SAN FRANCISCO – Although it is taking pains to not be seen as taking responsibility for card data breaches, Visa USA has put some policies into place to prevent them and to ameliorate their damage.
Beginning Oct. 1, Visa says it will implement the Account Data Compromise Recovery process, a procedure which will both provide a small measure of recompense to issuers who have suffered losses from card data security breaches and also provide a faster process for reimbursements of fraud losses, the card brand said.
"Our goal is to prevent fraud. But when it does happen we want to be able to help issuers and acquirers recover as quickly and efficiently as possible from its impact," said Jean Bruesewitz, senior vice president, with Visa USA.
Recommended For You
Under this enhanced process, issuer compensation will be automatically calculated and reimbursed based on the counterfeit fraud the financial institution reports to Visa. Typically, issuers will receive financial recovery within six months from the date Visa sends an alert notifying them of the account numbers at risk. Bruesewitz noted, "This new process represents a significant improvement over the current recovery process which requires extensive support documentation leading to compensation that could have taken up to 32 months."
The card brand also said it would offer to pay $1 per account for 80% of the accounts which had been identified as compromised in an event in which merchants had held onto card data they should not have which was then stolen.
The total number of qualified accounts would be reduced by 20% to approximate the number of accounts that are already closed or expired, those accounts generally not requiring any additional action by the issuer, Visa said. The new policy also has something in it for the merchants as well. In addition to helping issuers more easily receive reimbursement, the enhanced procedures also seek to set fair limits on acquirer and merchant liability by establishing a maximum timeline of up to 13 months of liability for eligible counterfeit transactions properly reported.
This is a significant change from the current process, which allows issuers to pursue financial recovery up to the last expiration date of the impacted accounts. Visa will provide the acquirer an estimation of liability early in the process to better forecast financial impact. Additionally, acquirers can submit a written appeal for consideration by Visa prior to any final assessment of financial liability. According to Visa, currently its issuers absorb more than 70% of payment card fraud losses incurred, with acquirers and merchants shouldering the balance. Visa's zero liability policy ensures that consumer cardholders are not responsible for fraudulent purchases. "Growth in card payments will continue to require the balancing of fraud losses and operational costs among issuers, acquirers and merchants," said Bruesewitz. "The improved ADCR process now makes that balancing act more equitable and efficient for issuers and acquirers."
Reaction in the credit union industry has been muted since many executives were on vacation or business travel when the announcement was made. CUNA Mutual Group, the insurer of most CU card programs and a frequent critic of the major card brand's anti-fraud policies, said only that it was still looking at the new policy and did not yet have a reaction to it.
But Greg Smith, CEO with the $2.3 billion Pennsylvania State Employees Credit Union, took a more critical look. The CU is involved in ongoing litigation with B.J.'s Wholesale Club over losses the CU incurred after a card security breach that retailer experienced.
"I suppose it's a step in the right direction, but it really doesn't begin to cover our costs," Smith said, a figure he reported came in between $7-$8 per account. Smith acknowledged that the CU was probably not very efficient in the replacing of accounts compromised in the B.J.'s breach and thus the CU's costs might have dropped. But he also questioned some of the premise behind Visa's recompense program, noting that the card brand had not been the one in violation of the rules.
"Our one point from the very beginning, which seemed very simple to us, was that the organizations responsible for the breach should pay for it," he said.
Visa also announced other changes to the merchant side designed to help close the security risk gap overall.
One of the changes came in the card brand's technical standards designed to decrease the risk of card data compromises by shifting more merchants into more rigorous compliance categories.
"Protecting the environment is critical to ensuring the future growth of electronic payments," said Mike Smith, senior vice president, enterprise with Visa. "Extending more rigorous validation requirements to additional merchants better reflects the security risks present in the marketplace."
While none of the validation requirements themselves have changed, merchants moving into a new validation level will be responsible for complying with that category's validation responsibilities. For example, merchants moving from Level 4 to Level 2 must now have quarterly network security scans performed by a qualified independent scan vendor. But the card brand also announced that the revised criteria impact a relatively small number of merchants. Less than 1,000 level 4 merchants are expected to move into the level 2 category, while an equal number of former level 2 merchants processing fewer than 1 million e-commerce transactions per year will move to level 3, Visa said. [See Sidebar for level definitions].
Finally, Visa also announced efforts to press more vendors to more thoroughly implement the best practices standards that Visa has promulgated, as well as publishing warnings to certain merchants, such as mid-sized restaurants, about security concerns.
"Often, merchants use third-party firms known as `integrators' or `resellers' to configure or install POS systems," Visa wrote in a message about the security concerns at restaurants. "Because third-party firms may vary in their ability to properly install and configure common security controls, POS systems may be vulnerable to compromise upon installation. Merchants are urged to begin a dialogue with their vendors to ensure their POS systems are adequately safeguarded from internal and external intrusions." [email protected]
© Touchpoint Markets, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more inforrmation visit Asset & Logo Licensing.