Get PCI Compliant

Payment Card Industry compliance refers to a specific grouping of standards that have been set up to help ensure that customer data is being secured uniformly throughout the industry. MasterCard, Visa, Discover, and American Express set up the Payment Card Industry Security Standards Council over 13 years ago in 2006 with a view to helping regulate the credit card industry and maintain the Payment Card Industry standards to hopefully improve the security of transactions and payments.

Why Do I Need PCI Compliance for My Business?

Any business, no matter how big or small and regardless of transaction volume, needs to be Payment Card Industry compliant if they’re accepting payments from credit and debit cards. To be more specific, any company that will be storing, transmitting, or processing credit card information is legally required to be Payment Card Industry compliant. Should a data breach occur, any company that is not fully Payment Card Industry compliant will be subject to steep fines by the Payment Card Industry Security Standards Council. When it comes to smaller-sized businesses, being Payment Card Industry compliant will lessen any liability for your business in the event of a data breach occurring.

How Do I Become PCI Compliant?

In order to become fully Payment Card Industry compliant, a yearly self assessment questionnaire must be completed, along with a quarterly Payment Card Industry security scan which must be passed.

The self assessment questionnaire will include a series of questions that have been designed to assess Payment Card Industry security levels, and depending on how a business is to deal with their payment processing, they will fall into one of several categories.

Additionally, by finding a payment processor that will provide Payment Card Inquiry compliant payment processing, you can ensure that all of your business’ credit card transactions will be secure.

The different types of Self Assessment Questionnaires break down as follows:

A: Card-not-present merchants for whom all cardholder data functions have been outsourced to validated third party service providers with no cardholder data stored, processed or transmitted on the merchant’s systems or premises.

A-EP: Online merchants for whom all payment processing data is outsourced to validated third parties, and who don’t receive any cardholder data through their website, but can, however, impact the transaction’s security. No cardholder data is stored, processed or transmitted on the merchant’s systems or premises.

B: Merchants who only use standalone dial out terminals with no electronic cardholder data storage and/or imprint machines with no electronic cardholder data storage.

B-IP: Merchants who use only standalone terminals that are PTS approved, with an IP connection to the payment processor, and with no electronic cardholder data storage.

C-VT: Merchants manually entering single transactions at a time with a keyboard into a validated third party virtual terminal solution. No electronic storage of cardholder data.

C: Merchants with online payment application systems and no electronic storage of cardholder data.

P2PE-HW: Merchants with hardware only payment terminals, with no electronic storage of cardholder data.

D (Merchants): All merchants not covered by any of the above

D (Service providers): All service providers a payment brand has defined as eligible to complete a self assessment questionnaire.

Qatar Bans Crypto Trading

On December 26, 2019, the Qatar Financial Centre Regulatory Authority (QFCRA) announced via a press release posted to Twitter that virtual asset services were no longer allowed in the Doha-based Qatar Financial Centre Authority (QFC). The QFCRA’s decision essentially cut off more than 500 financial firms and other businesses within that location from crypto trading. The QFCRA cited QFC Law No. 7 of 2005 and Financial Services Regulations (FSR) as the reasons and noted that it will penalize businesses that ignore the ban.

What Is Crypto Trading?

Crypto trading is when businesses purchase, sell and trade cryptocurrency, a type of digital asset that’s processed using secure digital encryption known as cryptography. Businesses who deal in cryptocurrencies trade one type for one or more others types of digital currency or physical non-digital assets like government-approved, legal tender, such as fiat money and commodity money backed by commodities like gold and silver. Crypto trading can also involve the use of cryptocurrency to buy products and services.

What Is the QFCRA’s Official Stance?

The QFCRA considers virtual assets to be any type of alternative digital currencies that aren’t related to fiat currency and other types of regulated “monetary instruments.” The QFCRA defined a virtual assets services provider as any “natural or legal person” who performs virtual asset services. It doesn’t matter if only one person initiates or accepts a transaction either. The QFCRA defined virtual asset services in the tweet to include exchange involving trade of virtual currencies for virtual currencies and fiat money, transfer of virtual assets and any transaction related to sale of virtual assets. It also banned the administration or holding of virtual assets and/or any tools that make it possible to control virtual assets.

Why Is This News Important?

