MasterCard and Visa targeted in Target lawsuit

The Target data breach, which compromised the data of 40 million cardholders continues to have ramifications across the industry. Following a class-action lawsuit against Target for the data breach, MasterCard and Visa are now targets of a separate class-action lawsuit related to the breach.

However, even if EMV had been adopted earlier in the US, this would not have prevented the data breach from occurring, given that it was the result of malware-infected POS systems. EMV does not prevent card-not-present fraud, which is a growing problem for online merchants. Instead, payment networks and other stakeholders are now focusing on tokenisation, which encrypts payment data at the POS. 

In an order dated August 13, the US Judicial Panel on Multidistrict Litigation detailed claims that the networks’ delay in implementing EMV in the US was a factor in the breach occurring. The lawsuit also asks why the networks “declined to implement that technology in the US, and whether the technology would have prevented harm to plaintiffs and class members – not just from the Target data breach, but from any number of data breaches in the last two decades,” the Judicial Panel on Multidistrict Litigation stated.

 

 Facebook   Twitter   LinkedIn   Website

Seizing SEPA opportunity in Asia

The Single Euro Payments Area (SEPA) is much more than a European operational compliance challenge, and should be seen as a strategic opportunity for corporations to restructure their European cash and liquidity management functions so that they can be run far more efficiently, and significantly reduce costs and risks.

The fundamental change that SEPA brings from an operational perspective is the standardization of all euro Automated Clearing House (ACH) payments in the SEPA zone. All businesses that make euro payments within Europe can do so using a single euro account to submit a SEPA compliant payment, which becomes mandatory with effect from 1 February 2014.

SEPA Migration – A Strategic Opportunity for Asia Pacific Corporations
At a basic level, some global treasurers headquartered in Asia Pacific and with operations in Europe may simply see SEPA migration as a European issue with limited relevance to them, leaving it up to the European operations to deal with the migration burden.

From a more strategic perspective, however, SEPA offers a unique and very real opportunity for treasurers to achieve far greater benefits by rationalizing payments practices, enhancing processes and reducing the cost of payments and banking fees. One major reason corporations are able to achieve these benefits is that SEPA will enable them to make all their euro payments out of one account, significantly reducing the number of bank accounts and simplifying the liquidity structures. Companies can even use a “Payment On Behalf Of” model to make payments for their entire group from one single euro account.

With SEPA, all euro ACH payments and collections in the SEPA zone are subject to one common set of conditions from a legal, formatting, processing and pricing point of view. Since one single account per legal entity will thus be sufficient, corporations will have the ability to rationalize account structures and operations, which means they can reduce their risk and further lower the cost of payments. 

Corporations that have multiple bank accounts across the Eurozone will gain tremendous strategic benefits from rationalizing their accounts and streamlining their payments so that they use one account (per legal entity) to make and receive payments in the same manner.  Using just one account will also immediately concentrate funding and liquidity, thereby reducing the need for physical and or notional forms of cash pooling, which simplifies the process of managing liquidity and enables better operational risk management.

Corporations can achieve further gains by analyzing the cost of payments across the SEPA zone, and re-evaluating where it will be most cost-effective and efficient to make their euro payments. A corporation that has a large number of payments in a country where payment processing is expensive, for example, could shift payments to a lower cost location and take full advantage of what will truly become a single market.

Along with replacing their current set of complex structures for payments with fewer accounts, treasurers also have an opportunity to consider rationalizing the number of banks they deal with and potentially working with a single banking partner. Whilst it is not absolutely necessary to change banking relationships, all banks operating in the SEPA zone will essentially have the same reach under SEPA from a banking point of view and corporations can take advantage of SEPA to work with a smaller number of banks.

Rather than just leaving SEPA migration to European counterparts as an operational issue, treasurers in Asia Pacific with operations of any size in Europe can benefit from focusing strategically on how best to rationalize their entire payments and collections process and practices during SEPA migration.

Beyond simply looking at how to change processes in the Eurozone for SEPA, treasurers can also examine innovations within the SEPA markets and leverage them to gain further benefits from leading-edge practices. The shift from fragmented markets to increasing harmonization in a single market over the past decade, as well as the additional congruence that SEPA migration provides, has resulted in increasingly sophisticated innovations in cash or liquidity management in Europe, and treasurers can leverage these developments to enhance their own global payments, collections and liquidity practices further.

