Security Threats Facing Online Payment Gateways

[Guest Post by Arthur Jones]

Most experts agree: it is a brave new world for payment gateway providers, which presents both opportunities and challenges. For nearly a decade, cyber security professionals have been warning about the ongoing rise of cybercrime. Agencies like the FBI regularly put out reports detailing the threats to the financial services industry, in particular. As outlets like TechRepublic have reported, this trend is only going to continue, and we may see record levels of cybercrime activity this year.

What kind of threats can we expect to face for online payment gateways? Let’s look at some major security challenges and how they may be addressed payment gateway providers as they continue to innovate and remain competitive in the marketplace.

Information Attacks

It is safe to say that a data breach is one of the most serious threats for payment gateways. Attacks like these can come in many different forms, and because they are smaller and require fewer resources, they are easier to carry out and occur much more frequently. If an attacker gets their hands on sensitive financial information, the losses can be catastrophic, putting companies at the risk of irreparable damage to customer trust.

There are many ways for attackers to breach a system. Phishing attacks consist of fake emails that can trick users into opening harmful links and installing malware or giving up sensitive information. Such attacks can open up system vulnerabilities, giving attackers access to valuable information.

Untrustworthy insiders can also get access to sensitive information and compromise security systems from within the business. Or hackers can gain access to sensitive systems through security breaches in compromised hardware and software.

Credit Card Fraud

Payment gateway providers may be concerned about threats to their internal data systems, but there are external threats to take into account as well. Attackers use skimming devices and other technologies all of the time, which can steal credit card information wherever a credit card is used. After this sensitive information is acquired, attackers can commit credit card fraud wherever they please, which can go undetected until banks or card holders notice suspicious activity related to any compromised accounts.

This is a sort of “death by a thousand cuts” threat for payment providers, as constant small attacks on credit card holders’ information can result in the gradual erosion of customer trust.

DDoS Attacks

Distributed denial of service (DDoS) attacks are a little trickier to deal with, as they can be very powerful and destructive on a systematic level. DDoS attacks are becoming more sophisticated, in that the attackers are finding specific structural weaknesses in internet infrastructure, and then exploiting those weaknesses to bring down large and powerful institutions. Additionally, the expanding internet of things (IoT) makes it much easier for attackers to use internet-connected devices like appliances, TVs, security cameras, and other machines to flood servers with requests, which crashes them.

Typically, only the largest financial institutions are targeted by these attacks. However, hackers are increasingly attacking broader internet structures like the DNS system, which can crash a wide range of businesses’ websites that are using the infrastructure. Fortunately, large attacks such as these have been less frequent, and most payment gateway companies will not have to deal with attacks like these as much. Nevertheless, a downed server poses a threat for payment gateway providers if they’re not able to process transactions in a timely manner.

Safer Transactions

It is important for cyber security professionals, payment gateway providers, and other financial services businesses to continue to develop secure technologies to protect their systems and data. The most promising avenues include advanced encryption, tokenization, and authentication methods, which go a long way towards cutting down on common cyber-attacks. The Payment Card Industry Data Security Standard (PCI DSS) is a powerful industry-wide tool to increase security with, and innovation in this field is welcome as well. Further, proper employee training can go a long way to reduce risk exposure. Ultimately, payment gateway providers and other tech and financial services businesses who innovate in these areas will come out stronger in the future.

Author Bio: Arthur Jones is a consultant for Allied Wallet. He is an innovator in eCommerce services and everything a company needs for success including a global payment gateway system, a prepaid affiliate debit card program, and much more. Arthur has extensive experience in the eCommerce and merchant services industry, and regularly writes about it for interested readers.

IMAGES:

https://pixabay.com/en/credit-card-payment-credit-card-1730085/

https://pixabay.com/en/technology-servers-server-1587673/

PayAnywhere Storefront POS-Lite Updates to Version 2.2

The Most Affordable POS System Just Got Upgraded

North American Bancard's PayAnywhere Storefront payment application for Android just got a major tweak. While it still is not a replacement for a full-POS system like Groovv or ShopKeep, it remains a perfect solution for small retail businesses that do not need the system to control the stock of hundreds of inventory items, maintain open checks or log employee hours. PayAnywhere Storefront still allows the input of inventory items for quick checkout (it just doesn't keep track of what is in stock) and offers a wide array of sales reports. But mostly it offers one of the most cost-effective checkout systems for merchants who want to keep low rates and low fees while still tapping into the most-wanted features of the higher-priced systems and taking advantage of added mobility.

New Features in PayAnywhere Storefront 2.2

• Faster checkout! Merchants no longer have to press an extra button before swiping -- just run the card through the card reader and get that transaction going. There is also a novel new feature to

Affordable Tablet POS Systems That Support Open Checks and Tips from Groovv and ShopKeep POS

Android and iOS based POS Systems perfect for small and mid-size restaurants, coffee shops, bars or any business that accepts tips or open tabs.

