U.S. Bank’s first embedded payment solutions as part of Microsoft collaboration

One of the first banks to directly embed its own payment tools within Microsoft Dynamics 365, U.S. Bank delivers easy-to-implement, efficient payment capabilities.

MINNEAPOLIS (October 31, 2022) – U.S. Bank has embedded payment solutions within Microsoft Dynamics 365, the first of a strategic collaboration established to embed U.S. Bank payment capabilities across Microsoft platforms. The integration helps meet businesses where they are, with secure, fast and easy-to-implement payment capabilities.

U.S. Bank is one of the first banks to embed its own payment tools directly within Microsoft Dynamics 365. The direct integration into the enterprise resource planning (ERP) and finance solution makes it easier for businesses to click and start using the capabilities quickly. U.S. Bank has several more capabilities in the pipeline to embed additional payment tools within workflows across Microsoft platforms including Microsoft Teams and Microsoft Power Platform.

“We are committed to meeting clients wherever they are in their digital journey, bringing payments to businesses in a way that’s instant, embedded and connected to the technology they use every day,” said Shailesh Kotwal, vice chair and head of Payment Services, U.S. Bank. “Our integration with Microsoft – which businesses rely on daily to serve their customers – opens new possibilities for U.S. Bank clients to improve efficiencies and enable faster payments.”

“Embedded payments can deliver powerful, new ways for businesses to streamline processes, enhance visibility, deliver better experiences, and reduce risk,” said Bill Borden, Corporate Vice President, Worldwide Financial Services, Microsoft. “We are excited to build on our work with U.S. Bank, delivering integrated, easy-to-use digital payments capabilities to our customers through Microsoft Dynamics 365 with additional embedded solutions to come.”

Businesses using Microsoft Dynamics 365 can now easily use U.S. Bank AP Optimizer® directly from their business application. This will enable treasury management departments to automate invoice processing for business and consumer payment disbursement within Microsoft Dynamics 365. The solution allows for automated accounts payable workflows, including matching and reconciliation.

With Elavon’s Payment Gateway also now available to use within Microsoft Dynamics 365, businesses can easily enable a secure and end-to-end accounts receivable payment solution with their ERP. Directly integrated with the payments journal for accounting within Dynamics 365 Finance, the solution helps companies automate more of the accounts receivables process, speed up collections through multiple payments acceptance channels, and reduce errors.

Contact:

Todd Deutsch, U.S. Bank Public Affairs & Communications todd.deutsch@usbank.com | 612.303.4148

About U.S. Bank

U.S. Bancorp, with approximately 70,000 employees and $601 billion in assets as of September 30, 2022, is the parent company of U.S. Bank National Association. The Minneapolis-based company serves millions of customers locally, nationally and globally through a diversified mix of businesses: Consumer and Business Banking; Payment Services; Corporate & Commercial Banking; and Wealth Management and Investment Services. The company has been recognized for its approach to digital innovation, social responsibility, and customer service, including being named one of the 2022 World’s Most Ethical Companies and Fortune’s most admired superregional bank. Learn more at usbank.com/about.

CAPK expired error messages on VeriFone EMV terminals

Looking for solutions to fix CAPK errors on credit card terminals? In 2016, 3D Merchant blog explained about CAPK expired error messages on VeriFone EMV terminals and how to fix them. With credit card terminal lifespans of about 5 years, primarily due to security enhancements, the answers are different in 2022. Computers cannot be upgraded at some point and neither can credit card terminals.

The old article referenced the VeriFone EMV Vx520, FD55, Vx510, Vx570, among other terminals. A later blog post explained Verifone PCI 3 End of Life Terminals, which includes those and others. Merchants using the related desktop terminals, which typically require a manual download from the merchant acquirer to update, are unlikely able to get new updates due to the end of life process.

Previously Visa extended the EMV Certification Authority Public Keys (CAPK) key’s expiration date from 12/31/2015 to 2022, which required a terminal software update. Chip cards contain the issuers private keys which need to be verified by the card issuer’s public keys during online authorization requests.  The keys come from the Certification Authority Public Keys (CAPK), and they expire periodically. Card readers reject transactions (decline) when an incorrect or expired CAPK is used. When a terminal reaches a certain point at end of life, they can’t be updated and the CAPK error is just another symptom of the current problem: it’s time to replace the credit card terminal.