SEPA Implementation
As soon as a corporation has decided on the strategy for SEPA migration that will bring the greatest benefit, it will need to start on the implementation process.  Corporations will need to perform a technical analysis of their Enterprise Resource Planning (ERP) and treasury systems to determine their ability to send SEPA compliant euro payments, as well as evaluate process improvements to streamline payments. They can then develop an implementation plan for any changes that are needed to rationalize bank accounts and banking relationships.

Since SEPA migration affects ACH payments and direct debit payments in 33 markets in Europe, 17 of which have the euro as their main currency and others such as the United Kingdom which support the euro next to their local currency, corporations will need to ensure that their plans include all payments in all markets that need to be SEPA compliant. Any company in Asia Pacific that initiates payments for the euro in SEPA markets from a Shared Service Center or other processing unit in Asia will also face similar operational requirements due to SEPA migration.  

Whilst the time required to become compliant will vary depending on the corporation’s size and their level of sophistication in making payments or using direct debits, it could typically take up to six to nine months to become compliant. 

The cost of implementation and technology also varies depending on the level of sophistication and the size of the corporation. The cost savings, however, will usually far outweigh the cost of implementation.

Corporations can benefit from working with their global banking partner at a strategic level to use SEPA as a key driver to assess their current structure of euro accounts in multiple countries, determine how best to rationalize their euro payments operations, and rationalize banking relationships as well as liquidity management.  The banking partner can also provide consultative advice at a tactical and operational level on switching package strategies, legacy account conversion or other practices to meet SEPA requirements.

The Risks of Non-Compliance
Following the SEPA migration deadline of February 2014, legacy systems that corporations use for euro accounts payable, accounts receivable, taxes, payroll transactions and other payments may no longer be usable. From an operational perspective, the risks of not meeting the deadline for SEPA compliance could range from simply not being in compliance with the rules, to potentially not being able to make payments for suppliers, staff salaries or even taxes.

Whilst there has been some speculation that the date for compliance will be extended, the 1 February 2014 date is fixed and companies that miss the deadline will face the difficulties of non-compliance.

More importantly, corporations should ensure that the changes to platforms and processes do not stop them from reaping the strategic benefits of SEPA immediately.

Conclusion
Although Asia Pacific treasurers often regard SEPA migration as a European operational exercise, the benefits go far beyond simple compliance. Corporations can benefit greatly from taking advantage of SEPA migration to rationalize account structures and enhance payment processing efficiency to reduce costs, complexity and risks.

by Jeroen Kok
Executive Director
J.P. Morgan Treasury Services

 Facebook   Twitter   LinkedIn   Website

What you need to know about Merchant category codes (MCC)

Accepting credit and debit cards as a payment option can be a highly profitable choice for most merchants, as it offers customers the convenience of one of the most commonly and easily used forms of payment, thereby making it simpler for them to patronize the merchant’s business and potentially spend more than they otherwise might. However, as any merchant who has applied for a payment card processing account is aware, not all merchant accounts are the same. When a business first applies to a processing institution for an account, it is assigned a merchant category code (MCC) based on the primary kind of business it offers. This four-digit code was originally implemented in 2004 as a means of simplifying tax reporting, but has since expanded to have a number of other applications.

Merchant category codes allow payment card processors to describe succinctly the type of market segment a given business occupies based on the primary form of goods or services it offers. A restaurant, a gas station, and a computer software store will each have a different MCC number that indicates the sort of merchant it is. The original purpose for these codes was to make 1099 reporting simpler for commercial customers, who needed to report payments made for the purchase of services, but not for goods, on their tax forms. Rather than having to review each individual transaction, they could simply refer to the merchant’s MCC number to indicate whether the business was listed as a seller of goods or a service provider.

Since then, merchant category codes have been put to other uses, some of which have more immediate relevance for the merchant itself. Credit card processing companies charge an interchange fee for each transaction they process. The interchange fee is separate from the markup these companies apply for their own profit, and reflects the expected risk of chargebacks and refunds for transactions of a given type. Interchange fees vary based on a combination of factors, including the type of payment card being used, whether the transaction is keyed, swiped, or online, and what kind of business is receiving the payment. This is where your merchant category code comes into play. Certain types of businesses carry a lower risk for payment processors, and thus have lower interchange fees for the merchant. By ensuring that your merchant category code is accurate, you may discover that you qualify for a different interchange rate, which could be lower than the typical rates.

