Search

Brian Pennington

A blog about Cyber Security & Compliance

Tag

VISA EUROPE

Cloud, Contactless, e-Commerce, Tokenization and V.me surging forward

VISA Europe has issued it’s Annual Report for 2014

The headline numbers from 2014

  • Visa accounts 509m
  • Point-of-sale spending €1.417tr
  • Point-of-sale growth 8.7%
  • Clearing & settlement transactions processed €16.1bn

Visa Europe is a payments business. Our company is owned by some 3,078 banks and payment providers from 37 European countries. Together, we are making payments faster, more convenient and more secure than ever before

A highlight for 2014 was the surge in contactless

Across Europe, more than 100 million Visa cards are contactless, as are 1.8 million Visa terminals. Hundreds of big-name merchants are rolling-out contactless and annual transaction volumes exceeded 460 million which is 263% higher than the previous year and the value of those transactions is 283% higher than the previous year.

The very same terminals can be used for Visa contactless mobile payments – like Apple Pay and its Android smartphone equivalents.

V.me by Visa takes off across Europe

V.me by Visa is the new digital wallet solution from Visa Europe, which brings more speed and simplicity to online payments.

From its initial launch markets of France, Poland, Spain and the UK, V.me by Visa will expand to Germany, Ireland, Italy, Norway and Sweden by the end of the 2015. Pilots will also be launched in the Czech Republic, Greece and Slovakia in 2015, taking the total number of countries offering the service to 12.

e-commerce spending continues to escalate

Today, e-commerce accounts for €1 in every €5.26 of spending on European Visa cards. This equates to 19% of our transaction volumes. Growth remains strong across all European countries.

Cloud-based payments

Visa’s Cloud-based Payments programme is now live for contactless payment services on Android smartphones. Members in ten markets are already bringing Visa Cloud-based Payment services to market, reporting a number of early successes, with further launches to be announced during 2015.

Tokenisation – our vision

Payment Tokenisation will act as a platform for innovation to help the development of scalable payment services via a variety of mobile technologies. Reducing the cost and complexity to deliver new and innovative services to cardholders will be a key benefit. Payment Tokens will also improve the security of digital payments.

The full report can be found here.

Advertisements

P2Pe, Pseudo-P2Pe, End-2-End Encryption, Linked Encryption, they are all good

This week’s Vendorcom Secure Payments Special Interest Group (SIG) met to discuss P2Pe and it became clear that there are many ways to achieve a compliant outcome.

My first impression was the large number of attendees at the SIG, 50+, only one of them was a Merchant. The rest were a mixed bag of Acquirers, PSPs, QSAs, Vendors and Consultants making it more of a Vested Interest Group than a Special one.

The Logic Group (TLG) started the presentations and covered their listed P2Pe solutions and how they achieved compliance. They explained all the hard work getting all the elements through the audits and the 970 P2Pe Controls (more than double that of PCI DSS).

TLG cited the issues of key custody and management and how once during the development period it required 6 people to cover the physical as well as the logical security requirements.

The Q&A session before lunch was mostly aimed at John Elliot of VISA Europe who handled even the most difficult questions very well and delivered the answers with humour. He even confirmed that next week there is a gathering in the US to ratify the much discussed Tokenization standard and some clarifications to the PCI DSS version 3.0. He however was wrong on one prediction that the new Self Assessment Questionnaires (SAQ) would be out on Thursday and they weren’t but to be fair to John almost everyone associated with PCI has tried to predict the arrival of the new SAQs and got it wrong. They finally came out today (28th February 2014).

After lunch Spire Payments and MagTek presented on their device solutions and their compatibility with the PCI PTS SRED and how they could fit into a P2Pe compliant solution.

Next up were Vodat International with their alternative to P2Pe. The Vodat solution is a managed end to end solution with encryption and resilience. Ian Martin’s presentation was supported by VISA Europe as a way to achieve PCI DSS compliance.

Some other discussion point

  • Linked Encryption combined with EMV could make a significant security improvement for the US market
  • Some merchants think switching to Ingenico gives them P2Pe
  • Some merchants and the PCI SSC are concerned that there are only two listed P2Pe solutions
  • PCI SSC would like to make P2Pe modular e.g. if you want to do your own key management or choose your own PEDs, etc.
  • An April deadline for moving to TLS 1.1 or above is not true, maintaining secure software is always required.
  • All mobile payments are mandated to have P2Pe
  • P2Pe will probably never be mandatory, except for mobile
  • If you have a certified P2Pe solution you can complete an SAQ no matter what size of merchant you are

It was an interesting day and after all the presentations and discussions what became clear is there are many ways to achieve PCI DSS compliance; Point to Point Encryption (P2Pe), Pseudo-P2Pe, End-2-End Encryption and Linked Encryption or a combination of them.

What is not in doubt is the chosen solutions must meet the business profile of the merchant and help them achieve PCI DSS compliance. The solution itself will not achieve compliance because there is more to compliance than installing a solution for example there is the on going maintenance of compliance and the human element.

Whichever solution you represent or are looking to buy lets hope it is installed and maintained well enough to meet and maintain continuous security and PCI DSS compliance.

Blog at WordPress.com.

Up ↑

%d bloggers like this: