card schemes | madrock

Archives for : card schemes

EFT Syetms and Device Considerations

Posted by :Derek On : August 5, 2008

EFT devices and systems differ depending on hardware vendor, country and bank / payment aggregator.
Below is a list of things you may like to consider. This list is off the top of my head so it is probably not complete.

Looking at the products and relationships us usually a good start.

Things to consider:

Card skimming methods
Some EFT POS devices restrict the connection of a skimmer
Review levels of associated fraud
Review devices and EFT methods
Review terminal identification (merchant and customer)
Manual processing. (internal and external)
eCommerce products
PC based software
Dedicated server services (Nobil, etc.)
Web based engine (Custom objects, Web pop-ups, etc)
Authorisation / identification methods (Merchant and customer)
TCPIP session hijacking / session spoofing
Direct Debit as well as Credit Cards.
Swift (methods and controls)
Telegraphic transfer (methods and controls)
Payment aggregator relationships (eg. Payment Tech, manual processing, cheque scanning, etc.)
Internet banking facilities (attack / penetration,Â Certificate registration / management, ISP SLA’s, etc.)
Implementation of Smart Card and / or alternative customer recognition devices.
Outsourcing and associated risks / service level agreements
Payment processing
Payment clearance
Payment switching
Reporting (segregation of merchant / customers / aggregators / partners / local / international)
Fraud detection and reporting
3rd party acquiring risks
Single merchant ID many businesses
Allows moneys to be laundered if the payment aggregator does not place appropriate controls on the merchant.
Encryption used
Internet / trusted partner / inter-bank / extranet
Private and / or public certificates
Single use certificates
Client side certificates
Remittance advice processes and controls.
EFT disaster recovery and manual fall back procedures (associated security and reconciliation risks)
Trusted partner relationships, SLA’s, liabilities and risks.
EFT regulatory / legal requirements (inter-bank and government)
Refund processing / authorisation. (policies, procedures, controls, etc.)
CVV, CVV-2 / CVC-2 processing and management. (http://www.atlanticpayment.com/CVV.htm)
Fraud detection mechanism (neural networks, inter-bank / department customer checks, etc)
Supported card schemes (AMEX/Visa/Mastercard/Discover/etc )
Review EFT floor limits (corporate and SME merchants)
Review the ability to withhold merchant settlement until the presence of fraud has been determined.
Review customer identification details. Such as (This varies around the world depending on local regulations / privacy laws)
Review real-time and batched processing methods and controls (sequence numbers, access to raw data, etc.)
Review processing with and without expiry dates. (exception controls and policies)
Review exception / fraud reports.
Review payment store and forward policies and procedures.
Review Pre-Auth and Completion controls.
Token based payment (eCash, etc)
Merchant reconciliation, reporting methods and controls (paper, Internet, email, PDF, Fax, etc.) and associated security.
Real time gross settlement policies, procedures and controls. (IT and amounts)
Card issuing policies and procedures. (customer ID checks, etc)
Banking infrastructure (ingress / egress) controls and security. (Web, partner, payment switches, outsourced infrastructure, monitoring / reporting.)
Use of Internet technologies for inter-bank transfers and remote equipment.
Physical security and controls of devices, ATM,s, line encryptors, etc.

Contactless credit cards with RFID are easily hacked

Posted by :Derek On : June 18, 2008

Category: Banking & EFTPoS, RFID, Security

Tags:acquirer, bank, BoingBoing, Card, card schemes, Chip, contactless credit cards, Credit, data, DES, encryption, hack, JAVA, javascript, payment, RFID, rfid chip, rfid chips, script, Shiraz, Technical, Vulnerabilities

A blog posting on BoingBoing provides further discussion as to the
inappropriate deployment and of RFID chips within the existing payment
marketplace.

http://www.boingboing.net/2006/10/23/report_contactless_c.html

The underlying point of this article is, the card schemes and banks said they are using key rotating encryption of all data between the card and the acquirer/issuer, but this is clearly not the case in many situations.

Another interesting paper is ‘RFID Payment Card Vulnerabilities Technical Report’ located at:

http://www.nytimes.com/packages/pdf/business/20061023_CARD/techreport.pdf

Technology is always being challenged

Posted by :Derek On : June 18, 2008

Category: RFID

Tags:acquirer, algorithm, authentication, bank, Banking, bidirectional, Card, card schemes, Chip, chip solutions, cryptographic algorithms, data, DES, Digital, digital signatures, Dust, EMV, financial transaction, identification, javascript, Merchant, payment, Pin, privacy, processing, Reader, Relay, RFID, rfid chip, RFID-enabled, RSA, rsa laboratories, script, security, security privacy, Shiraz, Skimmer, skimmers, SMS, standards, support, technique, technology, transaction, type, Vulnerabilities

I read a very interesting paper created by the University of Massachusetts,Â RSA Laboratories and Innealta, Inc.<<

This paper primarily relates to the compromise of contact less payment technologies (RFID) if the RFID and/or reader have not been implemented correctly or the solution provider has used an inappropriate type of RFID and discusses the challenges around Chip and Pin with respect to financial transactions e.g. EMV standards and compliance.

