Category: Credit Card Security
May 29th, 2014 by Elma Jane
New enhancements intended to provide its U.S. cardholders with greater protection from fraud and identity theft has been announced by MasterCard.
All MasterCard credit, debit, prepaid and small business cards issued in the U.S. will now carry Identity Theft Resolution assistance. MasterCard new program will provide help in canceling missing cards and alerting credit reporting agencies, as well as targeting searches to detect if stolen personal and confidential data appears online. The new Identity Theft coverage extension begins in July 2014.
MasterCard is also extending its zero liability policy in the U.S. to include all MasterCard PIN-based and ATM transactions. This is in addition to coverage already provided on signature debit and credit transactions. The Zero Liability coverage extension takes effect in October 2014.
Fraud prevention and detection is a 24/7 job at MasterCard. The changes in cardholder protection is a combined efforts to move the U.S. payments industry to EMV chip technology will help deliver safer shopping experiences to consumers. MasterCard noted that tanks and financial institutions issuing MasterCard-branded cards provide financial indemnity against fraud.
Posted in Credit card Processing, Credit Card Security, EMV EuroPay MasterCard Visa, Visa MasterCard American Express Tagged with: ATM transactions, business cards, cardholders, credit, credit reporting agencies, credit transactions, data, debit, EMV, EMV chip technology, financial institutions, fraud, Fraud prevention, identity theft, Identity Theft Resolution assistance, MasterCard, payments industry, PIN, prepaid, zero liability policy
May 8th, 2014 by Elma Jane
The complexity derives from PCI’s Data Security Standards (DSS), which include up to 13 requirements that specify the framework for a secure payment environment for companies that process, store or transmit credit card transactions.
Make PCI DSS Assessment Easier
Training and educating employees. Technical employees should obtain any certifications or training classes necessary so that they can operate and monitor the security control set in place. Non-technical employees must be trained on general security awareness practices such as password protection, spotting phishing attacks and recognizing social engineering. All the security controls and policies in the world will provide no protection if employees do not know how to operate the tools in a secure manner. Likewise, the strongest 42-character password with special characters, numbers, mixed case, etc. is utterly broken if an employee writes it on a sticky note attached to their monitor.
For an organization to effectively manage its own risk, it must complete a detailed risk analysis on its own environment. Risk analysis goal is to determine the threats and vulnerabilities to services performed and assets for the organization. As part of a risk assessment, organization should define critical assets including hardware, software, and sensitive information and then determine risk levels for those components. This in turn allows the organization to determine priorities for reducing risk. It is important to note that risks should be prioritized for systems that will be in-scope for PCI DSS and then other company systems and networks.
Once the risk assessment has been completed the organization should have a much clearer view of its security threats and risks and can begin determining the security posture of the organization. Policies and procedures form the foundation of any security program and comprise a large percentage of the PCI DSS requirements. Business leaders and department heads should be armed with the PCI DSS requirements and the results of the risk analysis to establish detailed security policies and procedures that address the requirements but are tailored to business processes and security controls within the organization.
Building upon the foundation of security policies, the committee of business leaders and department heads should now review the PCI DSS requirements in detail and discuss any potential compliance gaps and establish a remediation plan for closing those gaps. This is where it is important to have the full support of business leaders who can authorize necessary funds and manpower to implement any remediation activities.
This is also the time to schedule the required annual penetration testing. These are typically performed by third parties, but is not required to be performed by third parties, and can take some time to schedule, perform, and remediate (if necessary). The results of a PCI DSS assessment will be delayed until the penetration test is completed so now is the time to schedule the test.
At this point the organization is ready for a full-scale PCI DSS assessment and can now enter a maintenance mode where periodic internal audits occur and regular committee meetings are held to perform risk assessments and update policies, procedures, and security controls as necessary to respond to an ever changing threat landscape. PCI DSS must become integrated into the everyday operation of the organization so that the organization remains secure and to ease the burden of the annual assessments.
Payment Card Industry (PCI) compliance assessment is a major task for any size organization, but you can make it easier.
