End to End Encryption, Tokenization & EMV in the U.S. Vendor Analysis of Emerging Technologies and Best Hybrid Solutions

Transcription

1 Brochure More information from End to End Encryption, Tokenization & EMV in the U.S. Vendor Analysis of Emerging Technologies and Best Hybrid Solutions Description: If the merchant s cardholder data can be taken out of scope or rendered useless to the criminal through methods such as end-to-end encryption, tokenization or EMV, fraud liability and costs associated with PCI compliance can be substantially reduced. A recent flurry of public data breaches has heightened awareness of both the need for and the cost of PCI compliance. The card industry and merchants alike are looking to protect sensitive card data in motion and at rest. The National Retail Federation estimates that more than $1 billion has been spent by merchants on PCI compliance to date,1 despite existing card fraud increasing 16% to reach $22 billion in 2008 alone. But the question remains what method(s) makes the most sense for the card industry and merchants to adopt today, and how soon before the next technology comes along. Detailed comparisons of five newly announced processor solutions, including those of Chase Paymentech, Elavon, First Data, Heartland and RBS; five tokenization vendor solutions, Chase Paymentech, CyberSource, nubridges, RSA, and Shift 4; and six technology vendor solutions, Hypercom, Ingenico, MagTek, Semtek, VeriFone and Voltage, are included in this report. Primary Questions: - What impact would these solutions have for merchants? - What is the business case for these emerging technologies? - What are the best solutions? - What is end-to-end encryption? - What is card replacement technology or tokenization? - What is a virtual terminal? - How does EMV compare? - How do the vendor solutions compare? Methodology Javelin obtained this information through interviews with senior executives at five major payments processors: Chase Paymentech, Elavon, First Data, Heartland and RBS WorldPay; five tokenization vendors: Chase Paymentech, CyberSource, nubridges, RSA, and Shift 4; and six technology vendors: Hypercom, Ingenico, MagTek, Semtek, VeriFone and Voltage. Interviews were also conducted with MasterCard and Visa executives. The interviews were conducted in November and December 2009 with a follow-up survey in January This report was based on data collected via a standardized telephone CATI survey from 4784 consumers representative of the U.S. population, as to gender, age, ethnicity and income. Overall margin of sampling error is ± 1.4 at the 95% confidence interval. For questions answered by a proportion of all identity fraud victims the maximum range of sampling error varies and is greater than ± 4.4% at the 95% confidence level. Contents: Overview Methodology Executive Summary Definitions The Business Case for Emerging Technologies The PCI-PricewaterhouseCoopers Report on Emerging Technologies Credit Card Numbers 101 End-to-End Encryption

2 Format-Preserving Encryption Card Replacement Technology or Tokenization Encryption and Tokenization per Transaction vs. per Card Data Breach Guarantees Other Security Considerations Virtual Terminals Magnetic Stripe Imaging A Case for EMV Vendors Chase Paymentech CyberSource Elavon First Data Corporation Heartland Payment Systems Hypercom Ingenico MagTek nubridges RBS WorldPay RSA Semtek Shift4 VeriFone Voltage Appendix A: Detailed Comparison of Solutions (42 attributes compared) Processor Solutions: Chase Paymentech, Elavon, First Data, Heartland and RBS Technology Vendor Solutions: Hypercom, Ingenico, MagTek, Semtek, VeriFone and Voltage Tokenization Vendor Solutions: Chase Paymentech, CyberSource, nubridges, RSA, and Shift 4 Appendix B: GLOSSARY Related Research Companies Mentioned Table of Figures: Figure 1: Number of Breaches and Records Breached Per Year Figure 2: How Quickly Criminals Started Misusing Data after Compromise (Less Than One Week Only) Figure 3: Consumer Behavior Changes after Fraud Victimization Figure 4: Total Dollar Fraud Amounts for Existing Card Fraud by Credit vs. Debit Figure 5: Idealized End-to-End Encryption Figure 6: Examples of Encryption and Format-Preserving Technologies Figure 7: Hybrid End-to-End Encryption with Tokenization Figure 8: Virtual Terminal Example Figure 9: Magnetic Stripe Imaging Figure 10: EMV or Chip and PIN Figure 11: The Developing Secure Payment Ecosystem Figure 12: Processor Solutions- Detailed Comparison Figure 13: Technology Vendor Solutions-Detailed Comparisons Figure 14: Tokenization Vendor Solutions-Detailed Comparisons Figure 15: Idealized Tokenization Figure 16: Existing Card Fraud Rates and Mean Costs for 2008 and 2007 Figure 17: Means of Misuse: Online and In-Person Figure 18: Fraudulent New Accounts Opened Ordering: Order Online - Order by Fax - using the form below Order by Post - print the order form below and send to Research and Markets,

3 Guinness Centre, Taylors Lane, Dublin 8,

4 Page 1 of 2 Fax Order Form To place an order via fax simply print this form, fill in the information below and fax the completed form to (from USA) or (from Rest of World). If you have any questions please visit Order Information Please verify that the product information is correct. Product Name: Web Address: Office Code: End to End Encryption, Tokenization & EMV in the U.S. Vendor Analysis of Emerging Technologies and Best Hybrid Solutions SC Product Format Please select the product format and quantity you require: Electronic (PDF) - Single User: Quantity USD 1500 Contact Information Please enter all the information below in BLOCK CAPITALS Title: Mr Mrs Dr Miss Ms Prof First Name: Last Name: Address: * Job Title: Organisation: Address: City: Postal / Zip Code: Country: Phone Number: Fax Number: * Please refrain from using free accounts when ordering (e.g. Yahoo, Hotmail, AOL)

5 Page 2 of 2 Payment Information Please indicate the payment method you would like to use by selecting the appropriate box. Pay by credit card: You will receive an with a link to a secure webpage to enter your credit card details. Pay by check: Please post the check, accompanied by this form, to: Research and Markets, Guinness Center, Taylors Lane, Dublin 8, Pay by wire transfer: Please transfer funds to: Account number Sort code Swift code IBAN number Bank Address ULSBIE2D IE78ULSB Ulster Bank, Main Street, Blackrock, Co. Dublin, If you have a Marketing Code please enter it below: Marketing Code: Please note that by ordering from Research and Markets you are agreeing to our Terms and Conditions at Please fax this form to: (646) or (646) From USA or From Rest of World