What is carding and how can merchants mitigate risk?

Posted on by
Reply

Ecommerce merchants have been hit by credit card carding attacks by fraudsters for years. There’s tons of cardholder data on the dark web and even DIY instructions on how to commit fraud. With EMV implemented in retail, and the fast growth of ecommerce due to Coronavirus, carding is a serious risk for merchants for both attempted and successful transactions.

What is carding?

Carding, also known as credit card stuffing or card verification, is a web security threat where unauthorized people (carders or attackers) use multiple software tools, primarily bots, to attempt to verify if a debit or credit card is good. A typical bot attack will incur thousands of attempted authorizations. Bots do not typically seek a particular site, just opportunities to exploit a weakness.

What are the costly repercussions of carding attacks?

The merchant is dealt with several financial blows:

  • Attempted transactions will incur a payment gateway fee.
  • Attempted transactions may incur a merchant account authorization fee if the gateway didn’t kill before getting to the acquirer. This can happen if the gateway supports a rules based decision making.
  • Completed transaction fraud whereby the product was shipped to the fraudster because the card was approved.
  • Chargeback fees can be initiated by the issuer or the cardholder. If the merchant is not using 3-D Secure, they will surely be out of luck.

How can merchants mitigate risk of bot attacks?

A key first line of defense is preventing the bot initiating an exchange with payment gateway. For example, reCAPTCHA is a free developer tool from Google to protect your web site from abuse. reCAPTCHA v3 returns a score for each request without user friction, which means if it passes, the user can check out. Have you ever had to go through multiple screen challenges to identify the sidewalks or traffic lights? reCAPTCHA v3 is different from older versions. The score is based on interactions with your site and enables you to take an appropriate action for your site automatically. For more information click here for Google reCAPTCHA.

Note, PCI DSS V 3.2.1 Requirement 6: Develop and maintain secure systems and applications. this section includes web sites. Visa cites using Velocity tools specifically in their ecommerce guidance for merchants. For example, a fraud mitigation velocity tool might automatically manage attempted transactions based upon number of attempts from same IP address or other duplicate data within a specific timeframe. Note, fraudsters have gotten smarter and bot attacks are not as simplistic to detect as just a few years ago. For this reason, the use of AI and other tools is growing, especially for larger merchants.

Call Christine Speedy, for simple solutions to card not present payment transaction problems, 954-942-0483, 9-5 ET. Christine is Founder of 3D Merchant Services, PCI Council Qualfied Integrator Reseller (QIR), and is a credit card processing expert with specialized expertise in card not present and B2B payment processing technology. Less than 1% of all merchant services sales representatives are QIR certified. Christine is an authorized independent sales agent for a variety of merchant services and payment technology solutions.

Free credit card transaction fees checkup 2020

Posted on by
Reply

Merchant services fees gradually increased over time? While technology can optimize fee management, there are multiple reasons new fees or rising fees may occur. With this information, you can do a quick self-assessment and determine whether it’s worthwhile to engage with a payments professional for further review. This method is easier than my B2B credit card processing fact check, while still revealing problems that must be resolved.  As a processor neutral payments expert, Christine Speedy offers a unique perspective.

The areas needing most attention are rate qualification and other fees.

Here’s a shortcut to determine if you have authorization problems, which directly impact credit card transaction fees. Why is this important? Because unless you fix the underlying problem, switching merchant accounts will only provide partial relief from escalating transaction fees like the new MasterCard .25% misuse of authorization fee. If you have any of these items below on your merchant statement, there’s a problem that is causing unnecessary extra costs.

  • Misuse
  • Integrity
  • Compliance or Non-compliance
  • Standard / STD (any)
  • EIRF
  • Data rate I
  • Data Rate II or Data Rate 2
  • Chargeback: FRAUD TRANS-NO CARDHOLDR AUTH
  • Chargeback reason: Compliance

Hint: If you open your merchant statement in Adobe Acrobat, in OSX with command F you can copy and paste the terms above. It’s not foolproof due to varying abbreviations, but you only need to have one of the bad items to know there’s a problem.

For card not present business to business, these are two interchange types you should see, but many often don’t and that is also a problems resulting in higher costs.

  • Full UCAF
  • Data Rate III

I don’t know why, but I get calls from other salespeople in the industry looking for solutions to help customers qualify for Data Rate II. Why wouldn’t you want the customer to qualify at Data Rate III? Makes no sense.

