Page 34 - GS161202

CoverStory
In April, the PCI Security Standards
Council released PCI DSS 3.2.
A key change: mandating multifactor
authentication for any organization with
access to credit and debit card data, a
requirement that previously applied only to
those remotely accessing data.
In 2016, mobile commerce made significant advances, as
increasing numbers of shoppers took to their smartphones
and tablets to comparison shop and, in some cases, to
actually make purchases. BI Intelligence expects U.S.
mobile commerce to total $79 billion this year, or about 20.6 the upgrade for AFDs is more complicated than had
percent of all ecommerce. By 2020, mobile will account for
45 percent of all U.S. ecommerce, totaling $284 billion in
sales, the firm predicted.
The Federal Reserve reported in March that 24 percent of
adult Americans used mobile devices to make payments
in 2015. Bill payments were most popular, with 65 percent
using their mobiles to pay bills. Digital content and brick-
and-mortar purchases came in second and third, with 42
percent and 33 percent, respectively.
Meanwhile, a recent report from eMarketing Inc. revealed
that just 19.4 percent of smartphone owners in the United
States had used their devices in the previous six months
to make payments. "Despite double-digit growth this year
and next, Americans' use of mobile wallets like Apple Pay,
Android Pay and Samsung Pay, as well as branded apps
that include mobile wallets like the Starbucks app, Walmart
Pay and CVS Pay, will not reach mass adoption in the
foreseeable future," eMarketing wrote.
One reason for slow adoption is a shortage of POS devices
programmed to support near field communication (NFC).
Support for NFC, the underlying technology for tap-and-go
payments, has been built into the latest generation of POS
devices: EMV-compliant terminals.
Meanwhile, CurrenC, a mobile payment initiative launched
by a group of large retailers (known as MCX for Merchant
Customer Exchange) that leveraged quick response codes
instead of NFC was scuttled in June.
Progress with EMV, PCI
Security always has been an important consideration for card
payments. So when the card brands turned their collective
attention to implementing EMV (Europay, Mastercard and
Visa), an industrial strength security protocol, it seemed
as though the Payment Card Industry (PCI) Data Security
Standard (DSS) might assume diminished importance. It
has become abundantly clear, however, that is not the case.
For starters, EMV implementation is far from universal
at merchant checkouts. The Strawhecker Group reported
44 percent of U.S. card-accepting merchants have EMV-
34
compliant terminals, but only 29 percent were being used
to run EMV transactions as of September. However, EMV
is intended to protect against counterfeit card fraud, and
according to a July report from Auriemma Consulting
Group, counterfeit card fraud was down 18 percent in the
first quarter of 2016, the lowest level since 2013.
Under a plan put forth by the card brands, most merchants
were supposed to be up and running with EMV terminals
by October 2015 or risk liability for fraud perpetrated
with counterfeit cards. Petroleum dealers were given
until October 2017 to implement EMV security on
automated outdoor pumps. On December 1, though, Visa
and Mastercard extended the compliance deadline for
automated fuel dispensers (AFDs) to October 2020, noting
originally been expected.
Whereas EMV is about protecting against fraudulent
transactions, the PCI DSS addresses basic security
requirements for storing, processing and transmitting
cardholder data. As recent reports suggest purloined card
data remains a hot commodity with fraudsters. The website
Krebs on Security reported in August that hundreds
of computers at software giant Oracle Corp. had been
breached, including computer systems used by businesses
with Oracle's Micros POS systems. Additionally, several
individual retailers also reported card breaches this year,
including Eddie Bauer, Wendy's and Cicis.
But data breaches are not just a large retailer problem.
Vantiv LLC stated its research suggests 80 percent of card
breaches involve small retailers. The result: 60 percent of
those shops shutter their doors within six months of being
breached, according to Vantiv.
In April, the PCI Security Standards Council released PCI
DSS 3.2. A key change: mandating multifactor authentication
for any organization with access to credit and debit card
data, a requirement that previously applied only to those
remotely accessing data. In July, the council provided a
new set of compliance resources designed specifically for
small businesses. The new Guide to Safe Payments, available
on the PCI SSC website, aims to make the requirements
(which are laden with legalese and technical jargon)
easier to comprehend. Acquirers and their partners were
encouraged to download, brand and distribute the guide to
their small business customers.
"PCI compliance is important to everyone in the payment
processing industry," said Cleveland Brown, co-founder and
CEO of Payscout Inc., echoing the sentiments of acquirers
and ISOs alike. Not everyone in the merchant community
accepts this premise, however. The National Retail
Federation in June asked the Federal Trade Commission
to investigate the PCI SSC. It argued that because it is
controlled by Visa, Mastercard, American Express Co.,
Discover Financial Services and JCB International Co. Ltd.,
the council doesn't qualify as a legitimate standards-setting