One year ago today, The Clearing House debuted RTP, its Real Time Payments system for the US financial market. Supported by all the member banks of The Clearing House, RTP is off to a strong start. It’s estimated that 50% of eligible demand-deposit accounts will be able to receive an RTP transaction by year end. 

The purpose of RTP is to provide instant transfer of funds between member banks, reducing expenses and streamlining reconciliation. Faster and simpler than ACH transactions, RTP brings the convenience and speed to banking transactions that businesses expect in today’s instant-digital world. And in the case of card transaction settlement, RTP provides a vastly superior means for merchants to receive their money fast. However, while RTP is a system long overdue in the US, it comes with its own set of risks.  

Oftentimes, increased transaction speed goes hand in hand with decreased fraud controls. And fraudsters are quick to jump on opportunities. That’s just what has happened in the UK, which has had an RTP system since 2008. Invoice fraud has become a serious problem for consumers. Fraudsters manage to trick consumers into paying a valid-appearing invoice from a trusted vendor. Keep in mind that with RTP, money is transferred instantly, and once it’s gone, it’s really gone. Thieves are quick to move funds, making it nearly impossible to recover.

In addition to invoice fraud, thieves are taking advantage of transaction speed to take over and drain consumer accounts using stolen credentials. Again, because it’s so easy to transfer funds, fraudsters can quickly move money through multiple burner accounts until it’s no longer possible to track. Really, all forms of money laundering are made easier with RTP.

So what are FIs in the US doing to combat this risk? RTP security requires a multi-step approach. Since RTP eliminates the opportunity for manual risk evaluation, member FIs are turning to advanced machine learning and behavioral analytics that can spot questionable transactions much more effectively than the old system ever could. Another area of risk is account number theft. While we’ve made great strides safeguarding consumer account data for credit and debit cards, with RTP it’s imperative to secure bank account numbers. Fortunately, just as tokenization has cut fraud for card account purchases, tokenization can also protect bank account data.

While FIs are stepping up their fraud-prevention game in response to RTP risk, it’s a shift that needed to happen anyway. Investing in cutting edge fraud control technology can only help clear the way for additional innovation in B2B and C2B transactions in the future.

The rise in internet-connected devices brings terrific benefits to retailers: easier inventory management, increased data collection, targeted customer promotions and much more. But this same connectivity can leave retailers vulnerable to data breaches due to hackers and malware. When considering implementing IoT applications in a business setting, retailers need to manage risk with these 4 approaches.

1. Manage Remote Access

Most major data breaches happen through remote access. Thieves manage to hitch a ride into a retailer’s network using the access gained from a third party. That’s how the infamous Target breach of 2013 was accomplished: thieves used an HVAC vendor’s remote access to break into the network and steal 41 million customer payment card accounts.

Eliminating remote access isn’t the answer. Remote access is an essential tool for business productivity. As IoT continues to expand, remote access applications will only increase. Any business using remote access must take the necessary steps to segment their network to protect cardholder data and limit vendor access to only pertinent areas of the network. Securing remote access isn’t a place to take shortcuts.

2. Regulate Connectivity

Between IoT connectivity, remote vendor access, work from home employees and much more, a business might have countless devices accessing their network on any given day. And there’s no way to know what sorts of security standards these devices were (or weren’t) built with. Therefore, policing has to happen on the retailer’s end. It’s crucial to develop a company-wide security policy, providing for secure connections and delineating which devices are permitted to connect. In the largely unregulated world of IoT, anything less is an open invitation to thieves.

3. Maintain Compliance

Take it from the experts: the best thing a business can do to protect itself from risk is to follow established security protocols to the letter. PCI standards are complex, but they’re both effective in protecting payment data, and regularly updated to combat new threats. Europe’s rigorous GDPR standards protecting personal privacy will likely make their way to our shores over the coming several years as well. In the meantime, by following best practices such as minimizing storage of sensitive data, securing data in silos or other approved means, and transmitting data only through approved encryption methods, businesses can minimize opportunities for breaches.

4. Watch and Wait

Over time we can expect the wildly unregulated world of IoT to be brought in line. As manufacturers pay more attention to the security they’re programming into their IoT devices (and as they’re penalized for failure to do so) we’ll see more uniformity and control in the ways devices connect and in the services they can perform. Until then, businesses need to exercise extreme caution in protecting themselves and their customers from IoT related breaches.

