Author Archives: hostmerchantservices

data breach

Data Breach News: [2023 Update]

Today The Official Merchant Services Blog is updating its coverage of the Global Payments Data Breach. The news of this breach hit on Friday, March 30. At first there reports of a mere 50,000 cards were compromised. Then at the height of the frenzy it was reported that the number might be closer to 10 million cards. Quashing the frenzy, Global itself released a statement that the number was closer to 1.5 million cards. And now it seems the dispute over the timeline as well as the number of cards continues.

Back to the Future

Christopher Brook writes on ThreatPost that the data breach that hit payment processor Global Payments earlier this year could have dated back to June 2011, launching speculation over whether more credit card numbers were stolen than initially reported.

Brook’s source is the initial source of the news about the Breach, Brian Krebs and his blog krebsonsecurity.com. Krebs writes: “A hacker break-in at credit and debit card processor Global Payments Inc. dates back to at least early June 2011, Visa and MasterCard warned in updated alerts sent to card-issuing banks in the past week.”

Krebs explains that Visa and MasterCard send periodic alerts to the banks about cards that may need to be re-issued following a security breach at a processor or merchant. He states that it was these alerts that got him on the story to begin with, and ultimately report the breach. He then says, “Since those initial alerts, Visa and MasterCard have issued at least seven updates, warning of additional compromised cards and pushing the window of vulnerability at Global Payments back further each time.”

The timeline has been the trickiest part of the story as Global’s statements have been very succinct. The processor has stated that it reported the breach to the proper authorities when it found out about the breach. The company maintains that the breach is contained, and only affected 1.5 million cards or less and occurred in February 2012.

Krebs has been reporting that the timeline was larger and that suggests that more than 1.5 million cards could have been compromised. Krebs gives his own take on the timeline: “Initially, MasterCard and Visa warned that hackers may have had access to card numbers handled by the processor between Jan. 21, 2012 and Feb. 25, 2012. Subsequent alerts sent to banks have pushed that exposure window back to January, December, and then August. In an alert sent in the last few days, the card associations warned issuers of even more compromised cards, saying the breach extended back at least eight months, to June 2011.”

Krebs notes that the expanding timeline is most likely a result of the forensic audit and investigation that is being done on the data breach.

Blunder Reported From Down Under

Spreading our internet net far and wide, The Official Merchant Services Blog was able to find this story from Dan Kaplan reposted at the Australian CRN site. The story, that originally appeared on SC Magazine’s site, reports that Global admitted to being ditched from PCI lists. Kaplan reports: “For the first time, breached processor Global Payments disclosed on Tuesday that a number of card brands have removed the company from their approved list of Payment Card Industry (PCI)-compliant service providers. However, the US-based firm continues to process transactions for all of the major card brands as it seeks rejoin those lists, it said in an update.”

The story then reiterates Global’s continued commentary about how they immediately reported the breach, how it only affected 1.5 million cards or less and how the company continues to decline to elaborate on any further details about the attack while it cooperates with authorities to get the investigation resolved.

Kaplan then cites a Visa spokesman saying Visa has asked Global Payments to re-validate its compliance to PCI by using a qualified security assessor, or QSA. Retailers that use the company’s services will not be liable for penalties during that time.

Still no word on the involvement of Dominican Street Gangs in this breach or the early reports that the breach was caused by Taxi Cabs and a garage in New York using Global’s payment processing technology. The Official Merchant Services Blog will continue to keep its readers updated on the twists and turns taken in this ongoing story.

Internet Security

Security is one of the defining internet issues of this decade.  While there is not one distinct body of law that governs a company’s rights and responsibilities, there are methods to prioritize compliance efforts.  This issue is relatively unique to the internet space since the laws and regulations that apply come from many different areas.  In recent years the Federal Trade Commission (FTC) has taken an increasingly prominent role in responding to these problems.  In addition, almost every state has some sort of law that at least requires reporting of unauthorized disclosure of information.  Indeed many state laws, particularly Massachusetts and California, go substantially beyond simple breach disclosure and mitigation.