Posted in Best Practices for Merchants, Credit Card Security, Payment Card Industry PCI Security Tagged with: assets, card, card transactions, compliance, compliance assessment, credit card transactions, credit-card, data security standards, DSS, networks, password protection, payment, Payment Card Industry, PCI, Phishing, process, risk, risk analysis, risk assessment, secure payment, Security, security control, security policy, transactions, transmit
May 6th, 2014 by Elma Jane
Which fee structure works best remains unclear despite the recent high-profile data security breaches that are emphasizing the need for security measures. Acquirers charge fees – or not – based on what’s best for their business model and their security objectives
Some charge merchants that comply, others charge merchants that fail to comply and a few charge both. Some Independent Sales Organizations (ISOs) don’t charge merchants a fee for helping them comply with the Payment Card Industry data security standards (PCIS DSS).
If there is any trend, it’s that more banks are finding that some sort of funding is necessary to run a program that gets any results. That funding covers costs for security assessments and compliance assistance as well as internal resources for acquirers. When it comes to covering those costs and creating incentives for compliance, no one fee structure is ideal.
Non-compliance fees encourage merchants to comply so they can save money, but the fees may not accomplish that. Unless you charge exorbitantly, it’s not going to have the effect you want it to have, and by the time you charge that much, the merchant’s just going to move to a different ISO.
ISOs charging non-compliance fees often claim the fee revenue goes into an account designated for use in case of a breach. Non-compliance fees can also reward acquirers for doing nothing to increase compliance. You get this situation where a bank has a revenue stream. Their objective is not to increase the revenue stream but to increase compliance, when they increase compliance, the revenue stream goes down.
It is recommended to some acquirers that they consider charging merchants fees for doing things like storing card data, which could be checked with a scanning tool. Merchants that do store data or fail to run the scan would be charged a fee. That is something that could really decrease risk, because if you’re not storing card data, even if you are breached, there’s nothing to get.
Simplifying the compliance verification process, by making assessment questionnaires available on its merchant portal and by teaching merchants about PCI, will minimize the potential impact of fraud by increasing compliance, which saves the company money in the long run versus a more laissez-faire approach of fees without education and compliance tools.
It’s more important to educate the merchant, it’s the spirit and intent of PCI-DSS supported by the card associations. Visa and MasterCard support it because of the severe impact of a breach or other data compromise, not as a revenue source.
ISOs and other players in the payments chain that do not work to help merchants comply are also putting themselves at risk. Breached merchants may be unable to pay fines that come with a data compromise, potentially leaving ISOs responsible for paying them. Merchants that go out of business because of a data breach also stop providing the ISO with revenue.
Plus, when merchants ask why they’re being charged a non-compliance fee, point them to the questionnaire and explain that they’ll stop being charged as soon as they demonstrate they comply with PCI.
Posted in Best Practices for Merchants, Credit Card Security, Merchant Account Services News Articles, Payment Card Industry PCI Security Tagged with: card associations, card data, compliance, compliance fee, data, data security standards, ISOs, MasterCard, Merchant's, Payment Card Industry, portal, security breaches, visa
May 5th, 2014 by Elma Jane
The Payment Card Industry (PCI) Data Security Standard (DSS) has come under criticism as high profile data breaches continue to expose flaws in retailers’ data security systems. But telecommunications firm Verizon Wireless concluded that the PCI DSS is working.
Some Responses to Criticisms
Nilson Report research from August 2013 that said card fraud cost the global payments market over $11 billion in 2012. Verizon added that the frequency of fraud schemes that the PCI DSS was designed to avoid is in fact growing. And yet most businesses are not fully compliant at the time of assessment. Only 51.1 percent of the companies it had audited had passed seven of the 12 requirements of the PCI DSS and only 11.1 percent of said companies had passed all 12.
Verizon addressed some of the criticisms leveled at the PCI DSS. One concern is that the standard promotes compliance as a test to be passed and forgotten, which distracts companies from focusing on improving security. Verizon responded by stating that breached businesses were less likely to be PCI DSS compliant than unaffected companies. It also said businesses improve their chances of not being breached by having the standard in place, and of minimizing the damage of a breach should one occur.