Another usage of merchant category codes is most relevant to your customers, but a savvy merchant may be able to exploit it to make their business a more appealing place to spend money. Many credit cards offer rewards, such as cash back or airline miles, to cardholders who use their card for transactions at certain types of businesses. Some will offer double or triple points when the card is used to buy groceries, gas, prescriptions, or similar everyday needs. Whether these bonuses apply is determined by the MCC number of the terminal where the transaction takes place. Which code a given merchant has been assigned isn’t always obvious – often, different store locations within the same franchise will have different merchant category codes. For instance, one Target store might be categorized as a grocery store, but the Target in the next town may have the MCC of a discount store. Some stores have separate MCC numbers for their pharmacy terminals. Ensuring that your MCC number is accurate and reflects a business type that offers maximal rewards to your customers can make your business a more attractive place to shop.

We have a team of experts to answer any additional questions you may have regarding MCC Codes or merchant accounts in general. Contact us at below:

 Facebook   Twitter   LinkedIn   Website

Raptor Racing at Thruxton with Paymundo.com

After their superb third place finish at the previous round, Raptor Racings’ Paymundo F1 sidecar team made the trip to the 2.3 mile circuit of Thruxton in Hampshire for the fifth round of the Eastern Airways British Sidecar championship. The schedule was for three eight lap races over the weekend of the 1st to the 3rd August 2014. This is a change from previous seasons when there has been two 12 lap races. Due to the nature of the track and excessive demands on riders, it was decided to shorten the laps and add an extra race.

Driver Tony Brown and passenger Ashley Hawes have never raced at Thruxton before so they knew they would have a difficult task to repeat the podium from a few weeks ago. This circuit is extremely fast in most of the sections taking its toll on the machines and the passengers. The main aim for the team was to finish all 3 races, as so far, technical issues have held them back from achieving this. One short practice session on Friday, meant Tony and Ash had little time to learn the track and get the perfect setup for the bike. After practice, the team discovered the engine had been running hot and there was a water leak so the rest of the afternoon was to be spent repairing hoses. By this point, Tony said he didn’t like the circuit stating that in one part you just have to have a big set of balls due to the speeds they were reaching.

In Saturday mornings qualifying, the team managed a 10th position grid start. They averaged 101 mph, but they knew they would have plenty of work to do if they wanted to move up the field. When race one came about, the weather was unpredictable and as in previous rounds, tyre choice was difficult. The team opted for slicks. Tony and Ash did not get the start off the line they would have liked, and they were swallowed up, dropping to almost the back of the grid! A battle with Gilbert/Allum and consistently faster laps meant they were able to finish in 9th place. Both Tony and Ashley were satisfied with this. Race two took place later that afternoon and with few dramas, a 10th place finish was in the bag.

Two consecutive race finishes meant the team were happy and looking forward to race three. In glorious sunshine for Sunday afternoons third race, and in front of a large British Superbike crowd they settled into a good pace from the start. An action packed race was ahead and a few teams were to drop out of the race leaving Tony and Ash to finish in a strong 7th place. Afterwards, the team felt that the engine was not quite at its strongest and took the decision to remove the engine. Ashley later delivered it to Keith Whiting in the hope he can resolve the demons in time for the next round at Donington in 5 weeks time.

The team are now currently 7th in the championship and would like to thank all their sponsors

http://www.paymundo.com
Ged Canfield Engines
Wallace interior solutions
Pagid
Keith Whiting
Trevor Stafford
Ian Hamilton at Express Tyres
Herne Bay Motorcycles
Infinity Pro
Jennifer Shone at Knox
John Mcqueen at LS2
Ros and Lawrence Tumber
Surlingham Solutions
Wurth
AMR Exhausts
Sam Christie
Sam Ryder
Steve English
Julian Cole
Russ, Ross and the amazing Ryan Anderson for helping out so much with everything. I really appreciate all you do mate and I am glad you’re a part of the team.

And finally, of course, all our family, friends, Beccie and Emma for supporting us in this crazy hobby.

By: John Mushet

 Facebook   Twitter   LinkedIn   Website

How to Stop Chargebacks Before They Hit Your Bottom Line

When a customer disputes a charge, the issuing bank assumes the retailer is guilty until proven innocent. You’re left holding the bag as the bank debits your account and charges a fee for the chargeback.