Crypto trading is associated with high risk: It doesn’t require the use of a centralized bank or backing from a government entity. It occurs over decentralized networks using many computers, which means that the typically untraceable transactions are conducted without strict legal and regulatory controls. The exchange rates fluctuate wildly with little-to-no forewarning. Money launderers, tax evaders, thieves, terrorists and others often use virtual assets services to exchange cryptocurrency for fiat money or real-world assets in their criminal dealings. Although many standard fiat and commodity currency transactions are now conducted digitally, those transactions, unlike crypto trading, are heavily regulated, traceable and backed by real-world materials. Merchants need to recognize that they can face steep fines and other penalties in a growing number of countries if they’re caught performing business transactions using cryptocurrencies. For example, China and India have also enacted strict bans in recent years.

At Host Merchant Services, we believe that providing merchants with regular global economy updates can help them to adapt rapidly to changes in payment acceptance and protect them from fines and penalties. We want you to have the information you need to be an informed decision-maker so that you conduct transactions in a legal fashion. We also want to make it clear why we don’t offer certain payment acceptance and processing services. For more information about crypto trading or alternative transaction options, contact us today.

Retail Sales Have Plummeted In Hong Kong

Since March 2019, pro-democracy activists in Hong Kong have been staging massive rallies that often turn violent and destructive. Clashes between protesters and riot control police units have claimed more than 2,500 injuries and millions of dollars in damages. The lucrative tourism and retail industries of Hong Kong have also been deeply impacted; according to data compiled by regulators, sales transactions have plunged by more than $30 billion since November 2019, one of the worst plunges ever experienced by this autonomous region of China.

Hong Kong Digital Payments The worst month for retail sales in Hong Kong was October, which posted a 24.4% drop on an annual basis. Amazingly, market analysts expected an even more calamitous report for November when considering just how violent the protests have turned since October. The resolve of activists in Hong Kong has not shown any signs of abatement; on New Year’s Day, one of the most impressive rallies drew hundreds of thousands out onto the streets of the Kowloon district, and leaders who spoke to international journalists explained that they are not ready to stop until the Communist Party of China gets the message: People of Hong Kong do not want to abandon the democratic system.

For small business owners, particularly retailers, the protests have been disastrous to their bottom lines. Hong Kong is one of the most active markets in terms of digital payments, but this is not an advantage when storefront operators are forced to shut down their establishments, which are often damaged by vandalism during protests. Being a leader in digital payments means little when shoppers are too nervous about visiting stores because they fear protests will get unruly.

At a time when holiday sales in Asia are posting record annual increases, the situation in Hong Kong is dispiriting. Luxury brands such as Louis Vuitton, which rely on purchases by foreign visitors, are closing up stores in some of the busiest districts. As for foreign tourist arrivals, their volume has dropped by more than 55% on an annual basis.

Needless to say, representatives from the Hong Kong Retail Management Association are dismayed by the current situation. A recent survey among retailers revealed that 7,000 business owners are planning on closing up shop over the next six months unless things improve and the protests stop. Sensing that the worst is still to come, government regulators have urged commercial space landlords to put a moratorium on raising lease contracts. A deteriorating retail economy is the last thing Hong Kong would like to experience; thus far, the hardest-hit in this regard have been luxury retailers such as jewelry stores, but thereare fears about protest leaders calling for shopping boycotts in 2020.

Planned Fee Schedule Limits Access to Free ATM Cash Withdrawals in the UK

For many British consumers, using the ATM at their local convenience stores, which are colloquially known as corner shops, is the best way to access bank funds for free. The traditional arrangement consists of banks paying interchange fees to ATM operators; thus allowing account holders to enjoy free cash withdrawals they usually spend at the store, but this is changing to the detriment of consumers.

ATM Scam LINK, the business entity that controls the national network of cash machines located within corners shops across the United Kingdom, has sharply reduced the interchange fees, and it is planning even more cuts in the near future. ATM operators have taken swift action to cut their losses by removing machines from corner shops. The Association of Convenience Stores is now urging LINK to scrap the next fee reduction so that ATM operators do not end up removing all their cash machines, particularly in communities where residents do not have easy access to their banks.

