US Payments Forum Provides Comprehensive Primer on EMV Payment Tokenization
Many organizations interested in protecting payment data are now implementing tokenization as a tool to reduce opportunities for fraud. To help, the U.S. Payments Forum has released a resource examining the use of EMV payment tokenization to protect payment card data.

The white paper, “EMV Payment Tokenization Primer and Lessons Learned,” can be downloaded here.

“Tokenization provides an important layer of payment security by replacing valuable data with a token that has no exploitable meaning – but it also has implementation considerations across the ecosystem,” said Randy Vanderhoof, director of the U.S. Payments Forum. “The information in this resource will help organizations make informed decisions on EMV payment tokenization and determine whether it fits into their payment security strategy.”

This resource was created by the Forum’s Mobile and Contactless Payments Working Committee. The committee’s goal is to explore the opportunities and challenges associated with implementation of mobile and contactless payments in the U.S. market, identify possible solutions to challenges and facilitate the sharing of best practices with all industry stakeholders.

Additional resources created by the Mobile and Contactless Payments Working Committee include “Mobile and Contactless Payments Requirements and Interactions” and “Mobile and Digital Wallets: U.S. Landscape and Strategic Considerations for Merchants and Financial Institutions.” globenewswire.com

Cost of Cybercrime Up 37% in 2 Years
Driven By Ransomware & Insider Threats
The cost of cybercrime is increasing, due largely to a rise in ransomware attacks and insider threats that go undetected for weeks on average, according to a new study.

The average annual cost of cybercrime per company in 2018 was $13 million, up from $11.7 million in 2017 and $9.5 million in 2016, according to a survey of 355 businesses in 11 countries by the Ponemon Institute. The study sponsored by Accenture Security.

Insider threat attacks were the most expensive for firms to resolve, with an average cost of about $243,000 per incident, up from $169,000 in 2017. They also took an average of 55 days to fix—longer than any other type of attack.

More organizations are also experiencing ransomware attacks, which in 2018 took 33.8 days on average to resolve, up from 26 days in 2017, Mr. Thompson said. cybersecurity.cmail20.com

Payment Fraud: Criminals Enroll Stolen Cards on Apple Pay
Fraud Fighters Also See Spikes in ATM Malware, Card Enrollment as a Service

Fraudsters continue to get new tricks up their sleeves. Criminals are increasingly using Apple Pay, setting up mobile call centers to socially engineer victims as well as tricking consumers via look-alike but fake e-commerce sites that never fulfill orders, warns the European Association for Secure Transactions, based on reports from European countries as well as Ukraine and Russia.

On June 5, representatives from 16 countries in the Single Euro Payments Area, as well as four other countries, attended an EAST meeting held at Europol headquarters in the Hague, Netherlands. Here's a sample of the most recent fraud trends they're seeing:

Apple Pay mobile wallet fraud: Two countries reported cases of such fraud. "One reported that mobile wallets are fast becoming the new money mules - fraudsters are enrolling cards that are not yet associated to a specific wallet."

Mobile call centers: One country told EAST that to trick users into divulging personal details or account information, fraudsters are calling consumers from call centers that appear to have genuine bank customer service telephone numbers and pretending to be legitimate bank staff.

Fake websites: Sites in China and other Asian countries, in particular, are increasingly advertising goods for sale, but never fulfilling orders.

Card skimming: Skimming attacks were reported by 18 of the 22 countries, with five recovering M3 card reader internal skimming devices, the most recent versions of which are built from transparent plastic to make them tougher to detect.

Physical attacks: 10 countries reported ram raids and ATM burglary attempts; nine countries reported explosive gas attacks, with four countries noting that the frequency of such attacks has been increasing; and seven countries saw solid explosive attacks, with two countries saying they'd been increasing.

ATM malware and logical attacks: Six countries report seeing the use of "black box" devices to try and force ATMs into dispensing cash without authorization, in what's known as a jackpotting attack.