Is this just a cost of doing business? It doesn’t have to be. You can fight back and prevent the pain chargebacks inflict on your business’ revenues and profits.

However, you first need to understand that you’re starting from behind in the race against chargebacks.

The Chargeback Lifecycle is Long and Leaves the Merchant in the Dark

Merchants are usually kept in the dark about a chargeback issue until very late in the process as noted below.

1. A customer disputes a transaction, typically bypassing the merchant and going directly to their card issuer. In fact, Verifi’s research shows that 86% of the time cardholders will not contact the merchant until after a dispute was filed…or not at all!

2. The issuer, a bank or institution that offers credit to the cardholder, credits the customer.

3. The card brand, such as Visa or MasterCard, processes the dispute.

4. The acquirer, the bank or financial institution that processes card payments for the merchant, receives the chargeback and resolves the issue or forwards it to the merchant.

5. The merchant either accepts the chargeback or decides whether to dispute and represent the chargeback, resubmitting the charge to the acquirer.

6. The acquirer then reviews the evidence from the merchant, and if they believe the merchant has addressed the chargeback, they represent the chargeback to the issuer. If the evidence supports the merchant, the issuer reposts it to the cardholder’s account. If not, they may request further information.

Finally, the cardholder receives the dispute resolution information and is either re-billed or credited for the item.

Too Many Cooks in the Kitchen

Because of the multi-step, multi-party process, merchants sometimes aren’t informed about chargebacks until 180 days or more after the sale. By the time you receive a dispute, it’s usually too late to stop an order delivery or to avoid a chargeback, resulting in lost merchandise and profits.

All these “cooks in the kitchen” trying to address the cardholders’ problem are effectively burning up hard-earned dollars from your bottom line.

 

Chargeback Notifications

One way to cut chargebacks and boost profits is to use chargeback notifications. Why? Because they put you ahead of the curve when a customer is challenging a charge. In addition, notifications enable you to relax overly restrictive fraud prevention measures which may lead to false positives, negatively impacting conversion, sales and profits.Why? Because they put you ahead of the curve when a customer is challenging a charge. In addition, notifications enable you to relax overly restrictive fraud prevention measures which may lead to false positives, negatively impacting conversion, sales and profits.

Chargeback notifications put you directly in touch with top banks. When a customer disputes a charge and goes directly to their bank, as they are likely to do, the bank immediately alerts you, providing you with the opportunity to resolve the issue before it becomes a chargeback.

Notifications get you off the sidelines and allow you to be part of the high-stakes chargeback game. You have a chance to resolve disputes on both friendly and fraudulent chargebacks in a timely fashion. As a result, you avoid costly fines, fees and penalties…and the potential loss of your processing privileges.

Talk to us about your problem and let us help you and your business make a meaningful difference. Contact us to find out what card issuer-to-merchant collaboration can do for you and your company’s bottom line!

 

 Facebook   Twitter   LinkedIn   Website

Congratulation to Raptor Team again !

British F1 side car racing took place in Brands Hatch, Kent UK last weekends 18-20 July.

Great news from Paymundo sponsored car- Raptor Race 57.

Fantastic performance by Tony Brown and Ashley Hawes to get 3rd from back of the grid !!

 

Well deserve it, mates !!

okay, we  have seen a lot of front view of the car. Ever wonder how it looks like back of the car…

 Facebook   Twitter   LinkedIn   Website

Top 10 Best Banks in the World 2014

With United States put behind the race, this Top Ten gathers the most powerful and influential banks in the world for the year of 2014. Discover which bank is ranked at top of the biggest bank in the world.

1. Malaysian Bank

The first place comes to Malaysian bank. The institution is renowned thanks to its reliable, repute and customer-friendly loan and banking services. More than that, it greatly gets involved in empowering the finance and economy of Malaysia. It is one of the reasons why the country is not developed and the paradise for investors.

2. Bayerische Landesbank Germany

Coming in the second position is the dominating banks of Germany. It is making the country’s economy strong and powerful. Bayerische Landesbank’s non-performing assets are 0.17 for this year.

3. Credit Suisse Bank of Switzerland

Credit Suisse arrives on the third position with 0.15 estimated non-performing assets. It is the most reliable and strongest bank in Switzerland. Many multinational companies from all around the world choose to keep their money saved therein.

4. Oversea Chinese Bank

With estimated non-performing assets of 0.13, China is famous for its banking solutions that even overseas investors rely on. Oversea Chinese Bank managed to empower the country during the past few decades.

