Visa Inc. · NYSE:V
Visa — Layering Secure Technologies to Strengthen Payment Card Environments Webinar (January 2015)
27 slides from Visa's conference presentation, Jan 21, 2015
Slide 1: Layering Secure Technologies to Strengthen Payment Card Environments
Layering Secure Technologies to Strengthen Payment Card Environments Webinar 21 January 2015 Visa Public
Slide 2: Disclaimer
Disclaimer The information or recommendations contained herein are provided "AS IS" and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. When implementing any new strategy or practice, you should cons
Slide 3: Agenda
Agenda • Data Breach Landscape • Demystifying Tokenization • U.S. EMV Migration • Point-to-Point Encryption • Questions and Answers 3 | Layering Secure Technologies to Strengthen Payment Card Environments | 21 January 2015 Visa Public
Slide 4: Data Breach Landscape
Data Breach Landscape 4 | Layering Secure Technologies to Strengthen Payment Card Environments | 21 January 2015 Visa Public
Slide 5: Visa Inc. CAMS Compromise Events – Entity Type by Month
Visa Inc. CAMS Compromise Events – Entity Type by Month 2 3 2 3 4 2 3 4 12 13 14 2 12 3 13 4 14 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 p- p- p- n- n- n- l l l v v ay ay ay ar ar ar Ju Ju Ju No No Se Se Se Ja Ja Ja M M M M M M Brick & Mortar Ecommerce Processor / Agent Source: Compromised Account Managemen
Slide 6: Visa Inc. CAMS Compromise Events Top Market Segment (MCC)
Visa Inc. CAMS Compromise Events Top Market Segment* (MCC) • Restaurants and retailers are leading market segments in 2014 • Insecure remote access and poor credential management continue to be attack vectors RESTAURANTS OTHER RETAIL QSR'S B2B SUPERMARKETS LODGING 2011 2012 2013 2014 * Market Segmen
Slide 7: Demystifying Tokenization
Demystifying Tokenization 7 | Layering Secure Technologies to Strengthen Payment Card Environments | 21 January 2015 Visa Public
Slide 8: Payment Token Definition
Payment Token Definition Tokenization involves the replacement of the card- account number with a “non-financial identifier” which may be used in its stead to initiate payment activity Uses for Tokens • Conduct payment transactions over online and mobile payment channels • Provide a method for third
Slide 9: Demystifying Tokenization - Payment Token Processing
Demystifying Tokenization - Payment Token Processing 1. Token Request Process Token Requestor Visa Token Service Issuer Card # Token Request Token Issuer Assurance, Identity and Verification (ID&V) 2. Token Authorization Process Authorization Request Merchant Acquirer Visa Token Service Issuer 1 2 3
Slide 10: Demystifying Tokenization – Benefits for Ecosystem Participants
Demystifying Tokenization – Benefits for Ecosystem Participants Common tokenization standard minimizes impact by ensuring compatibility with current payment technologies and enabling support for emerging payment innovations Merchant/ Cardholder Wallet Provider Acquirer Issuer • Card re-issuance not
Slide 11: Demystifying Tokenization – Key Activities
Demystifying Tokenization – Key Activities Industry Standard • Donated to EMVCo by Visa • A new EMVCo task force established to govern the standard going forward VisaNet Processing • November 2013 Technical Letter • April 2014 Business Enhancements Release Visa Payment Token Service • Mid-2014 limit
Slide 12: Demystifying Tokenization – Key Takeaways
Demystifying Tokenization – Key Takeaways 1 Tokenization has two main components: standard and service 2 Token replaces account number with a non-financial identifier Issuers, acquirers/merchants, wallet providers and OEMs can be 3 potential token requestors A single PAN can have multiple tokens bas
Slide 13: U.S. EMV Migration
U.S. EMV Migration 13 | Layering Secure Technologies to Strengthen Payment Card Environments | 21 January 2015 Visa Public
Slide 14: Currently 83% of payment card fraud in the U.S. is counterfeit or card not present fraud
Currently 83% of payment card fraud in the U.S. is counterfeit or card not present fraud EMV chip, tokenization, and encryption are 83% of fraud in U.S. technologies designed to reduce risk from payment data being stolen and devalue the data if stolen ! Source: Visa Fraud Reporting System (FRS) and
Slide 15: Fighting fraud with layers of security
Fighting fraud with layers of security EMV chip • Creates a unique cryptogram for Counterfeit each transaction REAL-TIME PREDICTIVE ANALYTICS • Not a silver bullet ENCRYPTION 83% of fraud in the U.S. Tokenization Card not • Token replaces account number with present unique digital token • If payment
Slide 16: How does EMV chip technology work?