Unattended retail is a great way for your retailers to cut labor costs and build efficiency. From  grocery self checkout to payment kiosks, unattended retail is growing in popularity every year. But it’s important to realize that unattended retail comes with some unique fraud risks. Be aware of these risks so that you can help your merchants develop wise loss prevention strategies.

Unattended retail fraud risks come from three distinct angles:

1. Thieves using the technology to steal products directly
2. Thieves using the technology to steal data
3. Thieves using stolen data to buy products

First let’s look at the risks of direct product theft:

1. The Five-Finger Discount

If you think self checkout is a tempting opportunity for thieves, you’d be right. Retail self checkout is a major source of shrink. Some of the theft schemes are so common, they even have names. There’s the banana trick, where an expensive item like steak is weighed with a cheap produce code like bananas. With the pass-around, customers pretend to scan an item before dropping it into the bag. And finally, there’s the switcheroo – just as it sounds, replacing an expensive item’s barcode with a cheap one.

While these names might make you smile, they’re a real problem for merchants. Some studies ^{1, 2} have shown that up to 20% of shoppers admit stealing items at self checkout.

To reduce shrink, your retailers need more than a staff member monitoring the self checkout corral. Consider adding a layer of technology. Developers are producing AI that can visually recognize products and verify whether scanned prices are accurate.  

Some providers offer video-based solutions ready to be implemented today. Take a look at Stoplift, which boasts ease of POS integration as well as PCI compliance. And what’s more, they provide several entertaining (and alarming!) real-life videos of self checkout thieves in action.

2. Skimming for profit

Now let’s consider how unattended retail can be mined for data theft. Skimmers are an ongoing problem for fuel pumps and ATMs. Recently, this risk has expanded to other unattended retail providers such as car wash payment kiosks, vending machines and even grocery checkout units.

Bluetooth skimmers can be inserted deep into a card reader slot, undetectable to the eye. In the past, thieves would have to physically pull a skimmer from a card reader to access data, but these days technology makes it awfully convenient. Called blue skimming, thieves can simply park nearby and download data in real time via bluetooth.

So how can your merchants prevent skimming? To start, you should instruct merchants to check their equipment regularly for signs of tampering. Measures such as security tape on fuel pumps can keep thieves from disassembling equipment and installing skimmers.

But with skimmers inserted into the card reader, merchants need to fight fire with fire. For Android and iOS, your merchants can easily download apps such as Skimmer Scanner or Card Skimmer Locator (on the iOS app store) to check their machines for common bluetooth skimmers.

However, keep in mind that these solutions are just a patch on the problem. The underlying problem remains the use of mag stripe transactions. For the ultimate fix, urge your merchants to upgrade to chip technology, even if they are in a vertical currently exempt from EMV penalties.

3. NFC: Bypassing EMV security

While EMV upgrades will prevent mag stripe skimming, clever thieves have still found a way to bypass EMV security using NFC (tap and pay.) Since the EMV shift, most retailers have upgraded their POS hardware with NFC technology. It’s ironic that this move meant to increase security has left a back door wide open.

As it turns out, it can be easy to add stolen credentials to Apple Pay, Samsung Pay and Google Pay. While large issuers like Citi require two step verification before allowing a card to be added to a payment service, thieves have learned that many smaller issuers don’t bother. Thieves simply snap a photo of a counterfeit card, or even enter the data manually. And within minutes, they’re in business.

By using unattended retail, thieves don’t have to worry about showing a matching photo ID to a cashier. Depending on the issuing bank’s alertness, thousands of dollars can be siphoned away before the fraud is noticed. Are your merchants liable for these fraudulent transactions? They shouldn’t be, but it may be a hassle to convince the issuing bank otherwise.

Final Thoughts

Without doubt, unattended retail is the way of the future. And while this sector cuts labor costs, it still requires a level of retail supervision. From minimizing shrinkage to staying on top of equipment upgrades, unattended retail is not necessarily effortless retail. Help your retailers take the right steps to manage this payment environment, and you’ll make it as frictionless and profitable as it can be.

Merchants are intensely concerned about payment security. And rightly so, considering the destructive costs of data breaches. However when you try to explain PCI compliance, you probably notice their eyes glazing over.