Host Merchant Services is located in Delaware. The Delaware Security Breach Notification Law can be reviewed in its entirety at This Link.

While many agencies, such as the SEC, have regulations that address security issues in the industries they regulate, the FTC is the agency primarily tasked with addressing internet security issues.  The FTC has the authority to prosecute companies and individuals who engage in deceptive trade practices.  The best way to determine the enforcement priorities of the FTC is to look at recent enforcement actions.  These actions have focused on the “locked door” problem:  Many companies focus on the number of locks they’ve placed on the door to data, as opposed to making sure these doors do not become unlocked over time.

Sloppy security practices are an issue that the FTC has said is simply screaming for regulatory and enforcement activity.

Time and time again, the FTC has stated that companies must have procedures in place to ensure that their businesses are secure, to detect security vulnerabilities, and inform customers and, if necessary,  regulators, when unauthorized disclosures are discovered.  To avoid FTC action, internet businesses need to shift some of their security thinking and strategy from high profile areas to basic security and process control schemes.  This could involve redeploying resources from traditional security screening measures (such as trying to breach firewalls) to creating change control processes, training staff on quality control and ensuring that vendors actually meet the security standards you need — and that they profess to have.

It is a bit trickier to generalize about state security statutes.  That said, most state laws have relatively similar goals to their federal counterparts.  As an initial matter you should ensure that your entire “ecosystem” has the same, or similar, breach definitions.  Doing so avoids gaps that lead to misinformation and failure to comply with breach definitions set out in your state laws.  A second component of general compliance is to create both internal and external notification plans.  Your internal plan should create a system where both employees and vendors are alerted to a possible breach.  External plans should contain at a minimum a statement of what is known about the breach, mitigation efforts, a contact point, and future steps you are taking regarding the breach.  You should identify which information will be excluded from these notification efforts because of confidentiality or other restrictions.

A final component of a state compliance plan is to anticipate how you will fold in state regulators and law enforcement entities.  At a minimum, these will be agencies in the state in which you are located, but may, in some instances, include regulatory agencies in other states.  It is important not to play hide-the-ball and simply fail to provide the regulatory and law enforcement notifications required by law.  In making these notifications, you should involve your attorney to determine how much information you are required to disclose, and methods of protecting your company from litigation.

For More Information

For more legal information you can visit my site:

David Snead’s Home Page

Merchant Services Document Download Graphic

To learn more about PCI Compliance, Host Merchant Services offers these resources:

PCI Compliance FAQ

Merchant Services Document Download Graphic

PCI Compliance Guide

Merchant Services Document Download Graphic

Disclaimer:  Legal decisions must be made based on your unique situation. Please consult with an attorney prior to making decisions based on this post.

Industry Terms: Chargeback

This is the latest installment in The Official Merchant Services Blog’s Knowledge Base effort. Well we want to make the payment processing industry’s terms and buzzwords clear. We want to remove any and all confusion merchants might have about how the industry works. Host Merchant Services promises: the company delivers personal service and clarity. So we’re going to take some time to explain how everything works. This ongoing series is where we define industry related terms and slowly build up a knowledge base and as we get more and more of these completed, we’ll collect them in our resource archive for quick and easy access. Today’s term is:

Chargeback

Chargeback typically refers to the act of returning funds to a consumer. The action is forcibly initiated by the issuing bank of the card used by a consumer to settle a debt. Essentially what happens is a consumer disputes a transaction, and the credit card company’s bank responds by taking the money back from the Merchant and returning it to the consumer.

Customers dispute charges to their credit card usually when goods or services are not delivered within the specified time frame, goods received are damaged, or the purchase was not authorized by the credit card holder — the latter being the most common reason for a chargeback.