VX520 emv NFC verifone terminal

CURRENT RECOMMENDATIONS:

  1. If you want to keep your current acquirer, and are interested in exploring technology solutions to enhance business operations, security and your customer experience, contact 3D Merchant Services for cloud technology solutions and compatible terminals. If your acquirer, refers you to 3D Merchant Services to solve your CAPK problem, this is how it will be done- equipment and processes WILL change. For 3D Merchant clients, the benefits far outweigh the cost to replace.
  2. If you want to keep your current acquirer and keep your equipment, only your current acquirer can help you resolve CAPK issue, if feasible. If you do not know how to reach your acquirer, a phone number is provided on your merchant statement.

How to identify if terminal is end of life?

  1. If it’s more than 5 years old, it almost certainly is. Look for date on the terminal.
  2. Look for PCI PTS version on the terminal.
  3. Call your acquirer.
  4. If your terminal uses PCI PTS, which is rquired certification for devices that accept pin code entry, 3.x (expired now) or 4.x (expires 2023), the time to plan for their replacement is NOW. Do not wait. The sources below are not that great because PCI web site now says to refer to manufacturers for research and limits which are listed on their web site.
  5. Google your “terminal name specifications”. A PDF spec sheet will have the PCI PTS version or their might be a sticker on the terminal with a date and or P
  6. Search for devices here on the Official PCI Security Standards web site https://www.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices?agree=true
  7. On manufacturer web sites, look up the terminal security specifications. For example, this shows PCI PTS 4.x approved for the MX 915 currently for sale. https://www.verifone.com/en/us/devices/multilane/mx-915. PCI PTS 4.x expires in April 2023.
    COVID ALERT: Due to supply chain problems, terminals are nationally in short supply for all manufacturers. 3D Merchant Services offers equipment sales only to customers. All terminals ship direct from certified facilities and are billed by the recommended solutions provider.

Call Christine Speedy, 3D Merchant Services owner and Authorized Reseller. Call for simple solutions to payment transaction problems. 954-942-0483, 9-5 ET.

Federal Trade Commission Proposes Small Business Protections Against Telemarketing Tricks and Traps

Agency Also Seeks Public Comment on Combatting Tech-support Scams and Adding Click-to-Cancel Requirements

April 28, 2022

The Federal Trade Commission today proposed extending protections against telemarketing tricks and traps to small businesses and strengthening safeguards against other pernicious telemarking tactics plaguing consumers. The agency is seeking comments on updates to the Telemarketing Sales Rule that would protect small businesses against business-to-business telemarking schemes, address tech-support scams that target seniors, and extend click-to-cancel requirements to telemarketing. 

“Today we are taking aggressive action to protect small businesses and consumers from telemarketing tricks and traps,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “We look forward to hearing from the public about how we can further strengthen this rule to hold telemarketing scammers accountable.”

Both the notice of proposed rulemaking and advance notice of proposed rulemaking announced today stem from the Commission’s regulatory review of the Telemarketing Sales Rule and address public comments the FTC has received as part of that review.

The current regulatory review of the Telemarketing Sales Rule began with the publication of a 2014 Federal Register notice seeking comments on general issues such as whether to retain, eliminate, or modify the rule. It also sought comment on specific issues, such as whether the rule should provide additional protections to consumers from telemarketing calls involving use of previously acquired account information and negative option offers, as well as recordkeeping requirements for sellers and telemarketers.

The Telemarketing Sales Rule

The FTC’s Telemarketing Sales Rule became law in 1995 and applies to virtually all “telemarketing” activities, both in the United States and international sales calls to consumers in the U.S. With several notable exceptions, the rule generally applies only to outbound calls made by telemarketers to consumers and protects consumers in a range of ways. For example, the rule requires telemarketers to make certain disclosures and prohibits misrepresentations during sales calls.

