Visa Inc. · NYSE:V
Visa — Technical Presentation (March 2016)
26 slides from Visa's technical presentation, Mar 24, 2016
Slide 1: Best Practices for Detecting and Reporting a Common Point of Purchase (CPP)
Best Practices for Detecting and Reporting a Common Point of Purchase (CPP) Popuauliuli Kioa, Analyst, VISA, Cyber Investigations Stoddard Lambertson Director, VISA, Cyber Investigations 24 March 2016
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Introduction • Data Compromise Trends • Small Merchant Security Initiatives • Five Steps to Report a Common Point of Purchase (CPP) • Key Takeaways • Questions and Answers Visa Public
Slide 4: Data Compromises
Data Compromises Typical Data Compromise and Counterfeit Cycle Entry Card Data Theft Monetization • Hackers targeting internet-exposed • Payment card data is extracted with • Payment data is used to commit remote access systems as initial specialized, difficult to detect fraud, often across countrie
Slide 5: Data Compromise Trends
Data Compromise Trends Visa Public
Slide 6: Visa Security Pillars
Visa Security Pillars Remove sensitive data Prevent fraud Devalue Protect Harness Empower Data Data Data Consumers Identify fraud before Render data useless it occurs and increase Engage cardholders for criminals, Safeguard confidence in as an underutilized reducing incentive for payment data approv
Slide 7: Transactional Threat Intelligence
Transactional Threat Intelligence Intelligence comes from recognizing Breach Detection Cycle fraud patterns, predicting fraud activity – Cardholders report fraud to their bank Cardholder Issuing Bank – Banks report fraud to Visa (CPP) – Visa reports fraud to other banks – Breach found, stopped One m
Slide 8: Percentage of Compromises
Global CAMS Distribution CAMS Alerts Distributed by Region 1% • In 2015, total CAMS alerts increased to 8% the highest level in 3 years 1% • Because of the sheer magnitude of the Percentage of Compromises 17% 11% 1% number of small merchants worldwide 15% and especially in the United States, Level 1
Slide 9: Global Fraud and Breach Investigation Trends
Global Fraud and Breach Investigation Trends Breach Events by Merchant Level Level 1 Level 2 Entity Type 2013 2014 2015 2016* +17% % % % % Merchant / Entity size Level 1 1% 1% <1% 0% -29% Level 2 1% 1% <1% 1% Level 3 4% 4% 4% 7% Level 4 92% 93% 93% 91% Agent 1% 1% 2% 0% Other <1% 0% 0% 0% Total 100%
Slide 10: Global Data Compromises
Global Data Compromises Breach Trends by Merchant Category Code (MCC) 60% 52% 2013 2014 2015 *2016 Percent of Breach Events by MCC 50% 43% 38% 40% 32% 30% 23% 21% 19% 20% 10% 10% 9% 10% 4% 6% 5% 6% 7% 3% 2% 2% 4% 4% 2% 2% 2% 1% 0% RESTAURANTS OTHER RETAIL QSR'S B2B SUPERMARKETS LODGING • Restaurant
Slide 11: Small Merchant Security Initiatives
Small Merchant Security Initiatives Visa Public
Slide 12: Majority of Compromises Occur at Small Merchants
Majority of Compromises Occur at Small Merchants • Untrained integrators that deploy weak remote access configurations are the most common reason for small merchant compromises • Common attack vector: web-based and direct remote access services used by POS Integrators and Resellers According to Trus
Slide 13: Visa Small Merchant Security Program
Visa Small Merchant Security Program QIR and PCI DSS Validation Requirements* Effective Date Requirement Acquirers must communicate to Level 4 merchants that beginning January 31, 2017, March 31, they must use PCI-certified Qualified 2016 Integrators and Resellers for point-of-sale application and t
Slide 14: Five Steps to Report a Common Point of Purchase (CPP)
Five Steps to Report a Common Point of Purchase (CPP) Visa Public
Slide 15: Common Point of Purchase Process Flow
Common Point of Purchase Process Flow Goal is to Contain Compromises Quickly and Mitigate Issuer Losses by Sending At-risk Accounts via Proactive Compromised Account Management System (CAMS) Alerts Visa Investigations Receive Visa validates Fraud Incident Visa sends CPP Visa sends At- Suspected Merc
Slide 16: Best Practices: Determining and Reporting a Common Point of Purchase
Best Practices: Determining and Reporting a Common Point of Purchase • Start with similar types of fraud - Card present vs. Card Not Present (CNP) – CNP is under reported – Visa encourages issuers to report both CP and CNP fraud schemes despite the liability shift and the chargeback rights • Fraud t
Slide 17: CPP Reporting Overview
CPP Reporting Overview Step 1 • Enroll in VisaOnLine (VOL) – https://gvol.visaonline.com Step 2 • Download New Americas CPP Reporting Form Step 3 • Complete CPP Form and include accounts! Step 4 • Log into VOL Secure E-mail for CPP submission Step 5 • Send CPP form to Visa using VOL E- mail Visa Pub
Slide 18: VisaOnLine (VOL) – Your Platform for Reporting CPPs
VisaOnLine (VOL) – Your Platform for Reporting CPPs Step 1 • Enroll in VOL Step 2 • Access the CPP form on VOL: Risk Fraud Risk Products & Solutions Common Point of Purchase (CPP) Visa Public
Slide 19: Changes to New CPP Reporting Form
Changes to New CPP Reporting Form Visa Public
Slide 20: Changes to New CPP Reporting Form
Changes to New CPP Reporting Form Step 3 • Complete CPP Report - Data Fields Defined Note: The Card Acceptor ID fields must be formatted as TEXT to maintain the exact formatting 20 Visa Public
Slide 21: Changes to New CPP Reporting Form
Changes to New CPP Reporting Form (Step 3 cont.) • Accounts Must Be Provided With All CPPs • Second tab of CPP Form - Provide Visa accounts associated with each merchant name reported • Use only two columns to report multiple merchants and associated accounts • Account column must be formatted as TE
Slide 22: Compromised Account Management System (CAMS) Overview
Compromised Account Management System (CAMS) Overview • Compromised Account Management System (CAMS) notifies financial institutions when their accounts are at risk due to a compromise and provides critical information such as: - At-risk Accounts - Expiration Dates - Data Elements Involved • Visa CA
Slide 23: Account Compromise Response Strategies
Account Compromise Response Strategies Before • Consider Issuing EMV Cards! (identifying a • Analyze fraud patterns on “at risk” accounts, test fraud mitigation rules data • Report CPPs to Visa compromise) • Download accounts from CAMS During • Flag impacted accounts and (preventing fraud monitor ac
Slide 24: Key Takeaways
Key Takeaways Visa Public
Slide 25: Conclusion and Recap: The Benefits of CPP Reporting
Conclusion and Recap: The Benefits of CPP Reporting 1. We expect attack techniques to evolve along with security 2. Issuer CPP Reporting is critical intelligence to help monitor the security of the payment eco-system – Visa encourages Issuers to increase Card Not Present CPP reporting – CNP fraud ha
Slide 26: Questions and Answers
Questions and Answers Visa Public