iPhone credit card swipe war heats up

By Jessica Bruder, contributing writerFebruary 9, 2010 - CNNMoney.com

NEW YORK (CNNMoney.com) -- What if your iPhone took plastic? Imagine if your business could use it as a mobile credit card processor, a swipe-and-go system for ringing up payments wherever you roam.

Three rival companies are placing heavy bets on that vision, bringing to market three different magnetic stripe readers this year for use with Apple's (AAPL, Fortune 500) iPhone and iPod Touch. They're battling each other for the hearts -- and wallets -- of mobile merchants, promising an improvement over the clunky, hardwired credit card terminals that have been a staple of brick-and-mortar commerce for decades.

"Our only concern is that we're not able to get this into people's hands fast enough," says Twitter co-founder and chairman Jack Dorsey, who unveiled his new startup, Square, in December. Dorsey says the company will release its tiny, square-shaped credit card readers -- each roughly the size of a quarter -- early this summer. (more)

G&D, ARM Partner to Protect Mobile Applications from Data Theft

ARM and Giesecke & Devrient (G&D) have announced a strategic partnership for the development of highly secure mobile phone platforms. According to the two companies, "through the combination of ARM TrustZone technology, which creates a protected area in advanced systems-on-chip, and the highly secure Mobicore operating system developed by G&D, sensitive applications such as electronic payment and online banking via mobile phone will be efficiently protected from security threats. As a first step the two companies will develop a joint prototype."

“ARM TrustZone technology is already an integral part of the ARM Cortex™-A series processors which are currently being deployed in smartphones by many of the industry’s leading handset manufacturers”

“We will be working with ARM to develop the security architecture for the next generation of mobile phones. This will enable people to access highly valuable services with convenience and security,” explains Dr. Kai Grassie, head of the new business division at G&D. (more)

Are chip and PIN credit cards coming?

By Claes Bell • Bankrate.com

The U.K. is all abuzz about "chip and PIN," but it's not a popular pub snack or a nickname for the newest celebrity power couple. It's the credit card security system rolled out in recent years to stem a wave of credit card crime.

Chip and PIN replaces the credit card system we're used to -- swiping a magnetic strip and signing a receipt -- with a new generation of card readers that scan a tiny chip activated by a personal identification number, or PIN.

Yet in the United States, no one is rushing to adopt chip and PIN. The cost of new card readers, liability for fraud loss, and criminals already working around the system all figure into the reluctance to bring it to American cardholders.

Crime stopper?
The chip and PIN system is designed to make it more difficult for criminals to cash in on credit card fraud. The magnetic strip system used in the United States only requires a signature to authenticate a purchase. This allows criminals who get their hands on victims' credit cards to start making purchases immediately, potentially charging up thousands of dollars before the card is canceled. More enterprising thieves can also use information gained by Internet hacking or skimming -- secretly swiping a victim's card on a card reader -- to "clone" copies of victims' cards. (more)

VeriFone Holdings has announced that it is shipping its PAYware Mobile secure credit card encryption sleeve for iPhone and that the complementary PAYware Mobile app is now available on the App Store.

PaymentsNews.com - February 1, 2010

VeriFone Holdings has announced that it is shipping its PAYware Mobile secure credit card encryption sleeve for iPhone and that the complementary PAYware Mobile app is now available on the App Store.

According to VeriFone, "PAYware Mobile provides small businesses with simple and secure card processing capabilities using the revolutionary iPhone. The app and patent-pending card encryption technology are provided free in conjunction with a low cost PAYware gateway services agreement."
(more)

Study: Of All Breaches, Those Caused by Hacking Are the Costliest

January 27, 2010) The cost of data breaches rose slightly last year, but breaches resulting from computer hacking incurred by far the highest losses, according to a new report from privacy and data-security research firm Ponemon Institute LLC.

