Tag Archives: credit card processing

Hotel Chain Looking into Data Breach

Kimpton Hotels & Restaurants is investigating reports of a data breach at several of its properties.

Kimpton operates 62 boutique hotels across the country and has begun to look into the scale of this hacking. Management has hired a computer security firm to find out if guest information or internal systems have been hacked. The hotel group has been discreetly advising guests who recently stayed at Kimpton to monitor their credit card bills and immediately notify their banks of unauthorized charges.

Headquartered in San Francisco, Kimpton released a statement that said, in part, “Kimpton Hotels & Restaurants takes the protection of payment card data very seriously. Kimpton was recently made aware of a report of unauthorized charges occurring on cards that were previously used legitimately at Kimpton properties.” Kimpton says it is doing everything it can to resolve the matter. They do offer customers some small solace about fraudulent charges to customer accounts. “Payment card network rules generally state that cardholders are not responsible for such charges.”

One computer blog has reported finding multiple sources in the financial industry ready to confirm a pattern of fraudulent credit card processing, suggesting a data breach at somewhere in the vicinity of two dozen Kimpton hotels.

The hotel chain is not the only hotel to find itself on the wrong end of a data breach. Over the last year, a number of hotel chains, including Trump, Starwood, and Hilton, found themselves victim to cyber criminals with customers’ information stolen. Omni Hotels had 50,000 credit card numbers taken.

Reportedly, most of the incidents appear to have occurred at counters with POS systems, including gift shops, restaurants and stores, but there were also complex data breaches that accessed information through internal data systems.

These breaches only reinforce the need for strong security measures to avoid even the smallest data breach. From merchant services to POS, cyber criminals are working as fast as possible to breach security technology as developers are finding ways to fortify defenses. From patches and upgrades to better firewalls, everyone should be protecting their data which is always at risk.

paypal and visa partnership

What the PayPal and Visa Partnership Means for the Future of Payments

Discovering Visa and PayPal were partnering up has shaken up the credit card processing industry. It is believed that everything from merchant services to eBay will be affected. Some immediately lauded how the partnership will enhance in-store NFC payments. The most cynical critics believe Visa, with PayPal under its watchful eye, will be better suited to tackle competition like Checkout.

The major reason this partnership has stunned the industry is because company heads at Visa and PayPal previously expressed opinions that could be interpreted as being diametrically opposed to ever working together.

Visa CEO Charlie Scharf has stated that payment players – merchant services, credit card processors, etc. – were either against Visa or with Visa. He believed “co-opetition” did not reflect how the traditional payment ecosystem and standard network model had operated for over five decades. The success of PayPal’s ACH and the many accounts it held contradicted this and, for Visa, made PayPal a serious concern.

Meanwhile, Dan Schulman, CEO at PayPal, has made it quite clear he saw PayPal as a new and unique entity after its break from eBay. Schulman has made it clear that he was running a very different enterprise. He stated the company was primed to look at consumer options and, yes, partnerships. As the driving force behind ACH, PayPal was pretty much indifferent to tender types.

Among the most interesting notions to come out of the partnership is that it will energize in-store NFC payments. Others took issue with PayPal’s business model being totally overshadowed by its new partner’s traditional credit card processing. Some analysts wondered if Visa would force PayPal to disband its business model and take on a more traditional credit card processing operation. Whatever is to come, the market took notice of the potential disadvantages. The day after the announcement, PayPal saw its stock ending down 6.75%.

Visa is the biggest credit card network in the world. PayPal is the world’s largest digital payment network with an estimated 188 million active users. PayPal’s merchant services are beloved by vendors and businesses globally. PayPal also has dormant accounts that this partnership could reinvigorate with accountholder incentives.

Still, while one can make it look good on paper, all the credit card processing in the world cannot guarantee this will work.

