GOOGLE Australia is considering a plan to take on payments giants such as Visa, Mastercard and B-Pay in the booming online payments market. The move comes as the search giant secured a financial services license from local regulators.
The Australian Securities and Investments Commission recently issued Google Australia with an authority to provide deposit and payments services to local merchants and shoppers. While the licence does not permit Google to provide cash-based payments services to Australian clients, it will enable the group to facilitate digital or online transactions.
Web-based commerce is a hotly contested and lucrative market for payments providers and has spawned a raft of new players including E-Bay subsidiary PayPal.
The ASIC licence potentially opens a fresh revenue stream for Google which will be able to collect processing and transaction fees for bringing shoppers and merchants together via its websites. Google Australia spokesman Rob Schilken confirmed that the company was working on options to roll out an internet payments platform in Australia. "It's a matter of doing the due diligence and the homework so that if we're in a position to launch we can do it," he said.
But no decision has been taken." Through PayPal, EBay has stolen a march on Google in the Australian online payments arena.
Market research published earlier this month by Neilson Online found that 7.3 million Australians shop over the internet.
DAVOS, Switzerland (Reuters) - Businesses risk losing over $1 trillion from loss or theft of data and other cybercrime, according to a study released on Thursday by security technology firm McAfee Inc.
The California-based company launched the survey after detecting a rapid acceleration of malicious software, or "malware," last year, CEO David DeWalt told Reuters. Malware increased by 400 percent in 2008, he said.
"This was a very insidious type of malware that was designed either to steal your data, steal your identity, steal your money, and in many cases the scale as well as the sophistication was very alarming," DeWalt said in an interview at the meeting of the World Economic Forum in Davos, Switzerland.
Editor's Note: In the wake of the Massive Heart(land) Attack some industry leaders are calling for end-to-end encryption. (E2EE) HomeATM already incorporates E2EE and is awaiting PCI 2.0 certification for their personal swiping device with PIN Pad.
The survey of 800 companies in 8 countries showed that 80 percent of malware aimed to make a financial gain, in contrast to traditional viruses and worms which just had nuisance value.
In the survey, 42 percent of companies said that laid-off employees were the single biggest threat to their data security.
The increase in the availability and power of removable storage, such as mobile phones, laptops, and USB sticks, has made data loss or theft easier. And global supply chains mean that sensitive data is often stored abroad.
DeWalt said the survey showed that the average company has $12 million of data stored outside its home country -- often in countries with little intellectual property law.
Data lost accidentally or through theft can be expensive to replace or damaging to a company's reputation or brand.
In April last year, discount retailer TJX said it would pay up to $24 million as part of a settlement with MasterCard over a security breach that put credit card data for tens of millions of shoppers at risk.
The British government has been repeatedly embarrassed by losses of data, such as when the tax authority, HM Revenue and Customs, lost data on 25 million people exposing them to the risk of identity theft and fraud.
(Reporting by Jonathan Lynn; editing by Simon Jessop)
He says that the sniffer malware used in the Heartland attack was cloaked in an unallocated portion of Heartland's server, which is a well-known tactic. What's unique in this type of attack is that it requires "tricking" the Operating System either by modifying the OS itself, or installing a modified device driver. Either way, one consultant said that the fact the hacker(s) got around the OS itself is a "scary mother."
SFBT also says in the article that Robert Baldwin, President and COO of Heartland, says they were contacted by V/MC in late October. It then took two weeks by two different forensic teams, (who , according to Heartland) were both about to issue a clean bill of health, to find some .tmp files in an unallocated portion of the disk drives, which turned out to be a by-product of the malware.
Finally, Evan Schuman addresses Heartland's decision to pursue End 2 End Encryption, questioning how feasible it is, given the cost, the amount of payment players that would have to participate, combined with the fact that it is the card brands themselves, who insist on dealing with unencrypted data.
This from StoreFront Backtalk: The sniffer malware that surreptitiously siphoned tons of payment card data from card processor Heartland Payment Systems hid in an unallocated portion of a server’s disk. The malware, which was ultimately detected courtesy of a trail of temp files, was hidden so well that it eluded two different teams of forensic investigators brought in to find it after fraud alerts went off at both Visa and MasterCard, according to Heartland CFO Robert Baldwin.
Regarding end-to-end-encryption, Evan quotes Heartland CEO Bob Carr and explains the potential problem with it...
"Heartland CEO Robert Carr said in a statement. “Nevertheless, I believe the development and deployment of end-to-end encryption will provide us the ability to implement increasing levels of security protection as they become needed.”