Another common complaint leveled at the standard is that it is too cumbersome and slow moving in relation to the quickly evolving threat landscape and nimble fraudsters ready to try new tactics. Verizon countered that the PCI DSS is meant to be a set of baseline security protocols. Achieving compliance with any standard is simply not enough, organizations must take responsibility for protecting both their reputation and their customers. Most attacks on networks are of the simple variety, with 78 percent of hacking techniques considered low or very low in sophistication. Data Breach Investigations Report (DBIR) research shows that while perpetrators are upping the ante, trying new techniques and leveraging far greater resources, less than 1 percent of the breaches use tactics rated as high on the VERIS (Verizon’s Data breach Analysis Database) difficulty scale for initial compromise.
Recommendations
There’s an initial dip in compliance whenever a major update to the standard is released, so organizations will have to put in additional effort to prepare for achieving compliance with DSS 3.0.
The newest version of the standard, PCI DSS 3.0, went into effect Jan. 1, 2014. Businesses have until Jan. 1, 2015, to implement it. The updated standard has new requirements and clarifications to version 2.0 that will take time for businesses to understand and implement, and this will result in more organizations being out of compliance.
To help businesses deal with their PCI DSS compliance obligations the firm offered five approaches:
Don’t leave compliance to information technology security teams, but enlist application developers, system administrators, executives and other staff in helping further along the process.
Embed compliance in everyday business practices so that it is sustainable.
Integrate compliance programs into enterprise-wide governance, risk and compliance strategies.
Learn how to reduce the scope of organizations’ compliance responsibilities, chiefly by figuring out how to store less data on fewer systems.
Think of compliance as an opportunity to improve overall business processes, rather than as a burden.
Posted in Best Practices for Merchants, Credit card Processing, Credit Card Security, Electronic Payments, Payment Card Industry PCI Security, Visa MasterCard American Express Tagged with: attacks on networks, Breach, breached, business processes, compliance, compliant, data breach investigators, data breaches, data security systems, database, DSS, fraud schemes, global payments, hacking, information technology, Payment Card Industry, PCI, retailers, Security, security protocols, standard, system administrators, wireless
April 15th, 2014 by Elma Jane
Amsterdam, Netherlands-based Cardis has been piloting its technology in Europe with Raiffeisen Bank in Austria and Sberbank in Russia. They are now focused on the U.S., as this is the fastest growing mobile payments market in the world, where there’s a huge opportunity. Integration of technology with a large U.S. processor and with a major U.S. retail brand, which will be launching a mobile site and mobile app using Cardis solution.
Cardis International is planning an April launch in the U.S. for its technology, which enables merchants to accept low-value contactless or mobile payments without incurring high processing charges. Cardis is able to bring down the processing cost of low-value payments, the company said, by aggregating multiple transactions into a single payment.
The problem
Contactless card and NFC-based mobile payments are typically for low amounts, and yet still use a card processing infrastructure that was designed 40 years ago when the average credit card transaction was $100.
Traditional card processing systems require each transaction to be individually processed through the payment system, including authorization, clearing and settlement. The resulting variable costs of processing each transaction are independent of the transaction amount and too high for low-value payments, particularly in low-margin industries such as quick-service restaurants. QSR restaurants often have a 3 percent profit margin, yet, for low-value contactless payments, the processing cost could be as high as 6-7 percent of the transaction value.
Mobile and contactless cards offer consumers a convenient form factor. But they don’t solve the problem that low-value card payments are very expensive for merchants.
As an ever-increasing percentage of transactions have become cashless, card processing fees have become a significant cost. Costs that are based on the number of transactions, rather than their value. With average per person expenditures of $5 or under, feels each swipe fee much more than a business where customers spend $50 or more. But not accepting credit/debit cards for low-value transactions isn’t an option as many of customers don’t carry cash anymore.
Aggregation
Cardis’ solution is to act as an aggregator of low-value payments, sending a single batched transaction through to a processor instead of multiple low-value transactions. As there is no per transaction processing of individual low-value purchases, the cost-per-transaction is significantly reduced.
