fraud – Philip Andreae

VOID RESET BUTTON

AI companions contributed

IoT 2017 Payments Tuesday Afternoon

Continuing the learning and commentary

IoT Payments 2017 – Austin TX October 10th and 11th

Context-based payments

Security has always been an after thought as devices were deployed and solutions were developed. Security needs to be built in as a fundamental layer in these emerging IoT objects.
Growth in fraud in online payments is typically a result of the deployment of EMV.
As we think about Dash buttons and the myriad of other interfaces that can access a card on file style shopping and payment experience we must think anew about security.
What is context? Our digital footprint as we go through our daily lives.
The growing number of IoT devices can help to establish context, which can then be used as a fourth factor in an authentication scheme.
It is all about acquiring data and building a profile, your context.
What is the unique identifier that links all the objects to the individual.

Bridging the Security Gap

Brightsight a lab focused on security looking at both physical a logical security at both the operating system and application layer.
The IoT landscape is a world of objects where to goal is sell fast. No security has been built in and the attack surface is broad and wise.
The fear of who is able to access the vast array of data available through these connected devices.
Security is about managing risk. Risk evolves over time. Therefore security must evolve to stay ahead of the current level of risk – continuous improvement.
In the world of IoT who will define the security requirements and who shall pay becomes the key question.
We should consider using Common Criteria as a baseline for the security of IoT devices.
Bottom line – the implementation of security is all about the developer and the use of already certifies components e.g. Integrated Circuit and the Operating System.

The key to top of wallet

Changing our top of wallet card is not something we are driven to do.
So many sites drive to Card on File
The objects will end up with an embedded payment within
There is a hierarchy of needs
BASIC WANTS & NEEDS
MASS & PERMITTED RECOMMENDATION
SOCIAL & RELEVANT 1REFERRALS
ON-BEHALF

As he speaks of On-behalf a document produced back in 1996 must be found
Will the IoT evolution increase consumption, Maybe?

Wearables 101

What is the connectivity
Where are the credentials stored
Is it a configurable device relative to which credentials
Types
Contactless cards and devices
The mobile ecosystem introduces the token requestor

A solid overview of the world of tokenization
The tap experience with a wearable is an interesting design experience.
A wearable is smaller and much more personal.
As seen from the payment networks

Like a card

Mobile device (secure element)

HCE

Wearable are in market today

Wearable are in market today

Risk Based Payment Security

Beth took a walk through the history of payment acceptance
The Internet of Things creates the tsunami effect on our world of risk. Both scary and empowering.
Risk is or was always about the balance between security and convenience.
Tokenization moves the authentication responsibility from the Issuer to the payment brand. In this case who has the responsibility in the event of. Has the threat of penetration moved to the payment brand.
The move to mobile devices as a result of the inherent transaction security to the registration and ID&V process.
Interoperability and security standards who controls? IoT is not a market. It is a collections of vertical and closed environments.
We need to agree on a common set of security values not necessarily on a common standard.
When we think about the wider question of the how and what of security. We need to think about the security of the device and the cloud. We need to remember it is also about the ability to spoof and acquirer the credentials of a user.
Security must be designed in from the beginning.

The day came to a close.

European ATM Skimming Fraud Jumps 43%

Reported by Epaynews.com

May 08 2008 : In 2007, ATM fraud losses rose by 43 percent in Europe to €439.01 million (US$683.7 million) from €306.48 million in 2006, reports EAST (the European ATM Security Team). Most of the losses in 2006 and 2007 were due to card-skimming at ATMs, the non-profit organization says.The year-on-year increase in fraud losses was mainly due to a €173.6 million increase in cross-border losses in 2007.

“These (cross-border) losses are occurring globally in countries where all or part of the ATMs deployed are not yet EMV-compliant,” EAST says. “Domestic European fraud losses have fallen year on year, an indication that the roll out of EMV-compliant ATMs is driving down fraud.”

According to EAST, 78 percent of European ATMs are now EMV-compliant.

