Evan Schuman's StorefrontBacktalk

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

Words matter. When one uses terms like “two-factor authentication,” “sensitive authentication data” or “high vulnerability” in the context of PCI DSS, the words convey a very specific meaning. Each term conveys specific information, and misuse leads to confusion and errors. A recent payment vendor move—using Webcam footage of payment cards supposedly to deliver some card-present-like advantages—misused some important payment-card terminology. The product also raises new security problems. Confusion is bad, but increased risk is far worse.

If increased risk is not enough, using video to capture payment-card information means that retailers would have to absorb all the cost of complying with every PCI requirement without the benefit of lower interchange fees. One also has to wonder if using video cameras to validate cards means retailers will need to search for rogue video devices the same way they must test for the presence of rogue wireless access points today. Speaking of videos, another bad-guy trick could be harvesting legitimate cardholders’ videos and selling them like stolen primary account numbers (PANs). This technology could result in an entirely new secondary carders market.

In the world of payment cards, the incorrect use of industry-specific terms risks misleading anyone who is not a payment-card expert, whether intentionally or accidentally.

This point is important as retailers and vendors struggle to apply all manner of 21st Century technological wizardry to circumvent the restrictions of a mid-20th Century technology: the magnetic stripe card. Each technology struggles to meet the needs of a Web-based consumer-payment market. One outcome of this struggle will be new technologies and approaches that in turn introduce their own particular layer of risk to the transaction. Another outcome is one retailers address every day: PCI DSS.

Frank Hayes’ recent column on emerging technologies to support E-Commerce (together with the thoughtful reader comments) noted that in the payment-card industry, “card present” has a specific meaning. (Related story: “Does Card Present Make Sense Any More? What Should It Look Like In A Year?”) It relates to reducing the risk (and, therefore, the cost) of a card transaction.

Anytime an issuer receives an authorization request based on reading a card’s mag stripe, that transaction has lower risk than if the card information is entered manually. This principle holds when the card is physically present at the point of sale but the mag stripe is not read or when the card is not present, for example, mail order/telephone order (MOTO) or E-Commerce transactions.

The term “card present” means a lot more than the payment card is physically present at the POS. Card present means a lower risk transaction. It means the merchant swiped the card on its POS terminal, which read the mag stripe and sent the contents to the card issuer as part of the authorization.

Reading the mag stripe matters for two reasons. At the POS, the merchant can compare the name on its card-reader screen with that embossed on the card. If they don’t match, the retailer can confiscate the card, reject the transaction or call in a Code 10 authorization. Then when the authorization request gets to the issuer, it can use additional, critical data elements contained only on the mag stripe.

For example, the mag stripe contains the card verification value or code (CVV for Visa; CVC for MasterCard). When the issuer receives a card-present authorization, the CVV/CVC can tell it if the card is the one issued. A mag stripe encoded only with information from a cardholder statement, for example, would not contain the correct CVV/CVC. Obviously, the CVV/CVC can only be analyzed when the mag stripe is read and sent to the issuer.

As an aside, many merchants and even some QSAs who may not know the card business well mistakenly confuse the CVV or CVC with the security codes written on the signature panel (the CVV2 or CVC2, respectively). The addition of the “2” is another industry-specific designation that is important. The CVV2/CVC2 is not on the mag stripe, and it has a different but related purpose in reducing fraud—specifically when the card is not present.