Walmart Pay

Walmart Pay to Deepen Information about Shopper Habits

Businesses are striving to stay on top of trends in consumer behavior, and mobile payments have been a hotbed of activity. Walmart Pay just rolled out nationwide, and the company is hoping that the app will help them collect more information about how customers use their products and make purchasing decisions. Credit card processing has seen huge changes recently, and new mobile payment apps like Walmart Pay and Apple Pay are certainly capitalizing on this trend.

Mobile Applications are seeing a ton of investment from the tech sphere, and Walmart is only one of the many companies trying to launch their propriety applications for their customers. The applications are supposed to make purchases easier for consumers. The app can track purchase history, which will allow customers to reorder frequently purchased items.

The application also speeds up the checkout process in-store, which is intended to increase the frequency that customers will visit Walmart and open their wallets. Walmart Pay is also intended to provide more information to the company. Businesses of all sizes are interested in the big data trend, and this application will help them further analyze the purchases and products that customers are viewing.

Walmart Pay also incorporates mobile payments, another major industry trend. Other apps like Apple Pay have been allowing consumers to create e-wallets that allow them to pay using their smartphones. This has been a major shakeup for credit card processing firms, and there have been many startups looking to help companies take mobile payments. While mobile payments have yet to catch on in a major way in the United States, Walmart is hoping that they can help move the needle on this.

The company is rolling out the application nation-wide, after testing the product in smaller markets across the United States. The application does not yet support third-party e-wallets, but customers can currently connect the application with debit, credit and prepaid cards. The company might decide to pair with Apple Pay in the future, but for now the options are slightly more limited. Time will tell if this application sees mainstream adoption. One thing is for sure, the evolution of e-wallets and retailer applications is going to be a transformative force for firms that do credit card processing.

Err on the Side of Caution: Nonprofits and Virtual Credit Cards

A jarring amount of 17.6 million people (7% of Americans) had at least one incident of identity theft in 2014, according to the Bureau of Justice Statistics. Unfortunately some of that identity theft can come from third parties, including criminals accessing business accounts to get information about consumers. Nonprofits, small businesses and large corporate companies can all be at risk without a proper protection plan.

In the case of nonprofits, fundraising for charities may also be affected without a secure nonprofit processing system. One questionable online merchant can lead to access of a nonprofit’s bank or credit union account information, credit or debit card numbers, Social Security numbers (linked to employees of the nonprofit services). In a tech world where “password” continues to be a common password for both individuals and companies, a lucky guess can expose an entire company’s important documents.

Virtual credit cards are one continuously effective way to protect company financial information. Some of the biggest perks of virtual credit cards include:

• Flexibility to not release vital credit card information from lesser known companies
• Ability to set a maximum spending amount
• Specifying an expiration date for the virtual card
• Shopping safely online with what looks like a regular merchant card number
• Potential cash rebates

The owner(s) and accountant(s) of any company may already be aware of the amount of record-keeping involved in making sure that all involved parties receive their paychecks, reimbursements, supplies and any other applicable expenses. However, nonprofit processing has the added requirement of being able to explain all purchases and payments made for a humanitarian or environmental cause. Unlike for-profit companies, which benefit the founder and however many employees work for the organization, funds for charities ideologically make a full circle into supplies for education, first aid, food, shelter, water and other things associated with the organization’s focus.

So even one questionable purchase, or suspicious merchant, can hurt the reputation of a nonprofit. This is the exact reason why nonprofit processing should incorporate virtual credit cards into its billing options for charities. While some companies have already tried to make online purchases easier by using trusted sites like PayPal, a company may still be at risk of password break-ins.

An email site that isn’t secure, unattended mailboxes (where bank statements may be found), dumpster diving, malware and fake clone sites (spoof) could put a nonprofit at risk of releasing private financial account information. By using a virtual credit card, if an identity theft occurs, it gives the hacker less information to work with.

Wal-Mart Sues Visa

The swipe fee antitrust lawsuit that The Official Merchant Services Blog has been covering for a few years now has an update: Wal-Mart, accusing Visa of excessively high card swipe fees, is suing Visa for $5 billion. The action by Wal-Mart is being taken because Wal Mart opted out of the settlement of the class action lawsuit between merchants and Visa and MasterCard.

