Visa, MasterCard, AMEX, Green Dot, First Data etc.  It seems this was done a couple years ago by a company called EPC, or Every Penny Counts over some gift card patents they held.  Yesterday an Appeals court upheld a lower courts ruling that EPC is SOL. 

Thecourt ruled Thursday that the U.S. District Court for the MiddleDistrict of Florida had correctly construed the key term of the patentsheld by Every Penny Counts Inc.   It sounds like the court was a little annoyed at EPC:

Here's the pages argument for affirmation:

"EPC has surprisingly little to say about what it alleges is substantively wrong with the district court’s construction, or why its proposed construction would be better on the merits. Instead, it attempts to assign error to the district court’s construction on a number of procedural grounds. Principally, it argues that the court erred by (1) spending a portion of the claim construction hearing considering the meaning of the phrase “sales price,” which was not a disputed claim term; and (2) using the accused products to tailor a construction of the patent claims that would make it impossible for EPC to prove infringement. Neither of these arguments has merit.

EPC’s first argument is that the district court erred by spending a portion of the claim construction hearing considering the meaning of the phrase “sales price,” which was not a disputed claim term. This argument is somewhat puzzling, since it was EPC’s own proposed construction that raised questions concerning the meaning of “sales price.” EPC proposed to construe “excess cash” as “an amount . . . offered in excess of the sale price of merchandise” (emphasis added). It admitted, however, that the parties disagree about what constitutes a “sale.”  According to the defendants, a sale occurs when cash changes hands at the cash register. According to EPC, by contrast, to call a transaction a sale is to imply that the merchant would treat the cash the consumer tenders as income on its accounting statements. EPC also insists—without offering any evidence—that when a consumer purchases a gift card, a merchant would not consider this to be a sale.

In the light of this acknowledged disagreement over the meaning of “sales price,” the fact that EPC would both propose to define its patent claims in terms of this phrase and then fault the court for attempting to clarify the phrase’s meaning is at best ironic and at worst disingenuous.

Again, the court’s obligation is to ensure that questions of the scope of the patent claims are not left to the jury. In order to fulfill this obligation, the court must see to it that disputes concerning the scope of the patent claims are fully resolved. In the present case, to evaluate EPC’s proposal concerning the scope of its claims, the court first had to understand this proposal. If the court had adopted EPC’s proposed construction without first assigning a fixed meaning to this construction, then it would quite clearly have failed to assign “a fixed, unambiguous, legally operative meaning to the claim.” Thus, there was nothing improper about the fact that the court interpreted EPC’s (quite slippery) proposed construction.

As Michele de Montaigne has said, there are times when “[w]e need to interpret interpretations more than to interpret things.” Jacques Derrida, Structure, Sign and Play in the Discourse of the Human Sciences, in Writing and Difference 278 (Alan Bass, trans. 1980) (quoting Montaigne).

Equally without merit is EPC’s argument that the district court erred by “tailoring its claim construction to fit the dimensions of the accused product.” A court may not use the accused products for the sole purpose of arriving at a construction of the claim terms that would make it impossible for the plaintiff to prove infringement. But that is not what the court did here. To the contrary, the court quite properly invited the parties’ views of what they thought “excess cash” meant in the context of a series of hypothetical transactions, some of which involved the accused products. For example, the court described a situation in which a consumer tenders $50 for a grocery store gift card with a face value of $50, and then asked the parties to identify whether there was any “excess cash” in that transaction, and if so, what portion of the amount tendered constitutes the “excess.” In other words, the court considered the accused products only to elicit the parties’ views about what the claim term means in the context of a concrete transaction involving these products.

EPC’s suggestion that this was improper is way wide of the mark. See id. at 1326-27 (“While a trial court should certainly not prejudge the ultimate infringement analysis by construing claims with an aim to include or exclude an accused product or process, knowledge of that product or process provides meaningful context for the first step of the infringement analysis, claim construction.”); Aero Prods. Int’l, Inc. v. Intex Recreation Corp., 466 F.3d 1000, 1012 n.6 (Fed. Cir. 2006) (“Although the court revealed an awareness of the accused device, the court’s awareness of the accused device is permissible.”).

In short, the district court correctly construed the claim terms in EPC’s patents. EPC’s attempts to assign error to the process by which the court arrived at its construction cannot succeed.
.
The district court appropriately construed the key term in EPC’s patent claims. We therefore affirm. The defendants may recover their costs accrued in this court.
AFFIRMED.


Click here to read the court document

Reblog this post [with Zemanta]

Powered by Blogger.

Search This Blog

Our Manufacturing Facility

Learn More About Us

Find out how our patented technology can empower your financial institution.

Our secure two-factor online banking authentication eliminates dangerous passwords and usernames and replicates the same trusted process used to access cash at ATM's. (Insert Bank Issued Card, Enter Bank Issued PIN)

There is an R.O.I. as FI's also earn recurring revenue from each transaction conducted using our PCI 2.0 Certified PIN Entry Device. Our technology also provides a unique real-time P2P "Instant-Transfer" which allows your online banking customer to transfer cash from ANY of their bankcards to ANY other bankcard...with the Swipe of a card.

Help your bank eliminate phishing and your customers avoid identity theft by providing them with the ability to stop typing and start swiping. There is no safer way to conduct financial transactions online than by 3DES DUKPT encrypting the cardholder details, which we do at the mag-head "inside the box/outside the browser."

Total Pageviews

SLIM for PC or SmartPhone

SLIM for PC or SmartPhone
Click to Inquire

Chip and PIN eCommerce and Mobile

Chip and PIN eCommerce and Mobile
Click to Inquire

Kapersky Calls for Mass Adoption of Card Readers

Kapersky Calls for Mass Adoption of Card Readers

Translate This Blog

BobCaps

Search ePayment News (example: NFC)

About Me

My photo
Named one of the best Payment Industry News Blogs 4 Years Running

Feedjit

My Zimbio