Cardis provides its technology as a software plug-in to payment service providers for contact-based and contactless card payments, mobile wallet transactions and NFC payments.
There are two models. For card payments, it will aggregate multiple purchases by an individual cardholder at a single merchant on a post-paid basis up to a specific amount, for example $20. To guarantee payment to the merchant, since the aggregated transaction is processed at a later date, it will pre-authorize an amount, for example $15, the first time the customer makes a purchase at that merchant.
Alternatively, merchants can opt for Cardis’ prepaid system. This involves the consumer setting up a prepaid account hosted by Cardis’ sponsoring bank that is topped up via ACH (automated clearing house) transfers. Using the Cardis prepaid account on a smartphone provides the digital equivalent to cash.
With its post-paid solution, merchants will save 30-50 percent per transaction compared to conventional card processing fees, while its prepaid solution saves merchants 80 percent per transaction. With the post-paid solution, it will only aggregate a customer’s purchases at a single specific merchant. But, as the prepaid solution aggregates the customer’s purchases across multiple merchants, this enables to offer a much lower processing fee to the merchant.
Cardis provides an audit trail enabling consumers to track individual transactions that are aggregated using its technology. Consumers don’t lose any of their card protection rights and guarantees by agreeing to let a merchant aggregate their payments through Cardis. They can always charge back any disputed transactions.
Cardis sees opportunities for digital content providers such as online music stores and games providers to use its aggregation technology. It can integrate solution with existing digital wallets.
Raiffeisen
In 2012, Austria’s Raiffeisen Bank launched a pilot of Cardis technology for NFC-based Visa V Pay debit card payments in partnership with Visa Europe. Raiffeisen’s MobileCard mobile payment product uses a secure element stored on an NFC-enabled MicroSD card inserted in a mobile phone. Although Cardis supports secure elements stored on SIM cards as well as on MicroSD cards and on the cloud, Raiffeisen opted for MicroSD cards, as this is an easier solution to implement.
Raiffeisen cardholders participating in the pilot use MobileCard on average three times a week, with an average transaction value of ($5.70). Merchants accepting MobileCard are seeing 40 percent to 70 percent lower merchant processing fees for an average transaction value of ($5.43) to ($13.60).
Spindle
In October 2013, Spindle, a U.S. mobile commerce company, signed an agreement with Multi-max, a manufacturer of vending machines for mid-size and small offices throughout North America, Europe and Asia. Spindle will integrate its MeNetwork mobile commerce technology into Multi-max’s line of K-Cup vending machines for rollout across the U.S.
The MeNetwork solution will incorporate all card-based payment acceptance services, as well as mobile marketing services. Spindle’s partner Cardis will provide low-value payment processing services for purchases at K-Cup vending machines.
Posted in Credit card Processing, Credit Card Security, Digital Wallet Privacy, e-commerce & m-commerce, Electronic Payments, Gift & Loyalty Card Processing, Internet Payment Gateway, Mobile Payments, Mobile Point of Sale, Near Field Communication, Payment Card Industry PCI Security, Smartphone, smartSD Cards, Visa MasterCard American Express Tagged with: accept, ach, aggregated, aggregation, aggregator, authorization, automated clearing house, average transaction, batched, card payments, card processing infrastructure, card processing systems, card-based payment acceptance, cardholders, clearing, contactless, contactless payments, cost-per-transaction, credit card transaction, debit card payments, Digital wallets, high processing charges, low-value payments, merchant aggregate, Merchant's, microSD, mobile app, mobile commerce, mobile payment, Mobile Payments, mobile site, mobile wallet transactions, nfc-based, payment service providers, pre-authorize, prepaid, processed, Processing, processing cost, processing fees, processor, settlement, smartphone, transactions, transfers
April 11th, 2014 by Elma Jane
Of the 17 percent of consumers who reported having had their credit card declined during a card-not-present (CNP) transactions. As many as one-third of those declines were unnecessary. The result is consumer aggravation, increased operational costs for banks and credit card companies and as much as $40 billion in lost revenue for online retailers.
