Unit 3 Assignment 2.1 Chip-And-Pen Cards

An unauthorized and highly sophisticated malware that not been encountered previously by any security company attacked the point-of-sale systems where all the card information is stored. The outcome of this hacking been extensive and affected millions of customer’s personal and payment data was exposed, results in the payment card compromise of three million customers.

In January 2007, TJX Companies Inc. released a statement to the press that an estimated 40 million of their customer’s credit card accounts had been compromised (although final reports state that over 94 million accounts were affected) (Berg 2008). Through the company’s POS (Point of Sales) system, credit card information was stolen by a ring of hackers and approximately $4.5 billion spent on these cards (Berg 2008). What the hackers did was intercepted the credit card information from customers who swiped their cards at the store and then created their own physical cards using this information. Then they sold the credit cards to people, who turned around and used these cards at retail stores, like Walmart (Agrawal 2011). Three areas of weakness within the company’s IT systems that allowed for an attack of this scale were: inadequate wireless security, improper storage of customer data and failure to encrypt customer account data (Berg 2008).

On April 27, 2014 Michael’s CEO Chuck Rubin reported that criminals used highly sophisticated malware to infect some of the point-of-sale (POS) systems resulting in the theft of card related information including payments numbers & expiration dates (Michaels, 2014). The term POS system is used to describe the technology used by consumers to provide their payment information in exchange for a good or service. The primary stakeholders for today’s POS systems are consumers, merchants, acquirer, card brand companies,

In a highly competitive market space, being compliant with PCI standards will make our organization more acceptable in the market, and also help build trust and confidence in our operation among healthcare providers seeking our services. In a constantly evolving threat environment with increased levels of data breaches in recent times, ensuring PCI compliance even though not mandated will help attract customers and would be good return on investment. Along with BAA signed with our clients, being PCI compliant would also ensure extra layer of protection by following the practices suggested by leading payment card brands like Visa, Mastercard, etc. who are constantly looking out for new emerging threats in the industry, and are proactive in incorporating changes to PCI DSS standards to minimize the impact of these new threats. Though complying with standards like PCI doesn’t ensure security, they provide a structure around which organizations can build their information security and assurance program, thereby helping them anticipate and mitigate new risks in the area of storing payment card

In December 2013, Target announced that massive amounts of credit and debit card information they collected over the years might be in the danger of theft. The credit card breach could affect as many as 70 million customers who swept cards in the retail stores or linked their cards with the membership card, the RedCard. Each card information contains a card number, holder’s name, address, phone number and etc. The more information the thieves got, the more conveniently the thieves could use them to get benefits from the card holders. Jia Lynn Yang and Amrita Jayakumar, the authors of “Target says up to 70 million more customers were hit by December data breach”, write about how bad people will use customers’ information to crime. These thieves possibly shop online by inserting the card information. They could also contact with the victims to gather more sensitive information, and even hack into their computers. This event forces us to seriously consider the crisis in how retails protect customers’ data (Yang &

Target handled the data breach appropriately by investing in the chip-and-pin credit and debit card to have a more secure system. For example, under frequently asked questions Target states, “Requiring a PIN offers an additional layer of security to help protect against someone using your card if it’s lost or stolen. Using a PIN instead of a signature for transactions add an extra layer of protection for our guests against fraudulent purchases,” (Target 2016). According to Coombs, during a crisis, the company should make public safety number one priority (Coombs 2007). Target reissues all of their debit and credit cards with the chip and pin to make them more secure (Ewoldt, 2015). By investing millions of dollars in the chip and pin technology,

‘’Founded in 1994 the EMV referred to Europay, MasterCard, and Visa, who together provided better card security.’’ (www.thebreif.com) Currently credit card fraud has been at an all time high in the years 2016 and 2017. This activity has skyrocketed since young teens and young adults have the idea of targeting adults and senior citizens, and using someone 's information to buy whatever the scammer desires. “The U.S. is responsible for 47% of the world’s fraud despite only accounting for 24% of total worldwide card volume.’’ (www.nasdaq.com) Credit card fraud has been a big problem, although through new security implementations such as chips and pin systems, the level of security associated with cards has improved. In the future credit card fraud may come to a stop, or at least slow down significantly. With this new security being implemented and new legislation laws credit card offenders may finally be brought to justice.