Most mobile credit card processing solutions are not able to handle tips or open checks (tabs) at all, acting strictly as the equivalent of a counter-top terminal for swiping or key-entering a single transaction. This works well enough for most people, who rarely will need modifiers of any sort. However, business owners wishing to move away from or avoid altogether the high-priced POS systems now are seeing viable options appear in the affordable tablet-based solutions entering the market.

While affordable solutions such as Harbortouch have begun presenting themselves in the market for full POS systems required for high-inventory merchants who need extensive employee tracking and reporting for the accountant, the mobile marketplace has seen an explosion recently with excellent retail solutions like

New PayAnywhere (Free) Tablet Storefront Solution Is Here

First the good news: North American Bancard (NAB) has a new PayAnywhere branded mobile tablet-based processing program which offers the placement of a free counter-top system and some great new options built around a 10 inch Android tablet (plus an additional mobile card reader for phones or tablets). It is one of the most affordable processing solutions on the market that takes advantage of mobile solutions at highly competitive rates with a future-ready, upgradable combination of hardware and software. It will become EMV compliant and is consistently being updated on the software side to take advantage of the latest technology while offering more enhancements to merchants. The program is very similar to the previous Phone Swipe Tablet Program which NAB been providing, but without the high volume requirements.

Processing of Visa, MasterCard, Discover, American Express and the new PayPal card are all available with Next Day Funding and a lower swiped rate than Square or any "Pay As You Go" style programs, and still without additional transaction fees.

Having stated the good news, you might expect that there is bad news to counter it. But there isn't, at least not in the sense of anything new about the processing industry. Instead, there is the caveat that merchants still must deal with the same basic pricing and service of typical merchant accounts, including the PCI responsibilities and standard fees. Moreover, however, this program is not a "one size fits all" solution. If merchants are not processing over $5,000 in monthly charges, there is a good chance this program is not for them. On the other hand, it could save the right merchants a lot of money, offer a forward-thinking alternative to standard terminals and increase both productivity and profits. All will be revealed after the jump...

New Phone Swipe Promo, What It Really Means

North American Bancard just released a new promotional push for its Phone Swipe product, touting it as a new, first of its kind deal for 2014. The text of the promo reads:    

"This January, be the first in the industry to offer Visa, MasterCard, Discover and even AMEX at 2.69% with next day funding to all pay-as-you-go customers! It's just another reason why Phone Swipe is the mobile payments solution that sells itself!"  

Since the next day funding option has been standard for new accounts since mid-2013, and since American Express cards have been processing on Pay-As-You-Go accounts at the same qualified rate as Visa, MasterCard and Discover for the same period, I wanted to find out which part of this was supposed to be new for the new year. Well, it turns out that it isn't new and nothing has actually changed in the program. The spin is simply the suggestion that agents should take time now - in January - to point out that Phone Swipe is the first processor to offer qualified charges for the main card carriers at this rate. Agents and merchants should still be aware that the same mid/non-qualified downgrade of 80 basis points continues to apply to all accounts on the Pay-As-You-Go plan, along with the $0.19 transaction fee for business signature cards and even rewards cards.

Does this make the Phone Swipe program a bad deal?

If you have read this blog before, you know that I have endorsed Phone Swipe for a long time. I even

PCI DSS 3.0: The end of store and forward on mobile?

It is time for new PCI changes to get implemented. Last February (2013), the PCI Security Standards Council released a document on mobile payment security guidelines. While it is not the most entertaining read in the history of guidelines, it does shed light on some of the changes we are going to see implemented in the industry over the coming year. In November, expect to see a new set of regulations being handed down, to be fully implemented by the star of 2014. But most processors, not wanting to find themselves caught in the awkwardness of being out of compliance when the date hits, attempt to get on the bandwagon as early as possible and will demand the same of their merchants.

Harbortouch "Free" POS System Program, Simplified

I recently had the opportunity to expand my consulting service with the products offered by Harbortouch, aka United Bank Card, Inc. (UBC). UBC is a very similar company to the other processors I use, in terms of size and offerings and the flexibility of pricing, so there was little incentive for me to go through the paperwork until I looked deeper into their Point of Sale terminal program. As it happened, I had a client who was looking for a POS system and we decided to do some number crunching and some feature comparisons. What we found surprised me.   

My first impression was that the Harbortouch program would probably fall into the "too good to be true" category. Everyone who has been around the block knows that "free" terminals generally means that you get to borrow the equipment if your pricing structure is high enough. That's fine for most businesses, because the minimum pricing requirements to qualify for equipment placement are usually offset by the savings of not having to purchase new equipment combined with the ability to exchange a defective or outdated machine at little or no cost. The one thing that often does get merchants with equipment placement is that they are likely (but not always) locked into a 3-year term with a cancellation fee that is higher than the price of a terminal. But here we are talking about standard counter-top card swiping terminals and nothing beyond that. When moving into POS territory, things become a bit more complicated. And, in this case, more enticing.