The CEO of LINK has pointed out that the use of cash among British consumers has been falling in recent years thanks to the advent of mobile payments, thus doing away with the need of ATMs at corner shops. The ACS argues that mobile payments technology is not the only matter at hand; British banks have been shutting down branches across the country, thus leaving account holders with limited options such as making free withdrawals at local Royal Mail offices, which have also experienced rounds of closures.

There was a time when corner shop operators enjoyed direct profits from ATMs. Over the last few years, however, things have changed to the point of shop owners actually having to pay ATM operators to keep the cash machines in place. Consumer advocates estimate that at least two million individuals rely on cash withdrawals for various reasons, one of them being that not everyone can afford a smartphone with near-field communication features that would allow them to make contact-less payments.

For the payments industry, a strong transition to digital payments instead of cash transactions is good news, but market leaders agree that governments need to contribute with legislation conducive to inclusion, meaning that mobile payments should not be limited to NFC devices. In Commonwealth nations such as Kenya, the issues of ATM access and cashless transactions have been settled with M-Pesa, a mobile alternative to banking that works with just about any cell phone because it uses SMS technology.

One of the keys to ensuring easy access to digital payments is to take into consideration all consumers, even those who feel that they should be able to access cash at nearby locations and with reasonable fee schedules. Shifting all charges onto consumers, banks, or retailers is not the answer.

Hackers Steal Credit Card Data at Major Seafood Restaurant Chain

Individuals who have wined and dined at theme restaurants such as the Bubba Gump Shrimp Company and the Rainforest Cafe at least once since 2016 may want to review their credit and debit card statements. According to a notice posted by restaurant giant Landry’s shortly after New Year’s Day, hackers were able to inject malware into an internal system that operates separately from the point-of-sale (POS) network, but which nonetheless involved payment cards.

E-commerce Data Security Breach Before discussing details about this security incident, it should be noted that Landry’s POS system was not breached. In fact, the restaurant chain operates a system that not only encrypts data but also blocks all scripts it does not recognize which means that unrecognized malware would have no effect. There was another card-reader system affected, but not one used for payments. With this in mind, the scope of the incident is sharply reduced because the credit and debit cards that may have been intercepted were not supposed to be swiped in the targeted system anyway.

When you sit at table or at the bar of the Rainforest Cafe or Del Frisco’s Grill, you probably have noticed that servers interact with more than one card reader. There is the POS for payments, which is encrypted, but there is also an order-entry system that restaurant staff members access by means of swiping cards that often hang from lanyards around their necks for easy access. In some cases, servers carry a wireless tablet with from table to table; this portable card reader can be used to swipe Landry’s Select Club cards, a nice customer loyalty and rewards program.

Between payment cards, access cards, and customer loyalty cards, it would not be unusual to expect that busy Landry’s servers would, from time to time, get these cards mixed up, which is what happened in this case. Some debit and credit cards were inadvertently swiped to place an order from the table or from the bar to the kitchen; perhaps a MasterCard was swiped instead of a Landry’s Select Club card, thus depriving some customers of points that could have been redeemed for a frozen margarita or a free side order of Cajun shrimp.

Even though Landry’s operates more than 600 restaurants, only 60 locations were affected, and individual cases are limited because most servers employed by this chain are retained based on their ability to carry out their duties with precision. This does not mean that hackers are giving up on attacking point-of-sale systems; if anything, malware targeting card readers terminals is becoming more sophisticated. The intent to breach Landry’s was certainly there, but it did not work as hackers had hoped for.

More restaurant payment coverage and guides: Restaurant Payment Resources.

What Is Synthetic Identity Fraud?

It feels like a never-ending race and a battle to one-up one another: the battle against fraudsters. While the equipment we have to detect and prevent these fraudsters has been improving substantially over the previous decade, fraudsters always seem to find a way to get through eventually.

E-commerce Data Security Breach One of the latest tactics is synthetic identity fraud, a unique type of fraud in which fraudsters combine fake and legitimate information to create brand-new identities rather than just stealing someone else’s identity.

We’re not talking about a lone wolf hiding in their basement trying to make a quick grab at what they can, either. These are the actions of large-scale criminal organizations that know exactly what they’re up to. They are sophisticated, methodical and patient, and right now as many as 85% to 95% of synthetic identity fraudsters are easily slipping through risk detection systems that are failing to notice them.

