About Christine Speedy

B2B cloud payment acceptance solutions and CenPOS enterprise cloud payment solutions expert. Authorized reseller.

FRAUDSTERS TARGETING CALL CENTER CHAT AND NON-VOICE CHANNELS

Visa Security Alert to the risk of online chat solutions and non-voice channel services within call centers and merchant online environments, which are expected to increase along with artificial intelligence. There are known instances where threat actors compromised online chat service providers and were able to distribute malware to merchant clients designed to intercept payment card data during checkout.

Read the story here in the Visa library for merchants. https://usa.visa.com/support/merchant/library.html

The Visa alert also points out the importance of verifying your technology partners are secure and compliant. This is especially interesting in the context of this article.

The Visa Global Registry of Service Providers is Visa’s designated source for information on registered and PCI DSS-validated agents that provide payment-related services to Visa clients and merchants. Service providers that store, process or transmit Visa payment data must be registered with Visa and demonstrate PCI DSS compliance. All of the links in this article can be found on the merchant rules and  PCI compliance links

 

Federal Reserve e-Commerce Fraud Study

Fraud Threats in the e-Commerce Channel Vex Merchants

Minneapolis, June 18, 2018 According to a new survey of 166 U.S. merchants with an e-commerce presence, card-not-present (CNP) fraud is the top payment threat to retailers. The survey also found that retailers worry about their ability to handle increased e-commerce fraud, which many merchants expect to increase over the next six to 12 months, largely as a result of data breaches. The survey, released by the Federal Reserve Bank of Minneapolis, aimed to uncover approaches retailers are using to effectively reduce payments fraud in the e-commerce space. It complements the financial institution fraud mitigation tool effectiveness study published by the Bank in the first quarter of 2018.

The report provides information about the use of payments fraud detection and prevention methods used in the e-commerce channel and how merchant respondents rated the methods. When asked where merchants devoted the most resources toward fraud mitigation, they indicated CNP in the online channel. Merchants largely rely on older mitigation tools such as security code and address verification, but some new tools are emerging. The emerging CNP fraud tools that merchants find most promising include artificial intelligence, facial and voice recognition, and multi-merchant purchase velocity checks.

“This study provides great insights into what merchants find effective for mitigating card-not-present fraud today and which emerging mitigation technologies they are beginning to use.  Retailers could use the information from the report to assess and enhance their current fraud mitigation strategies,” said Guy Berg, vice president of the Payments, Standards, and Outreach Group at the Minneapolis Fed.

The report also analyzes usage and effectiveness ratings of information-sharing partnerships that help merchants identify fraud attacks and exchange threat information.

Access the full 2018 Fighting Fraud in the e-Commerce Channel: A Merchant Study.


The Federal Reserve Bank of Minneapolis is one of 12 regional Reserve Banks that, with the Board of Governors in Washington, D.C., make up the Federal Reserve System, the nation’s central bank. The Federal Reserve Bank of Minneapolis is responsible for the Ninth Federal Reserve District, which includes Montana, North and South Dakota, Minnesota, northwestern Wisconsin and the Upper Peninsula of Michigan. The Federal Reserve Bank of Minneapolis participates in setting national monetary policy, supervises numerous banking organizations, and provides a variety of payments services to financial institutions and the U.S. government.

 

###

Blog author note: CenPOS cloud commerce solutions are part of a layered security approach that help reduce manual order reviews and mitigate risk of bot automated orders which can rack up authorization fees. Tools include 3-D Secure, including Verified by Visa and other card brand solutions, among others. Headquartered in Miami, Florida, CenPOS is reshaping the future of commerce through technology innovation and the secure, flexible and simple solutions this enables. Christine Speedy, CenPOS Global Sales, 954-942-0483 has extensive ecommerce experience to help businesses mitigate fraud risk while maximizing profits.

Payment Processing Application for Microsoft Dynamics AX 365

Microsoft Dynamics AX credit card processing integrated for maximum profit and maximum security with Validated Point to Point Encryption (vP2PE).

 

PCI Compliance is a moving target. We help reduce compliance burden with a PCI validated Point to Point encrypted solution. It’s important to note that only non-validated P2PE solutions have experienced data breaches in the last 12-18 months.

  • Accept credit, debit, ACH, check with guarantee, cash, wire, Paypal and more payment types. 
  • Smart Rate Selector reduces credit card processing fees, including with level 3 processing. Qualifying transactions for the lowest rates is complicated and only with dynamic rules management can merchants automate processes that impact fees.
  • Flexible processor options. You choose. Whether you want to keep your existing First Data, Chase Paymentech, Worldpay, or any other provider, or make a change, we give you options. And if you change acquirers in the future, it’s non-disruptive to operations, unlike “all-in-one” solutions.
  • Need to reduce compliance scope for card not present transactions? Our Encrypted Virtual Keypad segregates your hardware from scope.
  • Compliance with new stored card credential rules is complicated also. We reduce compliance burden with various configurable tools.

Do you have DOPS transactions currently processing credit cards?
You cannot process (authorize, capture, void, refund) any transaction through Dynamics online after Dec 31, even if that transaction occurred prior to Dec 31.  After 12/31/2017:

  • Credit cards linked in AX – Will no longer work for any connector, need to be deleted and re-entered.
  • Authorization – Will be lost.  Either process this through your new solution or work with the payment provider to capture an existing authorization if possible.
  • Capture – Will not be able to process linked refunds.
  • Void – Will not be able to void a payment.
  • Refund – Will not be able to refund a payment.

The above transaction types are very limited. For example, re-authorization, incremental authorization and authorization reversal are common types of transactions in B2B. If not managed correctly, then merchants pay higher fees and risk chargeback by both issuer or customer.

