Secure Payments Task Force Payment Use Cases Webinar

Transcription

1 Secure Payments Task Force Payment Use Cases Webinar ACH, Wire, and Check Tammy Hornsby-Fink Vice President, Federal Reserve System Gloria Dugan Senior Industry Relations Representative, Federal Reserve System

2 Strategies for Improving U.S. Payment System Focuses on Improving Payment System Speed, Efficiency, and Safety from End-to-End Five strategies in pursuit of five desired outcomes 1. Actively engage with stakeholders on initiatives designed to improve the U.S. payment system. SPEED 2. Identify effective approach(es) for implementing safe, ubiquitous, faster payments. SECURITY 3. Reduce fraud risk and advance the safety, security and resiliency of the payment system. EFFICIENCY 4. Achieve greater end-to-end efficiency for domestic and cross-border payments. INTERNATIONAL 5. Enhance Federal Reserve Bank payment, settlement and risk management services to address identified gaps. COLLABORATION 2 2

3 Mission and Objectives of the Secure Payments Task Force Provide a forum for stakeholders to advise the Fed in its leader/catalyst and operator roles on payment security matters, and identify and promote actions that can be taken by payment system participants collectively and/or by the Federal Reserve System. Advise the Fed on payment security matters Coordinate with the Faster Payments Task Force Determine Areas of focus for payment security and priorities for action 3

4 Accomp Secure Payments Task Force Areas of Focus Payment Identity Management Identification and adoption of payment identity management practices to mitigate existing and anticipated fraud vectors Information Sharing for the Mitigation of Payment Risk / Fraud Payments industry fraud and risk data can be interpreted and acted upon by industry participants Data Protection Identification and adoption of frameworks / methodologies for protecting sensitive payment data at rest and in transit Law and Regulation Coordination Identify opportunities for more consistent interpretation and application of payment laws and regulations to enhance payments system security Standards Assessment Team 2017 Federal Reserve Banks. Materials are not to be used without consent. 4

5 How will your feedback be used? We are currently soliciting industry feedback on the Payment Use Cases, prior to the final publication to the industry. How you (or others within your organization) will use this information? How do you prefer to access the Payment Use Cases? Does level of detail found within the Payment Uses Cases provide appropriate context? 5

6 PAYMENT USE CASES: OVERVIEW 6

7 Value to the Industry Potential target audiences for the Payment Use Cases Bank operations Fraud group Auditors Product developers Technology solution providers/processors Information technology (IT) department Risk and compliance officers Payment Use Cases may be utilized to: Educate or train payment and security practitioners Aid decision making / product development and implementations Gain an end-to-end view into the payment flow Identify risks and mitigating controls 7

8 Sections of the Payment Use Case Document 1) Payment Flow Overview Definitions 2) Payment Type Operation 3) Overview of Security Methods and Associated Risks Security Methods Risks 4) Inventory of Sensitive Payment Data and Associated Risks Sensitive Payment data (data that need to be protected) Risks associated with the sensitive payment data 5) Overview of Standards Standards Rules Regulations Gaps/Issues 8

9 PAYMENT USE CASE: AUTOMATED CLEARING HOUSE (ACH) 9

10 How is an ACH payment defined? An ACH payment (credit or debit) may include direct deposit payroll, Social Security payments, tax refunds, person-to-person (P2P) payments and the direct payment of business-to-business and consumer bills. Within the ACH system, the originator is the entity that originates transactions, and the receiver is the entity that has authorized an originator to initiate a debit or credit entry to a transaction account. The transactions pass through sending and receiving banks that are authorized to use the ACH system. 10

11 ACH Payment Type Operations Highlights The Secure Payments Task Force identified two scenarios in the ACH Use Case Credit Debit Operationally the scenarios are similar utilizing common Access Mode/Network, Format Exchange as well as Clearing and Settlement Differences include Funding Account for Payment and User Protection/Recourse 11

12 Security Methods and Associated Risks Example Security Methods Enrollment Know Your Customer (KYC) Customer Identification Program (CIP) ODFI employee training NACHA operating rules Transaction Federal Financial Institutions Examination Council (FFIEC) guidance Anomaly and fraud detection Encryption Example Risks Enrollment Fraudulent use of account Transaction Account takeover Social engineering Machine takeover Reconciliation Auto-debits 12

13 Inventory of Sensitive Payment Data and Associated Risks Example Sensitive Payment Data Enrollment Data used to enroll or open an account: name, date of birth, address, social security number, account number Transaction Account holder data ACH file data Sensitive addenda data Example Risks associated with Sensitive Payment Data Enrollment Fraudulently set up an account Identity theft crimes Transaction Fake credit/debit ACH file Counterfeit checks Account takeover 13

14 Overview of Standards Examples Standards X Tokenization X 122 Secure Consumer Authentication for Internet Debit Transactions Rules NACHA Operating Rules/Guidelines govern ACH standards Regulations Regulation E: Electronic Funds Transfers Financial Crimes Enforcement Network (FINCen) BSA/AML Compliance Customer Identification Program CIP) 31 CFR 14

15 The ACH payment use case would be a useful resource to my organization. A Strongly Agree B Agree C Neither Agree nor Disagree D Disagree E Strongly Disagree 15

16 The amount of detail in the ACH use case is appropriate to inform my organization. A Strongly Agree B Agree C Neither Agree nor Disagree D Disagree E Strongly Disagree 16

17 PAYMENTS USE CASE: CHECK 17

18 How is a Check payment defined? A Check payment is a negotiable instrument drawn against deposited funds, to pay a specific entity a specific amount of funds on demand. A check was traditionally physically routed from the payer to the payee, then to the payee's bank, which issues funds to the payee, and then by the payee's bank to the payer's bank. The payer's bank then shifts funds from the payer's account to the payee's bank, thereby settling all accounts. Today, much of the physical routing of paper check is done electronically. 18

