In order to be PCI compliant, all acquirers, merchants and third parties using a card association’s payment system must not only abide by the PCI DSS requirements but also that association’s guidelines.  For example, any organization using Visa’s payment system (i.e. any organization which receives, processes or passes Visa branded cardholder information) must abide by Visa’s International Operating Guidelines.  Failure to comply can result in monetary fines and possible disqualification or merchant account termination.

Association compliance for merchants is based on levels of validation for each card association.  Visa, MasterCard, and Discover each have four levels of validation for merchants.  American Express has three levels and JCB has two levels.  Each level is based on annual transaction volume with Level 1 being the highest.  It is the responsibility of the merchant to check the criteria for each card brand it accepts and adhere to the validation requirements for the appropriate level in which it falls.

NOTE: MasterCard made some changes to their security program recently, whereby a merchant falls into a certain level based on its level with Visa.  So, if a merchant processes over 6 million Visa transactions (Level 1), but only 2 milllion with MasterCard (Level 2), it would be a Level 1 merchant with both associations.

Non-Compliant Activities

So, what type of activity can result in a fine or merchant termination?  Basically, two words – non-compliance.  Credit card compliance covers PCI DSS and card association guidelines.  Any activity violating those can result in fines, being put on MATCH or account termination.

Using Visa as an example again, per their operating guidelines, if Visa determines that a member, its agent, or a merchant has been deficient or negligent in securely maintaining the account or transaction information or reporting or investigating the loss of this information as specified in this section, Visa may fine the member, as specified in Section 1.6.D, or require the member to take immediate corrective action.  Visa members are financial institutions who issue and maintain account information (i.e. acquirers).

“Repetitive violations can incur heavier fines, possible listing on MATCH or account termination.”

Visa’s operating guidelines define the reason for terminating a merchant account (aka, Revocation of Privileges):

Visa may permanently prohibit a Merchant, IPSP, or any other entity, or one of its principals, from participating in the Visa or Visa Electron Program for any reasons it deems appropriate, such as:

• Fraudulent activity
• Presenting Transaction Receipts that do not result from an act between the Cardholder and the Merchant (laundering)
• Activity that causes the Acquirer to repeatedly violate the Visa International Operating Regulations
• Activity that has resulted in a Regional Office prohibiting the Merchant from participating in the Visa or Visa Electron Program
• Any other activity that may result in undue economic hardship or damage to the goodwill of the Visa system

Similarly, MasterCard’s rules state that failure by a Merchant or Acquirer or both to comply with any Standard may result in chargebacks, an assessment to the Acquirer, and/or other disciplinary action.

Repetitive violations can incur heavier fines, possible listing on MATCH or account termination.  Associations will also continue to levy fines if the merchant does not correct the action deemed as non-compliant.  Any fines from the card associations related to merchant activities will be passed down to the merchants.  If a merchant does not take correction action or neglects to pay the acquirer, the merchant account is at threat of being terminated and listed on MATCH.

Be Careful Using Third-Party Service Providers

Using third party vendors can certainly streamline your business operations and credit card sales.  However, they can also hurt your business if they are not compliant with industry guidelines.  Aside from any possible data breach, simply using a non-compliant vendor can result in fines from the associations as well.  Third party service providers include payment gateway, web hosting, or backup storage services.

There are many reasons to use a PCI compliant vendor – aside from following PCI compliance guidelines, using a compliant vendor helps to protect your customer records, which should be the number one priority.

According to PCI guidelines, merchants are required to verify service provider compliance.  The PCI DSS requirement 12.8 (outlined below) requires a merchant to “manage” any service providers:

12.8.1 Maintain a list of service providers.

12.8.2 Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess.

12.8.3 Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.

12.8.4 Maintain a program to monitor service providers’ PCI DSS compliance status.

To assist with compliance on this level, the PCI SSC adopted the Payment Application Data Security Standard (PA-DSS), formerly managed by Visa as the Payment Application Best Practices (PABP), for software vendors or other companies who develop secure payment applications.  A list of validated payment applications is available on the PCI SSC web site.  Each payment application on the list is valid for one year, so application vendors and developers need to go through similar annual reviews and due diligence as required by the PCI DSS for organizations.