This follows our previous report of the Minnesota Twins also opting out of the settlement. Wal-Mart filed the suit Tuesday, March 25, in the U.S. District Court for the Western District of Arkansas, where Wal-Mart is headquartered.

Wal-Mart’s Side of the Suit

Wal-Mart, the world’s largest retailer, is seeking damages from price fixing and other antitrust violations that it claims took place between January 1, 2004 and November 27, 2012.

In its lawsuit, Wal-Mart contends that Visa, in concert with banks, sought to prevent retailers from protecting themselves against those swipe fees, eventually hurting sales. Wal-Mart stated in court documents: “The anticompetitive conduct of Visa and the banks forced Wal-Mart to raise retail prices paid by its customers and/or reduce retail services provided to its customers as a means of offsetting some of the artificially inflated interchange fees. As a result, Wal-Mart’s retail sales were below what they would have been otherwise.”

Wal-Mart contends that that the way Visa set up the swipe fees violated antitrust regulations and generated more than $350 billion for card issuers over the time period in question, in part at the expense of the retailer and customers.

Case History

The antitrust case against Visa, MasterCard and several issuing banks stemmed from the dispute relating to the percentage of credit card transaction fees that retailers must remit to the credit card processing network. The fees generally range from 1.5 to 3 percent and are shared with the bank that issued the card. Also known as “swipe fees,” these charges serve to underwrite the supporting infrastructure that allows businesses to accept and process credit cards.

Large retailers and supporting associations have repeatedly complained about the costs associated with accepting credit cards and the fees for merchant services. These grievances resulted in a number of lawsuits filed in 2005, which were eventually consolidated into a single case known as the Payment Interchange Fee and Merchant Discount Antitrust Litigation.

There were 139 parties involved as plaintiffs, and the case was active for over eight years. In July 2012, a settlement was reached that provided $6 billion in damages to affected retailers and another $1.2 billion for a temporary reduction in interchange fees. As a further concession, Visa and MasterCard eliminated certain rules for merchant services that prohibited surcharging, which is a practice that allows retailers to recoup credit card costs by passing them on to the consumer.

After a settlement was reached in the case, major retailers such as Target, Nike, Home Depot, Lowes, Starbucks and Best Buy ultimately opted out of the settlement. Major trade organizations, including the National Restaurant Association (NRA), have voiced significant opposition to the agreement. In fact, the NRA strongly encouraged its constituent members to reject the settlement and highlighted the potential negative impact it could have on the emerging mobile payments market.

The Saga

To review the full extent of this ongoing saga, you can read our previous coverage of this settlement:

Online Poker in Delaware

Online Poker in Delaware [2025 Update]

On Tuesday, February 25, 2014, Nevada and Delaware lawmakers signed a landmark agreement to join the states together in online poker ventures, potentially increasing payouts for residents who gamble online. The Multi-State Internet Gaming Agreement signed by Gov. Brian Sandoval of Nevada and Gov. Jack Markell of Delaware established a legal framework for the first authorized interstate Internet gambling.

The legislation opened up a landmark new initiative for the two states. Delaware officials supported this venture in the hope that revenues from online poker in Delaware, blackjack, and slots would help boost revenue in the state’s three brick-and-mortar casinos. Competition in those real-world casinos has risen significantly because of the appearance of new facilities in surrounding states. This increased competition has affected overall state revenues from gambling and prompted Delaware lawmakers to seek out other revenue streams like online gambling.

Nevada has three online poker websites: Ultimate Poker, which is owned by a subsidiary of Station Casinos; WSOP.com, which is aligned with the World Series of Poker; and Real Gaming, which is owned by South Point. Delaware’s websites are controlled by the state’s three racetrack casinos and run on 888’s platform.

Online Poker in Delaware

The potential boost to Delaware’s economy from this move is unclear. Delaware officials predicted that online gambling would generate up to $5 million in state tax revenue in its first year. Those officials have since scaled back that forecast after some technical difficulties and slow take-up online.