The average cost per compromised customer record rose to $204 in 2009 from $202 in 2008 and $138 as recently as 2005, according to Traverse City, Mich.-based Ponemon’s “2009 Annual Study: Cost of a Data Breach.” Some 24% of breaches were caused by placement of so-called malware or botnets or related criminal attacks on computer systems, double the 12% rate for such attacks in 2008. Forty percent of 2009’s breaches resulted from negligence, and 36% come from system glitches, according to the study.

The study, sponsored by Menlo Park, Calif.-based data-protection technology provider PGP Corp., is based on the actual breach experiences of 45 companies in 15 industry sectors. The firms agreed to complete detailed surveys about their breaches, including discovery, response, and effects on their businesses. Respondents included eight financial firms, eight retailers, five services firms, and four technology companies. None was identified specifically. Breaches affected 5,000 to more than 101,000 records. Forty-two percent of the breaches in the 2009 study involved mistakes by outsourcers. (more)

Calif. officials probe credit card interchange fees

BY CHRIS RIZO - WEDNESDAY, JANUARY 27, 2010 - LegalNewsline.com

SACRAMENTO, Calif. (Legal Newsline)-California officials, under the leadership of a Democrat running for state attorney general, are probing rising credit card interchange fees.

State Assemblyman Pedro Nava, D-Santa Barbara, and the Assembly Banking and Finance Committee he leads is investigating interchange fees that credit card companies charge businesses and consumers in the course of transactions.

The credit card industry collects about $5 billion from credit- and debit-card fees charged in California. Most of the interchange fees in the state are collected by Visa Inc. and MasterCard Inc. (more)

Store-Card Regulations Not as Tough as Feared

American Banker | Tuesday, January 26, 2010

By Maria Aspan

Store cards have dodged a bullet.

The Federal Reserve Board's latest round of credit card rules require retailers and their issuing partners to consider some additional information about customers who apply for private-label or cobranded cards at the cash register, including their income and existing obligations.

Many in the industry had braced for worse.

Specifically, retailers had worried they would be required to verify income or assets by collecting copies of customer pay stubs, tax returns or bank statements. But the final version of the rule, which the Fed released this month, allows issuers to estimate income and assets using computer models.

"I think they are all breathing a big sigh of relief," said Steven Jacowitz, a former credit executive at Saks Fifth Avenue, Bloomingdale's and Filene's, and now the director of alliance development at Auriemma Consulting Group.

Under the Credit Card Accountability, Responsibility and Disclosure Act, beginning Feb. 22 all issuers granting line increases or new accounts will have to consider the applicant's ability to make the minimum monthly payment. Part of the Fed's rules — all 1,155 pages of which landed on Jan. 12 — defines "ability to pay," and says the assessment must include "a review of the consumer's income or assets as well as current obligations." (more)

ACH Direct and UMACHA Offering Free Webinar Series on ACH Topics

(Allen, TX – January 25, 2010) – The first in a series of 8 free webinars on automated clearing house (ACH) topics, hosted by ACH Direct and presented by Upper Midwest ACH Association (UMACHA), is scheduled for Tuesday, March 9 on an “Introduction to ACH.”

ACH Direct is proud to partner with UMACHA for the fourth year in providing a series of free webinars to educate participants on the many facets of ACH. This session discusses basic principles of the ACH Network, the history, legal framework, participants and flow of ACH transactions. It also provides details on where the Originator/Merchant fits into the “flow” of an ACH transaction and the route an entry takes before posting to the Receiver’s/Customer's account. The webinar series, produced and presented by the Upper Midwest ACH Association, is designed to provide basic to intermediate education on ACH for merchant participants with a concentration on specific aspects of ACH targeting merchant’s needs.

“It’s exciting to enter the fourth year of our partnership with UMACHA,” says Jeff Thorness, President and CEO of ACH Direct. “This gives us the opportunity to educate organizations on the associated rules and regulations that govern payment methodologies, and also provide each organization a better understanding of all of the payment acceptance options that are available to their business.”