According to GIACT Chief Experience Officer David Barnhardt, “They are doing the same things we are: always evolving their tactics to meet the newest technology and offers out there. Whenever a new thing in security comes along, they come out and see if they can beat it.” He went on to say, “When I was working in banking, we knew for certain that with any new initiative we rolled out, we would be attacked for six months and would have to tweak our approach every day. What they’ve learned is that they don’t have to rob a bank in person – they can do it with malware, make more money and get away with it.”

Synthetic Identity Fraud Is Rising

When looking into GIACT’s analysis, as much as $6 billion was stolen by synthetic fraudsters taking legitimate, personally-identifying information in 2016 alone, and that amount has been rising in the years since.

By establishing synthetic identities, fraudsters can open bank accounts and cards and act as if they’re legitimate customers, allowing them to make purchases slowly and quietly at first, sometimes for as long as a year while they build strong credit scores, before then going all out.

How to Defeat Synthetic Identity Fraud

It’s unfortunate, but there aren’t really any special ways to get rid of identity fraudsters. It would seem like, for now at least, they’re here to stay. What we do have, though, are tips and tricks for fighting fraud. Always remember though – the fraudsters are always thinking outside the box and always trying to get a step ahead. Therefore the industry has had to keep on its toes and come up with many creative ways of keeping ahead of the fraudsters.

Bernhardt also commented upon the advantages that fraudsters have. Should the levels of data breaches someday get down to 0, there’s always going to be data that fraudsters will find useful on social media. With this data, it’s possible that fraudsters could put together a functional profile from which they could commit synthetic identity fraud.

Ultimately, there’s no special answer to making this problem go away. We just need to remain vigilant and do all we can and continue to evolve to keep the fraudsters at bay while protecting the security of sensitive information.

The Sand Dollar is a New Caribbean Digital Currency

Of all regions in the world, the Caribbean may seem one of the least likely to officially adopt digital currencies, but that is exactly what has been taking place this year. In October 2019, the Eastern Caribbean Currency Union launched a pilot program to turn the EC dollar into an electronic form of cash, which residents of eight island nations can now use through the DXCDCaribe mobile app. Not to be outdone by this technology advancement, the Bahamas has launched its own pilot program to go cashless before the end of 2019.

Business owner happy with loan Project Sand Dollar went live just two days after people across the Bahamas celebrated Christmas with a traditional dinner of baked ham, rice and peas, and potato salad. Central bank officials explained that although there is a blockchain enabling the circulation of the sand dollar, which is pegged to the value of the Bahamian dollar, this is not a true cryptocurrency since it is centralized and does not allow mining.

There are certain initial restrictions in place for Project Sand Dollar. Individuals can only hold $500 sand dollars in their accounts, which are can be managed by means of a mobile app similar to the aforementioned DXCDCaribe. Business entities are limited to holding no more than $1 million, and the sum of monthly transactions may not exceed 1/8 of capital. Central bank officials see the sand dollar as being a natural progression in the sense that residents of the islands are not as enthusiastic about using banks as they used to.

Equal access to the banking system is something that the Bahamas and many other nations have curtailed through the enactment of anti-money laundering and “know your customer” legislation and regulations. In many jurisdictions, it is simply too late to reverse the effects of AML and KYC, which is why initiatives such as Project Sand Dollar are welcome since they can empower individuals who have been left out of the banking system, but who wish to make digital payments and money transfers.

As for the government of the Bahamas, financial regulators actually prefer to see digital payments taking place since they reduce the burden of physical currency controls and management. The goal is to get people used to holding sand dollars and generating quick response (QR) codes on their smartphones when they settle retail POS transactions or pay utility bills. The project will begin on the Exuma island and will later roll out to the Abaco islands. On the day the pilot program started the value of one sand dollar was equal to the United States dollar.

Chinese Hackers Were Successfully Able to Bypass 2FA

On December 19, the cyber security firm Fox-IT, which is headquartered in the Netherlands, reported that they discovered a previously-unknown infiltration of managed service provider and government computer systems in at least 10 countries, including the United States, Mexico, Brazil, the United Kingdom, France, Germany, Italy, Portugal and Spain. These systems covered a wide range of industries, including aviation, construction, energy, finance, gambling, healthcare, insurance, offshore engineering, payroll and HR services, physical lock manufacturing, software development and transportation. Fox-IT believes a Chinese government-funded hacking group managed to bypass two-factor authentication (2FA) to initially access and then spread through these systems.