If you want a busy merchant’s cooperation, you’ve got to be able to explain payment security in terms that are simple and direct. Unfortunately, in the busyness of merchant services, security terms and concepts can be sometimes become a little fuzzy for all of us.

Let’s review some data security terms and what they mean to you. By understanding the foundations of payment security, acquirers can communicate the priority of PCI certification to your merchants, as well as making sure your payment solutions are meeting merchants’ needs.

Here’s What You Need to Know:

PCI SSC: PCI SSC (Payment Card Industry Security Standards Council) is an independent group that sets, develops and modifies globally accepted payment card industry security standards. PCI is supported by all the major brands, although merchants may not be quite so enthusiastic about the work involved in meeting requirements. Remember that the PCI SSC website is an invaluable resource for merchants and acquirers alike: you can find everything from basic information pamphlets to in-depth technical requirements.  

PCI DSS: PCI DSS is the list of data security standards merchants must follow. PCI DSS standards vary based on the merchant’s payment scenario. As security risks and payment technologies evolve, these standards are regularly revised, so it’s important to make sure your merchants remain in compliance with changes.

PCI SAQ: The PCI SAQ (self assessment questionnaire) is a document merchants are required to complete annually and submit to their acquirer. This document, along with a signed AoC (Attestation of Compliance) certifies that the merchant is in compliance with PCI standards. There are several different SAQ categories based on a merchant’s payment scenario. It’s important for your merchant to follow the applicable SAQ.

EMV: Standing for Europay, Mastercard, Visa, EMV is a consortium supported by the 5 major payment brands that governs standards for chip card payments. EMV is responsible for the widespread adoption of tokenization as an encryption form for chip card transactions, and the resultant 75% drop in card-present transaction fraud.

Encryption: Encryption is the general term referring to the process of converting data to a code using an algorithm and a key. Secure encryption of PAN data is critical for payment security, and there are several methods by which it is accomplished depending on the processing environment. Encryption and tokenization are both effective means of protecting cardholder data, but in general tokenization is preferred due to faster processing times. Which leads us to…

Tokenization: Tokenization is a cryptographic method by which sensitive data is replaced with a token. The data can’t be decrypted without a token key, stored securely in at the processing end. Tokenization is used quite successfully in EMV chip card transactions, as it renders stolen data useless. Tokenization is also used in CNP channels, though not exclusively. Visa Checkout, Masterpass and Paypal all utilize tokenization for ecommerce payments.

P2PE: Point to Point Encryption is a data security standard that ensures the encryption of cardholder data at the point of the transaction terminal. Developed by PCI, P2PE is the gold standard for data security. Merchants who meet P2PE standards are ensuring the greatest security for themselves and their customers, although meeting these specifications is no walk in the park for acquirers or merchants.  

E2EE: End to End Encryption is a catch-all term for various encryption solutions used in the market that encrypt data from the merchant’s terminal. E2EE is not the same as P2PE. E2EE is not supported by PCI and does not qualify merchants for a PCI scope reduction. E2EE effectiveness depends largely on the compliance of the providers involved in the transaction chain, and there is no group providing oversight or ensuring implementation.

When possible, P2PE is a better security option for your merchants; however P2PE is not available for all payment scenarios. In these cases, it is reasonable to offer merchants an E2EE solution.

Merchant services is no job for slackers. It’s a juggling act of processing, billing, customer service and marketing. And when you throw in ever-changing security requirements? It’s easy for the details to get lost in the shuffle. With a good understanding of data security, you can explain these concepts effectively to your merchants. In the long run, clear communications will mean better security for your merchants. Make sure the facts aren’t being obscured by the buzzwords.

Is your call center ready to face new threats to data security in 2018? It’s important to understand the risks call centers face, and make a plan to protect your business and your customers.

2017 was a banner year in payment security – both good and bad. While EMV has slashed retail card fraud, fraudsters quickly turned their efforts to new channels. Last fall saw the worst data breach in US history with Equifax, which placed uncounted millions of consumer files into the hands of criminals. These two trends – the need for alternate avenues of payment fraud, combined with wide access to personal consumer information – have converged on the call center.

Since retail fraud is becoming less and less profitable, fraudsters have turned to call centers with alarming results. Research shows that call center fraud rose by 113% in 2016.  Fraudulent attacks run the gamut, from individual attempts to gain control of a consumer’s identity and drain bank accounts, to mass infiltration of a company’s network through the installation of malware. Combined, these efforts bring a major threat that requires a multifactor approach.