Eilers Research gaming analyst Adam Krejcik told investors that Delaware’s current numbers “have been nothing short of a disaster.”

According to the Delaware Lottery, the state brought in $145,200 in revenue from online gaming in January, following $140,000 in December and $111,000 in November.

Nevada hasn’t broken out online poker revenues in the state’s monthly figures, but Union Gaming Group estimated the revenues were between $200,000 and $750,000 each month.

Online Poker in Delaware: Already Opposition

Opposition to online poker in Delaware

On top of the consternation over the economic impact of this partnership is mounting opposition to the law. On March 26, 2014 members of both parties in Congress supported a ban on online gambling. This bipartisan ban comes just mere months after Delaware’s online gambling system went live and a few short weeks after Delaware and Nevada signed The Multi-State Internet Gaming Agreement.

Both Republican and Democrat lawmakers introduced legislation in the House and Senate aimed at banning online gambling, setting the stage for a two-pronged battle in Congress. The measures are aimed at reversing a 2011 decision by Attorney General Eric Holder that a 1961 law used in recent years to curb Internet gaming only barred sports betting. The bills would broaden the prohibition to where it stood before Holder’s ruling.

The Other Shoe Drops

So after Delaware, New Jersey, and Nevada leaped into the space created by the Holder ruling, creating online gambling systems, both Delaware and Nevada teamed up to allow their customers to play against each other in a virtual environment. But before this entire endeavor really gets going, Congress is looking to ban it outright. One key component to why the customer interest is lackluster has to do with something extremely basic (and relevant to The Official Merchant Services Blog): Credit Card Acceptance!

According to uspoker.com, the lack of credit card acceptance is one of the biggest complaints about regulated online poker in Delaware, Nevada, and New Jersey. The Mastercard acceptance rate at regulated sites is higher than Visa, however, neither is high enough to be considered adequate for players and operators.

While this is all still new and getting off the ground, the trend in behavior shows at least one of the obstacles online gambling in Delaware faces. Regulated sites have higher fees, and that is there to help offset the risk of fraud. Essentially what happens with these kinds of sites is that they suffer from a much higher rate of chargebacks.

The Other Shoe Drops

A chargeback typically refers to the act of returning funds to a consumer. The action is forcibly initiated by the issuing bank of the card used by a consumer to settle a debt. Essentially what happens is a consumer disputes a transaction, and the credit card company’s bank responds by taking the money back from the merchant and returning it to the consumer. Customers dispute charges to their credit card usually when goods or services are not delivered within the specified time frame, goods received are damaged, or the purchase was not authorized by the credit card holder — the latter being the most common reason for a chargeback. The chargeback mechanism exists primarily for consumer protection.

Now in online gambling, the risk of a chargeback happening is much higher. Customers who lose money will oftentimes initiate the chargeback instead of taking the loss.

Card issuers have the right to block any transaction that the company does not consider legitimate. Online gaming transactions, even if explicitly legal, sometimes fall into this category. Chargebacks are expensive for banks. These costs are passed onto merchants and processors in the form of penalties and higher processing fees. Banks loathe chargebacks and online gaming has been associated with too many of them over the years. This is one reason credit card companies are not quick to approve these transactions.

But regulation steps in and alleviates these fraud issues. All of the concern related to abusive chargebacks is resolved in regulated markets because players cannot easily charge back a credit card transaction. The transaction is coded as a legitimate, regulated purchase. Many are considered cash advances.  The poker site can prove where the player was located at the time of the transaction and that the chips were received. Proper player verification also provides evidence that a charge was proper.

In Conclusion

The allure of online gambling is still high and Delaware is one of the states diving headfirst into the industry. But there are already obstacles facing the First State. A ban from Congress and all of the problems with chargebacks and fraud create a daunting road ahead for Delaware’s online gambling future. Teaming up with Nevada in a partnership to expand the competition was a good first step. But more states need to be involved if the fledgling endeavor is to really get going. That also helps with the fraud issues as it will take more states regulating online gaming to help make banks more comfortable with the industry. This will also help the profitability of processing these transactions.

