Mobile Payments: Balancing Security with Convenience Ron King, President, CampusGuard

Mobile Payments Overview Trends In Adoption Security Risks Securing Mobile Payments

Mobile Payment Ecosystem Regulators Merchants Application Developers Device Manufacturers Financial Service Providers Standards Bodies Network Service Providers Payment Service Providers Consumers 11/16/2018

Who Wants Mobile Payments? Late Majority Millennials Early Majority ` Early Adopters Innovators Laggards Millennials are the first fully digital native population

Mobile Payments Awareness Is Exploding 32% Over half (56%) of consumers now know there is technology available to use their smartphone to pay 27% 16% 11% 8% 32% 41% 37% 36% 43% 52% 56%

Mobile Payments Landscape - Usage There are over a half-billion devices on 3G/4G networks By 2020, there will be 10 billion devices 60% of all users carry their devices with them at ALL times For high-profile, business folks and students that is near 100% A smartphone today has the same power as a PC from 10 years ago: Always-on network connectivity Location aware via GPS

Mobile Payments Landscape - Interaction Accessing sensitive information via smartphones is normal Users* do not fear making purchases or financial transactions Users * trust a smartphone over a public computer or kiosk They rarely question their smartphone’s integrity Limited “desktop real estate” means sacrificing notices Security notices are often misleading and/or cryptic

Your Campus = A City! Athletics – ticketing and concessions Performing Arts Business Office / Bursars Library – fines and copying fees DVD rental vending Campus Safety Office (parking fees and fines) Dining Residence halls Book Store Student Center (student activity fees, student newspaper advertising, food courts)

Mobile Payments on Campus

Types of Mobile Payments Mobile web browser Smartphone application Uses SMS, USSID technologies Credit Card transactions via WAP Remote Contactless Uses NFC technology Proximity

Mobile Payment Devices

Examples in Higher Ed

Balancing Security With Convenience

Benefits of Mobile Payments 4 1 3 2 Expenses Customer Preference Cash Flow “Meeting” Customer When Ready

Risk Assessment Required!

Top 10 Risks for Mobile Payments Fraud Against Customers 1 Repudiation Fraud 6 Man-In-The-Middle-Attack 2 Payments Coercion 7 Shoulder Surfing/Theft 3 Money Laundering 8 Expenditure Against Acct. 4 Internal Denial of Service 9 External Denial of Service 10 Acquiring Line of Credit 5

Cause Effect Nebraska Payment Processor Breach 2003 Nebraska Payment Processor Breach Huge Press/Media Coverage Card Brands React PCI Council Formed PCI DSS Implemented 2006

Cause Effect 1906: Upton Sinclair The Jungle Pure Food and Drug Act 1970: Ralph Nader Unsafe at Any Speed Highway Safety Act 2002: Enron and WorldCom Sarbannes-Oxley Act 2011: 9/11 USA Patriot Act

PCI DSS and Mobile Payments “Until it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape, the Council will not approve or list mobile payment applications used by merchants to accept and process payment for goods and services as validated.” 2011 “With the United States facing government price controls on debit and restrictive routing and exclusivity rules, it is not feasible or appropriate to drive the market toward major infrastructure investments, especially in an environment where financial institution could lose billions in revenue as a result of the regulation.” 2011

Some Guidance…

Responsibilities Mobile Payments Payment Card Issuers Merchant Fraud Identification Development of authentication mechanisms Payment Card Issuers Mobile Payments Define and enforce payment security and fraud rules Protect the cards in their possession Cardholders Merchant Employ fraud prevention controls Ensure compliance with the rules defined by the card brands, ensuring the security of their networks, applications, and systems Service Providers Develop solutions that support the objectives of the other groups

Act Fast and Constantly Course Correct Closing Thoughts Prepare For The Future Act Fast and Constantly Course Correct Know Your Customers

Resources SAQs Annual PCI Workshop FAQs Listserv White Papers Blog www.pcisecuritystandards.org www.treasuryinstitute.org SAQs FAQs White Papers Certified QSAs and ASVs Annual PCI Workshop Listserv Blog

.

. Contact Us www.campusguard.com Ron King Mobile: 214-770-3550 Phone: 972-964-8884 Email: rking@campusguard Andy Grant Mobile: 419-409-0424 Phone: 419-873-7016 Email: agrant@campusguard Allison Rivkin Mobile: 508-509-3909 Email: acantin@campusguard www.campusguard.com