Additionally, card companies have put requirements into place regarding service provider compliance.  Visa, for example, stipulates that issuers and acquirers must use, and are responsible for ensuring that their merchants use, service providers that are compliant with the PCI Data Security Standard (DSS). Although there may not be a direct contractual relationship between merchant service providers and acquirers, Visa issuers and acquirers are responsible for any liability that may occur as a result of non-compliance.

Service providers must register with Visa in order to be included on their list of PCI DSS-compliant service providers.  Visa defines two levels (based on volume) of compliance for service providers.  Visa defines service providers as TPAs (Third Party Agents), which are entities that provide payment-related services, directly or indirectly, to a Visa client and / or stores, processes or transmits Visa account numbers. TPAs include Independent Sales Organizations (ISOs), Third Party Servicers (TPSs), Encryption and Support Organizations (ESOs) and Merchant Servicers (MSs).  TPAs must be registered in Visa’s Agent Registration Program, mandated by Visa to “ensure that Visa clients are in compliance with Visa Inc. Operating Regulations (“Visa rules”) and policies regarding their use of TPAs.”  Only Visa clients (i.e. acquirers) can register TPAs and are thus responsible and liable for their TPAs.  POS software providers that provide the payment application only and do not store, process and / or transmit Visa account numbers also need to adhere to the PA-DSS.  Fines from Visa include $10,000 for using an unregistered TPA.

Under its SDP program, MasterCard also requires third party service providers to follow compliance guidelines.  It defines service providers as a collective term for Third Party Processors (TPPs) and Data Storage Entities (DSEs).  It also defines two service provider levels for compliance.

PCI compliance for service providers includes onsite assessments, self-assessment questionnaires, and network security scanning.  Summed up by MasterCard, the compliance process for its service providers is a 3 step process:

1. Review the relevant PCI documentation, validation tools and procedures
2. Engage an approved vendor, as appropriate, and follow the validation procedures
3. Once compliant, work with a qualified security assessor to send a Certificate of Validation to MasterCard

In all cases with service provider compliance, PCI SSC Qualified Security Assessors and Approved Scanning Vendors must be used.  For a merchant to ensure complete compliance across the board, it is necessary for its service provider(s) to be on all relevant compliance lists.

View Visa’s current list (as of March 6) of PCI DSS Validated Service Providers here.

View MasterCard’s list of compliant service providers here.

Using a third-party vendor or company in the processing of credit cards does not exclude a merchant from PCI compliance responsibility.  The merchant is still responsible for data security and abiding by PCI compliance rules and the operating guidelines of the card brands.  Issuers and acquirers are also responsible for any liability that may occur as a result of non-compliance.

How Merchants Can Avoid Fines and Account Termination

Before account termination or being put on MATCH, a merchant may be warned and fined for non-compliance for risky activities, such as excessive chargeback ratios or not following PCI DSS.  That is a warning which should not be taken lightly by any merchant.  Corrections for any non-compliance should be fixed immediately.  If a data breach has occurred, it is the merchant’s responsibility to report it as soon as it is discovered.

Using a third-party vendor or company in the processing of credit cards does not exclude a merchant from PCI compliance responsibility.  The merchant is still responsible for data security and abiding by PCI compliance rules and the operating guidelines of the card brands.  Merchants are responsible for reading and understanding the card association guidelines in their entirety for each card type they accept.  Merchants should also use a payment processor who explains compliance and helps avoid fines by keeping an eye on chargeback ratios and understanding their third-party vendors.  Of all the parties (with the exception of the customer) involved the payment transaction process, the merchant is the one who loses out the most if data security is compromised or the merchant account is terminated.  Merchants can prioritize compliance by assigning a security officer – or other responsible party – to ensure that all necessary compliance requirements are being met.  This includes making sure service providers are consistently compliant as well.