The chargeback mechanism exists primarily for consumer protection. To start a chargeback a consumer will contact their credit card company and ask for a chargeback. The dispute process then begins. During the dispute process he merchant will have to provide proof they rendered service properly. If the merchant can’t provide sufficient evidence, the credit card company debits the transaction amount from the merchant’s account and credits it to the consumer’s account. Additionally, the credit card company charges the merchant a chargeback fee as a penalty.

With each chargeback the issuer selects and submits a numeric reason code. This feedback can help the merchant and acquirer diagnose errors  and improve customer satisfaction. The code also helps the merchant better investigate the transaction in order to find proof during the Dispute Process. Reason codes vary by bank network, but fall in four general categories:

  • Technical: Expired authorization, non-sufficient funds, or bank processing error.
  • Clerical: Duplicate billing, incorrect amount billed, or refund never issued.
  • Quality: Consumer claims to have never received the goods as promised at the time of purchase.
  • Fraud: Consumer claims they did not authorize the purchase or identity theft.

 

For transactions where the original invoice was signed by the consumer, the merchant may dispute a chargeback with the assistance of the merchant’s acquiring bank. The acquirer and issuer mediate in the dispute process, following rules set forth by the corresponding bank network or card association. If the acquirer prevails in the dispute, the funds are returned to the acquirer, and then to the merchant.

The merchant’s acquiring bank accepts the risk that the merchant will remain solvent over time, and thus has an incentive to take a keen interest in the merchant’s products and business practices. Reducing consumer chargebacks is crucial to this endeavor. To encourage compliance, acquirers may charge merchants a penalty for each chargeback received. Payment service providers, such as PayPal, have a similar policy. In addition, Visa and MasterCard may levy severe fines against acquiring banks that retain merchants with high chargeback frequency. Acquirers typically pass such fines directly to the merchant. Merchants whose ratios stray too far out of compliance may trigger card association fines of $100 or more per chargeback.

For More Information

To find out more about Chargebacks and to gain some Chargeback Tips, be sure to CLICK HERE and read The Official Merchant Services Blog entry from January 9, 2012.

VexxHost Partnership

One constant struggle that we’ve seen with our customers is the ability to perform credit card transactions on their website.  While there are plenty of credit card processing companies in the market, it always seems like you need a degree in finance in order to understand all the fees involved, not to mention the plethora of documentation to go through.

Host Merchant Services Partner VexxHost LogoIt may also seem that a lot of the times, the credit card providers’ interests are not aligned with those of the merchant.  While a business has to operate with the interest of making profits through offering a service, however, it is important to draw the line and understand the limit of what a company should charge for to maintain a good relationship with their customers.

As a company, we were extremely happy to partner and work with Host Merchant Services.  When we were initially approached and presented with the opportunity that Host Merchant Services presents for their customers, it was undeniable that HMS works with their customer’s best interests.

All of our existing and new web hosting customers are now eligible for a $75 voucher that will cover their credit card processing fees, which means that all of VEXXHOST customers can now get started and offer payments via credit card either on their online e-commerce website or even in their store, as Host Merchant Services is not limited to online credit card processing.

From small things like having no contracts or any hidden fees up to the important details such as a locked-in lifetime rate that will never change and free equipment (such as terminals and supplies) for customers that do offline credit card processing. Host Merchant Services always goes to make sure that the customer is getting the best treatment they can possibly get.

We really hope that this partnership is equally beneficial, allowing our customers to leverage HostMerchantServices to process their credit cards online, if not start offering it now.  VEXXHOST customers can get started by simply clicking the “Merchant Account” icon from their cPanel control panel to get started!

Protection from Fraud

How to Protect Your Business from Merchant Account Fraud

In order to protect your business from high risk merchant account fraud, you will find yourself in the position of having to be as smart and as clever as the crooks themselves. In a way, this amounts to a technological dance, with fraud detection solutions evolving in response to the latest schemes fraudsters devise to acquire and to use purloined credit card account information. The same holds true when applying for usda home loans so its always in your best interest to trends with extreme caution.