19 Check Payment Type Operations Highlights The Secure Payments Task Force identified three scenarios in the Check Use Case Paper Check Check21 / Electronic Electronic Funds Transfer (EFT) Conversion Payer Authentication is common across all scenarios Numerous differences include Access Mode/ Network, Device Used to Initiate Payment and Acknowledgement/Guarantee 19

20 Security Methods and Associated Risks Example Security Methods Enrollment Know Your Customer (KYC) Customer Identification Program (CIP) Employee training Transaction Fraud mitigation services Anomaly and fraud detection Example Risks Enrollment Legacy accounts may lack KYC Social engineering Transaction Limited opportunity to authenticate the payer at payment initiation Remote Deposit Capture (RDC) / multiple deposit risk 20

21 Inventory of Sensitive Payment Data and Associated Risks Example Sensitive Payment Data Enrollment Data used to enroll or open an account: name, date of birth, address, social security number, account number Transaction Account holder data Payee Account Data from Endorsement Example Risks associated with Sensitive Payment Data Enrollment Fraudulently set up an account Identity theft crimes Transaction Counterfeit checks Account takeover 21

22 Overview of Standards Examples Standards ANSI ASC X9 Technical Report (TR) 8 - Check Security Guidelines ANSI X9.100 Series Check Image Exchange Basics (Formerly Check 21) Rules Electronic Clearing House Organization (ECCHO) rules Regulations Uniform Commercial Code Article 4A (UCC 4A): Funds Transfers Regulation E: Electronic Funds Transfers Regulation CC: Availability of Funds and Collection of Checks 22

23 The Check payment use case would be a useful resource to my organization. A Strongly Agree B Agree C Neither Agree nor Disagree D Disagree E Strongly Disagree 23

24 The amount of detail in the Check use case is appropriate to inform my organization. A Strongly Agree B Agree C Neither Agree nor Disagree D Disagree E Strongly Disagree 24

25 PAYMENTS USE CASE: WIRE 25

26 How is a Wire payment defined? A Wire payment (or Wire transfer) is the direct transfer of funds from the payer's account at one bank to the payee's account at another bank. This is a rapid form of payment where banks typically charge fees to both the payer and the payee. While this is typically a rapid form of payment, the time of a wire transfer can be a factor. If the wire initiation is near the close of business, then the banks may add an extra day to the transaction. Wire transfers are real time, final and irrevocable once processed by the Fedwire /CHIPS system. 26

27 Wire Payment Type Operations Highlights Relationship between the Originator and ODFI as well as the Receiver and RDFI Funding Account for Payment requires cash in hand or account at participating financial institution Limited number of Payment Networks Traversed No authentication for the receiver, just account reconciliation during Reconciliation/Exception Handling 27

28 Security Methods and Associated Risks Example Security Methods Enrollment Know Your Customer (KYC) Customer Identification Program (CIP) Employee training Transaction Financial institution authentication of customer Anomaly and fraud detection Example Risks Enrollment Lack of KYC for correspondent banks Legacy accounts may lack KYC Transaction Social engineering Lack of verification for recurring Wire agreements Reconciliation Finality of payment if fraud occurs 28

29 Inventory of Sensitive Payment Data and Associated Risks Example Sensitive Payment Data Enrollment Data used to enroll or open an account: name, date of birth, address, social security number, account number Transaction Account holder data Sensitive addenda data Example Risks associated with Sensitive Payment Data Enrollment Fraudulently set up an account Identity theft crimes Transaction Counterfeit checks Fraudulent ACH and/or Wire Fraudulent account set-up and account takeover 29

30 Standards Overview of Standards SWIFT/ISO X Framework for Key Management Extensions NIST Cybersecurity Framework Rules CHIPS Rules and Administrative Procedures Regulations Examples Regulation J: Collection of Checks and Other Items by Federal Reserve Banks and Funds Transfers through Fedwire Customer Identification Program (CIP) 31 CFR Uniform Commercial Code Article 4A (UCC 4A): Funds Transfer 30

31 The Wire payment use case would be a useful resource to my organization. A Strongly Agree B Agree C Neither Agree nor Disagree D Disagree E Strongly Disagree 31

32 The amount of detail in the Wire use case is appropriate to inform my organization. A Strongly Agree B Agree C Neither Agree nor Disagree D Disagree E Strongly Disagree 32

33 PAYMENTS USE CASE: NEXT STEPS 33

34 In what formats and methods would you like to access the material? A Search/filter online B Infographic C Print D Other ( SecurePaymentsTaskForce.org with your suggestion) 34

35 Next Steps for the Payment Use Cases Incorporate Industry Feedback One-on-one meetings Industry survey Webinar polling Publication of Payment Use Cases planned in Q3 of

36 Engagement Opportunities: Learn more at FedPaymentsImprovement.org Registration for the Secure Payments Task Force remains open Payment Identity Management Work Group Information Sharing for the Mitigation of Payment Risk /Fraud Work Group Data Protection Work Group Law and Regulation Coordination Work Group Join the FedPayments Improvement Community! 36

37 Appendix 37

38 Collaboration is the Key to Success: Secure Payments Task Force Segmentation Other Stakeholders 31% Large Financial Institutions 8% Medium Financial Institutions 11% 180+ Task Force Participants Small Financial Institutions 11% Business End Users 4% Consumer Interest Organizations 1% Government-End Users 1% Non-Bank Providers 33% 38