Participants must register in advance at http://www.achdirect.com/news/events-teleseminars.asp. All webinars will take place from 1:00- 2:30 p.m. Central Standard Time, and include time for questions and answers. Registered participants will dial into a conference line for audio and log into an online session to view these presentations.

The series will continue with the following webinar topics:

April 21, 2009 – Authorization Requirements - Authorizations can be verbal, written or similarly authenticated, or by notice – but there needs to be one in place for an ACH entry to be initiated. This session will provide details on ACH authorizations including, “Who is responsible for the authorization?”

May 11, 2009 – Exception Processing (Returns & NOCs) - ACH returns can happen – what are some reasons why and the timeframe for an ACH entry to be returned. Included will be details on a Notification of Change (NOC) outlining your responsibilities as an Originator (Company) and timeframes for compliance with the ACH Rules.

June 15, 2009 – Unauthorized Entries and Stop Payments - Details on why and when an entry is returned as unauthorized (consumer and corporate entries) and what your role and obligations are as an Originator (Company). What is a Stop Payment and what should you do when you receive an item returned as Stop Payment from your customer? What is your responsibility?

July 13, 2009 – WEB and TEL Entries - Requirements for Originators (Companies) for WEB (Internet Initiated Entries) and TEL (Telephone Initiated Entries) will be discussed in detail. Authorization and Authentication details for each application will be included.

August 10, 2009 – e-Check Conversion Products - A paper check converted to an ACH transaction, specifically ARC, POP and BOC will be examined in this session. As a company (Originator) you need to be aware of the authorization requirements, source documents and retention of the authorization. Represented Check (RCK) entry requirements for you as the Originator will be included.

September 14, 2009 - Check Basics / Check 21 - Have you ever wondered what the purpose is for the numbers on the bottom of a check? Attend this session to learn basic information on how a check travels; the participants in the check process; the regulations and an overview of Check 21.

October 19, 2009 – Remote Deposit Capture (RDC) Basics / Corporate Capture - Are you currently utilizing an RDC service or are you looking for a more efficient way to process your checks? What are the responsibilities and risks associated with RDC? Join us to hear the corporate benefits of using RDC; company warranties; how to avoid duplicate processing; secure storage and destruction of the paper check will be discussed.
About ACH Direct, Inc.

ACH Direct is one of the largest and most innovative processors in the United States, offering a comprehensive suite of payment processing and risk management solutions for credit card, debit card and E-check (ACH) acceptance. ACH Direct’s customers benefit from a complete solution for payment acceptance via the Internet, over the phone, by mail or in person. Dedicated to providing superior customer service and industry-leading technology, ACH Direct provides tools to help organizations of all types and sizes reduce cost, mitigate risk and increase efficiencies. Additional information about ACH Direct can be found at www.achdirect.com.
About UMACHA

Financial institutions and corporate members across the Midwest choose UMACHA as a key resource to enhance their understanding of electronic payments. Its mission is to support its members and other stakeholders in payment system participation through education and training, marketing and operational support, and information disseminating and consulting, with a particular emphasis on the ACH network.

Source: ACH Direct Press Release

Some Banks Try Again For Class-Action Heartland Lawsuit

Written by Evan Schuman
January 21st, 2010 - StorefrontBacktalk.com

Shortly after Heartland tried to sweep away most of the lawsuits against it with a series of recent negotiated settlements, a group of banks is trying to persuade other banks to reject the settlement offer and support a class-action lawsuit instead.

The lawsuit, filed Tuesday (Jan. 19), hit Heartland hard for its “lack of Payment Card processing system security; its desire to use a ‘lowest bidder’ system of selecting its outsourced IT ‘auditors’; its reliance on a ’snapshot’ telling it that, at one identifiable point in time, its system supposedly complied with the bare minimum industry standards; its startlingly poor IT oversight in general; and (Heartland’s) complete and utter disregard of the oversight responsibilities they had to their fellow members of the Associations that allowed the intruders to make trip after trip in and out of the Heartland Payment Card processing system.”