There are many transaction management utilities available that will give you access to the level of extensive reporting and data comparison necessary to monitor your transactions. The system itself is configured to alert you to suspicious activity, against which you can then take action. Normally when you apply for a merchant account, fraud detection systems will be recommended to you. In order to use these systems to their best advantage, it’s important to understand three core principles that define what you are trying to accomplish in detecting and responding to suspicious activity. These principles hold true regardless of the management utility you use.

First, establish thresholds for the processing of each order. These can range in complexity and be applied in any sequence that best suits your business. A threshold may be a dollar limit on an order, or even a total for a day, week, or other appropriate period. (Similarly you can set a limit for orders or sales in a given time period.) This level of sophistication is especially important in combating high risk merchant account fraud related to online payment processing.

Thresholds can be tied to specific IP addresses so only a given dollar or order amount can originate from that computer according to the parameters you establish. This prevents criminals who have acquired multiple stolen cards to test them all from one computer to see if they can accomplish an approved purchase. This kind of threshold monitoring is then tied to more specific bans directed at particular users. You can exclude an IP address, a given credit card number, a bank bin number, or even geographic regions that seem to be the source of the potentially fraudulent activity.

It is just as important, however, for any fraud protection system to also give you the flexibility to establish exclusions or overrides. This will ensure that your legitimate and honest customers are not penalized by the bans and limits put in place to shut down the crooks. Always remember when you are evaluating a fraud detection and prevention system that you are both trying to stop the crooks and protect your legitimate customers without compromising the ease with which they can use their cards to make a purchase from you.

Hand Inserting Credit Card To A Pos Terminal Payment Terminal Flat Design Vector 64931018

A is for Acquirer

We’ve been working hard the past 7 months at The Official Merchant Services Blog to offer our readers a knowledge base — a place to come frequently to get clear and useful information about the payment processing industry. But we’re always looking to take things a step further. We want to offer more information and be even more helpful. I was recently inspired by this article over at UniBul’s Credit Card Blog which offers a definition of 21 confusing payment processing terms. Credit Card Processing has a lot of buzzwords that get used. This type of technical or industry language can sometimes make understanding statements very difficult for merchants.

Well we want to make these terms clear and remove the confusion. This is part of the ongoing service Host Merchant Services promises: the company delivers personal service and clarity. So we’re going to take some time to explain how everything works. This is going to be an ongoing series where we define industry related terms and slowly build up a knowledge base. We’ll start with the same term that kicked off the UniBul blog. But our coverage is going to go a bit deeper than just a definition. We’ll provide a little extra context. And as we get more and more of these completed, we’ll collect them in our resource archive for quick and easy access.

Hand Inserting Credit Card To A Pos Terminal Payment Terminal Flat Design Vector 64931018

Acquirer

An acquiring bank (or acquirer) is the bank or financial institution that processes credit and or debit card payments for products or services for a merchant. The term acquirer indicates that the financial institution accepts or acquires credit card transactions from the card-issuing banks within an association. The best known (credit) card Associations are Visa, MasterCard, American Express, Discover, Diners Club, JCB and China UnionPay.

An acquirer is contacted to authorize a credit card or debit purchase. The acquirer will either approve or decline the debit or credit card purchase amount. If approved the acquirer will then settle the transaction by placing the funds into the seller’s account.

Every time you use your credit or debit card you are using the services of an acquirer. An Acquirer will charge a monthly and/or a per transaction fee to the stores or merchants to facilitate transactions. Acquirers need to be licensed with credit card companies, such as Visa or MasterCard.

To get a better understanding of how payment processing works, you can view this infographic.

data breach security

Data Breach Security [2023 Update]

data breach security

The Official Merchant Services Blog follows up its extensive coverage of the Global Payments Data Breach today. The news of this data breach hit on Friday March 30. At first there were reports that a mere 50,000 cards were compromised. Then the media upped the number to 10,000,000. Then Global Payments released its own statement to the media reporting that the number was closer to 1.5 million cards.