How does EMV chip technology work? Because the cryptogram changes with every transaction, even if the card data is stolen, the information can’t be used to create counterfeit cards because the cryptogram would have already “expired” 4 0 0 0 1 2 3 4 5 6 7 ^ J O H N D O E ^ 0 1 2 0 1 2 ^ 1 0 1 ^ 2 1 7
Slide 17: The benefits of EMV chip
The benefits of EMV chip Security, innovation and acceptance 1 2 3 4 5 Enhanced Enhanced Paves the way Moves U.S. Cardholders security – fraud international for secure mobile closer to still protected reduction acceptance payments – dynamic data with zero tokenization authentication – liability deva
Slide 18: Visa U.S. EMV chip roadmap
Visa U.S. EMV chip roadmap • In August 2011, Visa led the industry by setting a plan to move the U.S. to EMV chip technology • Successful globally, liability shifts have been the primary incentive used to encourage both issuers and merchants to adopt EMV chip technology April 2013 April 2015 October
Slide 19: The counterfeit fraud liability shift
The counterfeit fraud liability shift • Today: Issuer has card-present POS and ATM liability • After liability shift: Liability shifts to the acquirer Counterfeit fraud if counterfeit fraud occurs on a contact EMV chip-capable liability shifts card and the merchant is not contact EMV chip capable •
Slide 20: Point-to-Point Encryption (P2PE)
Point-to-Point Encryption (P2PE) 20 | Layering Secure Technologies to Strengthen Payment Card Environments | 21 January 2015 Visa Public
Slide 21: Point-to-Point Encryption (P2PE) Overview
Point-to-Point Encryption (P2PE) Overview • Point-to-Point Encryption is the process of encrypting payment data in a secure terminal and transmitting it through a network to a secure decryption point • Protects cardholder data from the point of data entry to the payment card processor • Shields agai
Slide 22: Point-to-Point Encryption and EMV
Point-to-Point Encryption and EMV EMV Only Dynamic authentication, but account number and sensitive Payment data remains exposed 4000121234569010 Network Mitigates fraud at the point- 5000121234569010 340012123458901 of-sale but does not affect Visa: 4000123456789010 cross-channel fraud MC: 5000
Slide 23: Leveraging Technology
Leveraging Technology Payment Security Taskforce Recommendations • PST is comprised of leading U.S. issuers, acquirers, merchants, payment networks and other electronic payment participants • PST recommends a multi-layered approach to security that includes compliance with PCI standards and use of r
Slide 24: P2PE, Tokenization and EMV
P2PE, Tokenization and EMV Card Present Card Not Present Mobile EMV + P2PE Tokenization EMV + Tokenization 24 | Layering Secure Technologies to Strengthen Payment Card Environments | 21 January 2015 Visa Public
Slide 25: Security Solutions End State
Security Solutions End State Hacker Chip Card PAN Mag-stripe Merchant Payment Network 4000123456789010 %$#^43@!&s* 4123456789101112 4123459876543212 PAN 4987654321012345 Token Token 4123456789101112 4123459876543212 4987654321012345 Offline Token storage 25 | Layering Secure Technologies to Strength
Slide 26: Upcoming Events and Resources
Upcoming Events and Resources Upcoming Webinars – Training tab on www.visa.com/cisp • Data Breach Findings for Large Merchants ‒ 28 January 2015, 10 am PST • Cyberlocker Merchant Overview & Enhanced Due Diligence ‒ 24 February 2015, 7 pm PST (Asia Pacific / Central Europe, Middle East, Africa audien
Slide 27: Questions?
Questions? Visa Public