Search

Brian Pennington

A blog about Cyber Security & Compliance

Tag

Mobile Payments

Mobile Payments Data Breaches will Grow

An ISACA survey of more than 900 cybersecurity experts shows that

  • 87% expect to see an increase in mobile payment data breaches over the next 12 months
  • 42% of respondents have used this payment method in 2015

The 2015 Mobile Payment Security Study from global cybersecurity association ISACA suggests that people who use mobile payments are unlikely to be deterred by security concerns.

Other data from the survey show that cybersecurity professionals are willing to balance benefits with perceived security risks of mobile payments:

  • 23% believe that mobile payments are secure in keeping personal information safe.
  • 47% say mobile payments are not secure and 30% are unsure.
  • At 89%, cash was deemed the most secure payment method, but only 9% prefer to use it.

Mobile payments represent the latest frontier for the ongoing choice we all make to balance security and privacy risk and convenience,” said John Pironti, CISA, CISM, CGEIT, CRISC, risk advisor with ISACA and president of IP Architects. “ISACA members, who are some of the most cyber-aware professionals in the world, are using mobile payments while simultaneously identifying and contemplating their potential security risks. This shows that fear of identity theft or a data breach is not slowing down adoption and it shouldn’t as long as risk is properly managed and effective and appropriate security features are in place

Reports say that contactless in-store payment will continue to grow. Overall, the global mobile payment transaction market, including solutions offered by Apple Pay, Google Wallet, PayPal and Venmo, will be worth an estimated US $2.8 trillion by 2020, according to Future Market Insights.

ISACA survey respondents ranked the major vulnerabilities associated with mobile payments:

  1. Use of public WiFi (26%)
  2. Lost or stolen devices (21%)
  3. Phishing/shmishing (phishing attacks via text messages) (18%
  4. Weak passwords (13%)
  5. User error (7%)
  6. There are no security vulnerabilities (0.3%)

What Consumers Need to Know

According to those surveyed, currently the most effective way to make mobile payments more secure is using two ways to authenticate their identity (66%), followed by requiring a short-term authentication code (18%). Far less popular was an option that puts the onus on the consumer installing phone-based security apps (9%).

CSX-Mobile-3-lg

People using mobile payments need to educate themselves so they are making informed choices. You need to know your options, choose an acceptable level of risk, and put a value on your personal information,” said Christos Dimitriadis, Ph.D., CISA, CISM, CRISC, international president of ISACA and group director of information security for INTRALOT. “The best tactic is awareness. Embrace and educate about new services and technologies

Understand your level of risk: Ask yourself what level of personal information and financial loss is acceptable to balance the convenience of mobile payments.

Know your options: Understand the security options available to manage your risk to an acceptable level. Using a unique passcode should be mandatory, but also look into encryption, temporary codes that expire and using multiple ways to authenticate your identity.

Value your personal information: Be aware of what information you are sharing e.g., name, birthday, national identification number, pet name, email, phone number. These pieces of information can be used by hackers to gain access to accounts. Only provide the least amount of information necessary for each transaction.

Security Governance for Retailers and Payment Providers

In the emerging mobile payment landscape, ISACA notes that there is no generally accepted understanding of which entity is responsible for keeping mobile payments secure—the consumer, the payment provider or the retailer. One approach is for businesses to use the COBIT governance framework to involve all key stakeholders in deciding on an acceptable balance of fraud rate vs. revenue. Based on that outcome, organizations should set policies and make sure that mobile payment systems adhere to them.

Members of the IT or information security group taking part in the discussion should also ensure they are keeping up to date with the latest cybersecurity developments and credentials. A joint 2015 ISACA/RSA study shows that nearly 70% of information security/information technology professionals require certification when looking for candidates to fill open security positions.

The full ISACA Press Release can be found here.

Advertisements

Cloud, Contactless, e-Commerce, Tokenization and V.me surging forward

VISA Europe has issued it’s Annual Report for 2014

The headline numbers from 2014

  • Visa accounts 509m
  • Point-of-sale spending €1.417tr
  • Point-of-sale growth 8.7%
  • Clearing & settlement transactions processed €16.1bn

Visa Europe is a payments business. Our company is owned by some 3,078 banks and payment providers from 37 European countries. Together, we are making payments faster, more convenient and more secure than ever before

A highlight for 2014 was the surge in contactless

Across Europe, more than 100 million Visa cards are contactless, as are 1.8 million Visa terminals. Hundreds of big-name merchants are rolling-out contactless and annual transaction volumes exceeded 460 million which is 263% higher than the previous year and the value of those transactions is 283% higher than the previous year.

