Security Threats Facing Online Payment Gateways

[Guest Post by Arthur Jones]

Most experts agree: it is a brave new world for payment gateway providers, which presents both opportunities and challenges. For nearly a decade, cyber security professionals have been warning about the ongoing rise of cybercrime. Agencies like the FBI regularly put out reports detailing the threats to the financial services industry, in particular. As outlets like TechRepublic have reported, this trend is only going to continue, and we may see record levels of cybercrime activity this year.

What kind of threats can we expect to face for online payment gateways? Let’s look at some major security challenges and how they may be addressed payment gateway providers as they continue to innovate and remain competitive in the marketplace.

Information Attacks

It is safe to say that a data breach is one of the most serious threats for payment gateways. Attacks like these can come in many different forms, and because they are smaller and require fewer resources, they are easier to carry out and occur much more frequently. If an attacker gets their hands on sensitive financial information, the losses can be catastrophic, putting companies at the risk of irreparable damage to customer trust.

There are many ways for attackers to breach a system. Phishing attacks consist of fake emails that can trick users into opening harmful links and installing malware or giving up sensitive information. Such attacks can open up system vulnerabilities, giving attackers access to valuable information.

Untrustworthy insiders can also get access to sensitive information and compromise security systems from within the business. Or hackers can gain access to sensitive systems through security breaches in compromised hardware and software.

Credit Card Fraud

Payment gateway providers may be concerned about threats to their internal data systems, but there are external threats to take into account as well. Attackers use skimming devices and other technologies all of the time, which can steal credit card information wherever a credit card is used. After this sensitive information is acquired, attackers can commit credit card fraud wherever they please, which can go undetected until banks or card holders notice suspicious activity related to any compromised accounts.

This is a sort of “death by a thousand cuts” threat for payment providers, as constant small attacks on credit card holders’ information can result in the gradual erosion of customer trust.

DDoS Attacks

Distributed denial of service (DDoS) attacks are a little trickier to deal with, as they can be very powerful and destructive on a systematic level. DDoS attacks are becoming more sophisticated, in that the attackers are finding specific structural weaknesses in internet infrastructure, and then exploiting those weaknesses to bring down large and powerful institutions. Additionally, the expanding internet of things (IoT) makes it much easier for attackers to use internet-connected devices like appliances, TVs, security cameras, and other machines to flood servers with requests, which crashes them.

Typically, only the largest financial institutions are targeted by these attacks. However, hackers are increasingly attacking broader internet structures like the DNS system, which can crash a wide range of businesses’ websites that are using the infrastructure. Fortunately, large attacks such as these have been less frequent, and most payment gateway companies will not have to deal with attacks like these as much. Nevertheless, a downed server poses a threat for payment gateway providers if they’re not able to process transactions in a timely manner.

Safer Transactions

It is important for cyber security professionals, payment gateway providers, and other financial services businesses to continue to develop secure technologies to protect their systems and data. The most promising avenues include advanced encryption, tokenization, and authentication methods, which go a long way towards cutting down on common cyber-attacks. The Payment Card Industry Data Security Standard (PCI DSS) is a powerful industry-wide tool to increase security with, and innovation in this field is welcome as well. Further, proper employee training can go a long way to reduce risk exposure. Ultimately, payment gateway providers and other tech and financial services businesses who innovate in these areas will come out stronger in the future.

Author Bio: Arthur Jones is a consultant for Allied Wallet. He is an innovator in eCommerce services and everything a company needs for success including a global payment gateway system, a prepaid affiliate debit card program, and much more. Arthur has extensive experience in the eCommerce and merchant services industry, and regularly writes about it for interested readers.

IMAGES:

https://pixabay.com/en/credit-card-payment-credit-card-1730085/

https://pixabay.com/en/technology-servers-server-1587673/

Update to Harbortouch POS Terms Improves the Best Full POS Deal On the Market

The Harbortouch POS systems have always been a good economic choice for small or medium size businesses that want a fully-featured POS system without having to spend thousands (or tens of thousands) of dollars out of pocket just to get set up. But many merchants have balked at the lengthy five-year agreement required to qualify for the "free" equipment placement. Even though the monthly fee was comparable to the requirements of other system providers who charged for their equipment, nobody likes being locked into a service for an extended period.

Good News for New Harbortouch Accounts

Harbortouch has now begun implementing two significant improvements in their agreements for new POS systems. First, on their lower-end POS, there is an automatic trial period of 30 days. While many companies offer 45 days, which is what you need to ensure that a full statement period is covered, this is still an important announcement from Harbortouch. This way, there is a chance to ensure that all the reports work properly and that all deposits happen as they are supposed to.

