Card Security & Tokenization- Are You on the Right Track? Debbie Cook Strategic Account Executive September 9, 2016

Transcription

1 Card Security & Tokenization- Are You on the Right Track? Debbie Cook Strategic Account Executive September 9, 2016

2 Card Security & Tokenization Are you on the right track? Fraud and data breaches What is EMV What is Tokenization How Do They Work How Will these Changes impact my credit union How EMV and Tokenization are changing the EFT industry

3 FRAUDULENT PURCHASES MADE GLOBALLY BILLION IN 2015

4 TIME AVERAGE CREDIT UNION SPENT ON CARD FRAUD ISSUES IN 2015 HOURS

5 MONEY AVERAGE CREDIT UNION SPENT ON CARD FRAUD ISSUES IN 2014

6 OF CONSUMERS WOULD CONSIDER CHANGING FINANCIAL INSTITUTIONS IF MONEY AND DATA WOULD BE SAFER

7 Global Consumers: Losing Confidence in the Battle Against Fraud Report by: ACI Worldwide and the Aite Group Our latest report shows that card fraud remains an issue of deep concern for consumers worldwide. As fraudsters are getting more organized it is fair to say that at this point in time, the assumption should be made that almost all users credentials and card information has been compromised. It is also no surprise that there is a direct correlation between fraud rates and consumer trust and loyalty. As our data illustrates, for financial institutions it is more critical than ever to implement effective fraud prevention solutions.

8 NEWS EMV Migration, Plus Cardholders Own Behavior, Propel Card Fraud in the U.S. July 13, 2016 By Kevin Woodward The percentage of U.S. consumers who experienced credit card fraud in the past five years leaped from 41% in 2014 to 47% in 2016, according to the 2016 Global Consumer Card Fraud: Where Card Fraud is Coming From report by Aite Group LLC. The study indicates the most common risky behavior among U.S. consumers is: Leaving a smart phone unlocked Throwing documents containing account numbers in the trash Using online banking or shopping sites without security software or on a public computer Writing a PIN on a piece of paper Responding to calls or s asking for banking information

9 Fraud Rates by Country Global Consumers: Losing Confidence in the Battle Against Fraud, was conducted by ACI Worldwide and the Aite Group

10 Still Insecure 781 U.S. Data Breaches in MILLION Total Records Stolen This Year 5,000,000+ Financial/Banking/Credit Records Stolen in 2015 Source: Identity Theft Resource Center

11 # of Breaches # of Records Banking/Financial 15 5,262 Business 234 2,428,342 Educational ,196 Government/Military 29 5,634,371 Medical/Healthcare 171 4,374,017 TOTAL ,808,188

12 Data Breaches

13 Insecurity think mobile wallets are safe in store are reluctant to try a mobile wallet because of security think they ve surrendered their right to privacy Consumers feel fatigue and denial

14 TECHNOLOGY TO THE RESCUE?

15 EMV and Tokenization What is EMV EMV and chip are often used interchangeably. EMV is an openstandard set of specifications for smart card payments and acceptance devices which was developed by Europay, MasterCard Visa in 1993 to insure interoperability between chipbased payment cards and terminals (Amex & Discover) An EMV-enabled chip card contains a small microprocessor chip embedded on the front as well as a magnetic stripe Chip contains an operating system and one or more applications Encrypted microchip is extremely difficult to copy or counterfeit

16 What s the Difference? EMV TOKENIZATION Card-Present Security for plastic cards Authenticates using cryptography Deters counterfeit cards Uses a processing chip implanted in the card Security for digital environment (online, mobile) Replaces card data with tokens that can t be used by others Also uses cryptography Powers security in Apple Pay, Android Pay and Samsung Pay 16

17 EMV and Tokenization What is EMV in the US EMV in the US is unique Impact Requires both a global and a common AID WHY 17 US domestic Networks and Federal Regulation II (Durbin) requiring 2 unaffiliated PIN Networks. Unique Chips Unique POS terminals Unique ATM readers Unique software to run it all for everyone (merchants, financial institutions, card manufacturers and card vendors, networks, EFT processors, core s