End-to-end encryption is far from a new approach. But the flaw in today’s payment networks is that the card brands insist on dealing with card data in an unencrypted state, forcing transmission to be done over secure connections rather than the lower-cost Internet. This approach avoids forcing the card brands to have to decrypt the data when it arrives." Read Evan Schuman's complete article here
It appears some financial institutions aren't very HPY with Heartland Payment Systems...
The Washington Credit Union League (WCUL) in Federal Way, Washington is seeking to revive legislation that would mandate specific data protection controls on all merchants and third parties, such as Heartland. The bill (HB 1149) received its first hearing last Thursday in the Washington State House Committee on Financial Institutions and Insurance, according to a statement released by the WCUL.
But in reading between the lines, or actually reading the yellow highlighted one's below, it looks like the beginnings of a class-action lawsuit against Heartland in order to recoup "$20 per issued card," the "30 minutes of staff time" it takes to get it done, and monetary damages to reimburse the "reputational damages" incurred by the Financial Institution. They also state that "if someone's careless actions result in financial loss, they should have to pay for it" and that some institutions are reporting that "more than 50% of their card base has been affected" by the Heartland breach. All bad news for Heartland's ticker...and like they say, this may just be the tip of the iceberg...
FOR IMMEDIATE RELEASE
Contact: David Bennett - Washington Credit Union League
Office: 206.340.4828Mobile: 425.221.1237
‘THE TIP OF THE ICEBERG’
Latest Data Breach Causing Significant Harm to Washington’s Consumers, some Financial Institutions
A credit union-written bill now before the state legislature encourages all financial institutionsto take extraordinary measures to protect consumers from identity theft and fraud.
FEDERAL WAY, WASH—The state’s credit unions have been prepared for tough times on behalf of their members for more than 75 years, but the latest whammy leveled on them may cause as much harm to some as the current national financial meltdown.
Last Tuesday’s revelation by third-party credit and debit card processing company and Princeton N.J.based Heartland Payment Systems, a company that completes about 100 million transactions per month on behalf of more than 250,000 merchants, disclosed that it had begun to receive fraudulent activity alerts last year from MasterCard and VISA. According to reports, all of the unauthorized transactions were applied to cards that rely on Heartland to process payments.
Heartland still does not know how long the breach occurred prior to its discovery and refuses to release the names of the merchants that contract with them, which deprives consumers who patronize those merchants the ability to be more vigilant in monitoring their credit and debit card accounts. Some of the Washington’s financial institutions have reported that more than half of their card base has been affected by the breach.
Most credit union leaders believe that the effect during the initial days is just the “tip of the iceberg,” and have already begun to notify members, block accounts, reissue cards and numbers and provide ongoing fraud monitoring.
According to some industry insiders, fraudulent activity alerts began to arrive in mid-November, however because of liability reasons the alerts did not mention where the breach occurred. At least one has confirmed that counterfeit cards have been created from the stolen information and so far used in Florida and Mexico.
“The state’s credit union community is appalled, but unfortunately not very shocked by the immense size of the Heartland data breach,” said Washington Credit Union League President/CEO John Annaloro.
“In far too many cases, negligent data breachers do business as if they were immunized from liability when they fail to protect their customers’ personal information. In our view, if someone’s careless actions result in a financial loss to others, they should have to pay for it.”
In the past, it has been standard operating procedure following a data breach for credit unions to block accounts, reissue cards and numbers and provide ongoing fraud monitoring.
However, taking those aggressive steps to protect members from financial fraud and identity theft is becoming cost prohibitive because the frequency and size of data breaches is skyrocketing and costs the financial institution around $20 per card, depending on the extent of the action taken. This number does not include costs associated with staff time, which can be as much as 30 minutes per card, or the negative reputational impact on the financial institution.
“While there are processes that are "supposed to provide" some reimbursement for fraud losses, the truth is that these processes only recoup pennies on the dollar,” (translation: we want more money) said Stacy Augustine, the Washington Credit Union League Senior Vice President in charge of government relations. “More importantly, the costs that are recouped don’t pay anything toward costs associated with a financial institution’s proactive steps to protect consumers from fraud and identity theft.”
Because of this, Washington’s credit unions have once again introduced legislation aimed at encouraging financial institutions to take extraordinary proactive steps to protect the state’s consumers from identity theft and financial fraud following a data breach. Like last year’s proposed bill, HB 1149 encourages financial institutions to take proactive measures to protect consumers by allowing them to sue negligent data breachers for the cost of aggressively protecting Washingtonians’ personal and private information.
In an article titled, "Banks, credit unions scramble in wake of Heartland breach," Jaikumar Vijayan writes for Computer World that several banks have begun reporting fraud and have been forced to issue replacement cards.
