Lead Story
QSGS
News
Bob Carr takes the encryption lead at IAPP
PCI SSC broaches possible changes
Aite identifies industry challenges
BofA, First Data give birth to BAMS
Features
GS Advisory Board:
Vertical market virtues - Part I
Selling Prepaid
Gift card legal perils - Part 1
Views
Where there's avarice, there should be ire
Hard-to-place merchants:
An untapped opportunity
Pulling the PIN on older systems
Education
Street SmartsSM:
Independents Day
Target portfolios for increased profits, merchant retention
Company Profile
checXchange Money Transfer Systems Inc.
New Products
Inspiration
Miscellaneous
The promise of community banks
Departments
July 13, 2009 • Issue 09:07:01
Pulling the PIN on older systems
he compliance clock is ticking. It is estimated that more than 500,000 PIN entry devices (PEDs) that predate security certifications are in use in the U.S. market. These devices predate the Visa Inc. PED standard - now the Payment Card Industry (PCI) PED Standard - and were "never approved" by the card brands, which have mandated they must be removed from service by July 2010. Are you ready for that challenge and opportunity?
Liability landing
Criminals are increasingly targeting older, unsecure PIN pads and terminals as a relatively easy means to gain access to cardholder data. The liability for these attacks is being placed with greater frequency squarely at the feet of merchants and acquirers.
The 2009 Verizon Business Data Breach Investigations Report examined 98 confirmed data breaches that compromised almost 300 million consumer records. Of the organizations victimized, 81 percent were not PCI Data Security Standard compliant, according to Verizon Business.
PINs beguiling
While many of these breaches had nothing to do with PIN pad compromises, obtaining PINs by exploiting vulnerable elements of computer networks is now the primary game in town for a number of criminal organizations.
Offending breaches range from highly sophisticated computer networking assaults to crude efforts that might be equated to "smash and grab" attacks in which criminals simply replace an existing terminal with a device that appears identical but has been bugged.
For example, according to The News Journal of Delaware, two men pled guilty in February 2009 to using a skimmer at the counter of a Rite Aid Corp. store to scoop up account numbers and PINs and use them to make counterfeit cards, with which they stole more than $500,000 from bank accounts.
Standards strengthening
The payments industry has long recognized the need to stay ahead of scofflaws by requiring ever more secure procedures and devices to protect PINs, making it difficult to tamper with devices and ensuring merchants and acquirers are quickly alerted to tampering when it occurs.
In 2004, Visa mandated that new installations connecting to its payment network be certified as meeting a series of requirements it had set forth for PEDs - which became known as the Visa PED standard.
Later in 2004, Visa and MasterCard Worldwide agreed to align their separate PED requirements into an industrywide standard, which subsequently became known as the PCI PED standard.
In 2006, the PCI Security Standards Council (SSC) was formed by the major card brands to oversee security standards; in April 2007, Visa, MasterCard and JCB International Co. Ltd. formally transferred responsibility for PCI PED to the council, providing a more formal structure for future development of PED requirements.
Confusion clearing
The evolution of PED standards has been a source of confusion to merchants, and to enhance understanding of these standards and their impact, it is helpful to categorize PEDs into three classes:
Prior to 2004, PEDs were governed by minimal standards. Generally, the only things required were protection of the master keys and key encryption schemes, as well as proper software operation of the devices. Validation of software requirements and tamper prevention and detection were left to individual manufacturers.
As stated in the preceding numbered points, the card brands mandated that, as of Dec. 31, 2007, acquirers and merchants deploy PCI PED-approved devices only.
And they set July 1, 2010, as the date by which unapproved devices must be removed from service. No such sunset date has been set for pre-PCI devices, although they can no longer be installed except as replacements for PIN pads that are already in place.
Sanctions coming
Although Visa has indicated it won't strictly enforce penalties against noncompliant organizations until 2012, acquirers have the ability to penalize merchants once the July 1, 2010, cutoff arrives.
There are several reasons to take this seriously and not postpone helping merchants replace devices that are now or soon will be obsolete:
Opportunities rising
Many merchants are unaware of or confused about target dates for implementation of PCI PED-approved devices. Many may be tempted to put off PIN pad upgrades to some future time.
Educating them on the facts behind the compliance effort and the perils of delay presents a great opportunity to up-sell with new technologies such as Internet protocol and wireless, as well as value-added applications to which newer systems are better suited.
Scott Henry is Director, North America Product Marketing, for VeriFone. He can be contacted at scott_henry@verifone.com.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.
Back to Top