The Telemarketing Sales Rule ensures that telemarketers obtain a consumer’s authorization before billing or collecting payment, and prohibits telemarketers from requesting advance payments for services, such as credit repair, “guaranteed” loans, and debt settlement programs. The rule also prohibits credit card laundering by or on behalf of telemarketers and generally prohibits them from calling phone numbers on the Do Not Call Registry or plaguing consumers with robocalls, among other things.

Proposal to Protect Small Businesses and Strengthen Enforceability

The notice of proposed rulemaking announced today proposes amending the recordkeeping requirements of the Telemarketing Sales Rule and prohibiting deception in business-to-business telemarketing calls. Specifically, the notice seeks public comment on:

  • Business-to-business schemes: Whether the FTC should amend the Telemarketing Sales Rule to prohibit misrepresentations in business-to-business calls, as the Commission’s experience has shown that small businesses continue to be harmed by deceptive telemarketing, and
  • Recordkeeping requirements: Whether the FTC should amend the rule’s recordkeeping provisions to require telemarketers to retain information in seven new categories, such as keeping recordings of robocalls.

Addressing Other Telemarking Tactics and Scams

The advance notice of proposed rulemaking announced today seeks information on a range of issues, some of which were identified during the previous comment period. Specifically, the agency seeks public comment on:

  • Tech-support scams: Whether the Telemarketing Sales Rule should add additional provisions to address the rise in tech-support scams. These are scams where telemarketers trick consumers into purchasing unnecessary computer technology services to fix phantom problems. Generally, telemarketers who induce consumers to call them by placing deceptive internet ads are currently exempt from Telemarketing Sales Rule requirements. The advance notice of proposed rulemaking seeks comment on whether those calls should be covered by the rule.
  • Click-to-cancel requirements: Whether the rule should require telemarketers to provide consumers with a simple notice and cancelation, such as click-to-cancel, when they sign up for subscription plans; and
  • Robocalls and other telemarketing to small businesses: Whether the Telemarketing Sales Rule broadly should stop treating telemarketing calls made to businesses differently from those made to consumers. Generally, such calls currently are exempt from certain provisions of the rule.

The Commission vote approving publication of the notice of proposed rulemaking and advance notice of proposed rulemaking in the Federal Register was 4-0.

The Federal Trade Commission works to promote competition and protect and educate consumers. Learn more about consumer topics at consumer.ftc.gov, or report fraud, scams, and bad business practices at ReportFraud.ftc.gov.

Block, formerly known as Square, Confirms Cash App Data Breach

On April 4, 2022, Block, Inc. (the “Company”) announced that it recently determined that a former employee downloaded certain reports of its subsidiary Cash App Investing LLC (“Cash App Investing”) on December 10, 2021 that contained some U.S. customer information. While this employee had regular access to these reports as part of their past job responsibilities, in this instance these reports were accessed without permission after their employment ended.

The information in the reports included full name and brokerage account number (this is the unique identification number associated with a customer’s stock activity on Cash App Investing), and for some customers also included brokerage portfolio value, brokerage portfolio holdings and/or stock trading activity for one trading day.

The reports did not include usernames or passwords, Social Security numbers, date of birth, payment card information, addresses, bank account information, or any other personally identifiable information. They also did not include any security code, access code, or password used to access Cash App accounts. Other Cash App products and features (other than stock activity) and customers outside of the United States were not impacted.

Upon discovery, the Company and its outside counsel launched an investigation with the help of a leading forensics firm. Cash App Investing is contacting approximately 8.2 million current and former customers to provide them with information about this incident and sharing resources with them to answer their questions. The Company is also notifying the applicable regulatory authorities and has notified law enforcement.

The Company takes the security of information belonging to its customers very seriously and continues to review and strengthen administrative and technical safeguards to protect the information of its customers. Future costs associated with this incident are difficult to predict. Although the Company has not yet completed its investigation of the incident, based on its preliminary assessment and on the information currently known, the Company does not currently believe the incident will have a material impact on its business, operations, or financial results.

SEC event filing of Cash App data breachhttps://www.sec.gov/ix?doc=/Archives/edgar/data/0001512673/000119312522095215/d343042d8k.htm

FTC Takes Action Against CafePress for Data Breach Cover Up

March 15, 2022- Commission orders e-commerce platform to bolster data security and provide redress to small businesses.

The Federal Trade Commission today took action against online customized merchandise platform CafePress over allegations that it failed to secure consumers’ sensitive personal data and covered up a major breach. The FTC alleges that CafePress failed to implement reasonable security measures to protect sensitive information stored on its network, including plain text Social Security numbers, inadequately encrypted passwords, and answers to password reset questions. The Commission’s proposed order requires the company to bolster its data security and requires its former owner to pay a half million dollars to compensate small businesses.

“CafePress employed careless security practices and concealed multiple breaches from consumers,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “These orders dial up accountability for lax security practices, requiring redress for small businesses that were harmed, and specific controls, like multi-factor authentication, to better safeguard personal information.”

In a complaint filed against Residual Pumpkin Entity, LLC, the former owner of CafePress, and PlanetArt, LLC, which bought CafePress in 2020, the FTC alleged that CafePress failed to implement reasonable security measures to protect the sensitive information of buyers and sellers stored on its network. In addition to storing Social Security numbers and password reset answers in clear, readable text, CafePress retained the data longer than was necessary. The company also failed to apply readily available protections against well-known threats and adequately respond to security incidents, the complaint alleged. As a result of its shoddy security practices, CafePress’ network was breached multiple times.

According to the complaint, a hacker exploited the company’s security failures in February 2019 to access millions of email addresses and passwords with weak encryption; millions of unencrypted names, physical addresses, and security questions and answers; more than 180,000 unencrypted Social Security numbers; and tens of thousands of partial payment card numbers and expiration dates. Some of the information was later found for sale on the Dark Web.

After being notified a month later that it had a security vulnerability and that hackers had obtained consumer data, CafePress patched the vulnerability but failed to properly investigate the breach for several months despite additional warnings, the complaint alleged. This included a warning in April 2019 from a foreign government, which notified the company that a hacker had illegally obtained CafePress customer account information and urged the company to notify affected customers. The company, however, withheld this essential information, and instead only told customers to reset their passwords as part of an update to its password policy.

The complaint alleges CafePress did not inform affected customers until September 2019—one month after the breach was reported widely. The company’s lax security practices, however, still left many consumers at risk. For example, the company continued to allow people to reset their passwords on the website by answering security questions associated with customer email addresses—the same information that had been previously stolen by hackers.

According to the complaint, CafePress was aware of problems with its data security prior to the 2019 data breach. Through at least January 2018, when CafePress determined that certain accounts of shopkeepers had been hacked, CafePress closed the accounts and charged the victims a $25 account closure fee. The company also experienced several malware infections to its network prior to the 2019 hack but failed to investigate the source of such attacks.

In addition to its security failures, the FTC alleged the company misled users by using consumer email addresses for marketing despite its promises that such information would only be used to fulfill orders consumers had placed.

As part of the proposed settlement, Residual Pumpkin and PlanetArt will be required to implement comprehensive information security programs that will address the problems that led to the data breaches at CafePress. This includes replacing inadequate authentication measures such as security questions with multi-factor authentication methods; minimizing the amount of data they collect and retain; and encrypting Social Security numbers.

In addition, the proposed settlement requires Residual Pumpkin to pay $500,000 in redress to victims of the data breaches. PlanetArt will be required to notify consumers whose personal information was accessed as a result of CafePress’s data breaches and provide specific information about how consumers can protect themselves. Both companies will be required to have a third party assess their information security programs and provide the Commission with a redacted copy of that assessment suitable for public disclosure.

The Commission voted 4-0 to issue the proposed administrative complaint and to accept the consent agreement with the companies.

The FTC will publish a description of the consent agreement package in the Federal Register soon. The agreement will be subject to public comment for 30 days after publication in the Federal Register after which the Commission will decide whether to make the proposed consent order final. Instructions for filing comments will appear in the published notice. Once processed, comments will be posted on Regulations.gov.

NOTE: The Commission issues an administrative complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. When the Commission issues a consent order on a final basis, it carries the force of law with respect to future actions. Each violation of such an order may result in a civil penalty of up to $46,517.

https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-cafepress-data-breach-cover