Phishing Scams Alert

The first update comes from this Credit Union Times Article: “CUNA Mutual Group has sent a risk alert to its bonded credit unions urging them to warn members about possible phishing attempts in the wake of the data security breach at Global Payments Inc.”

The article reviews the steps that Global revealed it took in response to the data breach. The payment processor said it immediately engaged external experts in information technology forensics and contacted federal law enforcement and then Global stated promptly notified appropriate industry parties to allow them to minimize potential cardholder impact. Global admitted 1.5 million cards were compromised but the company called the breach “contained.”

Host Merchant Services image on phishing scams

The alert issued by CUNA however focused on the follow through that scam artists and hackers may attempt on the information that was compromised. It pointed out that criminals may launch a campaign of their own to obtain the additional data such as billing addresses, three digit security codes and passwords through fraudulent means. So the alert warns consumers to be wary of emails, text messages or phone calls requesting this type of information. And the alert tells consumers to report any suspicious activity involving that information.

So the breach may be contained, but the risk is still out there according to CUNA.

Verizon Releases Data Breach Report

The 2012 Data Breach Investigations Report has been released by Verizon.

As with previous reports, the 2012 report aims to understand the underlying issues of major data breaches. This year’s report has been supplemented with contributions from law enforcement agencies in order to increase the awareness of global cybercrime. To that end, the report also looks at breaches from 22 additional countries over the previous year. The 2012 report looks at 855 confirmed security breaches that affected 174 compromised records in 36 countries around the world. A quick big picture statistic: The 8 years of reports now includes over one billion compromised records from 2500+ breaches.

Visa, MasterCard Investigate

logo VisaBuilding off of the statements from Global regarding its reaction to the breach, comes this story from Vanguard, citing Visa and MasterCard’s continuing investigation of the breach. The story, filed April 11, states that Visa and MasterCard are investigating whether a data security breach at one of the main companies that processes transactions improperly exposed private customer information.

The key information in the article levies some indirect criticism of Global and raises some concern about the data breach that is in direct contradiction to Global’s statements about it being contained. Citing an anonymous bank official, the article says:

“The incident has opened a crucial vulnerability that could affect millions of credit card holders. The bank official, who insisted on anonymity because the inquiry is at an early stage, said that Visa and MasterCard notified his company on Thursday, but that banks had been frustrated with the pace of disclosure by Global Payments.

He said that Global Payments, which is one of the biggest transactions processors, had provided little information on where the breaches took place, how accounts were hacked and other details that could indicate which customers might be vulnerable. Banks said that when they could identify victims, they would notify them and replace credit cards, if necessary.”

Confidence Shaken

Host Merchant Services logo art for Blog Series on Global Payments Data BreachAnd now the general texture of the data breach, as reported by Newsweek here, seems to be that confidence is shaken and security issues are a huge concern.

The article states that “experts say that the break-in is a big deal and could nudge us closer to a federal breach-disclosure law. Avivah Litan, a security analyst for consulting firm Gartner, says Global Payments is one of the largest payment processors in the country and that the breach is just the latest in a string of credit-card-security failures that have plagued corporate America. “

The article quotes Beth Givens, director of the Privacy Rights Clearinghouse, an organization that tracks data breaches, as saying the data breach “brings into question the very security of the credit- and debit-card industry and whether or not it’s safe to use such payment cards.”

The article also touches on the disparity between what Brian Krebs initially reported about the data breach and what Global released in its statements. First it points out the long delay in when the breach occurred versus when the news broke: “The company insists it notified all parties and contacted law enforcement in early March when it discovered the break-in. ‘We did not delay,’ says company spokeswoman Amy Corn. Yet it took another three weeks for the news to reach the public, and it wasn’t the company but a security blogger named Brian Krebs who broke the news.”