The lawsuit also referenced Heartland’s initial response to the attack. “Thirteen months later, the ‘clean up’ efforts would be
seen for what they were—worthless.” (Pause. But other than that, Mrs. Lincoln, how was the play?) (more)

Are Tokenization And End-To-End Encryption Substitutes?

Written by Walter Conway
January 20th, 2010 - StorefrontBacktalk.com

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

If your goal is to limit your PCI scope, should you pursue tokenization or end-to-end encryption? Or should you do both? I find it interesting that many large (L1 and L2) merchants are actively pursuing both options, and I’m wondering if that really makes sense from either a PCI or an economic perspective.

Maybe tokenization and end-to-end encryption are just two closely related approaches that can, when properly implemented, accomplish the same thing: minimize your total PCI scope. One thing is for sure, though: Either way, you will need to bring your checkbook.

Everybody wants to minimize their company’s PCI scope. When I look at scope issues, I generally classify systems into two broad areas. The first is the set of applications and network infrastructure in the payment transaction flow from the POS to the processor/acquirer and back. The second area of scope deals with post-transaction applications that use the data; for example, velocity checking/fraud systems, relationship management, delayed or split shipments, recurring payments, and chargeback and refund processing. (more)

Credit card charge-offs slip at most U.S. companies

(Reporting by Jonathan Spicer; Additional reporting by Dan Wilchins and Chris Kaufman; Editing by Lisa Von Ahn and Richard Chang)

NEW YORK (Reuters) - U.S. credit card data for December showed some signs that fewer consumers were falling seriously behind in their payments.

Four out of six companies reporting credit card activity for December said charge-offs declined in the month.

Delinquency rates, which portend future credit card defaults, declined at all of the companies except JPMorgan Chase & Co (JPM.N), according to regulatory filings on Friday.

The data, while not uniform, was a reversal from a general rise in defaults in November.

December was "a point of flux," said Jason Arnold, analyst at RBC Capital Markets. "If there are two more months of improvement across the board then that's starting to bode a lot more favorably for trends, but we suspect that that won't be the case."

"This is one of those transitional months, and we'll likely see in coming months as a result of seasonality some weakness ... before things get better," Arnold added.

JPMorgan, the largest issuer of Visa-branded credit cards, said charge-offs fell to 7.11 percent last month from 8.81 percent in November. Citigroup Inc (C.N), the leader for MasterCard-branded cards, said charge-offs dropped to 9.56 percent from 10.29 percent over the same period.

American Express Co (AXP.N), the largest U.S. credit card company by purchase volume, logged its seventh straight monthly decline. Defaults dropped to 7.10 percent in December from 7.60 percent in November, the company said. (more)

Blippy Shows Its Own Funding On Blippy. And Now Everyone Can See.

by MG Siegler on January 14, 2010 - Tech Crunch

People love Blippy. Well, they love to talk about Blippy. And complain about it. And argue that it’s the end of privacy as we know it. But some people do actually love Blippy, the service which lets you share you credit card transactions with the world. In fact, a number of investors do, as the service has just raised a $1.6 million round of funding.

The large angel round was led by Charles River Ventures. Also participating are Sequoia Capital, Evan Williams, Jason Calacanis, James Hong, Ariel Poler, and Ron Conway. A pretty impressive list.

Blippy co-founder Philip Kaplan is also putting his money where his mouth is and investing. The fact that Charles River Ventures is leading the round should surprise no one since Kaplan left his role there as an Entrepreneur In Residence to help launch Blippy. CRV’s Saar Gur is also taking a seat on Blippy’s board.

Alongside the funding news, Blippy has another big announcement: They’re opening up to everyone today. You’ll no longer need an invite; simply visit the site and sign up.

So why did Blippy feel the need to raise $1.6 million? “There was a lot of interest,” Kaplan says. “We trust this gets us through at least the next 12 to 18 months. Enough time to prove the model,” he continues.

