My thanks to Bruce Schneier’s wonderful security blog for finding this link, which is actually an unusually funny video of Hitler complaining about cloud computing security problems, pointing out that the Nazi’s provider had been certified PCI compliant.
Although the whole video is quite funny, you really should stay for the last line. I don’t laugh out loud much, but this surprise ending got me. …
This month, an electronic message started appearing on automatic deposit machines telling investors that the machines were being "decommissioned" early this year. Some store associates added that the timing would be more like May or early summer. At first, this seemed an ordinarily unusual move, as few chains that have made the investment in self-service machines (Fidelity started rolling them out 10 years ago) bother to yank them out. But then Fidelity tried to explain the move, and what seemed merely unusual became positively surreal.Read more...
For the mysterious data breach crime folder, the U.S. Secret Service is investigating a series of payment card thefts—originating at an Alabama Dairy Queen—that has only been impacting debit cards. The Hanceville, Ga., police department’s Capt. Jimmy Rodgers is quoted in a local newspaper saying: “At that location, somebody has apparently tapped into the Internet server and hacked into the debit card system, and they’re printing out the customers’ debit card numbers and using them all over California and Georgia.”
This is a disturbing trend, as retailers see debit card approaches as a way to try and reduce interchange costs. It’s even more frightening when we factor in that debit cards are more likely to suffer a processing glitch—as Best Buy and Macy’s discovered last year–than credit cards and that consumers impacted by a debit card data breach are far more exposed than they would have been had they used a credit card.…
During an onsite assessment, QSAs confirm that merchants have met PCI Requirement 11.2 by examining the passing vulnerability scans for each of the last four quarters. The problem is, what if the merchant has missed a scan? If this happens, is the merchant noncompliant until it can get four quarters of passing scans? Ouch.Read more...
Target, for example, has decided that its in-house payment cards are a priority, so it's trialing a program in Kansas City that—in part—offers customers who use the card "5 percent off on every item, every transaction, everyday," Target CFO Doug Scovanner told analysts in a Tuesday (Feb. 23) conference call discussing the chain’s earnings.Read more...
In its latest financial report, Heartland Payment Systems reported that it dropped $129 million on data breach costs last year (an incident that briefly placed Heartland on Visa’s Bad Breach Boy list). The company added that it still has a reserve of $100 million for additional expenses.
As a processor, Heartland’s pain is certainly much more severe than what would be inflicted on a retailer involved in a similarly large breach. But $229 million is starting to look like real money. Think of that $100 million in the bank as sort of mad money, in the sense that it’s needed because everyone Heartland has done business with seems to be driven stark raving mad. It’s less hush money than “please don’t hurt me” money.…
Additional rules, typical for any security shop, include prohibiting passwords that are in the dictionary and certainly ones that are easily guessable. And yet, the password for the PCI DSS document seems to violate the four password rules contained in its words (that's about as quintessentially ironic as anything could get), in addition to the dictionary and guessable rules. It's—wait for it.
Before he offered the unsolicited advice for Amazon, Lampert penned an unusual claim: that Sears and its 20th Century catalogue business is essentially the father of E-Commerce. It's a bit of a stretch, but he makes a legitimate point.
"Sears has a long legacy in serving customers beyond physical stores. In many respects, The Sears Catalog was the 20th Century model for selling products through the mail," Lampert said, with the suggestion being that selling-through-the-mail is essentially what E-Commerce is. "To be successful, Sears had to earn the trust of its customers who purchased products sight unseen and who had to feel confident that they would receive what they purchased and, if they were not satisfied, they would be able to get their money back."Read more...
Braden Black, a senior enterprise architect (and security specialist) for 305-store shoe chain DSW, said that, in his opinion, the biggest problem with chip-and-PIN—as it's currently deployed—is that banks have little incentive to make these systems secure because they no longer have any liability if they're repeatedly breached. That liability has been pushed to the retailers. "The ramifications of this attack are most disturbing when viewed in light of the fraud liability regulations that were adopted alongside the technology. Essentially, the banks offloaded fraud liability to merchants and cardholders." Read more...
From a security perspective, PCI Columnist Walt Conway pens, retail CIOs should understand a few things about these chip cards or smart cards (i.e., payment cards with an embedded integrated circuit or microchip). Chip cards can reduce fraud losses, but chip-and-PIN zealots can overstate the benefits.Read more...