18 EMV and Tokenization EMV How will EMV impact my financial institution If you are a Visa issuer PAVD (Pin Authorized Visa Debit) Fallback transaction Did you issue net new PAN (card numbers) Your budget Your resources Staff education Customer education FRAUD Is it making a difference

19 EMV and Tokenization EMV How Does it Work Card transactions: A cardholder inserts an EMV-enabled card into an EMV reader The card and terminal enter into a dialog The card must stay in the reader throughout the transaction OR DOES IT? Member education regarding new usage experience is critical U.S. EMV cards will still have a magnetic stripe on the back ATM transactions: PIN validated online by the host POS transactions: May require entry of a PIN or a signature verification on a receipt

20 EMV and Tokenization What s New Visa and MasterCard Offer Faster EMV April 27, 2016 by Diana Asatryan Visa released its new technology, dubbed Quick Chip, last week, claiming it will cut the time it takes to pay using a chip-enabled card to two seconds. Quick Chip allows your customers to remove their card from payment terminals before the transaction amount is finalized or before the authorization response has been received, the company said. MasterCard announced of a similar solution M/Chip Fast. Our solution brings some of the principles successfully implemented for contactless cards and mobile wallets around the world to point-of-sale terminals, according to a company blog post.

21 EMV and Tokenization EMV What s New

22 EMV and Tokenization EMV Caution don t believe everything you read

23 PARTIES INVOLVED IN EMV IMPLEMENTATION 201 4

24 EMV and Tokenization How will EMV impact my financial institution SAMPLE implementation time line

25 State of the Industry October 1 st

26 EMV in Late 2015: What About Merchants? EMV PAYMENT TERMINALS LAG BEHIND CREDIT CARD ISSUANCE 100% 75% 50% 25% 0% EMV Credit Cards EMV Enabled Terminals Source: Mercator Advisory Group Estimates

27 Data Breaches and Lawsuits Class Action Lawsuit for lackadaisical security measures 1,025 locations affected by Malware Breach may be larger than Home Depot and Target combined CUNA/20 Credit unions have filed a lawsuit

28 The $8.65 Billion Question EMV conversion will cost $8.65 billion: ,000 BILLION MILLION ATMS Credit and debit cards POS terminals Source: Javelin Strategy and Research

29 Visa New EMV Data (July 2016) million chip cards currently in the U.S. market million Debit & Credit U.S. added more than 100,000 chip-enabled merchant locations last month total # of 1.3 million Since liability shift - 35% decrease in amount of counterfeit fraud compared to the prior year. Top five states for chip-ready merchants California, Connecticut, New Jersey, Michigan and Pennsylvania.

30 EMV and Tokenization

31 Tokenization 101 Card number replaced by randomly-generated token Specific to the phone Changes the game for data breaches Token can be disabled with card still protected Process is effortless to consumer Credit union authorizes with actual card number

32 Tokenization Announced Sept 9, 2014 iphone 6 and 6 Plus both support NFC/Touch ID payment and in-app payments through Apple Pay. Apple sold more than 10 million iphone 6 and 6 Plus models over the first weekend. 1 million cards registered in Apple Pay during first 72 hours Tokenization 1,043 U.S. Issuing FI s 3 million locations in U.S accept Apple Pay

33 Tokenization 33 What is Tokenization

34 Tokenized Transaction Flow for Apple Pay 34

35 TOKENIZATION TAKES HOLD Google (Android) Pay and Samsung Pay Tokenization Android Pay and Samsung Pay Different technology than Apple Pay Android is an open source code with thousands of versions so the secure element used in Apple Pay is not a viable solution Both Android Pay and Samsung Pay use Host Card Emulation (HCE) Samsung also includes Magnetic Secure Transmission (Loop Pay/MST) Tokenization of PAN and NFC are common among all three wallets Samsung (LoopPay) / Google (Android) Pay work with virtually any POS terminal

36 What s the risk of not participating? Missing the boat: If you don t offer it, someone else will. Looking soft on security Missing the opportunity to shine with new technology Losing the Millennial audience

37 Counterfeit Cards Down, Other Types of Fraud Up? COUNTERFEIT CARD FRAUD CARD-NOT-PRESENT FRAUD during the first 10 years of EMV in the U.K. in the U.K. between 2005 the year of their liability shift and 2008, when it peaked

38 Card Not Present Fraud 53.92% respondents stated their credit union has experienced a spike in card-not-present fraud. Credit Union Times reported fraud attacks on U.S. merchants rose 11% after the EMV liability shift. Overall, fraud attacks (both successful and non successful) spiked 215% overall in 2015, which translated to 27 fraud attacks for ever 1,000 online transactions at the end of 2015 compared to nine fraud attacks for every 1,000 online transactions at the beginning of 2015.