Card Enrollment as a Service: The Russian cybercrime underground also continues to provide a variety of services to help criminals earn illicit profits using stolen credit card data. One up-and-coming offering, according threat intelligence firm Advanced Intelligence in New York, involves "enrolling" stolen cards in legitimate accounts, via online banking tools, as part of an account-takeover scheme. databreachtoday.com

Promise Lies in BOPIS for Retailers With RFID
Opportunities for retailers are looking rosier than news reports might be indicating, according to Greg Buzek, the president of retail research company IHL Services. When he spoke at last month's RFID Journal LIVE! Retail conference, co-located with RetailX in Chicago, Buzek had a message for retailers. Those that are moving ahead of the pack, he said, are the ones that have invested in technology, including RFID. They're the ones that have understood the importance of "buy online, pick up in store" (BOPIS) models, and that know how to provide a good experience for customers that use this buying method.

RFID can't solve all inventory problems alone, Buzek explained, but those retailers that have employed RFID are gaining significant benefits. "What it comes down to is embracing technology to remain competitive, or fall far behind," he said. The technologies being adopted, he added, also include artificial intelligence, computer vision and mobile marketing solutions.

Since data based on BOPIS orders are being omitted from brick-and-mortar store sales numbers, and this is the fastest growing area of e-commerce.

The future looks bright for retailers able to adopt BOPIS-based sales, according to IHL's research. If a sale is placed online, it still often requires a physical store where the product can then be collected—and that, he said, offers retailers an opportunity, but only if they have good inventory accuracy. Instead, the statistics in one report Buzek referenced assume all ecommerce growth is for delivery directly to a customer, not BOPIS or "click and collect."  rfidjournal.com

Phishing Campaign Tied to Amazon Prime Day
Fraudsters Use Phishing Kit Called 16Shop, McAfee Reports
In the run-up to Amazon Prime Day, some of the company's customers were being targeted by a phishing kit called 16Shop, according to researchers at McAfee.

These phishing attacks, which use a kit called 16Shop, had targeted Apple users in late 2018. This time, Amazon users were targeted in the days leading up to Amazon Prime Day, a sales event taking place Monday and Tuesday, according to McAfee. Some Amazon customers across the U.S. and Japan were being targeted by the phishing kit, which starts out by sending a link request to customers asking them to update their Amazon account information, McAfee says.

Phishing for Dollars An email with an attached PDF file was received by some Amazon users. It attempted to redirect them to a phishing site that tricks users into updating their personal information, including payment and contact details, according to McAfee.

In the U.S. alone, the company is believed to have as many as 101 million Amazon Prime customers, according to an analysis by Consumer Intelligence Research Partners. govinfosecurity.com

California Consumer Privacy Act of 2018 - Beginning January 1, 2020

'Inside the LPRC IMPACT Conference' 2018
An Eight-Episode Series Presented by Sensormatic

Assessing The Real-World Impact of LP Efforts
The LPRC Delivers Evidence-Based Solutions and Actionable Results
 

New Retail Members

The Value - Expectations - Benefit - Why They Joined

Perry Resnick, Former Director, Loss Prevention, Boot Barn
Lincoln LeFebvre, Senior Manager - Field Asset Protection, The Home Depot
Aaron Hancart, Director of Operations - Inventory Management, Lenscrafters

In our 7th episode, hear from one LP executive who's been involved in the Loss Prevention Research Council for quite some time but with a recent move is getting his new company and team involved in the LPRC; and two AP executives who have been involved for a relatively short time but are engaged and adding value.

Long-term LPRC member Perry Resnick shares what factors went into his decision to invest part of his operating budget in the LPRC, and how the group's evidence-based research helps him in selling programs and obtaining capital from his senior leadership.

Lincoln LeFebvre explains how LPRC's scientific approach takes emotion out of the equation and gives you plausible solutions you can measure immediately.

And Aaron Hancart talks about the importance of staying at the forefront of industry research and results, and how LPRC's violent crime working groups have been especially useful in his retail environment.
 

Exclusive Sponsor:

See more of our 2nd LPRC series here.
Watch our 1st series here.

Take the time to learn.
As this is the LP/AP academic "Think Tank".