Here Comes CoinSummit! [2023 Update]

Today marks the start of CoinSummit San Francisco, a two-day event ”connecting virtual currency entrepreneurs, angel and VC investors, hedge fund professionals and others who are looking to learn and network in the virtual currency industry.” CoinSummit will take place on March 25-26 2014 at the Yerba Buena Center for the Arts in San Francisco.  Many in the bitcoin community have been waiting for this event for a while.

The event with feature notable entities in the virtual currency community that include Marc Andreessen of Andreessen Horowitz, Brian Armstrong of Coinbase, Nic Cary of Blockchain.info, and Tony Gallippi of BitPay.

The Official Merchant Services Blog has been tapped into the ongoing saga of Bitcoin since this article in November — delving into the fascinating gimmick of Bitcoin mining. Traversing the ups and downs of this unstable and chaotic currency led to the crazy month of February and then the fall of Mt. Gox. Since that fateful day, the virtual currency industry has been scrambling. And now we have this much anticipated summit of industry experts discussing the details and potential future of BitCoin and its competitors.

Don’t Miss a Moment of the Action

For those interested, a live stream of the event begins at 9 AM Eastern time today, and can be viewed here.

Points of Interest

So some of the things we’ll be hoping the Summit delves into are: The Mt. Gox crisis, its aftermath and the future of the currency exchange. Of course industry insiders are all going to be sharing their thoughts, rants and frustrations about MtGox. Many will be raging about the losses incurred by the public and so many bitcoiners, and how badly Mark Karpeles has handled this debacle. But more importantly the issue of malleability will be explained and also how the currency and its exchanges can survive well into the future.

Which leads right into the fact that the crisis didn’t imply a complete price crash for BTC, even after hundreds of millions of dollars in permanent losses. How will exchanges guaranty transparency? Audits? Open balance sheets? These are critical issues if Bitcoin is to be adopted by mass markets. So let’s hope the summit dives right into the answers for those questions.

And then there’s the heavyweight presence to consider. The “big 4″ (Coinbase, Blockchain.info, Bitstamp, and BitPay) will all be present at this summit through its founders. Let’s see if the industry leaders explain their current strategies and growth trends.

The competitors also have some spotlight. Ripple, DogeCoin, Litecoin, and Ethereum will be pitching the advantage of alternative options, but also talking about the future of Bitcoin through smart contracts and smart property, two functionalities many think will catapult BTC prices to new levels.

That’s a quick roundup of what to expect at CoinSummit San Francisco.

The VX 520 Embraces the Future

Sometimes the future just sort of sneaks up on you. Even if you’ve given yourself reminders, sticky notes, calendar alarms, and the proverbial string tied around your finger, the future still has a way of creeping up on you unawares.

Which is why Host Merchant Services is happy to offer its customers a payment processing terminal that comes with a reminder built in. Verifone with its VX 520 Terminal is here to prevent any memory lapses about the future from happening to your business and its PCI compliance needs. The VX 520 is PCI PTS 3.0 compliant right out of the box and is a forward thinking terminal designed specifically to be prepared for the PCI compliance mandates that are changing the rules of the industry.

Verifone terminals use end-to-end encryption with SSL v3.0 and 3DES to maintain the highest levels of security. This encryption, coupled with Master/Session and DUKPT key management, provide maximum protection from fraud and misuse of the terminal. The VX 520 terminal is also certified with PCI PED 2.0 approval.

All About Security

Security and secure transactions have been a hot button issue in the payments processing industry for the past few years. Everything from the Global Data Breach to Bitcoin to the Target Breach has people wondering about how secure their payment information really is. This is the root of the creation of PCI and its standards. In the ten years since the PCI DSS emerged as a consensus industry standard for the major credit card vendors, PCI DSS succeeded wildly in some areas – such as the use of endpoint security, encryption and network monitoring technology.