What Is 2FA?

Two-factor authentication was designed to make it more difficult for hackers to access secure, private data. It requires that a user provide two unique forms of information to prove identification when logging into accounts. For example, a system might recognize a user by their physical hardware, via a unique linked code, coupled with a separate unique password. The user might input a memorized password or a one-time password generated by a separate piece of hardware called a token or password generator. In banking, 2FA occurs when a card holder uses their physical card with their unique PIN number at an ATM or during debit transactions. In point-of-sale software payment processing, a merchant or an employee uses 2FA when they sign into their point-of-sale software on a computer, a unique device, with a unique password.

Which Group Is Responsible?

Although many hacking groups supported by the Chinese government exist, Fox-IT has linked this event to a Beijing-based group called APT20. Security firms believe this group started in 2011. Since the Chinese government invests a lot of time and money into hiding their hacking groups, APT 2020 was able to keep a low profile during 2016 and 2017. Firms couldn’t track them until they slipped up in 2018. Fox-IT referred to the 2FA bypass as “Operation Wocao” after a member of APT20 used the Chinese curse word “wocao” in a final line of Windows command failure code when they realized that their actions had been detected and they couldn’t hack a system. The word aptly described both the frustration and shock felt by not only the hacker, but also Fox-IT techs who realized that the system and others had been hacked in such a rare fashion.

How Did They Do It?

Cloud-Based Business App For Merchants This specific group typically uses the most basic hacking tools combined with the software already present on their victims’ systems. Two-factor authentication is incredibly difficulty to bypass since it uses unique forms of identification. Fox-IT has stated that APT20 found a way, currently unknown, to compromise the 2FA for virtual private networks possibly via vulnerabilities in the the corporate and government enterprise application platform known as JBoss. Essentially, they found a way to bypass the credentials necessary to access their victim’s VPN accounts and the computer systems attached to those networks. APT20 then focused their efforts on locating and hacking additional linked systems that held the credentials necessary for them to find and retrieve additional private data. The attack was designed to help them find higher and higher levels of authentication to access higher and higher levels of information. For example, they targeted password managers/vaults and then used the passwords they found to continue their data search and retrieval. Once they were finished, they did everything possible to delete all footprints of their actions to prevent detection.

What About Payment Processing?

APT20’s rare bypass of 2FA shows that hackers might be able to access any system in a similar fashion, including networked computers owned by merchants using point-of-sale software and/or customer databases. A hacking group could potentially mine merchant systems for customer names, credit card numbers, expiration dates and secure CVV codes. If the system also has a customer database, hackers could also retrieve private details, such as customers home addresses and product likes and dislikes. Hackers might use this data to learn more about specific individuals, such as politicians or military leaders, or create false identities.

We recommend that all merchants focus on improving not only their computer and network safety, but also their employee-based vulnerabilities. It’s important to train employees to recognize the many techniques used by hackers and how their actions can help these bad government-funded actors gain access. Merchants can also protect their systems by blocking employees from checking private email or downloading software on these systems.

Our team at Host Merchant Services goes beyond securing our own payment processing systems against these types of attacks: Host Merchant Services Data Breach Security Program. Click that link to download a PDF explaining the value-added service HMS provides its merchants that goes above and beyond just simple PCI Compliance and helps ensure a merchant’s peace of mind.

Plenty of Cheer During the 2019 U.S. Holiday Shopping Season

The numbers are in for the 2019 holiday shopping season, the final one of the decade, and retailers were pleased to learn that overall sales increased by nearly 3.5% compared to last year. Starting on Black Friday and culminating with last-minute shopping on Christmas Eve, retailers were definitely in the black this season, and this is despite the period being shorter than last year by six calendar days. E-commerce was the biggest winner with an increase of 18.8%, and the payments industry was pleased to see a greater volume of credit and debit card transactions along with digital payments.

e-commerce merchant options Even though online shopping accounted for a little less than 15% of the overall sales volume, it should be noted that the Cyber Monday shopping event continued to grow, particularly in the consumer electronics segment, which experienced a boost of 10.7% on a year-over-yer basis. Specialty apparel was the segment that shoppers expressed greater interest in compared to 2018, but even department stores posted a nice growth of 6.9% despite industry analysts warning that the heyday of American shopping malls is behind us.