The really exciting part, however, is that their Elite II system now comes with only a three year commitment. And this is at the same monthly rate that they charged for the service before. This is a significant potential savings when the hard costs of ownership are considered. Of course, the reality is that most merchants will likely continue with the service and the payments well past the three years, but it is good to know that if cheaper and better technology is available, nothing will prevent a merchant from being able to adopt it.

AMEX at the Same Rate as Visa and MasterCard -- Is it True?

Merchants may have been hearing over the past few months that some agents are claiming they can provide American Express transactions at the same low Qualified Rate as swiped Visa and MasterCard transactions. Well, yes and no. It had a lot to do with which network is handling the transactions, at least at the moment, and also what platform the transactions are being processed on.

Let me simplify this a bit. The first thing merchants should know is that only Global Payments affiliated providers are offering this low rate option for AMEX, not First Data network affiliates and probably not Paymentech, either. Merchants with a POS system that requires a First Data connection are currently out of luck unless they change systems. The good news is that merchant services providers like North American Bancard, Total Merchant Services and other processors that use the Global Payments network are already offering the reduced American Express rates to their new clients and rolling them out to existing clients.

For users of mobile "pay as you go" apps like Phone Swipe, PayAnywhere or Square, which use a simple swipe rate for all their card transactions, AMEX is already going through at the lower rate, which is 2.69% for NAB's Phone Swipe or 2.75% for Square. That is already less than most merchants had been paying for AMEX charges. But what of the promised 1.69% (or less) Qualified Rate for merchants on tiered processing?

This is where it gets muddy, but don't worry: it is still a lot cheaper than before. When a merchant has a standard contract and all its monthly fees, they also get much lower rates to offset those fees and, if they are processing over $3,000 each month, ought to see a net savings that improves as volume offsets the monthly fees. Such merchants may have a Qualified credit card rate of anywhere from 1.08% (plus dues and assessments and network fees) on up to around 1.79% or even more, depending on how the account was set up. What is happening now is that American Express is being priced at the same percentage as the other cards, but with a small catch.

The catch is that the other associated charges are slightly higher than the other card brands. Visa, MasterCard and Discover (and also the new PayPal card) all have additional little fees sneakily tacked on and passed through to merchants for things like "brand usage," "network access," "assessments," and more. And these tiny amounts add up. The fact is, each brand of card determines its own fees and to make it possible to sell lower rates, the processing companies take those out of their Qualified Rate and just pass the cost along to the merchant at the end of each statement, all lumped together. This is where merchants will notice that, yes, while their AMEX transactions have the same low rates, they still end up costing slightly more.

The bottom line, though, is that for merchants who take a lot of American Express cards, this new program can lead to a significant savings on the bottom line. Need another bonus? Turns out that the AMEX charges will also post along with the other card brands now, as well, which could be next day or within 48 hours, no longer requiring the additional day or two that American Express sometimes takes to make the deposits. All told, this is a lot of good news for merchants who are set up with the right plan and the right company. 

Consultations are always available, no pressure and no obligation.

PayAnywhere Storefront POS-Lite Updates to Version 2.2

The Most Affordable POS System Just Got Upgraded

North American Bancard's PayAnywhere Storefront payment application for Android just got a major tweak. While it still is not a replacement for a full-POS system like Groovv or ShopKeep, it remains a perfect solution for small retail businesses that do not need the system to control the stock of hundreds of inventory items, maintain open checks or log employee hours. PayAnywhere Storefront still allows the input of inventory items for quick checkout (it just doesn't keep track of what is in stock) and offers a wide array of sales reports. But mostly it offers one of the most cost-effective checkout systems for merchants who want to keep low rates and low fees while still tapping into the most-wanted features of the higher-priced systems and taking advantage of added mobility.

New Features in PayAnywhere Storefront 2.2

• Faster checkout! Merchants no longer have to press an extra button before swiping -- just run the card through the card reader and get that transaction going. There is also a novel new feature to

Affordable Tablet POS Systems That Support Open Checks and Tips from Groovv and ShopKeep POS

Android and iOS based POS Systems perfect for small and mid-size restaurants, coffee shops, bars or any business that accepts tips or open tabs.