Additionally, the paper describes a RFID relay method which is being discussed within many forums around the world and we have now begun to see equipment being produced for the RFID skimmers/clonners to use for malicious means.

The overarching point of this paper is to use an appropriate RFID & Chip solutions which supports the security/privacy of the user and purpose of theÂ transaction (financial or non financial)<<

The paper can be found at http://prisms.cs.umass.edu/~kevinfu/papers/RFID-CC-manuscript.pdf

In modern payment RFID & Chip solutions, newer devices can be used which possess a high degree of processing power and are therefore able to execute strong cryptographic methods (such as digital signatures) to protect the identification and payment information whilst the transaction is occurring.

These systems often utilise bidirectional authentication between the RFID/Chip scanner and the RFID tag/Chip prior to performing the transaction. These methods and cryptographic algorithms are accepted and proven to work within the traditional payment markets.

As mentioned in the paper, some solution store static digitally signed and/or encrypted data which is provided to the RFID/Chip reader when queried, but this data never changes from one transaction to another. This may allow a malicious individual to capture and re-inject the data into the reader at a later stage. The alternative to storing static digitally signed and/or encrypted data is to negotiate a key exchange at the time of the transaction in which the card/value information is encrypted and subsequently transmitted. With this method the transmitted data
changes on every transaction and therefore even if a malicious individual was to capture the encrypted transaction data from one transaction, this would not be accepted by the reader if re-injected at a later stage.

Although this is the case today, older RFID/Chip solutions often use technologies which are not appropriate for financial transactions and therefore may be compromised easily and in some cases without the knowledge of the card holder, merchant or acquirer.

I find this interesting how some of these less secure solution have been approved for use by acquiring banks and the card schemes around the world (if they were told) in recent years, where it has been seen that these solutions have utilised techniques or deployment methods which can be compromised. These technologies and techniques would never be approved within the Point of Sale (PoS) or traditional banking markets.

It can only be assumed that the need to get product to market quickly at the expense of proper testing, understanding and with due consideration to industry lessons learnt has succeeded again.

New e-Commerce and Payment Technologies Company

Posted by :madrock.net On : March 24, 2008

Category: Banking & EFTPoS

Tags:access, authentication, Authorisation, bank, Banking and EFTPoS, Card, card schemes, Commerce, Communications, Credit, Debit, DES, Dust, EFT, EFTPoS, Electronic, encryption, Enterprise, Ingres, integration, interface, ISP, JAVA, javascript, network, online, payment, payment solutions, processing, reporting, script, security, settlement, Shiraz, standards, SWIFT, transaction, type, VISA, web

Recently I came across a new e-Commerce company called EFT Networks, which seems to have an exciting future in the Global Payments Market.

It looks like they have a good mix of consulting and solution design.

www.eftnetworks.com

Services

Electronic Payment

Designed to enable both credit card and direct debit, EFT Networks electronic payment solutions work effectively across multiple sales channelsâ€”including Web, Contact Call Centre, IVR and EFTPOS. Manage your payment processing system in-house or outsource, depending on your business needs.

Global Payments

International commerce requires fully integrated global payment and risk management solutions. Requirements span the gamut of payment acceptance considerations from accepting local payment types, pricing in local currencies and dynamically updating prices with changes in exchange rates (dynamic currency conversion), authorising and settling in multiple currencies, to managing fraud and compliance issues such as tax and export regulations. EFT Networks offers a single interface to the global payment network to handle all of these considerations as your business grows.

ICE – Reporting & Management

The EFT Networks Enterprise Business Center gives you a single, easy-to-use interface for managing and configuring payment processing services.

ICE caters for each area of the payment transaction cycle from authentication, authorisation, settlement, dispute resolution and reconciliation â€“ enabling our clients to reduce transaction costs, eliminate fraud, minimise risk, maximise cash flow and increase profitability.

Integrations

EFT Networks provides flexible and secure payment and risk management integrations in to host and legacy systems as well as industry-leading software.

Using industry standards and protocols, our solutions can be customised to suit your exact business requirements

Products

ICE (Intelligent Communications Exchange)

At the core is our Intelligent Communications Exchange (ICE) which enables all known transaction enablers from EFTPOS to eCommerce to be routed directly to a clientâ€™s bank without intervention for real time acceptance and authentication.

The EFT Networks ICE operates under a philosophy of total System and Physical redundancy delivering the highest uptime rates possible, whilst the transaction network is protected using Solid State and Application Firewalls on all points of ingress and egress.

Every transaction processed through EFT Networks is encrypted using 128 bit Secure Socket Layer (SSL) encryption and submitted for authorisation through EFT Networks â€œSecure Virtual Private Networkâ€ (SVPN).

Our commitment to security is also reflected in our swift compliance with Card Schemes security initiatives such as VerifiedByVisa and MasterCard SecureCode.

EFT Networks comprehensive suit of online reporting tools combined with daily transaction reports will ensure that our clients always have access to up-to-date management information allowing Business Managers to make quick and well-informed business decisions. The decision making process is simplified even further with the power of daily reports that are customised to be imported into most existing legacy systems.