Headquartered in Miami, Florida, CenPOS is reshaping the future of commerce through technology innovation and the secure, flexible and simple solutions this enables. Christine Speedy, CenPOS Global Sales, 954-942-0483 has extensive B2B experience to help any business understand risks and benefits of alternative cloud solutions.

 

Why does my web site need SSL security 2018

Every web site needs SSL in 2018 to avoid web site insecure messages that scare away visitors.

Disabling TLS 1.1 and lower is recommended for all businesses. While web site security with SSL is commonly considered only necessary if accepting payments or using secure online forms, that’s no longer the case. It can impact Google listings, overall SEO, and whether visitors see your web site.

SSL secured web sites for years. Even though tech people still call it SSL, the next phase of ecommerce security was TLS. TLS 1.1 and lower, including SSL 1.0, are not considered secure. For that reason, all businesses accepting payments online must have disabled TLS 1.1 and lower on their servers for mandatory Payment Card Industry Data Security Standards  (PCI) compliance by June 30, 2018. Additionally, buyers with outdated browsers may be blocked from making purchases if not supporting the latest security standards.

If your web site does not have an SSL certificate, visitors will get a browser message, which may vary by browser, telling them your web site is not secure and that any information submitted could be viewed by others.

connection not secure message

Web browser warnings like this will scare away visitors.

FREE Test SSL/TLS for Browser and Servers:

Server penetration testing falls under the Computer Fraud and Abuse Act (CFAA) (18 U.S.C. 1030). It’s a federal crime to “intentionally access a computer without authorization or exceed authorized access”. If it’s not your web site, and you don’t have explicit permission to access, don’t run a server test. If you do have the right to run it, be sure to check the box, HIDE RESULTS. If you get a YES next to TLS 1.0, SSL 3, or SSL 2 on the server test, then hardening is needed. To modify your web site, it’s managed in host administration and disable in security settings. Free SSL and TLS test from Qualys. https://www.ssllabs.com/ssltest/index.html.

Godaddy gives a very good overview of options. https://www.godaddy.com/web-security/ssl-certificate#compare. I recommend getting the Extended Validation (EV) SSL for the value-added benefits.

Headquartered in Miami, Florida, CenPOS is reshaping the future of commerce through technology innovation and the secure, flexible and simple solutions this enables. Christine Speedy, CenPOS Global Sales, 954-942-0483 has extensive ecommerce experience dating back to the early internet days and can assist with any questions.

Equipment Rental Credit Card Processing Rules Change

Bobcat, Caterpillar, and similar that offer rental equipment, all are impacted by new credit card processing rules for rentals. equipment rentals credit card processing

While businesses expect their software, including ERP, Point of Sale, and ecommerce shopping carts to help them manage compliance with credit card acceptance rules, the reality is that many don’t. Compliance increases profits; non-compliance increases new chargeback risks, interchange fees, penalty fees and authorization declines.

Traditional desktop terminals don’t support the new transaction data requirements. If merchant is not using EMV chip device, now is the time to upgrade to a cloud-based solution and fix two problems at once. Rental merchants cannot meet both card acceptance and Payment Card Industry Data Security Standards compliance requirements using traditional paper credit card authorization forms. Cloud technology and a compliant payment gateway are needed. For example, pair the Verifone MX 915 with the CenPOS validated Point to Point Encryption (P2PE) solution and use either a standalone or integrated to ERP such as Microsoft Dynamics AX.

Key elements for compliance:

Initial authorization transaction must send new transaction indicator that it’s an estimate; the final amount could change for example because the renter kept it longer or damaged the equipment. This is technically managed by the payment gateway.
If applicable, send incremental authorizations with related indicator.
If storing the card, the Visa Stored Credential mandate outlines the specific requirements for agreement with customer, cardholder authentication, and procedures to use a stored card on file. For example, perform cardholder authentication with either security code or 3-D Secure. 3-D Secure can only be invoked if the customer self-pays; it shifts friendly fraud liability to the issuer and merchants can also qualify some cards for even lower interchange rates. CenPOS Express Checkout via text or email includes 3-D Secure capability as part of a layered security approach.
Final authorization with related indicator.
Update language in agreements for opt-in to terms and conditions as required by Visa.

Card issuers and acquirers were mandated to be compliant in 2017, and merchants by October 2017, however, there’s no mandate for payment gateways. Even if an existing payment gateway supports the new requirements, merchants must make changes. Visa is the most complex, however other brands have similar rules.

From tokenization to Express Checkout, CenPOS creates a seamless commerce experience throughout the enterprise. Innovations, including Express Checkout via text or email, help businesses maximize profit in all departments. CenPOS takes the heavy lifting out of payment acceptance offering a range of solutions that simplify every aspect of implementing, operating and maintaining a payment system enabling merchants to focus on their business.

CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships. Powered by its enterprise-class, end-to-end transaction engine, CenPOS’ secure, cloud-based solutions seamlessly integrate with a merchants existing infrastructure minimizing disruption and saving time and money. Committed to a merchant-centric approach CenPOS provides a one-to-one level of service and support, enabling merchants to focus on their core business.

Headquartered in Miami, Florida, CenPOS is reshaping the future of commerce through technology innovation and the secure, flexible and simple solutions this enables. Christine Speedy, CenPOS Global Sales, 954-942-0483.

Reference:

https://usa.visa.com/dam/VCOM/global/support-legal/documents/stored-credential-transaction-framework-vbs-10-may-17.pdf

See also core rules, especially section 5 https://usa.visa.com/dam/VCOM/download/about-visa/visa-rules-public.pdf