TrustInsight which helps establish trusted relationships between financial institutions, merchants and online consumers conducted study. A report and infographic detailing the findings of the study found that avoidable online credit card declines lead to loss of trust for consumers, sales for merchants and increased operational costs for credit card companies and issuing banks.
Study also revealed that consumers handle credit card declines in a variety of ways all of which carried negative economic impact to at least one party in the transaction, resulting in unnecessary operating costs for banks, decreased loyalty for the credit card company and lost revenue for all. Almost half call their issuer immediately when their card is unexpectedly declined. This is a natural response. 34 percent of consumers try again another credit card, other use a different payment method and 24 percent will skip the purchase altogether or shop at a different online retailer.
No one wants to turn away business, and no one wants their business declined. The frustration and impact of wrongful declines is a real problem especially as more and more transactions occur in non-face-to-face situations.
Impact of consumer action in the face of a decline can have real and measurable effects on all parties, including credit card companies, banks and merchants manifesting itself in lost customer loyalty, lost fees and lost revenues. Creating a standard for online trust that enables credit card companies, merchants and issuing banks to better recognize trusted digital consumers and reduce the number of wrongly declined consumers avoiding unnecessary losses.
In a world where people are increasingly reliant on a variety of Internet-connected devices for everything from banking to shopping to entertainment and media, creating friction-free customer experiences and preventing online fraud are constant business challenges.
Posted in Best Practices for Merchants, Credit card Processing, Credit Card Security, Electronic Payments, Financial Services, Gift & Loyalty Card Processing, Merchant Services Account, Small Business Improvement, Visa MasterCard American Express Tagged with: banking, consumers, credit-card, decline, declined, declines, different payment method, digital, digital consumers, financial, frustrate, internet-connected devices, issuing banks, loyalty, Merchant's, online credit card declines, online fraud, online retailers, shopping, transactions, wrongful declines, wrongly declined
April 11th, 2014 by Elma Jane
A new standard that uses Host Card Emulation (HCE) was introduced by VISA to enable financial institutions to securely host Visa accounts in the cloud. Visa’s move to support HCE includes tools and services as well as the standard. It is available now and will include support for QR codes and in-app payments in the future.
With this new service and platform that Visa is developing, it will enable clients and partners to issue Visa accounts digitally in the cloud, on secure elements in smartphones, or linked to a digital wallet. The solution will also enable the issuance of payment tokens that will replace the 16-digit payment account number and can be limited for use with a specific device, merchant or payment channel.
Layers of security will deploy by Visa to protect payment accounts in the cloud, including at the Visa network, application and hardware levels. Device fingerprinting technology, one-time use data, payment tokens and real-time transaction analysis will make up a multi-layered defense against unauthorized account access for their services.
Visa has intensified its Visa PayWave contactless payment application and is introducing a new implementation guidelines, program approval process standard and requirements for their standards.
Visa is also developing a tool, its software development kit (SDK) to support clients who wish to develop their own cloud-based payment applications or want to enhance their existing mobile banking applications with Visa PayWave functionality.
HCE is introduced to make it easier for developers to create NFC applications like mobile payments, loyalty programs, transit passes, and other custom services. Visa’s move to enable NFC payments with Android devices is welcome news and will guide the way for the payments industry.
Clients and partners around the globe are continuously looking for cost efficient, flexible and secure ways to enable mobile payments. The Android HCE feature provides with a platform to evolve the Visa PayWave standard, support the development of secure, cloud-based mobile applications, while at the same time offer greater choice.
Posted in Best Practices for Merchants, Credit card Processing, Credit Card Security, Electronic Payments, Financial Services, Merchant Services Account, Mobile Payments, Mobile Point of Sale, Near Field Communication, Smartphone Tagged with: accounts, android devices, approval, cloud, cloud-based mobile applications, contactless payment, device fingerprinting, Digital Wallet, digitally, financial institutions, HCE, host card emulation, in-app, mobile banking, nfc, payment account number, payment channel, payment tokens, payments, qr codes, real-time transaction, secure elements, securely, Smartphones, unauthorized, visa, visa network
April 11th, 2014 by Elma Jane
PCI DSS 3.0 standard, which took effect January 1st, introduces changes that extend across all 12 requirements, aimed to improve security of payment card data and reducing fraud. There will be some shakeups for many organizations when it comes to their day-to-day culture and operations. Transitioning to meet the new requirements will help e-business build a stronger, safer, lower-risk environment for their customers.