And then it gets Krebs’ response to the disparity between the number of cards he reported were compromised and the number of cards Global said were compromised in their statements. Krebs told Newsweek: “The number of transactions or card numbers potentially exposed is probably far larger than the 1.5 million number they are citing.”

Infographic

And finally Shelia Turner from backgroundcheck.org has been following our blogs and shared with us this wonderful infographic about The State of IT Security. Thanks Shelia!

The State of IT Security
Compiled by: Background Check Guide

Android Phone Now Takes Payments

Host Merchant Services finally gets to make this announcement official: All mobile payment solutions the company offers now feature both iPhone and Android compatibility.

On February 28, 2012 Host Merchant Services teased through its Facebook Page that it would have big news regarding HMS and Mobile Payments in March. But technical difficulties with the full release of Payfox’s Android solution held the news back until today. In the Android Marketplace, Payfox is now listed and available for download. You can see the listing here.

The App has been on the Android Marketplace since March 21. But now the rest of the support is in place to get the app working. The final piece of the puzzle was the card reader — UniMag II, Two-Track Secure Mobile MagStripe Reader. The device is a two-track, encrypted magnetic stripe reader that works with a wide variety of mobile platforms, including Apple, HTC, LG, Motorola, and Samsung devices. Use your mobile device to read credit cards, signature debit cards, gift cards, loyalty cards, driver’s licenses, and ID badges. The UniMag reads up to 2 tracks of information with a single swipe in either direction, providing superior reading performance for your mobile device.  A merchant account is required to accept credit card transactions.

Host Merchant Services image of the Unimag II.

You can download the specs from the UniMag II data sheet right here. These are the Android devices supported by the reader:

  • HTC Aria
  • HTC Desire Z
  • HTC Eris
  • HTC EVO 4G
  • HTC EVO Shift 4G
  • HTC G2
  • HTC Hero
  • HTC Incredible
  • HTC MyTouch 4G
  • HTC EVO 3D
  • HTC Nexus One
  • HTC Incredible 2
  • HTC MyTouch 3G Slide
  • HTC MyTouch 4G Slide
  • HTC Thunderbolt
  • HTC Merge
  • LG Optimus T
  • LG Revolution
  • Motorola Droid 2
  • Motorola Droid X
  • Motorola Droid Pro
  • Motorola Milestone
  • Motorola FlipSide
  • Motorola Atrix
  • Motorola Droid 2
  • Motorola Droid 2 Global
  • Motorola Droid Bionic
  • Motorola Droid 3
  • Samsung Captivate
  • Samsung Droid Charge 4G
  • Samsung Epic
  • Samsung Epic 4G
  • Samsung Fascinate
  • Samsung Nexus S
  • Samsung Replenish
  • Samsung Infuse 4G
  • Samsung Continuum
  • Samsung Galaxy SII

Please Note

When you go to the Google Play Market and search for PayFox using your Android/Droid phone, the PayFox application will only display for those devices for which the application itself is compatible.

Host Merchant Services image for difference between Android phones and Star Wars Droids.

Red 5 Standing By

Our friends at Transfirst also wanted to offer some clarification about the use and licensing around the word Droid:

“Android and Droid are often used interchangeably when referring to ever-growing & increasingly popular line of smartphones that run on Google technology. The difference, for most purposes, is one of legal definitions and intellectual property. Android simply refers to the operating system and software that powers phones built by any of number manufacturers, including HTC or Motorola, and that run on any of the major carriers.

Droid, on the other hand, is a term coined and owned by LucasFilm Ltd., the licensing rights for which Verizon had to purchase in order to brand their specific line of Android Smartphones.”

In short, Androids are phones, and you can now use them to swipe payments. Droids are what Jawas scavenge. Though I’m sure the Jawas will happily accept mobile payments from all you moisture farmers out there. Ootini!