I would think this may just be the "tip of the iceberg" when it comes to lawsuits, as numerous credit unions and small banks will look for ways to recoup some of the exorbitant costs associated with a breach of this size. Maybe Heartland Bank will lead the way. Wouldn't that be a full circle and a half?
More likely it will be the Washington Credit Union League. Based on the tone of their language in this document (Word) they are not very HPY with Heartland right now.
Here's a couple paragraphs from the ComputerWorld article.
"In the first real indication of the scope of the recently disclosed data breach at Heartland Payment Systems Inc., banks and credit unions from Washington to Maine have begun to reissue thousands of credit and debit cards over the past few days.
Several have also begun disclosing fraud associated with payment cards that were reported to them by Visa and MasterCard as having been exposed in the breach.
A Pennsylvania law firm today filed the first class-action lawsuit related to the breach. Chimicles & Tikellis LLP in Haverford, Pa., filed the lawsuit on behalf of Alicia Cooper, a resident of Woodbury, Minn., and others who might have been affected by the breach.
The complaint, filed in the U.S. District Court for the District of New Jersey in Trenton, alleges that Cooper, whose card was compromised in the breach, and others, were victims of Heartland's negligence in protecting cardholder data. The lawsuit, which calls for a jury trial, charged Heartland with breach of contract, breach of implied contract and breach of fiduciary contract for the breach..."
Looks to me like this is going to get rather messy for Heartland. Click here to read the whole story at ComputerWorld.com
The Press Association, is reporting that: "One in four Briton's are a victim of card fraud." According to their story, "1 in 4 Britons have been the victim of credit or debit card fraud." Research has shown that:
Around 26% of people have now had their card used fraudulently, up from 21% when the same research was carried out 12 months ago, according to life assistance group CPP. (Editor's Note: Unless they lived in London, where nearly 40% of Brits were victims.)
On average, fraudulent transactions totalled around £650, but 6% of people reported losses of more than £2,000. But despite the large sums of money involved, 42% of card fraud victims did not spot the rogue transactions themselves, and only found out about them when they were alerted by their bank.
London remained the country's credit and debit card fraud hot spot, with 38% of people living in the capital having been hit by the problem, a 10% jump on the number of people who had been affected last year. It was closely followed by Cardiff at 34%, Manchester at 29% and Brighton at 27%, where there was a 15% jump in the proportion of people hit during the year.
Nearly four out of 10 victims had their card used online, while 21% had it cloned when using a cash machine or chip and Pin device, with others losing money after their card was lost or stolen.
Kerry D'Souza, card fraud expert at CPP, said: "The dramatic increase in card fraud shows no sign of abating which isn't surprising given the desperate measures some people will resort to during the recession.
"Fraudsters are becoming increasingly sophisticated, especially when it comes to online transactionswhich are a particular cause for concern."
"Cardholders need to remain vigilant with their cards and take the necessary steps to protect themselves - from checking statements more frequently to keeping sight of their card when paying for transactions. It might seem like simple steps but they will go a long way in preventing fraud."
Alternative Payments are on the rise, and they are cutting into the margins of the Dynamic Duo-poly. As credit card use declines, and debit, ACH and Money Transfer options increase, V/MC will take an even bigger hit...especially as the lime leeches from the mortar in the bricks of the house that retail built.
This article, about alternative payments, doesn't even touch on PIN Debit for the web. But it's the consumers preferred payment, which is what make s the potential for this industry so enticing. BTW, the rest of the AltPay's aside, PIN based transactions for the web is really starting to gain some "major momentum." The chatter around PIN Debit for the web has picked up tremendously over the past 10 months or so. And rightfully so...after all what part of online debit for online shopping doesn't make sense?)
I'll answer my own question. The part that doesn't make sense is the part where it's more secure than the way it's done now... and the part whereby lower interchange rates would potentially save internet retailers hundreds of millions of dollars annually.
Is it that simple...the fact that because interchange is lower, it's not as profitable to the banks, EFT's, processors and networks? Nah...couldn't be...no matter anyway because that is all about to change. Hackers have changed the game and "now it's all about security." TJX, CardSystems, Hannaford, RBS Worldpay, and now Heartland have seen to that. We need a more secure transaction, one that's encrypted from beginning to end and not only have we already got it but it's already the consumers preferred method.
Here's a tidbit from Bala J.'s article:
Alternative Payments: More Ways to Close the Sale By Bala Janakiraman
Online customers are increasingly turning to alternative payment methods, and merchants who don't want to miss out on sales should consider accepting some or all of them. Banks also are getting in on the act, creating Secure Vault Payments, which authenticate customers through online banking portals.