Most mobile credit card processing solutions are not able to handle tips or open checks (tabs) at all, acting strictly as the equivalent of a counter-top terminal for swiping or key-entering a single transaction. This works well enough for most people, who rarely will need modifiers of any sort. However, business owners wishing to move away from or avoid altogether the high-priced POS systems now are seeing viable options appear in the affordable tablet-based solutions entering the market.

While affordable solutions such as Harbortouch have begun presenting themselves in the market for full POS systems required for high-inventory merchants who need extensive employee tracking and reporting for the accountant, the mobile marketplace has seen an explosion recently with excellent retail solutions like

The Affordable, Full-Featured Harbortouch POS - Reliable Testimonials Speak Volumes

Harbortouch continues to offer one of the more compelling full POS systems on the market. While I am a proponent of software like PhoneSwipe / PayAnywhere and Registroid, which work on tablets and offer considerably better pricing for the use of the software and hardware, there are times when a business simply needs more muscle under the hood. Whether this is a retail situation, a high volume coffee shop or restaurant, or even a hotel, Harbortouch can be configured to offer best-in-class service that provides over 80 customized reports while managing everything from consumables in stock to employee hours and a customer's preferences. It is a very fluid system that works through the cloud, offering a complete backoffice experience from anywhere with an Internet connection, keeping multiple stations in sync and even has the ability to tie in a roaming station that can take tableside orders or payments. Plus, the equipment costs are folded into the service agreement at about the same (or lower) cost as other comparable services without the thousands of dollars those other services might expect up front in hardware purchases.

But what I really like about Harbortouch is that the company is starting to show a bit more proof about their customer satisfaction. Most of the big players have plenty of high profile clients. Squirrel, for example, doesn't need to convince anyone that their equipment works, because they have a pretty substantial slice of the pie, as does Halo. However, an upstart like Harbortouch which is offering a radically different type of pricing approach and the promise of "Free Hardware" (in quotes because, frankly, nothing is free -- here you have a time commitment of five years to make it worth their while and cover their costs, which is only two years more than most other companies sign merchants up for even when they buy the equipment upfront), needs to be able to show merchants who might not be able to attend a hands-on demo that the system is worth jumping into. No sensible merchant wants to rely on blind faith, even if there is a "trial" window available. So it is pretty impressive that Harbortouch has been slowly releasing testimonial videos from some of their clients.

New PayAnywhere (Free) Tablet Storefront Solution Is Here

First the good news: North American Bancard (NAB) has a new PayAnywhere branded mobile tablet-based processing program which offers the placement of a free counter-top system and some great new options built around a 10 inch Android tablet (plus an additional mobile card reader for phones or tablets). It is one of the most affordable processing solutions on the market that takes advantage of mobile solutions at highly competitive rates with a future-ready, upgradable combination of hardware and software. It will become EMV compliant and is consistently being updated on the software side to take advantage of the latest technology while offering more enhancements to merchants. The program is very similar to the previous Phone Swipe Tablet Program which NAB been providing, but without the high volume requirements.

Processing of Visa, MasterCard, Discover, American Express and the new PayPal card are all available with Next Day Funding and a lower swiped rate than Square or any "Pay As You Go" style programs, and still without additional transaction fees.

Having stated the good news, you might expect that there is bad news to counter it. But there isn't, at least not in the sense of anything new about the processing industry. Instead, there is the caveat that merchants still must deal with the same basic pricing and service of typical merchant accounts, including the PCI responsibilities and standard fees. Moreover, however, this program is not a "one size fits all" solution. If merchants are not processing over $5,000 in monthly charges, there is a good chance this program is not for them. On the other hand, it could save the right merchants a lot of money, offer a forward-thinking alternative to standard terminals and increase both productivity and profits. All will be revealed after the jump...

Harbortouch "Free" POS System Program, Simplified

I recently had the opportunity to expand my consulting service with the products offered by Harbortouch, aka United Bank Card, Inc. (UBC). UBC is a very similar company to the other processors I use, in terms of size and offerings and the flexibility of pricing, so there was little incentive for me to go through the paperwork until I looked deeper into their Point of Sale terminal program. As it happened, I had a client who was looking for a POS system and we decided to do some number crunching and some feature comparisons. What we found surprised me.   

My first impression was that the Harbortouch program would probably fall into the "too good to be true" category. Everyone who has been around the block knows that "free" terminals generally means that you get to borrow the equipment if your pricing structure is high enough. That's fine for most businesses, because the minimum pricing requirements to qualify for equipment placement are usually offset by the savings of not having to purchase new equipment combined with the ability to exchange a defective or outdated machine at little or no cost. The one thing that often does get merchants with equipment placement is that they are likely (but not always) locked into a 3-year term with a cancellation fee that is higher than the price of a terminal. But here we are talking about standard counter-top card swiping terminals and nothing beyond that. When moving into POS territory, things become a bit more complicated. And, in this case, more enticing.