This is dangerous because your information could potentially be getting into the wrong hands. RFID chips are

Card holders have several countermeasures, including complex software which can assemble a vest interaction and guesstimate the possibility of fraud. For example, a large trade occurring in a great distance from the cardholder’s home might seem mistrustful. Merchants may be commanded to call the card holder for authentication, or reject the transaction or do whatever they want. Customers must call the issuer and prove their identity to get their card back.

Redesigning of these cards is a part of the Next Generation Secure Identification Document Project. The new cards will have fraud resistant security features and enhanced graphics. These new features will make the cards highly secure and tamper-resistant.

ATM machines with exorbitant fees have been thought to be acting as highway robbers, now they may even have a thieving companion; Card scanners. By stealing the information off the credit card as it is swiped the consumer is not even aware they have been attacked. Even if the consumer is careful to hide their hand as they enter the PIN in order to withdraw money from an ATM, the larcenist might still have a hidden camera or card reader to steal the card information. Erin Lowry, a content director for a popular magazine was a victim of two different attacks on her credit identity; she had $600 stolen from her account after using a shady ATM with a hidden scanner inside. The use of a low security ATM is a consumer error, but with everyday stresses sometimes common sense is abandoned in place of convenience. Larcenists will place these scanners inside ATM’s located in low socioeconomic areas with the intent to instantly copy the card numbers onto an embedded micro storage

The biggest risk of data theft lies within a company 's customers. When security breaches happen, the customer begins to question if Sunoco has looked out for their personal information and overall trust becomes an issue. Whenever someone purchases with a credit card, the customer is putting their trust in Sunoco that the information will not fall into the wrong hands. If Sunoco does not handle the situation quickly and efficiently after it occurrs, panic ensues by current and potential customers. Credit cards are a huge portion of sales today. According to Javelin Strategy & Research, “plastic cards purchases comprised 66 percent of all in-person sales, with nearly half of them, or 31 percent, made with debit cards. Last year shoppers used credit cards for 29 percent of point-of-sale purchases; it is expected that the numbers will rise to 33 percent by 2017” (New, 2012, para. 5). That leaves potential for a significant loss in sales and annual earnings. With the increase of credit and debt card usage, Sunoco needs to take the necessary action to ensure that data theft does not occur again for their customers.

Transactions nowadays are mainly performed using 2 ways. The traditional way in which people use cash to make payments and, afterwards, with the advancement of technology, credit cards were invented allowing people to make transactions easier and more conveniently without the need to carry a lot of money in cash. However, both of these methods have serious drawbacks. Credit cards and cash can be easily stolen by thieves. Additionally, considering the case of credit cards, it should be noted that our personal information is exposed while using, thus making us vulnerable. For example, the cashier may acquire the card

“The migration from magnetic stripe to the Europay-MasterCard- Visa (EMV) chip standard promises enhanced credit card security, and the opportunity to offer loyalty and reward programs to cardholders”(Peterson, 2004). EMV chips are finally gaining a strong momentum in the United States banking system. The promise of enhanced security and benefits is a hit with banks and consumers alike. The United States is very late to the game though; Europe and Asia have implemented the EMV technology since the early 2000s. "Within Asia-Pacific, Visa has issued more than 20 million Visa EMV cards, and globally this figure is in excess of 100 million. Since January 2003, every new point-of-sale terminal deployed in the region is required to be EMV-compliant. By 2008, we expect over 90 per cent of all terminals to be EMV-enabled”(Peterson, 2004). Credit unions and banks have finally begun rolling out the EMV chip enabled debit cards to customers. The adoption percentage will hit the low 70s, far lower than countries that have had the technology already. A low adoption percentage of EMV shows how the current banking system is slow to adapt to change. If the banking system wants to be current and keep cost low they need to start embracing new technology as soon as it becomes available. The issue banks/credit unions will face is; any fraud that occurs on customer’s accounts with debit card will be their responsibility. Our current banking system needs to adopt the new EMV technology faster,

In addition to this, the topic named security issues and vulnerabilities of smartcards is proposed for carrying out this research study as there is an increased popularity of the smartcards in different business organizations due to which attackers poses harm to the security aspects of the applications that are supported by the smartcard technology as it is used for providing security to such applications for the purpose of carrying out different activities smoothly and efficiently. In this context, the following research study concentrates on the security threats and vulnerabilities associated with smartcards and measures to be taken to reduce and eliminate it in order to improve the efficiency and usage of smartcard technology by different business organizations for carrying out different transactions in a secured manner (Pappu, Carvalho and Pardalos