Inside Risk

As with most businesses, call center data security risks come from both inside and outside the organization. Considering the high turnover, low compensation environment of many call centers, employees may pose an attractive target for compromise. According to Semafone, 11% of call center staff report being approached by people either within or outside their organization to access or share sensitive customer information.

It’s crucial to follow PCI DSS best practices to set up a secure operational environment to prevent opportunities for data theft. Consider setting up a clean room environment, excluding cell phones and locking out personal access to email and internet browsers. Monitor for signs of unusual employee activity, such as printing extra copies of customer information or downloading files to a USB drive. Common sense oversight can go far in maintaining data integrity.

Outside Risk

Mitigating outside risk must be approached on two separate fronts: inbound calls and IT systems.

Inbound Calls: Considering the recent data breaches, call centers are finding inbound calls to be an increasing source of fraud. Caller authentication is growing more difficult. Armed with stolen personal data, fraudsters are often quite capable of answering security questions. Verifying inbound phone numbers is little help, as it’s easy to spoof caller IDs, particularly when using VOIP. Multi-layer authentication is the key to weeding out fraudulent callers. It’s wise to partner with outside experts to help manage this process. Of course, call centers should adhere rigorously to PCI DSS requirements, which are regularly updated to reflect best practices.

Keep in mind, fraudsters that dial your call center might not be trying to bilk your customers out of cash outright, but rather seeking to gain additional personal information, in order to build a more complete consumer profile for future fraudulent attempts. Don’t participate in their game. Educate your employees about what information they can and cannot provide. An educated workforce is less likely to fall prey to scams.

IT Systems: Smart IT systems provide the best defense against data breaches due to malware or information theft. Take the time to set up proper firewalls, antivirus software, and intrusion monitoring systems. These steps seem like common sense, but too often, corners may be cut in IT.  Call Center Management reports,  “IT system development or maintenance of call centers do not always deploy the right security technologies, which introduces a number of network deficiencies that could easily be exploited by hackers.”

Human error remains a common entry point for malware infections – from accidentally downloading an attachment to visiting a compromised website. By excluding personal emails or browsers from inside-facing systems, you can provide a wall of separation to catch any resulting attacks before they have a chance to rob you.

Today more than ever, call center data security is paramount. Considering the threats to payment security that have evolved over the past year, you can’t afford to neglect this aspect of your business. It’s vital to look both outside and inside for possible weak links. By following PCI DSS requirements, and carefully managing your call center staff, software and IT systems, you can go far in protecting your business and customers from threats.

What’s the first word that comes to mind when you think about PCI compliance? Most likely “security” (or perhaps the word “headache”). But in either case, hardware storage is probably not your top consideration. And yet, PCI compliant hardware storage is absolutely crucial for your merchants’ data security.

Protect Your Merchants

Unsecured encryption keys, PIN pads and POS terminals can be a gold mine for data thieves and a nightmare for merchants. Thus, PCI has put a number of stringent requirements in place regarding device management, including how equipment is “produced, controlled, transported, stored and used.” These standards ensure that at all points in the life cycle, devices are protected from unauthorized access.

Look for Qualified Vendors

So what should payment service providers look for to protect your merchants’ devices? Work with vendors that are PCI-PIN validated. Approved vendors, including CDE Solutions,  have done the rigorous work involved in establishing dual-control secure storage and chain-of-custody tracking that meets PCI specifications. Bottom line, by partnering with a PCI compliant support partner for hardware storage, payment service providers can greatly reduce the risk of equipment compromise prior to merchant deployment.

Meeting Security Standards

Wondering what makes hardware storage secure? Here’s an overview of the specifications:

• POIs are kept in locked storage with dual access control.
• POI access is highly employee restricted.
• POIs are both stored and shipped with tamper-evident security features
• The vendor documents the POI’s complete chain of custody.

For more in depth details, you can review the standards here.  These measures, and more, are designed to protect device integrity, ensuring optimal function in the field and protection for merchants and consumers.

When considering the runaway disaster of data breaches, secure hardware storage is absolutely crucial for your merchants. By partnering with a PCI compliant hardware storage provider, you can help your merchants avoid this danger. After all, PCI standards are not just paperwork, they’re truly best practice.