Phone Swipe Tablet Placement Program Update

What It Is

The new Phone Swipe processing plan from North American Bancard offers a free tablet for merchants to use and lower rates than "Pay-As-You-Go" plans, or even most monthly processing plans.

Who It's For

The merchant requirements for this new processing program ("Option C") are a little steeper than in  the standard Phone Swipe programs. For "Option A," which has a $14.95 monthly cost but a wide range of structures customized by the agent for each merchant, the only real minimum is that the merchant processes over $2,000 each month (and really should tend toward $2,500 and up), because that is where it becomes cost-effective. For "Option B," commonly known as the "Pay-As-You-Go" plan, there are very few requirements at all. 

In order to process with the "Option C" plan, however, merchants need to be processing over $10,000 every month and also must have a processing history to show this. At least the most recent month's statement will be required to submit to the underwriting department after the application is sent in (via a secure web form filled out by the merchant after receiving an email from the agent who is setting it up). 

What's the Catch?

Recommended Solutions

One Size Does Not Fit All

One of the most important things for merchants to remember is that what works best for one business may not be a good fit for another. This applies in almost every area of business, and the processing set up for a business is no different. Except in one way: every merchant wants the cheapest solution that will serve their needs.

The problem is, what saves one merchant money may not save another merchant who does business very differently. Having the lowest transaction fees is terrific until it means that all transactions are going to have to be stored for later because a merchant is trying to save on mobile processing fees, only to discover that more charges are downgraded and other charges are simply not approved... In fact, there are dozens of considerations to be made before ensuring that the merchant has the best program set up.

Some generalizations remain true

It is always in the best interest of a merchant to save money. The rates and fees set by Visa, MasterCard, Discover, American Express, et al,  are varied by card type and transaction type, and even have built in adjustments by industry. There are ways in which the processing companies have worked to save merchants on some types of charges while profiting off other types of charges. This was the birth of "Tiered" pricing.

A good "Tiered" deal may actually save a merchant money over an Interchange-based plan. This may be the case when the Mid- and Non-Qualified markups are not excessively high and the Qualified rate itself is low, because many cards may be processed at very little profit or even at a loss for the processing company, versus the consistent markup on every charge as processed via an Interchange-plus agreement. These kinds of "Tiered" plans are pretty rare, however, and many merchants find that their "Tiered" rates are raised periodically to compensate for the increase in Interchange costs for a few card types every six months or so. This is also assuming that the Interchange-plus plan is based on the typical "book rates" from most processors (likely 50 basis points over cost).

I generally believe that Interchange-based plans are the most fair-minded and often the most cost-effective. There is no undue rounding up on rates, no downgrading. And there is usually no additional transaction fee to go along with the downgrades, either. A merchant pays the cost of processing with a nominal surcharge on the total and a reasonable fee per transaction. This "cuts the fat" and makes the costs much more equitable most of the time. Still, this sort of plan sometimes looks complicated and does not work best for every merchant, so the pros and cons must be examined.

Recommended Solutions

I like to put my merchant clients into a narrow range of solutions whenever possible. For some, they have an existing POS system that needs to be reprogrammed and it is as simple as discovering what processing company will interface best with the POS system and then setting an account up with the proper parameters and lowest available cost. I'll use the First Data network for most POS systems, because I can provide that through a third party at much less than First Data usually charges merchants who have accounts directly set up through their processing wing. Plus, I'll do it with no long-term contracts and without cancellation fees. I can also process over the Global Payments network, or through a gateway like Authorize.net. For most high volume businesses, this sort of solution is perfect for them. They have the hardware already, I'll simply provide them with better numbers. I'm not precisely in the POS business, but I have the ability to set up several types of systems and can provide a limited range of them as well.

PhoneSwipe Just Got Better

This is just a quick update for those interested in the fast-paced world of mobile processing. As we all know, SquareUp is in bed with Starbucks now. The little white cube is becoming more and more ubiquitous. SquareUp's goal is to make smartphones the new wallet, something that Google also has its eye on and even PayPal has jumped into the game. But what about just getting the best rates for a mobile solution, without the additional motive of sticking your customers with a singular means of paying that only a select few merchants can accept?