Reference documents

Card association operating guidelines

MasterCard

Visa

American Express

Guidelines for Discover and JCB are not available online.  Merchants can obtain them from the card associations directly.

Card association requirements for merchant compliance

Visa Cardholder Information Security Program for Merchants

MasterCard Merchant Requirements

Discover Information & Security Compliance

American Express

JCB Data Security Program

The Importance of PCI Compliance

According to Privacy Rights Clearinghouse.org, more than 346 million records with sensitive information have been breached since January 2005.  According to the Ponemon Institute’s annual study, the cost of a data breach was $204 per compromised customer record for 2009.  The data, obtained from 45 companies that publicly acknowledged – and were willing to discuss – a breach of sensitive customer information.  The study also revealed that the average total cost of a data breach was $6.75 million in 2009.

Most laws involving credit card fraud and data security breaches target the criminals who conduct the breaches and obtain the card data.  Although, state attorney offices have investigated and filed suits against companies who were found to be non-compliant during a data breach.  In an effort to stay ahead of the curve, the only way the card associations are able to enforce the security standards is to penalize those who do not comply and/or jeopardize data protection.

The Payment Card Industry Data Security Standard (PCI DSS) applies to any organization or merchant that accepts, transmits or stores any cardholder data.  The PCI DSS was created in 2004 by the PCI Security Standards Council (SSC), which include the major card brands – otherwise known as associations – American Express, Discover, JCB, MasterCard, and Visa.  Each card association stipulates that the PCI DSS, in addition to the individual association guidelines, must be followed in order to be fully compliant.  Achieving PCI compliance means that you have met the technical requirements of the PCI DSS.

Consequences of Non-Compliance

Non-compliance can result in fines or other actions by the card associations.  Even though the PCI SSC managed the PCI DSS, any fines levied for non-compliance are done so by the card associations, not by the security council.  The card associations usually fine the acquirer under which the non-compliant merchant processes transactions.  The acquirer then passes the fine onto the merchant, ISO or third-party.  However, a merchant can be fined or terminated directly by the card association.

“T.J. Maxx agreed to pay as much as $40.9 million in a settlement with Visa.”

The amount of the fines and fees are dependent upon the type of activity.  A breach of data would cost a merchant a lot more than if they were discovered to be non-compliant with no data breach.  For example, in the largest data breach thus far, T.J. Maxx (TJX) agreed in November, 2007, to pay as much as $40.9 million in a settlement with Visa and the bank that processes the company’s credit card payments, as a result of a massive data breach, discovered in 2006, of TJX’s customer records.  (TJX admitted to 45.7 million compromised records, but court filings by the banks suing TJX estimate that about 100 million cards were affected.)  The settlement funds were reported to be used to help the U.S. credit card issuers (i.e. banks) recover costs related to the breach.  Last year, they agreed to pay $9.75 million to settle investigations by 41 state attorney generals.  That settlement was the sixth one that TJX announced regarding the breach.  Visa originally fined Fifth Third, TJX’s acquiring bank, close to $900,000 for non-compliance.  $500,000 was assessed “due to the seriousness of this security incident and the impact on the Visa system,” according to a Boston Globe report. $380,000 was assessed for “TJX’s failure to cease storing prohibited data.”

Visa announced, following the TJX breach, that it began fining level one merchants (6M + transactions annually) $25,000 per month if they fail to comply with the PCI DSS.  Although this information is relative to the largest data breach in U.S. history, merchants of every level should take these actions very seriously to avoid risking loss of data, not to mention customer confidence.

How Does Account Termination Affect A Merchant?