5. Qatar National Bank

Fulfilling their reputation of being super powers, United Arab Emirates and Dubai are also famous thanks to Qatar National Bank. Bank loans and offers are trustworthy. It owns total non-performing assets of 0.11.

6. Toronto Dominion Bank

On the next position arrives Toronto Dominion Bank with estimated non-performing assets of 0.9. The bank is hundred percent evolved in strengthening the country’s economy and financial situation.

7. BOC Holdings Hong Kong Bank

Whether for exchanging currency or opening an international account, BOC Holdings Hong Kong Bank is the reference in this term. It is the most recommending bank in Hong Kong with a total of 0.7 non-performing assets.

8. OP Pohjola Bank

Renowned as being the most powerful bank in Finland, OP Pohjola Bank continues strengthening the nation’s economy. For several years now, it is ranked as a reputable and reliable bank from several institutions. Its total non-performing assets are 0.6.

9. Nova Scotia Bank of Canada

Enjoying its reputation with the hugest number of clients in the country and worldwide, Nova Scotia is a financial institution located in Canada. It offers a wide range of profits in return as saving accounts. This bank profits from 0.5 non-performing assets.

10. Imperial Bank of Commerce

Last but not least is the Imperial Bank of Commerce with 0.3 non-performing assets. This is surely the hugest bank in Canada after Nova Scotia Bank of Canada. Millions and even billions of customers (national and international) are saving their wealth in this bank. Even with a huge number of clients, transactions are safer than any other bank in the country. SOURCE

 

 Facebook   Twitter   LinkedIn   Website

PCI 3.0 – What You Need to Know

The PCI DSS was updated for the fourth time (1.0, 1.2, 2.0, 3.0) in November 2013. As always, the changes the PCI Council made address the latest vulnerabilities and include additional clarification and new guidance.

The following covers the most important changes affecting the majority of merchants.

Requirement 0 – PCI Intro

The introduction section probably holds the biggest change for PCI 3.0. Web redirection systems are now defined as system components, which means they’re now part of scope for PCI DSS.

The principal of redirection is when a website points users to a third party that collects and processes all card data. Another form of redirection is client side redirection, in which a customer types card data into a web form generated by the merchant, and is then sent directly to a third party. Either way, card data will not pass through the original website.

In the past, these forms of redirection were validated using SAQ A, but new emphasis in PCI DSS 3.0 changes that.

The new SAQ-A EP form is designed for ecommerce merchants using client side redirection.

Review the new PCI 3.0 SAQ forms 

This new direction will affect many merchants who were previously completing an SAQ A and now must move to an SAQ A-EP, which is significantly longer and includes things such as external vulnerability scans and penetration testing.
The reason behind this requirement change? If a hacker is able to manipulate redirection code, he could direct your customers to a fake payments page that looks identical to the one you had originally outsourced.

Attacker directing customers to a fake payments page (i.e., man-in-the-middle attack)

 

Requirement 1.1.3

A cardholder data flow diagram should show how cardholder data enters your network, the systems it touches as it flows through your network, and any point it may leave your network (e.g., sent to a payment processor). You’ll want to maintain a diagram for each card flow that exists. Most businesses will have just one flow, but you might also have an additional flow if your website processes payment cards.

Simple card present flow diagram

Physically creating a document that explains the processes will help you better understand where card data lives on your network.

Requirement 2.4

This requirement involves a document that lists all in scope device types and their function (e.g., POS systems, computers). This inventory list is also a great place to document software/firmware versions. If you’re feeling a little daunted by this task, interviewing department heads is a great place to start.

Requirement 4.1

In addition to GSM (cellular) connections and wireless Internet, it is now required that any communication that includes cardholder data sent over satellite should be encrypted. Depending on your business, this may not have much impact.

SecurityMetrics has many large retail chain clients (e.g., gas stations, hospitality, restaurant chains). Many of these chains use satellite communications between chains and even as a backup connection. According to the PCI Council, it’s no longer good enough to rely on the link provider’s system security. It’s your responsibility to keep this data secure.

Requirement 5.1.2

For systems not commonly affected by viruses and don’t have anti-virus software installed, you are required to implement and document a new process that shows you periodically evaluate these systems against emerging threats.

The point of Requirement 5.1.2 is to acknowledge hackers invent new ways to hack into systems every day. It requires merchants to research and pay attention to security notices from PCI vendors. If a new attack method is deemed a threat to your system, evaluate if the threat requires anti-virus.