And that model is key. While the site may be controversial right now, the possibilities are interesting. If Blippy is able to prove that people don’t mind sharing their purchase data, a number of potential business plans could spring up. Affiliate fees are an obvious one, but think about featured vendors, and maybe even Blippy credit cards eventually too. (more)

The Future of Plastic: 5 Credit Trends for 2010

Card Sharp by Aleksandra Todorova - SmartMoney - January 12, 2010

If 2009 was the year of hammering out credit-card reform, 2010 will be the year consumers feel the effects of those changes.

The CARD Act goes into effect on Feb. 22 and with it come stronger consumer protections. Banks will no longer be able to raise interest rates during the first 12 months after opening an account – or hike rates on pre-existing balances altogether. Credit-card payments, if exceeding the minimum, will be allocated to the higher-rate balances first. Monthly statements will become easier to understand and the ability to issue credit cards to college students will be severely restricted. (For a more detailed outline of the new rules, click here.)

But these new safeguards will come at a price. Although card issuers focused last year on making sure they’ll be in compliance with the new law, now they will have to figure out how to make money given the changes in their business, says Dennis Moroney, a research director at financial-services research group TowerGroup. This “will be the year of transition for the banks,” he says.

Consumers have already gotten a hint of what’s to come. As soon as President Obama signed the CARD Act into law last year, banks sprung into action, hiking interest rates across the board and switching their APR formulas from fixed to variable rates. They’ve already found loopholes in the new law, including a creative way of charging a penalty APR as soon as a payment is one day late and continuing to implement the soon-to-be prohibited practice of double-cycle billing. (more)

The Different Fraud Protections for Signatures and PINs

By JENNIFER SARANOW SCHULTZ - January 12, 2010 - The New York Times

Last week’s New York Times article “How Visa, Using Card Fees, Dominates a Market” detailed the behind-the-scenes struggle between banks and retailers to encourage customers to sign when making debit card purchases or to punch in their PIN because of the higher fees that stores pay banks for signatures.

Many readers took issue with the notion in the article that the debate over signing versus typing in a PIN “is a pointless distinction to most consumers, since the price is the same either way.”

Some readers said they felt there actually was a big difference between signatures and PINs for consumers in terms of fees and cost, safety and protection against fraud and purchase records, among other issues.

We’ve boiled this down to four main points: which costs more, which is safer, which offers more protection in the case of fraud and which is easier to track.

Last week, we looked at the cost differences for consumers and on Monday, we looked at which use of a debit card might better protect consumers’ accounts from the risk of fraud. (To be sure, many people think using credit is better than using any kind of debit transaction, but we’ll save that issue for another series.) (more)

Bill Me Later hit with class-action lawsuit over interest rates

Baltimore Business Journal - by Scott Dance Staff - Friday, January 8, 2010

Bill Me Later is facing a class-action lawsuit claiming the online sales processor skirts California consumer protection laws to hike its interest rates.

Kyle Sawyer, a Bill Me Later customer in Torrance, Calif., filed the lawsuit Jan. 6 in U.S. District Court for the northern district of California. The complaint accuses Timonium-based Bill Me Later, a subsidiary of online auctioneer eBay Inc., of using a middleman to avoid California law prohibiting exorbitant credit penalties and interest rates.

The lawsuit seeks refunds of unjust fees and cancellation of loans for Bill Me Later customers in California. It also asks Bill Me Later and eBay to pay damages equal to three times the interest it charged Sawyer and any additional plaintiffs who join the lawsuit.

Bill Me Later is an online payment processor that Internet retailers use to boost sales. When making a purchase online, consumers who choose to use Bill Me Later undergo an instant credit check by the company, which it uses to decide whether to approve or deny the sale. If approved, Bill Me Later then foots the bill for the purchase and charges the customer like a credit card company would.

The lawsuit argues that Bill Me Later evades consumer protection laws because it isn’t a chartered bank or other financial institution. If it were, it would be subject to consumer protection laws limiting interest rates and penalty fees. (more)