So, your processor terminated your account.  You may ask, “What’s the big deal?  I will just get a new merchant account elsewhere.”  Well, it’s not as easy as it sounds.  A merchant who has been terminated is put on MATCH, more or less known as a blacklist in the credit card processing industry.  Formerly known as the TMF (Terminated Match File), the MATCH (Member Alert to Control High-Risk) list is a file of merchants who have been terminated for “cause”.  Reasons include activities such as fraud or excessive chargebacks.  (See a previous blog on this subject here.)  The list is used primarily by acquirers to assess the risk of a business when it applies for a merchant account.  It is tied to MasterCard and Visa, so all acquirers check the MATCH file against any new merchants who apply for an account.  (It’s rare, with the exception of Costco for instance, for a merchant to accept other cards but not MasterCard and Visa.)  A MATCH listing includes the company name and principal names of the company, but a company’s inclusion on the list does not mean it, or its principals, would be prohibited from obtaining a merchant account again.  Acquirers use the MATCH file as an informational tool and will usually base a merchant application approval or denial on a complete investigation.  Once a merchant is on the MATCH list, it is almost impossible for them to removed, but it can be done.

Stay tuned for Part II, which will discuss who is really responsible for PCI compliance, working with third party service providers and how to avoid fines, MATCH and account termination.

“….the algorithm used to encrypt GSM phones is over 20 years old.”

Mobile payments are a hot topic, particularly for companies and merchants targeting the unbanked – or underbanked – segment.  Research by Mercator Advisory Group shows that 68% of consumer payments (by dollar volume) will be electronic-based in 2012.  The group estimates that volume to be 75% by 2017.  Electronic payments offer huge cost savings for merchants, as well as financial institutions.  Consumers are demanding more ways to operate remotely as well as easy ways to make payments.  It’s a win-win for both sides.  However, the fraud issue cannot be ignored.  Since smartphone technology is fairly new, few anti-fraud tools have been developed and even fewer have been deployed.

As smartphones provide access to more sensitive data each year, the need for security is of monumental importance.  There is some protection available for mobile phones, such as McAfee’s VirusScan Mobile (for Windows Mobile phones) and the VeriSign(R) Identity Protection Access for Mobile.  While these programs protect the phone against viruses, worms, spyware and malware, they do not encrypt data being sent or received.  However, VeriSign’s application does use a two-factor authentication tool and iPhones are equipped with Remote Wipe, which can erase the phone’s data remotely, should the phone be lost or stolen.

There are varying levels of security issues, depending on the type of mobile payment (mobile web site, contactless, SMS, etc).  Vulnerabilities of standards, infrastructures, platforms, and technologies (i.e. GSM, NFC, SMS, Bluetooth, RFID, mobile applications, etc.) pose a complicated issue for researchers to develop protections against secure data loss.  Mobile malware and spyware, Trojans, phishing attacks and third party applications add even more threats.

The future of mobile payments, tagged sometimes as ‘m-payments’, would have credit card data embedded on the SIM card or on a chip in the phone.  (Fingerprint scanning is envisioned further into the future.)  Remote access to the phone and its payment applications would be necessary should the phone be lost or stolen.  This would require agreements between carriers, equipment manufacturers and financial institutions.  Additionally, organizations that deal with sensitive data (i.e. financial, medical, personal identification) would still have to comply with various regulatory requirements (such as HIPAA and SEC) for protecting data.

A new industry consortium, the Financial Services Technology Consortium (FSTC), formed in 2009, is tasked with developing standards for secure mobile payment transactions, regardless of the device or carrier.  Jim Pitts, managing executive of the FSTC’s Payments Standing Committee (Payments SCOM), stated that the standards may also recommend that individuals be authenticated before making a purchase.  Standards will likely include the use of a SIM card or data chip to authenticate the device and authorize the payment.  Due to various technologies and products in use today, the costs required by all parties will likely cause delays in the standards being accepted as well as compliant products and services being deployed.

In the UK, the migration to EMV technology has reduced fraud in face-to-face transactions since EMV adoption in 2003.  The EMV standard operates with EMV-compliant cards (which have embedded chips instead of magnetic stripes) and EMV-compliant POS terminals.  The chips require a PIN entry for a secure EMV transaction.  The acronym EMV is derived from the initial letters of Europay, MasterCard, and Visa, all of whom cooperated to create the technology standard.  MasterCard merged with Europay in 2002.  JCB and American Express have since joined the organization as well.