I also hear from merchants how they were told that the new solution would fix their level 3 data problems, but it didn’t. If you do preauthorizations, and the solution doesn’t automatically get new authorizations and manage reversals it’s not going to fix authorization problems. Always ask, “how will the payment gateway manage authorization reversals if we don’t settle for the original preauthorization amount’? That’s one of several critical key questions. If they don’t know the answer instantly, move on.

Due to massive changes in card network rules and data security compliance rules over the last two years, a review by a neutral payments expert is essential. Did you have any red items? It’s time for a deeper dive into why.  Your FREE report will identify issues impacting profits and security, include action items how to fix them, and rarely requires changing financial partners.

credit card transaction fee checkup form

Call Christine Speedy, to reduce merchant fees with new or existing merchant account at 954-942-0483, 9-5 ET. Less than 1% of merchant account salespeople are PCI Council QIR certified. With Christine as your account manager you’re assured a unique experience to maximize profits and security without business disruption.

Massive Travel Industry Data Leak

Posted on by
Reply

Prestige Software’s main product Cloud Hospitality, the channel management software to the travel industries biggest consumer buying web sites, including Expedia, Hotels.com, and booking.com left data exposed for over 10 million log files, dating all the way back to 2013. At the November 6, 2020 breaking news, it was not yet known whether the data left open on a server was stolen or not. However, we know that criminals run scripts looking for data all the time so it won’t be a surprise if there was a breach.

A channel manager is used to manage bookings across multiple webs sites, including hotels and restaurants. For example with vacancy management, if there is one room left and someone buys it on booking.com, it will show unavailable on hotels.com. With millions of records exposed around the globe, there is sure to be fall out.

Because both personal and credit card data was exposed, I recommend consumers change their travel web site passwords, email passwords, and keep an on on credit card usage or set up alerts.

The data contained full card data and the security code. It’s a PCI Compliance and card network violation to store sensitive cardholder data, therefore, they could lose the ability to store, transmit, and handle all credit card data. While the booking platforms did not expose the data, there is certainly a weakness. For more information from the team that broke the news, see https://www.websiteplanet.com/blog/prestige-soft-breach-report/.

This incident demonstrates your security is only as good as your weakest link. What actions have you taken to remediate deletion of old records both paper and digital? What about your partners? I know of multiple solutions providers that enable merchants to create their own digital credit card authorization forms. This form is then reviewed or downloaded by an employee, with card data key entered then into some other system by the employee. There are so many things wrong with this, including the signature is not even a valid form of defense for card not present. 3-D Secure is the way to go.

  1. If your company uses a 3rd party for billing and or collections, ask questions.
  2. If you’re not using updated tools to keep card numbers out of employee hands, hardware and software, you’re at risk.
  3. Remember, if cardholder data can be decrypted and viewed, you’re at risk.
  4. If you can see the full card number and security code after authorization, that is not compliant.

Contact me for a FREE checkup for common problems IT and security professionals might miss.

If your company has card data that can be retrieved and viewed, you’re at risk too. I fix that.

Christine Speedy, Founder 3D Merchant Services, QIR certified, is a credit card processing expert with specialized expertise in card not present and B2B payment processing technology. Less than 1% of all merchant services sales representatives are QIR certified by the PCI Council. Christine is an authorized independent sales agent for a variety of merchant services and payment technology solutions.

2020 Referral Compensation Holiday Cheer

Posted on by
Reply

Refer a business for a new merchant account and get paid $150 per new merchant account. If the business has multiple locations, you get the referral money for each location, no limits! Valid for USA merchants only and account must be approved by 12/31/2020.

What happens if the merchant is not approved by the end of 2020? The promotion is only valid in 2020, however, it will be reviewed on a case by case basis. If you refer a sizeable account, then you’ll likely get compensated, but depending on the number of locations, there may be a delay.

What happens if the merchant doesn’t sign by the end of 2020, but does sign in January or later? The promotion is only valid in 2020, however, it will be reviewed on a case by case basis. If you refer a sizeable account, then you’ll likely get compensated, but depending on the number of locations, there may be a delay.

Do you pay the referral to a person or to a company? That’s up to whomever does the referral.

Christine Speedy, Founder 3D Merchant Services, QIR certified, is a credit card processing expert with specialized expertise in card not present and B2B payment processing technology. Less than 1% of all merchant services sales representatives are QIR certified by the PCI Council. Christine is an authorized independent sales agent for a variety of merchant services and payment techology solutions.