According to the MasterCard Spending Pulse survey of retail activity during the holiday season, stores were prepared for the shorter shopping period this year; many retailers stepped up their omni-channel marketing efforts starting in early November. It should be noted that department stores actually saw a decline in their brick-and-mortar transactions, but they posted a 6.9% increase of their online sales.

Now that Christmas has come and gone, retailers are gearing up for the post-holiday blues, which tend to feature many gift returns or exchanges; a typical example is footwear, which tends to see a lot of exchanges because of size issues. Clearance and special discount situations will likely see a migration towards e-commerce channels, but brick-and-mortar retailers are ready to welcome more store traffic that should last through the first week of the New Year. Physical storefronts located within shopping districts have an advantage in this regard when merchants get together to organize entertainment and family events; the idea is to increase foot traffic at a time when many shoppers have time off work.

Wall Street Investors Also Enjoyed Holiday Cheer

The Santa Claus rally on Wall Street was delayed by just one day this year. According to market analysts at Nasdaq.com, exchange-traded funds that focus on the banking sector soared when traders returned to work after Christmas Day. This is good news for the payments industry, which does not exclusively rely on banks to stay busy. Consumers are warming up to alternatives to the traditional banking system; increased regulation and oversight along with a lack of flexibility by banks are driving consumers towards payment systems that they can manage from PCs and smartphones. Since providers of alternative banking services work closely with payments processors and clearinghouses, the future looks good for the payments industry.

Facebook Users’ Phone Numbers Exposed Online

Earlier this month, a huge database containing Facebook user IDs and phone numbers of 267 million members was breached and exposed, where it was then left on the web for almost two weeks before finally being removed.

E-commerce Data Security Breach According to security reasearcher Bob Diachenko, who discovered the unsecured Elasticsearch dabatase along with Comparitech, it may not have belonged to Facebook, rather a cybercriminal organization.

According to the report released December 19th, “A database this big is likely to be used for phishing and spam, particularly via SMS. Facebook users should be on the lookout for suspicious text messages. Even if the sender knows your name or some basic information about you, be skeptical of any unsolicited messages.”

First annexed on the 4th of December and not noticed until 10 days later on December the 14th, the database is now thankfully unavailable. According to Diachenko, however, the data was also posted on December 12th to a hacker forum, where it was then available to download.

It’s still not clear exactly how the information was collected, although Diachenko suggests that it could have been stolen from the developer API that Facebook provides to app developers in order for them to access user data and profiles prior to it becoming restricted last year. Another possibility could be that it was all due to a glitch, which enabled the criminals to access the information despite the restrictions. Or, it could simply have just been scraped from profile pages that are publically visible.

According to the published report, “’Scraping’ is a term used to describe a process in which automated bots quickly sift through large number of web pages, copying data from each one into a database. It’s difficult for Facebook and other social media sites to prevent scraping because they often cannot tell the difference between a legitimate user and a bot. Scraping is against Facebook’s – and most other social networks’ – terms of service.”

Regardless of how it actually happened, Facebook users have been warned by the researchers to make sure that their security and privacy settings are set to private rather than public, which can help to decrease any chances of their profiles being scraped. Especially since the stolen data has also been posted to the aforementioned hacker forum and is still being held by the cybercriminals, so it could very well still be used for targeted phishing attacks or spam.

This isn’t the first time that Facebook user data has been found around the web, and unfortunately it probably also won’t be the last. As recently as September, hundreds of millions of Facebook user phone numbers was again found leaked on an open server, and just a few months prior in April two different datasets held by two app developers were found by researchers. In both of these instances, Facebook was the data source for the records.

And one last thing to consider if you are a merchant and you are worried about data breaches affecting your bottom line: Host Merchant Services Data Breach Security Program. Click that link to download a PDF explaining the value-added service HMS provides its merchants that goes above and beyond just simple PCI Compliance and helps ensure a merchant’s peace of mind.