The very same terminals can be used for Visa contactless mobile payments – like Apple Pay and its Android smartphone equivalents.

V.me by Visa takes off across Europe

V.me by Visa is the new digital wallet solution from Visa Europe, which brings more speed and simplicity to online payments.

From its initial launch markets of France, Poland, Spain and the UK, V.me by Visa will expand to Germany, Ireland, Italy, Norway and Sweden by the end of the 2015. Pilots will also be launched in the Czech Republic, Greece and Slovakia in 2015, taking the total number of countries offering the service to 12.

e-commerce spending continues to escalate

Today, e-commerce accounts for €1 in every €5.26 of spending on European Visa cards. This equates to 19% of our transaction volumes. Growth remains strong across all European countries.

Cloud-based payments

Visa’s Cloud-based Payments programme is now live for contactless payment services on Android smartphones. Members in ten markets are already bringing Visa Cloud-based Payment services to market, reporting a number of early successes, with further launches to be announced during 2015.

Tokenisation – our vision

Payment Tokenisation will act as a platform for innovation to help the development of scalable payment services via a variety of mobile technologies. Reducing the cost and complexity to deliver new and innovative services to cardholders will be a key benefit. Payment Tokens will also improve the security of digital payments.

The full report can be found here.

Guidance for merchants on how to securely accept mobile payments the PCI way

This has been coming for a while but finally the PCI SSC has published a fact sheet outlining how merchants can securely accept payments using mobile devices such as smartphones or tablets.

The “At a Glance: Mobile Payment Acceptance Security fact sheet” provides merchants with actionable recommendations on partnering with a Point-to-Point Encryption (P2PE) solution provider to securely accept payments and meet their PCI DSS compliance obligations.The ability to use smartphones and tablets as point-of-sale terminals to accept payments in place of traditional hardware terminals offers great flexibility. As mobile technology continues to change at a rapid pace, the Council continues to work with the industry to ensure data security remains at the forefront of mobile evolution.

This latest educational resource is the product of the Council’s Mobile Working Group and is the result of valuable input from leading merchants, vendors and organizations actively involved in the mobile payment acceptance industry. The document helps clarify and distill some of the more complex technology and security terminology into straightforward, practical guidance that can help merchants to:

  • Better understand their responsibilities under PCI DSS, and how they translate to mobile payment acceptance
  • Leverage the benefits of the Council’s recently published Point-to-Point Encryption (P2PE) standard and program
  • Choose a mobile payment acceptance solution that complements the merchant’s PCI DSS responsibilities, for example a P2PE solution provider

Using this resource to guide them in how PIN Transaction Security (PTS) and P2PE standards work together, merchants can better understand how to securely use external plug-in devices with smartphones or tablets to accept payment cards by first encrypting and securing the data at the point that the account data is captured. The smartphone or tablet has no ability to decrypt the data, thus simplifying PCI DSS scope for the merchant.

“We know merchants are eager to take advantage of their existing smartphones or tablets to accept payment cards,” said Bob Russo, general manager, PCI Security Standards Council. “And the Council and its stakeholders want to help the market to do this in a secure way. We’re excited about this easy-to-use reference that will help merchants understand how to use the suite of PCI Standards to enable their businesses while still keeping data security top of mind.”

As with all SSC fact sheets, this guidance does not replace or supersede any of the PCI Standards

The Council continues to work with the payments community to address mobile payment acceptance security and evaluate whether additional requirements are needed in this area. As part of this ongoing initiative, the Council plans to publish best practices for securing mobile transactions later this year.

“The PTS and P2PE standards are being leveraged by mobile solution providers today. With this fact sheet we hope to help merchants understand how these standards work and the options that are available to them for accepting mobile payments in a secure and PCI DSS compliant manner,” said Troy Leach, chief technology officer, PCI SSC.

The link to the At a Glance: Mobile Payment Acceptance Security fact sheet is here.

Create a free website or blog at WordPress.com.

Up ↑

%d bloggers like this: