Mobile Payment Acceptance Security fact sheet

PCI Council Releases Tip Sheet for Tablet POS

The PCI Security Standards Council (PCI SSC), a global, open industry standards body providing management of the Payment Card Industry Data Security Standard (PCI DSS), PIN Transaction Security (PTS) requirements and the Payment Application Data Security Standard (PA-DSS), has published a customized fact sheet outlining how merchants can securely accept payments using mobile devices such as smartphones or tablets.

The At a Glance: Mobile Payment Acceptance Security fact sheet provides merchants with actionable recommendations on partnering with a Point-to-Point Encryption (P2PE) solution provider to securely accept payments and meet their PCI DSS compliance obligations.

The ability to use smartphones and tablets as point-of-sale terminals to accept payments in place of traditional hardware terminals offers great flexibility. As mobile technology continues to change at a rapid pace, the Council continues to work with the industry to ensure data security remains at the forefront of mobile evolution.

This latest educational resource is the product of the Council’s Mobile Working Group and is the result of valuable input from leading merchants, vendors and organizations actively involved in the in the mobile payment acceptance industry. The document helps clarify and distill some of the more complex technology and security terminology into straightforward, practical guidance that can help merchants to:

* Better understand their responsibilities under PCI DSS, and how they translate to mobile payment acceptance

* Leverage the benefits of the Council’s recently published Point-to-Point Encryption (P2PE) standard and program

* Choose a mobile payment acceptance solution that complements the merchant’s PCI DSS responsibilities, for example a P2PE solution provider

The fact sheet also draws on recent updates made to the PIN Transaction Security (PTS) Requirements at the end of 2011, creating the foundation for data security in mobile payment acceptance.

Using this resource to guide them in how PTS and P2PE standards work together, merchants can better understand how to securely use external plug-in devices with smartphones or tablets to accept payment cards by first encrypting and securing the data at the point that the account data is captured. The smartphone or tablet has no ability to decrypt the data, thus simplifying PCI DSS scope for the merchant.

“We know merchants are eager to take advantage of their existing smartphones or tablets to accept payment cards,” said Bob Russo, general manager, PCI Security Standards Council. “And the Council and its stakeholders want to help the market to do this in a secure way. We’re excited about this easy-to-use reference that will help merchants understand how to use the suite of PCI Standards to enable their businesses while still keeping data security top of mind.”

As with all SSC fact sheets, this guidance does not replace or supersede any of the PCI Standards. The Council continues to work with the payments community to address mobile payment acceptance security and evaluate whether additional requirements are needed in this area. As part of this ongoing initiative, the Council plans to publish best practices for securing mobile transactions later this year.

“The PTS and P2PE standards are being leveraged by mobile solution providers today. With this fact sheet we hope to help merchants understand how these standards work and the options that are available to them for accepting mobile payments in a secure and PCI DSS compliant manner,” said Troy Leach, chief technology officer, PCI Security Standards Council.

iZettle mobile payment app and dongle comes to the UK

iZettle, a new mobile payment solution, has arrived the UK. The dongle, which attaches to the iOS device, reads your card like a chip-and-pin machine and allows you to sign for goods

The Square mobile payment company, from Twitter founder Jack Dorsey, has revolutionised the idea of mobile-based payments in the US by allowing businesses to accept card payments, quickly, easily and cheaply.

The little white dongle, which can be attached to iPhones and iPads where there's mobile data connectivity, allows the vendor to swipe the card, enter the amount and pass over to the user to authorise.

With Sqaure, or rival company PayPal Here, still to reveal when they might be crossing the Atlantic, a new European-based solution is coming to the UK.

The iZettle company, which has already earned some success in the Nordic region, is launching a free dongle and software to 3,000 invited businesses in the UK and is aimed at supporting those small companies that have never accepted plastic before.
So, it could be perfect for market stalls, taxi drivers, roadside cafes, t-shirt sellers at concerts and more. According to Jacob De Gaer, the company's CEO, there are 20 million businesses in Europe that fit into this category.

Unlike Square, which swipes the magnetic strip on the card, iZettle's is a solution more akin to the UK's chip-and-pin infrastructure. The dongle fits into the charging port and the card is simply inserted. Users will then be asked to sign the screen with their finger before the transaction is completed. For its troubles iZettle takes a small commission from the payment, but that won't cost users a penny.

The service is for iOS initially, but the company promises an Android solution soon. Interested businesses can download the iPhone app and register. The app features the ability to itemise the inventory's so businesses can keep track of exactly what they sell.
Whereas NFC has is still in the early stages of its development, services like Square have been massively successful in the United States. It'll be interesting to see how iZettle's solution performs on these shores.