Language Selection

English French German Italian Portuguese Spanish

Visa to Bar Transactions by Processor

Filed under
Security

Visa USA said yesterday that it would stop allowing the payment processor CardSystems Solutions to handle its transactions, months after the processor left the records of millions of cardholders at risk for fraud.

"CardSystems has not corrected, and cannot at this point correct, the failure to provide proper data security for those accounts," said Tim Murphy, Visa's senior vice president for operations in a memorandum sent to several banks. "Visa USA has decided that CardSystems should not continue to participate as an agent in the Visa system."

Cardholders and merchants should not be affected by the change.

Visa said its decision to remove CardSystems came after a review and an independent investigation found that the payment processor had improperly stored cardholder data and did not have the proper controls in place.

It is unclear if MasterCard and American Express will take similar action, but with Visa accounting for more than half of all card transactions, the move raises questions about the future of CardSystems.

"I've never heard of them booting off a processor," said Avivah Litan, a security analyst at Gartner Inc., a technology research group. "The worst thing that I've heard is a processor that had to cough up $1 million."

The move came at least two months after Visa first learned that data had been compromised and just days before its executives, along with those of other major card companies, have been called to testify in Washington about their security practices. The chief executive of CardSystems, John M. Perry, is also expected to testify on Thursday.

In a statement released yesterday, CardSystems said Visa's decision was unexpected and upsetting. "We are disappointed and very surprised that Visa has decided to take this action today, not only because of the impact that it will have on our employees, but the disruption that it will cause to our 110,000 merchant customers," the processor said in a statement. "We hope that Visa will reconsider."

Visa has given at least 11 banks, which hired CardSystems to handle the merchant transactions, until the end of October to change processors, the memo said. Until then, CardSystems will be allowed to process Visa transactions as long as it has corrected any problems and allows a Visa-affiliated monitor on site to oversee its operations in Tucson. CardSystems is also banned from handling Visa transactions from its international affiliates or any new merchants, processors or member banks in the United States.

Visa had been weighing the decision for a few weeks but as recently as mid-June said that it was working with CardSystems to correct the problem. CardSystems hired an outside security assessor this month to review its policies and practices, and it promised to make any necessary upgrades by the end of August. CardSystems, in its statement yesterday, said the company's executives had been "in almost daily contact" with Visa since the problems were discovered in May.

Visa, however, said that despite "some remediation efforts" since the incident was reported, the actions by CardSystems were not enough.

"Visa cannot overlook the significant harm the data compromise and CardSystems' failure to maintain the required security protections has had on member financial institutions and merchants as well as the significant concerns it raised for cardholders," the company said in a statement.

At this point, it is unclear what the other branded card companies will do. MasterCard has previously said that it was giving CardSystems a "limited amount of time to demonstrate compliance with MasterCard security requirements" but never laid out a specific timetable.

Sharon Gamsin, a MasterCard spokeswoman, did not return calls seeking comment. Judy Tenzer, an American Express spokeswoman, said the company did not comment about its relationships with vendors. Leslie Sutton, a Discover Financial spokeswoman, could not offer an immediate response.
Visa's decision is the latest development since the disclosure in mid-June that the CardSystems computer network had been compromised, putting the cardholder names, account numbers and security codes of as many as 40 million credit and debit cardholders at risk for fraud. The information of about 22 million Visa cardholders was exposed; MasterCard reported the data of 14 million of its cardholders was potentially at risk; and the rest largely belonged to customers of American Express and Discover.

At the time, Mr. Perry of CardSystems acknowledged that the company had been improperly storing data, violating Visa and MasterCard security rules. He said data thieves directly obtained information related to some 200,000 cardholder accounts. The F.B.I and a group of federal banking regulators are now investigating.
In its statement, Visa offered its most scathing indictment of those security violations to date. The chief executive of CardSystem had "stated that the company knowingly retained unmasked magnetic stripe cardholder data, purportedly for 'research purposes,' " Visa said. "Visa's security requirements were adopted precisely for the purpose of protecting cardholder information and guarding against the type of data compromise recently experienced by CardSystems."

In the letter Visa sent to the banks, Mr. Murphy suggested that the data breach occurred as early as August 2004.

By ERIC DASH
The New York Times.

More in Tux Machines

PayPal Reduces Costs 10x With Open Source CI

The bigger you are, the more small efficiencies add up. Manivannan Selvaraj's talk from LinuxCon North America gives us a detailed inside view of how PayPal cut operating costs by a factor of ten, while greatly increasing performance and user convenience. Everything has to be fast now. We can't have downtimes. No going offline for maintenance, no requesting resources with a days-long ticketing process. Once upon a time virtual machines were the new miracle technology that enabled more efficient resource use. But that was then. Selvaraj describes how PayPal's VMs were operating at low efficiency. They started with a single giant customized Jenkins instance running over 40,000 jobs. It was a single point of failure, not scalable, and inflexible. Read more

Turn Raspberry Pi 3 Into a Powerful Media Player With RasPlex

I have hundreds of movies, TV shows and music that I have bought over the years. They all reside on my Plex Media Server. Just like books, I tend to buy these works and watch them once in awhile, instead of relying on "streaming" services like Netflix where content isn’t always available forever. If you already have Plex Media Server running, then you can build an inexpensive Plex Media Player using Raspberry Pi 3 and RasPlex. Plex Media Server is based on open source Kodi (formerly XBMC), but is not fully open source. Plex Media Center has a friendly interface and it’s very easy to set up a media center (See our previous tutorial on how to install it on a Raspberry Pi 3 or on another dedicated Linux machine). Read more

7 Linux predictions for 2017

Last year I made a set of predictions of events that I thought would happen in the tech world (focused primarily on Linux and free software). I was mostly right. This has emboldened me to make another set of predictions for 2017. I have no inside knowledge on any of these—I am basing this entirely on the twin scientific principles of star maths and wishy thinking. Read more

GTK Graphics

  • GTK Lands A Big Refactoring Of OpenGL Code
    In addition to Red Hat's Benjamin Otte working on a Vulkan renderer for GTK4's GSK, he's also been working on a big refactoring of the OpenGL code that's now been merged to master. OpenGL is very important for GTK4 as it will play a big role in rendering with GSK. With this "large GL refactoring", a big clean-up was done of the OpenGL GDK code, affecting the X11, Win32, Wayland, and Mir code too. Some of the specific work includes no longer using buffer-age information, passing the actual OpenGL context, and simplifying the code. More details via this Git commit.
  • A Vulkan Renderer For GNOME's GTK+ GSK Is In Development
    A Vulkan back-end is in development for GNOME's GTK's tool-kit new GTK Scene Kit (GSK) code. Benjamin Otte has begun experimenting with a Vulkan back-end for GTK's GSK code with GTK Scene Kit being one of the big additions in development for the major GTK+ 4.0 milestone. GSK implements a scene graph to allow for more complex graphical control of widgets and other improvements to its graphics pipeline. GSK was merged back in October and currently uses OpenGL for rendering while there is now a branched Vulkan renderer.