Phone Swipe Tablet Placement Program Update

What It Is

The new Phone Swipe processing plan from North American Bancard offers a free tablet for merchants to use and lower rates than "Pay-As-You-Go" plans, or even most monthly processing plans.

Who It's For

The merchant requirements for this new processing program ("Option C") are a little steeper than in  the standard Phone Swipe programs. For "Option A," which has a $14.95 monthly cost but a wide range of structures customized by the agent for each merchant, the only real minimum is that the merchant processes over $2,000 each month (and really should tend toward $2,500 and up), because that is where it becomes cost-effective. For "Option B," commonly known as the "Pay-As-You-Go" plan, there are very few requirements at all. 

In order to process with the "Option C" plan, however, merchants need to be processing over $10,000 every month and also must have a processing history to show this. At least the most recent month's statement will be required to submit to the underwriting department after the application is sent in (via a secure web form filled out by the merchant after receiving an email from the agent who is setting it up). 

What's the Catch?

PhoneSwipe Just Got Better

This is just a quick update for those interested in the fast-paced world of mobile processing. As we all know, SquareUp is in bed with Starbucks now. The little white cube is becoming more and more ubiquitous. SquareUp's goal is to make smartphones the new wallet, something that Google also has its eye on and even PayPal has jumped into the game. But what about just getting the best rates for a mobile solution, without the additional motive of sticking your customers with a singular means of paying that only a select few merchants can accept?

Stripping away the branding and the nifty (if unnecessary for the most part) bells and whistles, you are left with a small group of needs. Merchants want low rates and they often want a modest POS system to make transactions easier. While Square does offer a nice version of their software for the iPad, and now some iffy flat monthly rates that might save a small business some money (in a rather narrow window, if you ask me), the recent upgrades in the PhoneSwipe service offered through North American Bancard seem to make it a much more obvious choice for a wider range of businesses.

Lets look at the updated terms rolled out this month.

Why a Merchant Should Never Pay Over 4% in Total Processing Costs

How to spot a bad processing deal 101

It's true: I've spoken with merchants who thought that they were paying a fair price on their processing service even though the aggregate total they were spending for a month of processing was coming out in the range of 5 to 7%. That's right, because they had been with the same service for years and it was provided by a "reputable" company (or even their own bank), these merchants assumed that they were paying market rates and not getting ripped off. But they were wrong.

One of my clients, a plumber, had been paying over 7% when the "discount" rates and transaction fees and monthly fees had all been added together. When he told me this I responded that I was sure he must be mistaken, that no legitimate company should be setting him up at rates that high for his business. But there were his statements, clear as day, and he had been with this same processor for over a decade, just handing the company his hard-earned cash.

All a merchant has to do is check their bottom line. If your total costs to process exceed 4% for any given month and you swipe cards in a retail environment, you have a bad processing deal. Period. Go ahead and figure in the cost of PCI compliance, too. If you're still over 4%, there is a better option on the market. Even if a merchant is primarily processing keyed-in transactions via the Internet, phone or mail order, the total costs should normally be under 4% as well. (Because of some additional costs to process through gateways or shopping carts online, those expenses may need to be removed from this discussion. However, many businesses do spend much more than necessary on gateway fees, so those ought to be examined carefully as part of the bottom line.)

Mobile Payment Processing Options Growing

The options available for merchants of any scale to process credit cards have been growing at a rapid pace. In fact many service providers in the industry have been tripping over themselves in their attempt to keep pace with innovations and also carve out their niche to give the appearance of being a better deal than their competitors. Essentially, there is little difference between the majority of services offered on the mobile market, but the small differences may be significant enough to make one or another of the options a better fit for any particular merchant.

An important point to mention here is that the industry and products are changing. This is a snapshot of offerings as they are available in May, 2012. The broad strokes are likely to remain intact for a while, but it never hurts to double check the industry trends. Also, because the big, bad Visa and MasterCard corporations adjust their Interchange rates and fees every six months or so, pricing may fluctuate over time.

"Mobile" payments used to be relegated to the likes of PayPal, which meant processing from your computer at relatively high rates or perhaps using a phone service that required calling in and using touch tone entry of the card number, also at high rates. Other PC based solutions existed that allowed for card swipers to be attached to a laptop, and these usually required service providers that had merchants hooked on long-term contracts. And there were high-priced mobile terminals that were built around cell phone chips that came with expensive monthly fees.

Technological Revolution Drives the Mobile Processing Industry

Then the smartphone began opening up the realm of mobile computing. With many phones and tablets on the market today being more powerful than the laptops of just a few years ago, it makes sense that this power would be harnessed to do more work for every aspect of business. Innovative companies like SquareUp were strong out of the gate with a product that merchants were hungry for. Online pioneers like PayPal have been slow to catch up, while numerous processing companies have stepped in to fill the gap between the expensive mobile processing solutions and traditional lower-cost merchant services contracts.