Card fraudsters are being forced to seek out non-EMV compliant ATMs to obtain cash, EAST says. “Incidents continue to be reported where data skimmed from EMV cards in European countries where ATMs are EMV-compliant, has been sent by criminals to European countries where ATMs are not fully EMV-compliant,” it says.

The skimmed data is used to make counterfeit cards that enable fraudsters to illegally withdraw cash from ATMs.

According to EAST, skimmed data is also increasingly being sent to countries in and outside Europe where EMV cards can be used as magnetic-stripe cards in ATMs. This takes advantage of a process known as “mag-stripe fallback”, which is designed to ensure that a card can be used even if its EMV chip is damaged or faulty.

Crooks Have Your Card and You Don’t Even Know It

How Thieves Copy Credit and Debit Cards and Drain Accounts

By ELISABETH LEAMY – ABC News

May 2, 2008—

While your ATM card is tucked in your wallet, thieves half a world away could be cloning it and using it. The crime is called “white card fraud,” and ABC News investigated just how easy it is for thieves to make a copy of your card and use it to drain your account.

It’s difficult to get an exact figure, but it’s estimated that identity thieves net an estimated $345 million this way every year. Gary Burkey of Wilmington, Del., discovered somebody was withdrawing money from his account at ATM machines in a part of Pennsylvania he had never even visited.

Criminals get people’s numbers in a variety of ways. One way they capture card numbers is by installing skimmer devices over the slot where you insert your card when you use an ATM.

They also use hidden cameras to record your PIN. Miami Beach police have actual footage from a crook’s camera in Florida that shows a victim inputting his PIN. Clear as day: 1-4-2-6.

Click here for tips to protect you from today’s modern identity thieves.

“What makes this really sneaky, really devious, is once the criminals get the account information, they wait on it for a little while, said Cpl. Jeff Whitmarsh of the Delaware State Police. They replicate the cards and when the consumer least expects, that’s when they go in and hit the account.”

ABC News found the machines used to copy cards for sale right on the Internet, even though there are very few legitimate uses for them. We had our choice of 30 machines and bought one for about $500. We were even able to request priority shipping and received the package the next day.

ABC took the device to Chris O’Ferrell, an ethical hacker for a computer company called Command Information, which helps the federal government secure its systems.

We handed over an ABC News credit card and O’Ferrell swiped it so the machine could capture the information on the magnetic strip. Right away, the data popped up on the computer screen: name and account information.

With another swipe, O’Ferrell transferred it to a blank white card that came with our kit. Any card with a magnetic strip can be made into a clone — gift cards, hotel key cards, etc.

In less than five seconds, we had a duplicate credit card.

“That’s it. That’s all there is to it,.” O’Ferrell said.

We cloned an ATM card too. At one point we even accidentally deleted the data on one of our source cards, but since we had a clone, we were able to put the data back on.

Once we had clones of our cards, the question was, would they work? We tried the Visa card out at a gas pump. Without actually making a purchase (we didn’t want to violate any laws) we inserted the card to see if it would get authorized.

When the “lift the handle and begin fueling” message came up, we knew our clone was working. We tested the cloned ATM card by checking our balance at an ATM machine. When the screen read “Hello Elisabeth Leamy,” that was our first clue that that one was working.

It’s a bonanza for crooks. They used to have to risk going into stores to buy pricey merchandise, which they then sold for cash. Now they can just drain ATMs. Authorities say specialized crews do nothing but hit ATMs, cashing out on behalf of other identity thieves and taking a commission. One Bulgarian gang pulled $200,000 out of a single cash machine in Florida.

More than 65 other countries in Europe, Asia and South America now use smart chip technology that makes card cloning almost impossible. But the United States has stayed with magnetic strips to avoid the cost of converting ATMs. By one estimate, we have 400,000 cash machines in this country.

“It’s totally unacceptable,” O’Ferrell said. “It makes it extremely easy for the criminals to clone our cards and steal our identities.” Experts say since U.S. credit and debit cards are so much easier to tap, U.S. cardholders have become targets.