The Clock is Ticking

However, the success of PCI DSS in some areas highlighted others in which the standard had little to say or created perverse incentives—rewarding “compliance” over real security. Subsequent updates have attempted to right those wrongs. And the VX 520 is on the cutting edge of those PCI updates.

In January 2012 the PCI DSS released version 2.0 of their standards. And the VX 520 was built to be compliant to those standards and more.

In November 2013, the PCI DSS released version 3.0 of their standards. And again the VX 520 was compliant.

The 520, offered by Host Merchant Services, is a nimble processor that is ahead of the curve on security standardization. This is helpful because by December 2014, changes are coming from the credit card companies where older terminals will no longer be valid. Host Merchant Services offers a free terminal to new customers that sign up and are available 24x7x365 to help upgrade existing customers to terminals that will be PCI compliant.

Getting Secure and Staying Secure

Host Merchant Services knows that your business needs secure transactions to function. And we’re here to make the process of PCI Compliance easy, understandable and consistent for you each year. We offer the lowest PCI Compliance fee in the industry, at just $4.95 per month. PCI Compliance is essentially the process of adhering to the standards set forth by the Payment Card Industry Data Security Standards Council (PCI DSS). Essentially the standards are a set of requirements designed to ensure that all companies that process, store or transmit credit card information maintain a secure environment.

Secure transactions are important for merchants and a key element of the customer service Host Merchant Services provides. As part of our commitment to our Merchants and their transaction security, HMS offers a PCI ComplianceInitiative to anyone interested in processing with us. We are happy to offer this initiative as well as our free resources to help our merchants see what needs to be done to become compliant … and stay PCI compliant.

PayPal President Hacked [2023 Update]

Twitter, the modern equivalent of Mad Libs and the yellow journalism of the late 19th century, has revealed to us a gem of irony that makes the whole Target getting hacked story seem that much more poignant.

No one is safe in this bold new era of credit card hackers and identity thieves. Not even the president of a major payment processing company.

PayPal President David Marcus has been the victim of credit card fraud, he said on Monday. The leader of the online payments company revealed via Twitter that his credit card information had been stolen on a trip to the United Kingdom and he’d racked up a “ton” of fraudulent transactions on his account.

Smart Chip Didn’t Help

Marcus speculated that thieves probably skimmed the info from the magnetic stripe on his card, even though his card had an EMV chip, a technology that makes cards in Europe more secure than the ones commonly used in the U.S.

EMV® chip technology– or EMV — is a worldwide standard for credit and debit card payments based around the use of chip card technology. The acronym stands for Europay, MasterCard, and Visa, who collaborated to create the technology. The goal of this project was to create a card that worked based off of a microprocessor chip that is read by the payment terminal. Because the U.S. has yet to widely deploy embedded chip technology, the nation has increasingly become the focus of hackers seeking to steal such information. The stolen data can easily be turned into phony credit cards that are sold on black markets around the world.

Is it Just a Marketing Ploy?

Marcus adroitly used the incident as an opportunity to plug his own company, suggesting that the fraud wouldn’t have happened if the merchant had accepted PayPal. His company is currently trying to expand its presence as a payment option in physical stores, putting it in direct competition with platforms like Square and Google Wallet.

It also comes right when data breaches are major news in the payment processing industry. On December 19 2013, Target confirmed a sophisticated data breachoccured. In their press release they stated: “Approximately 40 million credit and debit card accounts may have been impacted between Nov. 27 and Dec. 15, 2013. Target alerted authorities and financial institutions immediately after it was made aware of the unauthorized access, and is putting all appropriate resources behind these efforts.  Among other actions, Target is partnering with a leading third-party forensics firm to conduct a thorough investigation of the incident.”

So Marcus’ misfortune happens right at the time identity theft, credit card fraud and hackers are on everyone’s mind. With EMV chip cards being touted as one of the best solutions to the hacking problem, Marcus’ mishap even taps into that buzz.