EMV is a perfect example of two-factor authentication, where two different factors are required to complete a transaction, and has been referenced as a key solution for secure, fraud-resistant transactions.   There is a strong push for EMV abroad and to encourage merchant acceptance, merchants are held responsible for fraud resulting from any non-EMV transactions.  As more countries adopt EMV technology, they are also banning signature transactions.  Australia will ban signatures by 2013.  Canada will not accept magnetic stripe transactions after 2015.  These added security layers will push payment card thieves to focus on easier targets, such as the U.S.  EMV employed as the only method for secure face-to-face transactions abroad is also altering how U.S. cardholders are conducting (or abandoning) transactions in these countries.  This could result in lost revenue for international merchants and will hopefully put the pressure on issuers and merchants in the U.S. to adopt EMV.

“Australia will ban signatures by 2013.  Canada will not accept magnetic stripe transactions after 2015.”

Ecommerce Data Protection

According to the U.S. Census Bureau, ecommerce sales in 3Q 2009 were estimated at $32 billion, 3.7 percent of total retail sales – an increase of approximately 2.1 percent from 3Q 2008 while total sales decreased in the same period.  Visa, MasterCard and JCB already have 3-D Secure protocols in place for online purchases.  Verified by Visa, MasterCard SecureCode and J/Secure (JCB) all require the cardholder to enter a password or unique ID to complete a transaction.  Cardholders must register with the programs for the extra layer of security to be added during a transaction.  Unfortunately, these programs have not been well received or implemented due to added costs to the merchant and low acceptance from cardholders.  In response – and to support EMV online – MasterCard has developed their Chip Authentication Program (CAP) and Visa has created their Dynamic Password Authentication (DPA), a different version of CAP.  To date, deployment has been minimal.  Last week, ArcotOPT was announced as the first solution using CAP on mobile phones for ecommerce and online banking.  Although the company, Arcot, is based in California, the product was released in Europe where EMV has a strong presence. We are not likely to see deployment in the U.S. until EMV takes hold here.

Going Contactless

As contactless card adoption grows (mostly in the small ticket market – fast food, convenience stores, etc.), so does the acceptance of the added security already in place.  Contactless cards include a unique CVV for each transaction.  If thieves were to obtain the payment card data from a transaction, the CVV could not be used for another transaction.  Additionally, contactless payments do not transmit the cardholder’s name and some also do not include the account number.  MasterCard teamed up recently with RIM to deploy MasterCard PayPass contactless stickers on Blackberry phones.  After each PayPass transaction, a confirmation email with the transaction information is sent to the Blackberry phone. Verifone has combined its end-to-end encryption solution, VeriShield, with EMV to support contactless payments beginning this spring in the UK and a few other regions.  End-to-end encryption does not supply any usable cardholder data to a merchant’s POS device or network, thereby reducing fraud risk.

How About Mobile Shopping?

Smartphone technology, not to mention the iPhone, has significantly increased the interest in mobile payments.  Presently, contactless stickers can easily satisfy this demand (as mentioned above with MasterCard and RIM).  Some major card companies have also tested near field communication (NFC) as a contactless payment option. NFC is a short-range wireless technology which enables the exchange of data.  Payments using NFC also require a PIN to complete the transaction.

It is apparent that various options for added payment security are already available. As to why these new security options are not yet deployed in the U.S. rests on the concern for cost and revenue stream.  Mobile carriers want a piece of the pie when transactions are made using devices over their networks, thereby slowing the adoption in carrier channels.  EMV would certainly incur costs for merchants (new POS devices) and card issuers (new cards with chip technology).  Despite these new security protocols, a strong fraud risk still exists with merchants, processors and companies storing sensitive data (against PCI compliance), as well as physical cards being cloned or skimmed.  Costs associated with fraud in the U.S. today are written off as a cost of doing business. Pending government legislation, card association guidelines and PCI compliance appear to be the only factors pushing for faster adoption of stronger security measures.