But the economic hardships of last year may have shined a tiny ray of light on some bargain-hunting retailers at the expense of Big Blue. IHL President Greg Buzek said second quarter POS shipments last year for IBM plunged more than 40 percent worldwide, and a good chunk of that was a flood of barely used, ludicrously discounted POS units from chains that never made it to 2010.Read more...
Saying that it was "a result of additional market feedback," the Council ruled that the sensitive payment date on the digital recordings could be retained if the retailer can prove that the data in question can't be queried. "The Council is now saying that call centers can keep this data—even if digital—so long as they protect it per PCI. That is big," said Walter Conway, a 403 Labs QSA who is also StorefrontBacktalk’s PCI columnist.Read more...
Franchisee Columnist Todd Michaud adds that the kicker is that most retailers don’t even know it’s happening. We're talking about your closest competitors having access to some of your customer profiles (at a much deeper level than what you probably are aware of), the purchase patterns of those customers and the amount they are spending on each visit. And you have no idea. Sound scary? It is.Read more...
Concors said he was lucky; his senior management team is open to creativity and was willing to roll the pizza dough dice on what sounded like an interesting idea for the world's largest pizza chain, with its more than 7,500 U.S. restaurants and more than 5,600 shops in 97 countries and territories globally. But few CIOs are in that position, and that's a piece of reality that could cripple the nascent retail mobile app space. "A lot of companies are struggling with whether to enter this space because of the ROI issue," Concors said. A big part of the problem is that far too many retailers are deploying mobile apps for the wrong reason or doing it the wrong way.Read more...
FACTA, the federal law that prohibits POS receipts from displaying full credit card numbers and expiration dates, does not apply to E-Commerce purchases, a federal judge has ruled. The fear had been that the electronic purchase receipts E-mailed to customers might have to comply with the same paper receipt truncation rules, but U.S. District Court Judge John W. Darrah (Northern District of Illinois) ruled that E-tailers are immune from the Fair and Accurate Credit Transactions Act (FACTA).
“E-mail order confirmations are not entitled to FACTA protection” because they “are not electronically printed receipts under FACTA,” Darrah said. “Second, an E-mail order confirmation is not provided at the point of sale or transaction under FACTA. Although plaintiff posits that print is commonly understood to mean ‘to display on a surface (as a computer screen) for viewing,’ this argument is unpersuasive.” …
For the last few years, the payments industry has made convenience a top priority. Promising it, not delivering it. Biometric authentication was the first attempt (when your slogan is “Don’t Swipe. Just Give Cashiers The Finger,” it’s rarely a good omen), until vendors realized that no one wanted it. Contactless payment was the next effort. This effort has delivered lackluster performance; major retailers only offered it when the bribes exceeded the effort. Finally, Visa has hit on a convenience method that is actually likely to be faster. It’s called cutting corners.
Visa on Monday (Feb. 8) agreed to waive the retail requirement to get consumer signatures for purchases costing $25 or less. “With the changes announced today, approximately 98 percent of all U.S. merchant category codes in the Visa system will be covered by the No Signature Required program,” a Visa statement said. Although it could be seen as diluting a time-honored anti-fraud tactic, signatures have been fairly worthless for years; almost no chain asks its cashiers to spend the time even looking at a customer’s signature and comparing it to the one on the card. Without that verification, there’s no reason to not waive the requirement for a lot more than $25 purchases. Set the amount at $200 or more, and not only will it truly accelerate lines, but it will allow chains to justify having cashiers really look at every signature for those purchases that still require them.…
Target said Monday (Feb. 8) it will start accepting gift cards—but only its own, for now—displayed from customers’ mobile phones. The chain will redeem the cards via associates scanning the barcodes at checkout, a process that some retailers have avoided because of a high number of scanning errors.
Target issued a statement claiming that it “is the first major retailer with the ability to scan mobile barcodes in all of its stores. Guests may access their Target Mobile GiftCards to add value at store registers, and check GiftCard balances at any time via the Target.com mobile site. In addition, Target Mobile GiftCard functionality allows guests to save multiple GiftCards to their account and label each one for easy reference.” This approach may prove to be a good move for Target, but it will almost certainly give a lot of cover to executives who want to try mobile gift card scanning. Unanswerable Question Of The Day: Is it better for the associate to hold the consumer’s phone during the scan—risking liability if, for example, a high-priced iPhone is dropped and shattered—or for the consumer to hold the phone—making a consistent scan much more difficult?…
"Visa sent customized settlement information packets to the affected financial institutions on January 14, 2010. In order to accept the settlement, a financial institution was required to affirmatively complete and return the settlement paperwork to Visa by January 29, 2010," said the statement from lawyers representing some of the impacted banks. "The offers--at least those reviewed by class counsel--appeared to be less than 10 cents on the dollar for most financial institutions and some at less than 1 cent on the dollar."Read more...