Requirement 5.3

This requirement states that anti-virus can’t be altered without managerial approval. Often, anti-virus needs to be turned off to do system maintenance. During maintenance, who knows what could slip past your unguarded system.

My advice is, if you are updating an application that requires disabling an anti-virus, don’t. Instead, take that system off the network or cut off its Internet connectivity for that period. As a side note, it’s not OK for system admins to just give all users admin access to get around the requirement. That’s missing the point entirely.

Requirement 6.3

Any custom software application for a cardholder environment (whether in-house or commissioned by a third party developer) is under your jurisdiction. It’s ok to outsource your software development, but it’s not OK to outsource your responsibility to ensure secure development practices are followed. If you’re planning to use the application, remember that it’ll be part of your PCI assessment…not your third party’s.

Requirement 6.5.10

This requirement to protect against broken authentication was added to fix common application vulnerabilities. You should create/add/adjust your application code to mitigate any exposure to vulnerabilities. This can be done through not exposing session IDs in URLs, using secure cookies, and enforcing appropriate session timeouts.

Requirement 7.1.1

You’re required to have a role-based access control system. That means access to card data and systems should only be granted on a need-to-know basis. PCI 3.0 requires a defined list of the roles that have access to the card data environment.

On this list, you should include each role, definition of each role, access to data resources, privilege level, and what privilege level is necessary for each person to perform normal business responsibilities. Users must fit into one of the roles you outline.

Requirement 8.4

Organizations are now required to not just document, but also train their users on how to implement password policies. This training should include guidance on how to select a strong password, how to secure it, and instructions not to reuse it.

It’s also crucial that you communicate password policy to your users. This will help them understand how to change their passwords and also not to use the same password between work and home.

Requirement 8.5.1

This new requirement is targeted specifically towards service providers who have remote access into a customer environment. This is common practice with vendors who do remote support or software training.

Any service provider with access to multiple customer systems is now required to maintain unique credentials for each customer environment. The PCI Council knows this requirement in particular will take some time to change, so they’ve given until July 2015 before this is officially required.

Requirement 8.6

The use of alternative authentication mechanisms (e.g., logical tokens, smart cards, certificates) must be tied to an individual user account and not shared among user accounts. To ensure this is met, every merchant must implement a control to enforce those authentication methods can only be used by the intended user (e.g., requiring a PIN, password, or biometric scan in addition to the token to validate the person is authorized).

Requirement 9.3

This requirement is all about controlling employee access to sensitive areas, which must be related to an individual’s job function. To meet this requirement, it’s  exactly who has access to these environments and their business need. Access must be kept up to date, especially when individuals are terminated or their job role changes.

 

Requirement 9.9

This is a huge addition to the PCI standards. Organizations that use point of sale systems, PIN pads, mobile devices etc., are required to do three new things:

1. Maintain an up-to-date list of all devices (9.9.1) including physical location, serial numbers, make/model.
2. Periodically inspect devices (9.9.2). That means looking at device surfaces to make sure they haven’t been tampered with, making sure the serial numbers match, checking that seals haven’t been broken, etc. This could be a very large task depending on the size of your organization. Whether you inspect devices every day or month is based on how at risk you are of tampering (e.g., publically accessible 24/7 gas station terminals vs. a behind-the-counter card swipe device). Make sure you document what you find.
3. Provide staff awareness training (9.9.3) for staff that interact with card present devices on a day to day basis (e.g., cashiers), and record the who, what, and when for future reference. Ideally, the training will help staff detect any suspicious activity around a payment device. Training should include how to report suspicious behavior and what to do when third parties claim they need to work on the system. For example, rather than assuming IT came in last night to install a new device on the side of her terminal, an employee should question if its supposed to be there and notify appropriate persons.

 

Requirement 10.6.2

Depending on its size and complexity, this requirement could have a large impact on your environment. In addition to the logging requirements in 10.6.1, you’re now required to review logs of all other system components periodically, based on your policies and risk management strategy.

Lots of different systems in your environment may impact your payment security. As part of your annual risk assessment, you need to identify systems that pose risk and define a process to periodically look at their logs to determine suspicious activity.

Requirement 11.1.1

Maintaining a complete list of authorized wireless access points will require extra documentation, especially in large environments. This list should include a documented business justification for each wireless access point.