While the growing number of digital payment avenues offers convenience to customers, it also offers a larger attack surface for criminals.
As cloud technologies and e-commerce environments continue to grow, creating multiple points of access to cardholder data and online retailers will only become more appealing targets for hackers. Cybercriminals are cunning and determined. They understand payment card infrastructures as well as the engineers who designed them.
A scary proposition and it’s exactly why the payment card industry is so determined to help keep e-commerce organizations protected. Meeting the new standard, businesses will be better armed to fight evolving threats. Changes will also drive more consistency among assessors, help business reduce risk of compromise and create more transparent provider-customer relationships.
Transitioning to PCI DSS 3.0 will involve some work, but doing that work on the front end is going to save much work down the line. Adopting the new standard ultimately will drive your e-commerce business into a secure and efficient era.
Cultural Changes – One of the main themes of 3.0 is shifting from an annual compliance approach to embedding security in daily processes. Threats don’t change just once a year. They’re constantly evolving and that means e-commerce organizations must adopt a culture of vigilance. Only through a proactive business-as-usual approach to security can you achieve true DSS compliance. Realistically, this could mean the need to provide more education and build awareness with staff, partners and providers, so that everyone understands why and how new processes are in place.
Operational Changes – The 3.0 standard addresses common vulnerabilities that probably will ring a bell with many of you. These include weak passwords and authentication procedures, as well as insufficient malware detection systems and vulnerability assessments, just to name a few. Depending on your current security controls program, this could mean you’ll need to step up in these areas by strengthening credential requirements, resolving self-detection challenges, testing and documenting your cardholder data environment and making other corrections.
Overview Changes – How much work lands on your plate will depend on your current security program. Examining your current security strategies and program is a good idea. Below are the areas requiring your attention, which this series will explore in more detail in future installments.
Service Provider Changes – Some organizations made unsafe assumptions in the past when it comes to third-party providers. Some have paid the price, from failed audits to breaches. One reason that the new standard is designed to eliminate any confusion over compliance responsibilities. Responsibilities, specifically for management, operations, security and reporting all will need to be spelled out in detailed contracts. In addition to improved communication, an intensified focus on transparency means that you should have a clear view of your provider’s infrastructure, data storage and security controls, along with subcontractors that can impact your environment. So if your organization isn’t exactly clear on which PCI DSS requirements you manage and which ones your providers handle, prepare to get all of that hammered out.
The Compliance Rewards – The path to preparing for the 3.0 deadline in January 2015 sounds like it’s a lot of work. So to get started request your QSA’s opinion on how the changes will impact your organization, by doing the gap assessment and you’ll be able to address any shortcomings.
Meeting the new 3.0 requirements isn’t just about passing audits. In fast paced payment IT landscape, staying smart and protected is part of our commitment to our customers. Beefing up security game not only reduce audit headaches, but also enjoy stronger brand reputation as a safe and reliable e-commerce business.
Posted in Best Practices for Merchants, Credit card Processing, Credit Card Security, e-commerce & m-commerce, Electronic Payments, Financial Services, Payment Card Industry PCI Security, Small Business Improvement, Visa MasterCard American Express Tagged with: 3.0, attack surface, authentication, breaches, businesses, cardholder data, complance, compliant, credential, cybercriminals, digital payment, DSS, e-business, e-commerce, embedding, hackers, lower-risk, online retailers, passing audits, payment card infrastructures, PCI, processes, reducing fraud, requirements, risk of compromise, security controls, security of payment card data, security program, standards
April 7th, 2014 by Elma Jane
Payment processors share an inherent responsibility to keep their systems secure. It requires a system of governance that includes a broad array of policies, procedures, planning activities, responsibilities, practices and resources for implementing and maintaining a secure system and network operating environment.