39 Upgrading ATM s MasterCard October 1, 2016 liability shift for ATM s Visa 2017 Install new card readers that support chip cards. Upgrade support software as well as infrastructure or purchase new ATM s.

40 Analyze This: Data Detects Fraud 1. Distinguish purchasing patterns and behaviors 2. Identify at-risk cards 3. Flag merchant points of compromise 4. Integrate transaction and demographic data

41 WHAT S THE FUTURE?

42 Mobile Menace? Mobile fraud rose 70% in 2014, according to Forrester. And mobile growth is far from leveling off: The Internet of Things will span 4.9 billion connected devices this year, 25 billion expected by (Gartner) With that explosive growth, millions of additional mobile payment opportunities will occur without conscious effort. Starbucks alone does 6 million transactions/month through their mobile app (21% of their total transactions). Wearables currently $3 billion in worldwide payment transactions, expected to reach $500 billion in 2020.

43 Payments are Everywhere #Cashtag

44 EMV and Tokenization Tokenization Where are we and what s new Moving forward slowly New Wallets EVERY DAY! 44

45 HOW DO CREDIT UNIONS RESPOND?

46 And now for something

47 Mobile Meets Card Payments Control on the Go! Ability to set alerts and controls to monitor card activity Add-on component to current processing offering Mobile app for easy access Adds a new dimension to transactions 47

48 Broad Appeal Deliver Appeal and Build Loyalty. Offers individual cardholders greater control and security against fraudulent activity Empowers parents to monitor and limit children s spending Gives employers effective tools to manage company-issued cards Helps credit unions increase security and build member loyalty, moving their cards to top of wallet

49 CardNav Solutions Add an Extra Layer of Security. CARDNAV IS AVAILABLE IN TWO WAYS STAND-ALONE APP Ready-to-go card control solution Members see your logo and brand identity once they log in API SOLUTION Leverages your existing mobile banking app by integrating card control and alert capabilities Customizable with your own brand identity within your current app

50 Impact of CardNav Technology First Six Months Usage Source: 2013 OnDot Systems Mobile Card Services Case Study

51 HOW DO WE START?

52 Fraud and Risk Management Tools

53 Card Fraud and Risk Education Internal actions Strengthen notification processes to customers for changes made to their accounts: Any changes (address, phone number, etc.) made to a cardholder s account by the cardholder should to be verified with the customer. This can be accomplished by the following: Sending a confirmation to the original provided by the cardholder. A follow-up letter to the original address of the cardholder. A phone call to the original phone number on file. Gather current information By setting standard practices in place with tellers, notifications, etc. for updating: addresses Home phone numbers Mobile phone numbers

54 CREATE A STRATEGY Create a Business Plan Calculate Timeframe Get the Right People to Lead the Charge Educate the Entire Team Communicate

55 EDUCATION BUILDS 7 Things Your Members Need to Know 1. EMV transactions are well worth the wait 2. EMV payment terminals are not all the same 3. Full U.S. migration to EMV will likely take years 4. EMV is the global security standard today 5. ATMs are converting to EMV 6. Members can and should play an active role

56 7. EMV prevents card fraud but not all fraud

57 Value Added Fraud Protection Suite

58 Develop Your Role as a Trusted Expert CO-OP Marketing Materials are available at

59 HERE TO HELP EMV Planning & Rollout (visit for recorded webinars, white papers, blogs, Ask the Expert site and links to external resources. Tokenization & Apple Pay CardNav App & API State-of-the-Art Fraud Detection & Analytics 24/7 Call Center Support