Cyber Security in Retail

Transcription

1 Cyber Security in Retail Nick Kemske Director, Cyber Security Jacki Snyder Sr. Director Payments, Asset Protection and CIC Services 1

2 Cyber Security RANSOMWARE AND SKIMMERS 2

3 Ransomware A Retail Perspective 1. What it is and why it works 2. How to avoid it 3. Options for when it happens 3

4 Ransomware Video Video placeholder 4

5 Ransomware What You Can Do 1. Patch your systems regularly 2. Make sure you back-up your data 3. Do not pay the ransom 4. Know who to contact 5

6 Credit Card Skimmers Front Back Requires physical access Skimmers take a variety of forms and change constantly Skimmers target a wide variety of devices: retail payment terminals, selfcheckout terminals, gas station pumps, ATM machines, etc. 6

7 Credit Card Skimmers What You Can Do 1. Ongoing education for employees teach them normal 2. Inspect terminals often daily or during shift changes 3. Physically lock devices; use tamper evident controls 4. Adopt EMV chip and PIN 7

8 Cyber Security GOVERNANCE & COMPLIANCE 8

9 Payment Card Industry Data Security Standard (PCI DSS) OCT 31, 2016: PCI-DSS 3.2 becomes effective Notable new requirements: Access to PCI systems is going to be more restrictive. This may include vendors and support teams. Systems need to be assessed more often Systems may need to be reconfigured to the latest standards 9

10 EMV Update Europay, MasterCard and Visa Jacki Snyder Sr. Director Payments, Asset Protection and CIC Services August 9,

11 The Presentation Powered by 11

12 US EMV Stats as of June 30, % of credit cards have chips 26% of credit card transactions are chip on chip 10% of debit card transactions are chip on chip Credit card fallback rate is 2.9% Debit card fallback rate is 5.1% 42% of Visa cards are chip 52% of MasterCards are chip 26% of merchants are EMV enabled Dollar volume percent is greater than transaction volume Supervalu 64% of credit and debit transactions are conducted with an EMV card Fallback transactions are less than 1% 12

13 Fraud Stats & Tips Fraud Stats Card brands see a 26% reduction in fraud at locations that have implemented EMV Fraud is shifting to non EMV locations and ecommerce Overall fraud last year vs. this is +15% Chip on Chip transactions are expected to reach 50% in months then overall card present fraud will start to drop Tips for non-emv stores Validate last 4 of card to last 4 swiped Control open loop gift card sales Limit sales to service desk Consider cash only policy 13

14 EMV EMV is challenging and complex for all retailers Implementation Many hardware and software versions add complexity and issues Operationally Retailers must train consumers Imperfect software can cause operational issues Technically There are numerous issues that we have encountered many resolved, some we are still learning about and working on 14

15 Why so Complex? No longer swipe and sign Fraud controls are now between the PIN pad and card vs. at the issuer Complex interaction between terminal and card Cryptograms to reduce fraud Public and Private keys are assigned to each bank and must be loaded in the store system These keys control which cards will process in your store The chip defines parameters that control the capability and flow of the transactions AID table (application identifier) on cards and in store software define card capability PIN, Signature, International Table must be correct or select cards will decline Cash Back CVM preference 15

16 Issues/Learnings Sequence # issue at card issuers Causes offline transactions to decline Cards declined due to AID table issues Cards declined due to Public/Private Key issues Many issues with code Increased offline transactions Transaction missing data declines Expired card declines Non standard EBT mag stripe data PinPad lock ups 16

17 EMV Installation Status Supervalu corporate stores & SAL (including Licensees) are EMV compliant Independent Retailer status: 115 Independent retailers that use VeriFone MX915 are EMV compliant All POS systems that interface to ServerEPS are running at least 1 EMV store ACS, ACS IR, ISS45, ScanMaster, StoreLine, LOC No Independent retailers that use Equinox L5300 & NCR are EMV compliant Conversion from SCAT to FPE delayed availability ACS POS upgrade required NCR testing underway on ScanMaster, ISS45 and StoreLine 17

18 Known EMV Issues by POS type - VeriFone MX915 18

19 Known EMV Issues by POS type Equinox L

20 Changes to Fraud Chargeback Rules Visa Effective July 22 no fraud chargebacks under $25 will be issued Effective October 16 Visa will not allow banks to issue more than 10 chargebacks per card These changes expire in April 2018 These changes are expected to result in: MasterCard 40% fewer chargebacks 15% reduction in chargeback dollars Currently evaluating it s rules 20

21 Industry Status & Info Approximately 30% of FMI members have implemented EMV Visa/MC say larger retailers have been faster to deploy than small due to technical challenges Safeway: Credit only pilot underway Ahold: In pilot Kroger, Target and Walmart: Fully deployed Other points of interest: Walmart, Kroger & Home Depot have filed suits against Visa for NOT requiring PIN with EMV Not as secure Protects banks signature debit revenue Allowed EMV to be implemented quickly at banks 21

22 EMV What s Next Continue to resolve issues & deploy to Independent s using VeriFone 915 terminals Move as quickly as possible with all POS interfaces Won t be perfect out of the gate but will stop fraud shift and improve customer impression Continue to work with NCR to resolve issues with Equinox L5300 code Pilot ASAP Pending Quick Chip solution from Visa and M/Chip Fast from MasterCard to speed up transaction time Contactless EMV release from NCR/VeriFone TBD Secured Waiver from Visa to avoid mandate to shut off mag stripe emulation contactless (Apple Pay) if not doing EMV contactless In summary there s lots more to learn and come with EMV 22