As retailers make the changes necessary to support EMV technology, it is important that they consider the full security picture for payments and also deploy point-to-point encryption and tokenization.
LAS VEGAS – Jan. 8, 2015 –
The credit card brands have set October 2015 as the goal date for U.S. merchants to have EMV technology in place. Retailers who delay past this date may be made financially liable for credit card fraud committed in their stores. As this date draws closer, businesses risk focusing too much on this single security tool that will do little to prevent breaches like those the industry has suffered over the past 18 months. Shift4 Corporation, provider of the world’s largest independent payment gateway and sworn merchant advocate, has brought together a trio of mature solutions that will provide true security against breaches, simplify PCI compliance efforts, and ensure retailers are ready for EMV well in advance of the October liability shift date.
Shift4 is working with leading device manufacturers Ingenico and Verifone to provide EMV-capable devices that also allow for these additional security measures. This trio of technologies will bolster security, preventing breaches:
- EMV: Developed nearly 20 years ago by international credit card brands EuroPay, MasterCard and Visa, EMV cards (also known as smart cards) use a computer chip embedded in the card, instead of a traditional magnetic stripe, to store card data. Shift4 has supported EMV in Canada since 2012 and is actively pursuing EMV certifications in the U.S.EMV chips are significantly more difficult and expensive for criminals to copy. EMV cards also include technology to authenticate themselves each time they are used in a store. These capabilities should lead to a decrease in card-present fraud scenarios; however, EMV is not a silver bullet when it comes to security as it does nothing to prevent card data from being stolen in the first place. Most EMV terminals on the market today still allow card numbers to flow out of the terminal and into the merchant’s point-of-sale system in plain text. This means the malware used against Target and Home Depot would still be effective against retailers using EMV – unless those devices also support point-to-point encryption (P2PE).
- P2PE: When properly deployed, P2PE encrypts card data the moment it enters the merchant environment – whether it is swiped into a terminal device at checkout or keyed in by a representative in the call center – and then passes that encrypted data on for processing without ever revealing the actual card numbers within the merchant’s network. Pairing P2PE with EMV will be possible for Shift4 merchant customers using leading devices such as the Ingenico iSC250 and iSC480 and Verifone MX 915 and MX 925 to ensure that they never process or transmit any sensitive cardholder data within their environment.The combination of P2PE and EMV provides strong security, but does have one major limitation: due to industry regulations, P2PE-encrypted payment data cannot be held by the merchant after an authorization has taken place. This means retailers need an additional solution to allow them to store payment card data for future returns and credits, or recurring billing situations.
- Tokenization: Introduced to the payments industry by Shift4 in 2005, tokenization replaces card data stored in a merchant’s database with a globally unique, random string of letters and numbers that cannot be mathematically reversed to reveal the card number. This allows retailers to keep card data on file for future purchases or returns without the risk of losing sensitive card data to a cyber attack. Shift4’s TrueTokens® hold no value to hackers if stolen.With P2PE and tokenization in place, the customer’s card number never advances beyond the secure swipe device, leaving the merchant with an extremely limited card data environment and drastically reducing the time and effort required to obtain PCI compliance.
Shift4 CEO Dave Oder said, “It is vital for merchants to adopt real card data security measures in addition to the highly publicized stopgap that is EMV. Security Beyond Compliance® is our mantra, and that’s exactly what Shift4 delivers to our customers.”
About Shift4 Corporation
Shift4 Corporation makes it simple for merchants across all industries to securely process credit, debit, and gift card transactions. With connections to nearly every bank and processor in North America and integrations to hundreds of PMS/POS systems, Shift4’s DOLLARS ON THE NET® is the world’s largest independent payment gateway. Shift4 provides pre- and post-settlement auditing capabilities, fraud prevention tools, support for emerging technologies like EMV and mobile payments, and security solutions such as TrueTokenization® and P2PE, which drastically simplify PCI compliance. Shift4 is a proud merchant advocate, maintaining complete bank and processor neutrality to ensure that their customers have the freedom to switch banks and processors as needed. For more information, visit www.shift4.com.
###
Media Contact
Nathan Casper
Shift4 Corporation
[email protected]
702.597.2480, ext. 43307
Michael Salmassian
Nadel Phelan, Inc.
[email protected]
831.440.2408