Payment Methods Newsletter September 2021

PCI SSC Publishes New Guidelines for Conducting Remote Assessments

In response to questions about how remote assessments should be conducted, the PCI SSC has recently published a new document titled ‘PCI SSC Remote Assessment Guidelines Procedures’, which defines the principles and procedures for the proper use of remote assessments when an in-person assessment is not possible.

More information can be found at the following link:

https://blog.pcisecuritystandards.org/new-guidelines-on-remote-assessments

PCI SSC Publishes New Article on the Implications of 8-Digit BINs

The use of 8-digit BIN numbers may have implications for companies that work with payment card data. In terms of PCI DSS, this impacts Requirement 3.3 (masking the PAN so that only the first six and/or last four digits are displayed) and Requirement 3.4 (rendering the PAN unreadable anywhere it is stored).
 

More information at the following link:
https://blog.pcisecuritystandards.org/8-digit-bins-and-pci-dss-what-you-need-to-know

PCI SSC Updates FAQ#1091 Regarding Payment Brand-Approved Truncation Methods

In this new update to FAQ#1091, the PCI SSC has updated the positions of payment brands VISA and Mastercard. Accordingly, both payment brands indicate that all 16-digit PANs with an 8-digit BIN can retain the first 8 and any other 4 digits, stipulating that at least 4 digits must remain unreadable.

Finally, it is worth noting that the truncation methods accepted by UnionPay have also been added.

More information at the following link:
https://pcissc.secure.force.com/faq/articles/Frequently_Asked_Question/What-are-acceptable-formats-for-truncation-of-primary-account-numbers

Impact of COVID-19 on the PCI DSS Standard (I)

Sergio Moreno, from the consulting department, analyzes the overall impact of Covid-19 on PCI DSS environments, the changes expected after the pandemic, and the risks arising from the growth of remote work worldwide.

The National Security Framework and Risk Reduction in Office 365

Eric Tormo, from the consulting department, provides information on how to improve the security of the O365 suite in accordance with the security parameters analyzed by the National Security Framework (ENS).

XSS, An Evil That Never Ends

Héctor Berrocal, from the auditing department, introduces cross-site scripting (XSS) attacks, including practical examples and indicating some countermeasures that should be used to protect against them.

To promote and publicize an illegal online store, a group of hackers released 1M stolen card records between 2018 and 2019. It is estimated that 50% of these cards were active at the time of exfiltration. The exfiltrated dataset included the PAN, expiration date, CVV number, and personal data of the cardholder, such as their name, mailing address, email address, or mobile number.

More information at the following link:
https://www.forbes.com/sites/emmawoollacott/2021/08/10/with-unprecedented-generosity-hackers-release-a-million-credit-cards-for-free/?sh=3ac38060654e

Last August, the cyberattack suffered by T-Mobile made headlines, in which hackers allegedly accessed the data of 100M people. T-Mobile immediately began investigating the alleged security breach. At the end of August, the company issued a new statement about the incident, explaining the findings of the investigation and confirming that customer payment data (financial information, payment card data, etc.) were not affected, but personal data of former, current, and prospective customers were. The exfiltrated data varies depending on the individual, but may include social security numbers, name, mailing address, date of birth, driver's license information, mobile number, IMEI code, etc.

More information at the following links:
https://www.t-mobile.com/news/network/additional-information-regarding-2021-cyberattack-investigation
https://www.vice.com/en/article/akg8wg/tmobile-investigating-customer-data-breach-100-million

Mastercard Ends Magnetic Stripe

Mastercard is the first payment brand to publicly announce that it will remove the magnetic stripe from its payment cards. To this end, it has announced a transition plan:

• 2024: From this year onward, it will be optional for issued cards to have a magnetic stripe in most markets familiar with EMV payments.
• 2027: In the case of the U.S., this optionality will not arrive in 2024, and will be delayed for three more years.
• 2029: Newly issued payment cards will not have a magnetic stripe.
• 2033: The date from which no payment card will have a magnetic stripe.

BBVA Expands the Aqua Card to Latin America

The Aqua card was launched in Spain in October 2020 and, since then, more than 1,200,000 payment cards have been issued. These cards do not have any printed data (PAN, expiration date, CVV2) on either the front or the back. Therefore, to view the data, it is necessary to use the bank's mobile application. In addition, the card's CVV2 is dynamic, so it changes over time.

BBVA is gradually expanding this payment method to Latin America. Accordingly, in some countries it opts to offer the dynamic CVV2 service, and in others, 'clean' cards without printed data.

Renfe Implements Payment and Access with Bank Card in Madrid Commuter Rail

Renfe is launching the so-called Cronos project to deploy contactless EMV terminals throughout the commuter rail network, starting with Madrid. Accordingly, customers will be able to pay directly at the turnstiles, without having to go to the ticket office and buy a single ticket. Direct access and payment using a contactless bank card will optimize users' time, because they will not have to arrive early to make the purchase, and it will also improve the flow in the lobbies. In addition, this innovation also pays homage to the environment, as fewer cardboard tickets will be issued.

This message has been sent pursuant to your authorization for the communication of commercial information from Internet Security Auditors. You can consult our Data Privacy Policy here. You have the possibility to exercise the rights of access, rectification, erasure, restriction, objection and portability provided for in the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC" by letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2 08030. Barcelona (Spain), or by email to the following address: legal@isecauditors.com. If you only wish to unsubscribe from these communications, click the following link and send that email from the email address at which you received our communication: marketing@isecauditors.com

This email is sent according to your previous authorization for sending commercial information from Internet Security Auditors. You can read our Data Privacy Policy here. You have the possibility at all times to exercise the rights of access, rectification, erasure, restriction of processing, objection and portability according to the "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" by sending a letter addressed to Internet Security Auditors, Calle Santander, 101. Edificio A-2. 08030 Barcelona (Spain), or through the following email: legal@isecauditors.com. If you only wish to request your cancellation of these communications, click on the following link and send that email from the email address where you received our communication: marketing@isecauditors.com