To help organizations identify the best payment processors, a recent white paper from i2c outlines the various governance and security best practices processors should use. And it all starts from the top.
Good governance calls for establishing internal audit, compliance, and information security groups within the organization that have separate reporting channels to upper management and/or a board-level audit committee, the report notes. This organizational structure ensures that all security and operational-related risks are appropriately addressed and that all internal processes and practices remain in compliance with the organization’s defined policies and procedures, which in turn should align with applicable external security standards, regulatory laws and payment systems operating rules.
Resource Dedication
Payment processors also need to dedicate proper resources to the task of understanding, and complying with all applicable government, industry, association, legal and regulatory requirements that are relevant to each of their operating regions, according to the paper. Such applicable requirements need to be carefully identified, documented, applied, and updated on a regular basis.
Payment processors’ compliance activities need to cover not only the applicable government, industry, association operating rules and legal/regulatory requirements pertaining to their operations, but they also need to understand and comply with the applicable rules and regulatory requirements pertaining to their client partners. Let say you process customer data on behalf of a partner whose data is governed by a given regulatory rule, then you as their third-party provider must also apply those regulatory rules when handling their data.
Policies and procedures should be developed and put into practice that ensure the payment processor remains in compliance with these various requirements.
Risk Management
Risk management should be incorporated into every payment processors’ system of governance. It provides a framework for identifying and addressing risks within the organization and provides a process for regular operational review and improvement, according to the report. An effective risk management process should adopt an appropriate risk management methodology to identify, evaluate, mitigate and monitor risks pertaining to critical business assets and operations.
Security best practices also call for a defense-in-depth strategy to ensure the protection of information assets and overall risk reduction. A defense-in-depth approach ensures that the failure of any one control does not lead to successful penetration. By providing multiple layers of protection, the controls collectively ensure the confidentiality, integrity, and availability of critical system assets and data.
Posted in Best Practices for Merchants, Credit Card Security, Payment Card Industry PCI Security, Small Business Improvement, Visa MasterCard American Express Tagged with: availability, confidentiality, defense-in-depth, information security, internal audit, layers of protection, network operating, payment processors, risk reduction, secure system, security best practices, system assets and data, system operating rules, systems secure
March 17th, 2014 by Elma Jane
Young people and Londoners are leading the way in adopting cashless payments in the U.K., The U.K.-based market research firm also found that non-bank electronic payment methods such as PayPal are trusted more than contactless and mobile card payments.
According to research, 38 percent of British people are interested in being able to make mobile payments and an enthusiastic 8 percent claim they would apply for mobile payment services straight away. Eighteen percent of U.K. Internet users say they would prefer to be able to stop using cash altogether.
Support for a cashless society is strongest in London, with 30 percent prepared to stop using cash. And it is the nation’s youth who are leading the way in new payment forms. Twenty-two percent of those aged 25 to 34 have used Barclays’ Pingit peer-to-peer mobile payment system, compared to 5 percent of those aged 45-54. About 17 percent of 25- to 34-year-olds have used the virtual currency Bitcoin at least once.
However, consumers are more concerned about the security of mobile payments than card payments. Sixty-five percent of consumers showed some concern about mobile payment security and 61 percent showed some concern about contactless cards, compared with 34 percent who were concerned about using debit cards and the 33 percent who were concerned about credit cards.
Consumers were notably less concerned about using non-bank payment services such as PayPal, which protect users’ financial data from being seen by third parties. Only 27 percent of Internet users are concerned about using non-bank payment services such as PayPal.
Posted in Credit card Processing, Credit Card Security, Digital Wallet Privacy, Electronic Payments, EMV EuroPay MasterCard Visa, Mobile Payments, Mobile Point of Sale, Near Field Communication, Smartphone Tagged with: card payments, cashless payments, cashless society, contactless, contactless cards, credit cards, debit cards, electronic payment methods, financial data, internet users, mobile card payments, mobile payment security, mobile payment services, non-bank, non-bank payment services, peer-to-peer mobile payment system, Security, Virtual Currency