It’s difficult to determine which wireless devices to remove if you don’t have an accurate list of them to begin with. That’s why the PCI Council requires you create a total list. If you’re a small ecommerce provider and all your systems fit into a single rack in your data center, this requirement should be pretty easy. If you’re a widespread organization, it will take a bit more time.

Requirement 11.3

The rewrite of section 11.3 is intended to provide additional guidance to both merchants and penetration testing organizations on penetration testing’s intended coverage.

Penetration testing organizations are now required to have documented and standardized testing methodologies that meet industry accepted standards, such as NIST 800.115. In addition, guidance is provided on how best to scope the penetration test and identify critical systems.

A penetration test Special Interest Group has been organized by the PCI Council to help merchants and penetration test organizations best interpret this new set of requirements.  Results from this SIG group are expected near the end of 2014.

The PCI Council knows this requirement in particular will take some time to change, so they’ve given until July 2015 before the changes in the penetration testing requirement become official. However, this doesn’t mean you can wait to receive a penetration test until July 2015. The guidance provided in PCI DSS 2.0 for penetration testing is still valid until then.

Requirement 12.8.5

Not only should merchants maintain a list of a third party service providers, but now they must maintain a list of all PCI requirements their service provider meets, and a list of PCI requirements they’re required to meet.

Requirement 12.9

In conjunction with Requirement 12.8.5, service providers are now required to provide written documentation to all customers stating which PCI requirements they cover on their behalf. These two requirements attempt to avoid past mis-communication problems between service providers and merchants. SOURCE

 Facebook   Twitter   LinkedIn   Website

Americans feel EMV chip cards make their debit or credit card transactions more secure

NXP Semiconductors has announced the results of its ‘Security Matters: Americans on EMV Chip Cards’ survey.

To gain further understanding of how confident Americans are in the security of EMV chip card technology and debit/credit card purchases in general, NXP polled more than 1,000 American adults on credit card usage, behavioural trends and consumer sentiment toward the electronic and cashless movement.

Attitudes towards Breaches and Retail Hacks
Overall sentiment reveals that while consumer confidence in credit card technologies remains high, Americans continue to demand better solutions that protect identity, personal information and financial data. With recent reports of compromises in security at Target, Neiman Marcus, PF Chang’s and other retailers, Americans are more likely to pay in cash following a security breach at large retailers, with 37% of the millennial age group (18 to 34 years of age) being the most likely to convert to cash. For example, 80% of Americans are confident in their financial institution and the security of their financial accounts, as well as the security and protection of their credit/debit cards (73%).

However, once a security breach at a major store occurs, consumers automatically turn to less convenient forms of payment (64%) – such as cash – to complete a purchase.

Credit Card Protection Technology
Respondents were asked a number of questions pertaining to security, confidence in financial institutions and credit cards, purchasing habits, geographic location, gender and general understanding of current magnetic strip and EMV technology. When asked specifically about the underlying technologies of a credit or debit card, Americans responded favourably, with 69% stating that EMV chip cards are making their debit and credit card transactions more secure, with only 5% feeling chip cards make their transactions less secure. When asked about the tap and pay feature available on some EMV chip cards, the most common concern expressed was an increased risk of theft (61%), followed by 37% expressing concerns about being charged incorrectly for purchases.

Security and Personal Information

• 69% of Americans feel EMV chip cards make their debit or credit card transactions more secure
• 28% believe they are much more secure
• 31% of men believe they are much more secure compared to 24% of women

Security of finances

• 73% of Americans are confident in the security of their credit/debit cards or their financial accounts (80%) with their primary financial institution
• 33% are very confident in the security of their accounts, compared to 26% feeling very confident in the security of their credit/debit cards
• 64% of Americans say they are more likely to pay in cash after hearing about security breaches at large retailers
• 36% say they are not more likely to pay in cash
• 37% of 18 to 34 year olds say they are much more likely compared to 27% of 35 to 54 year olds and 23% of those 55+
• 5% believe chip cards make their transactions less secure

SOURCE

 

 Facebook   Twitter   LinkedIn   Website

More to come from Raptor Race. Make sure you follow !

After a successful race in Brand Hatch last month, Raptor Race is back !

In case you miss out the full report, check here 

Check out more from Tony Brown & Ahsley Hawes RaptorRace this season

HERE

 

 Facebook   Twitter   LinkedIn   Website