by Ty Hardison

PCI 3.0 standards expect more constant vigilance from vendors

A more proactive approach to payment data security can reduce the risk of costly attacks.

One of the biggest hurdles to payment card processing security is for companies to remain compliant between audits. As we've reported on this blog, many don't. However, continuous review and monitoring is written into the new PCI 3.0 standards to prevent companies from overlooking their responsibility to evaluate practices on an ongoing basis. Instead of cramming for a PCI audit, businesses are expected to integrate assessment measures into their regular operations. 

Experts say that those expectations may be the most challenging difference between old PCI standards and the latest guidelines. 

"PCI DSS 3.0 inherently implies that organizations adopt continuous compliance and monitoring to reduce the risk of a breach...," writes Torsten George of Info Security Magazine. "This … more

Robust penetration tests are critical to data security

Robust penetration tests are critical to data security.

One of the most effective ways a company can determine the security of a card processing platform is to undergo a penetration test. These are required for PCI compliance, and merchants conduct them annually to identify vulnerabilities to preempt malicious hacking attempts. In a standard penetration test, administrators make their best effort to compromise a network in the manner of cybercriminals, thereby revealing which areas might be sensitive to a breach. 

Mark Burnette of Net Security says penetration tests allow merchants to use the tools of hackers to help fortify existing systems. Rather than waiting for criminals to discover vulnerabilities in your payment card processing system, penetrating them yourself first can allow companies to double down on security. 

"In the … more

What merchants need to know about the new credit card fraud liability rules

Starting October 1, retailers, rather than card issuers, may be held liable for credit card fraud if an EMV card is accepted at an EMV-less terminal.

New rules for retailer credit card fraud are slated to go into effect on October 1, representing the first major sea change in credit fraud liability in years. But what do merchants need to know to make sure that they're ready for this change?

According to the financial news website The Street, come this October, U.S. retailers looking to better manage risk after a new shift in fraud liability will need terminals compliant with Europay-MasterCard-Visa (EMV) "smart cards," which are designed to better curb instances of counterfeiting. This shift in determining where liability lies if fraud occurs is just one step in a much larger process of pushing for a more widespread of EMV throughout the U.S.

While card issuers — predominantly banks — used to … more

Marriott franchise hit by another string of breaches

Many of the Marriott Hotel locations whose credit processing systems were compromised in 2013 experienced a similar breach in the second half of last year.

Many of the Marriott Hotel locations whose credit processing systems were compromised in 2013 experienced a similar breach in the second half of last year. After several banks and credit institutions investigated incidents of fraud on credit and debit accounts, investigative reporter Brian Krebs followed the payments to the series of hotels, 14 in total. 

The locations in question are run by franchise operator White Lodging Services, and the breach was traced to hacked point of sale systems. The compromises mostly occurred at restaurants and bars at the hotels, between September 2014 and January 2015, according to Jeff Goldman at eSecurity Planet. 

"We recently were made aware of the possibility of unusual credit card transactions at a number of hotels operated by one of our … more

New "Ghost" vulnerability prompts warning from Homeland Security Department

A new vulnerability called

A new vulnerability called "Ghost" has emerged as a threat to computer systems, cautions PCI Security Standards. The United States Department of Homeland Security has issued a warning to users of Linux GNU C Library operating versions prior to 2.18. By remotely executing a code, hackers can take control of a system to install malware, manipulate files and carry out other illegal activities with stolen credentials, reports Mobile Payments Today. 

The warning was released through the United States Computer Emergency Readiness Team, and PCI Security Standards Council made suggestions for companies to protect their secure payment card data in light of the new threat:

First, companies should work with IT departments to find systems, servers and pieces of hardware that run a targeted … more

Less than one-third of retailers remain compliant between audits

According to Verizon's 2015 PCI Report, only 28.6 percent of retailers remain compliant with PCI standards in the periods between audits.

Businesses that use credit card merchant services are held to PCI compliance standards, but many of them only do the legwork in advance of an audit. With the spate of headline-grabbing breaches, it's easy to see why this is bad business practice. According to Verizon's 2015 PCI Report, only 28.6 percent of retailers remain compliant with PCI standards in the periods between audits. This means that some companies are keeping up with standards imposed on credit card security for only a brief window of time, leaving them open to vulnerabilities for the remainder of the year. 

"We see compliance going down day by day, month by month, after the assessment," said Rodolphe Simonetti, managing director for Verizon's compliance consulting. "Compliance is supposed to be … more

Supreme Court denies merchants' petition for lower debit card processing fees

The Supreme Court opted to dismiss a merchant petition calling for the court to reconsider the debit card swipe fees set by the Fed.

In 2011, the Federal Reserve was accused of ignoring the Durbin Amendment to the 2010 Dodd-Frank Act when it established a debit card swiping fee of 21 cents per transaction, a cap that they claimed was allowed by the amendment's ambiguous language. On the other side of that debate, merchants argued that that cap was far beyond what was originally intended by Dodd-Frank, with a U.S. district court ruling in their favor in the summer of 2013. But as we shared with you last year, that ruling was then overturned by an appellate court, stating the legislation, albeit "poorly drafted," still entitled the Fed to the merchant interchange fees it had set for debit card swipes

That setback prompted merchants to file a petition with the U.S. Supreme Court, arguing the high court to take up its … more

Global mobile payments to surpass $130 billion by 2020

NFC-based mobile payments are growing in popularity.

Technologies such as Apple Pay are driving increased adoption of NFC-based mobile payments, and the industry is expected to grow significantly over the course of the next few years. According to a report from Strategy Analytics, the NFC mobile payment market will exceed $130 billion by 2020. 

This is encouraging news for an industry that took longer than initially expected to get off the ground. For years, there was talk that Apple's iPhone would contain the NFC technology needed to facilitate mobile payments at retail stores and restaurants, but it was only this year when the iPhone 6 and iPhone 6 Plus came out that the technology was finally included in the popular line of smartphones. Now that NFC is becoming more mainstream, it's expected to only grow exponentially over … more

Google sues MasterCard, Visa for allegedly high merchant interchange fees

Visa and MasterCard are being sued by Google for charging excessively high merchant interchange rates.

Google has slammed MasterCard and Visa with a new federal lawsuit, accusing the credit card companies of excessively high and "supracompetitive" merchant interchange fees.

The complaint alleges that from January 1, 2004, to November 28, 2012, Google was forced to pay a merchant interchange rate considerably higher than "what a competitive market would allow" whenever it accepted payments from MasterCard or Visa cardholders. The tech giant accuses the credit card providers of violating Section 1 of the Sherman Act with its merchant service rates.

A class action lawsuit had previously been filed against both MasterCard and Visa over debit and credit card merchant fees. That case ended with a settlement of $7.25 billion that was then divided up among the plaintiffs who were forced to pay … more

January marks the start of PCI version 3.0

Companies that rely on credit card merchant services must be compliant with a new set of Payment Card Industry Data Security Standards in 2015.

Companies that rely on credit card merchant services must be compliant with a new set of Payment Card Industry Data Security Standards in 2015. Effective this month, version 3.0 will replace the previous set of standards, in an effort to enhance security and protect personal data for consumers. 

PCI updates its standards every three years, as advances in technology and new vulnerabilities emerge, to make the industry more airtight to breaches. Experts say that while becoming compliant with new PCI directives might cause headaches in the short term, it will benefit companies and their customers in the long run. 

"It's also a response to events that have taken place since the last DSS version, like the numerous security breaches and mass credit card data thefts that … more