For the past few decades, checks, ACH, credit cards and debit cards have been the primary means of payments for consumers. These payment methods have been successful because consumers can pay for their purchases without carrying cash, merchants can increase sales by reaching a wider consumer base, and banks are able to establish themselves as trusted financial providers to both merchants and consumers. However, changing market trends are creating opportunities for alternative payment methods and practices.
The Driving Forces Behind Payments Innovation
Communications technologies, mainly the Internet and mobile phones, have dramatically altered the ways in which individuals interact with each other and, in turn, consumers are shifting more of their purchases from the physical world to the virtual. Merchants have adapted by becoming multichannel marketers and banks are following suit by providing new means for consumers to interact with their finances through popular tools such as online bill pay and mobile banking.
Second, the rise of online purchases has brought with it concerns of security. While most banks fully protect consumers against fraudulent transactions, consumers don't want to go through the hassle of identifying and fixing fraud. And merchants are even more concerned especially since they end up digesting most of the liability in the event of a security breach.
Merchants are also concerned about managing the rising costs of payment acceptance. Over the last 20 years, credit card interchange fees have gone up 25 percent to 90 percent, depending on the card type and the nature of the merchant business... continue reading
Find out how our patented technology can empower your financial institution.
Our secure two-factor online banking authentication eliminates dangerous passwords and usernames and replicates the same trusted process used to access cash at ATM's. (Insert Bank Issued Card, Enter Bank Issued PIN)
There is an R.O.I. as FI's also earn recurring revenue from each transaction conducted using our PCI 2.0 Certified PIN Entry Device. Our technology also provides a unique real-time P2P "Instant-Transfer" which allows your online banking customer to transfer cash from ANY of their bankcards to ANY other bankcard...with the Swipe of a card.
Help your bank eliminate phishing and your customers avoid identity theft by providing them with the ability to stop typing and start swiping. There is no safer way to conduct financial transactions online than by 3DES DUKPT encrypting the cardholder details, which we do at the mag-head "inside the box/outside the browser."
Is Google Going Down...Under? The Herald Sun says it very well may be, mate. ![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vpAbstG7PdPzY5RQ7icrZGINK9lS2q4P93H0lQR02J_51iVlDQoPP17-ma7xuRXU4BOfIzjIjWUVfwWma9sKeuDgb8_66aZNEqIp8ryF1ClMeozrZfYfxpIocRH_GsaRu8eN6jAWaEQ9KQoGP10hk=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_spg-fSUywilD7qjfxQhPm01-4dwgsX2l0y8yKCkxQCn1B7_i1C5vtQ1Ql2SkAYd7LG6e7BW_DUQ76yKWFo2x-T3MPtWjuCWuHOkBdP52OeBfj-h-Df5RhoY7omIbwTJvNBUUNLP--RCg-D787pBmLl=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v43daKjIjf4GizappMqTm1Ck5PkTq_Vt81rsPiwogHjtvryQpI50oppcjCsgdUNz_ez7CMKC3qMINIktxMW4FIpDhIZ5M1inaZyFqxM9COuPUmoayTtRjqBaC5hrU61yzof3N41qxqVNmmgLN0APpz=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sjSd4khpECR15JPonODbrQ1Usky2TJIQl-jpVX2hVlAfDXmRDHHpZnLqRBiYmZ3gr-HNsdG2Uu5D8gi4GyzES8z5U6-Crh139gVSJva0-GqnTmQ90gXtOy2CYofrLgHAzVUOXlEinqx7ichOlHFjk=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_thF9kw02tPXDO_rIBMyAxmVa9b5uGFxxv3ORJ8WxdF25vHBMv1b-4fhO1bcJSecnwzB7ENuCdq4ogo2wQq8RBJ_zqBTxOFSIeeqHiLYtuQDzdyEkqbenDTeKCyFpUgDyjzXtICHBvwQ6i8jPK0MJOK=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vkyixRQt6jc5BtOtnaUga11ZbeOuqdyx9U1E33Per5lIggRKwaPUYaQC2HyuG9lCIzZfwv-8CTT9758KJGtA-WtlSDAk52EX7LjGFuxk658lSMJE8pj4FkUEp-H3t6XTvJDh5NR8RS0XWu4z2qEGY=s0-d)
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u_On6e_4ez48nFz2CwI9dOalE0DA2wJsG4MvcZyltS5U4sxLBjlyH79hxfm2X2sCQikw5PFcX5lf-NxkCH28h4pvDErLwiCnTKDO7L_vdNM7FK894D1WLijk7EhfzajRCIOXGkvo2ni94HYwMFkgYf=s0-d)