Stripping away the branding and the nifty (if unnecessary for the most part) bells and whistles, you are left with a small group of needs. Merchants want low rates and they often want a modest POS system to make transactions easier. While Square does offer a nice version of their software for the iPad, and now some iffy flat monthly rates that might save a small business some money (in a rather narrow window, if you ask me), the recent upgrades in the PhoneSwipe service offered through North American Bancard seem to make it a much more obvious choice for a wider range of businesses.

Lets look at the updated terms rolled out this month.

Mobile Payment Processing Options Growing

The options available for merchants of any scale to process credit cards have been growing at a rapid pace. In fact many service providers in the industry have been tripping over themselves in their attempt to keep pace with innovations and also carve out their niche to give the appearance of being a better deal than their competitors. Essentially, there is little difference between the majority of services offered on the mobile market, but the small differences may be significant enough to make one or another of the options a better fit for any particular merchant.

An important point to mention here is that the industry and products are changing. This is a snapshot of offerings as they are available in May, 2012. The broad strokes are likely to remain intact for a while, but it never hurts to double check the industry trends. Also, because the big, bad Visa and MasterCard corporations adjust their Interchange rates and fees every six months or so, pricing may fluctuate over time.

"Mobile" payments used to be relegated to the likes of PayPal, which meant processing from your computer at relatively high rates or perhaps using a phone service that required calling in and using touch tone entry of the card number, also at high rates. Other PC based solutions existed that allowed for card swipers to be attached to a laptop, and these usually required service providers that had merchants hooked on long-term contracts. And there were high-priced mobile terminals that were built around cell phone chips that came with expensive monthly fees.

Technological Revolution Drives the Mobile Processing Industry

Then the smartphone began opening up the realm of mobile computing. With many phones and tablets on the market today being more powerful than the laptops of just a few years ago, it makes sense that this power would be harnessed to do more work for every aspect of business. Innovative companies like SquareUp were strong out of the gate with a product that merchants were hungry for. Online pioneers like PayPal have been slow to catch up, while numerous processing companies have stepped in to fill the gap between the expensive mobile processing solutions and traditional lower-cost merchant services contracts.

What Should Make A Merchant Want To Change Processing Companies?

Merchants must ask themselves why they would consider changing their processor. Perhaps even before the next sales representative walks through their door, seeking their business, it would be a good plan to have the answer in place

Nobody likes wasting their time

As an agent in the field, I can assure any merchant out there that nobody in a sales position enjoys wasting their time. If a sales rep is going to put in the effort to sign a merchant, he or she is going to appreciate knowing the merchant's actual wants and needs. And the merchant will save both time and money by being aware of his or her own expectations. In actuality, if the agent is honest and the merchant is above board, both are on the same side. Many merchants feel adversarial toward sales reps of any stripe, often with good reason. Being on the same page, however, is a win for both the merchant and the rep. The rep may not see the huge profit or windfall initially hoped for, but the relationship should be much more solid and the retention of the client much more likely.

Top Reasons To Consider Switching Credit Card Processors

Consider this check list as a starter only. Every merchant will have different issues that they want to consider and different values attached to each. What ranks as most important to one merchant (i.e., cost savings or next day funding) may be of little importance to another. And it may be that if a merchant has ten things on the list, one or two of them might be flexible options if the other 8 or 9 are going to be handled well.

When Does It Make Sense To Switch Credit Card Processors?

As a field sales rep in the credit card processing industry, it is important to understand when it is really in a merchant's best interest to switch processing companies. It is even more important for the merchant to be aware of when it is the proper choice. Let's be honest, a sales rep wants the merchant's business. The merchant should simply want what is best for his or her bottom line.

Fear of Change

Most merchants suffer from the same basic phobia with regard to anything involving their banking situation. "If it ain't broke, don't fix it" seems to sum up the excuse for retaining the status quo. To a certain extent, this is reasonable thinking. Functioning processing that gets funds deposited where they are supposed to be is the primary concern of many merchants. A processor that has done this for some time is a known commodity and therefore is also in the merchant's comfort zone. This does not  necessarily mean it is the correct option for the merchant.

When deciding whether to make a change away from a company that has been successfully processing on behalf of a merchant, there are always a few considerations:

• Contractual obligations or cancellation fees
• Ease of transition
• Guarantee of rates and fees
• Terminal purchase, lease or rental
• Reprogramming time requirements
• Customer loyalty or working relationships
• Fair treatment
• Company perception
• Trust

And the list really can keep growing quite easily.