Although contactless payment is going through a tough time in the U.S. these days, its global efforts got a huge boost this month. Europe’s largest chain—French grocery giant Carrefour—announced the purchase of 12,000 EMV contactless PIN pads, with immediate plans to deploy the pads “at 210 of its French hypermarkets, as well as at all of Carrefour’s petrol stations in France.” The world’s second-largest retailer’s latest contactless deployment, which started in October 2009 but wasn’t announced until last Thursday (Feb. 4), is using readers from Hypercom, the chain said. The vendor would only describe Carrefour’s investment as “multi-million dollar.”
Domestically, contactless is having problems, with Best Buy kicking out Visa’s contactless program and Discover having its own technical problems with contactless . Even many of the U.S. chains that have deployed contactless have done so very unenthusiastically, including Home Depot and Subway.
…
The smart ones—and the only vendors you should be talking to, by the way—will tell you that there is no silver bullet to make PCI go away, which is a victory for reality over marketing hype. But there is one thing you should know about reducing your PCI scope: It is pretty important. If retailers are going to get the full value for their investment in either or both of these technologies, opines PCI Columnist Walter Conway, they better look carefully at their implementation or they may find they will not get all that they paid for.Read more...
Much of this defense sentencing recommendation tries to argue down how many dollars Gonzalez' activities have lost. Federal sentencing guidelines force judges to factor in how much damage the defendant's actions have caused and use that to help calculate the length of the sentence. It starts by suggesting that TJX weathered the cyberattack remarkably well. "The government has (produced) no evidence regarding the extent to which the stolen TJX data was ever used to an individual cardholder's detriment, as opposed to simply remaining on the server," wrote Gonzalez defense attorney Martin Weinberg. "And, as to TJX, a telling (indicator) of the degree of damage it suffered is found in the fact that during one of the most devastating economic periods in the country's history, TJX's stock value rose 30 percent."Read more...
This situation involves the U.S. government's General Services Administration (GSA) and some GSA interactions enjoyed by Benjamin Moore & Co. (the paint people). The conflict cropped up when the chain was dealing with some military accounts in Hawaii. The issue comes down to needing that payment card copy in the files (tax-exempt rules) but being unable to save the copy of a Visa payment card (PCI rules).Read more...
"I typically say something like, 'It is our requirements that drive us to that price point. Adding centralized menu management, polling, integrated inventory management and labor management into the mix requires that we buy this type of system. You can’t do that stuff with a cash register or basic POS.' Typically, the response I get is something like: 'So? I don’t care about all of that complicated stuff. I just need to ring sales.' It’s no wonder franchisees think that retail CIOs are out of touch with reality. Here is the really crappy part. When you add in all of the other costs, such as high-speed broadband, hardware maintenance, software maintenance, help desk, installation, inventory management, labor management, training and various upgrades along the way, that $10,000 POS is probably going to cost franchisees $20,000 over five years--not to mention that they wrongfully expect the system to last 7 to 10 years.”Read more...
The almost daily reports of consumers and retail employees using either weak passwords or the same passwords in multiple places—or both—is being met with yawns by retail security executives. But the kneejerk response—forcing consumers and associates to be smarter about security—has had little effect, beyond being counterproductive.
For example, a company can automate rules for choosing passwords and require that they be changed periodically. But the stronger the password, the more it will fuel its own failure. Let’s say the rules require that passwords be at least 11 characters and include numerals, characters and non-traditional characters (&, %, |, @, #, ~, etc.). Add to that requirement that no character or number be repeated and that each password must pass a dictionary search. Sure, you’ll get a strong password, but you’ll also almost guarantee that that password will be written near the computer in plain sight as well as typed into a desktop file in clear text. As Newton’s IT director said, “To every password action, there is an equal and opposite stupid user reaction.” This is the topic of this week’s StorefrontBacktalk column on the McAfee security blog.…
"You will need to reconfigure your call center application to stop recording the security codes. This point is where I start to have some problems. If your application can’t do this, you need to upgrade or replace it with one that automatically interrupts recording when, for example, the payment screen is displayed. And forget about using manual interrupts, at least if I’m your QSA. In practice, they can be too easily missed, forgotten or ignored. Large retailers will make a business decision and budget for the investment. But what about smaller merchants, charities and universities with call centers?"Read more...
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
