Truncating Fraud: Canadian Credit Card Security - Issue 2 - March 15, 2004

Note from the Editor:

The Frontier Times is already becoming the ‘lightening rod’ for Canadian payment processing news and information. We have received a number of calls from businesses looking for the elusive Canadian ISO deal, and we have done our best to put those callers in touch with the most suitable Canadian partners. We are planning a feature article on Canadian ISO deals in a coming issue.

We are especially appreciative of the response from Visa Canada, that has undertaken to place advertising in our next issue. Senior management at BCE Emergis has also expressed great interest in this publication.

The coming months are a critical time in the history of payment processing in Canada. Canadian banks now have the choice of either ignoring the emergence of competition in the merchant acquiring business, or taking the challenge head on and deploying programs to maintain and grow their merchant portfolios. As the theme of the FT suggests, we are at the starting gates of a gold rush in Canada in the payment processing business. With a measure of bravery and luck, some among us are very likely to strike gold in the true North.

Please let us know how we can best inform you about payment processing in Canada.

Adam N. Atlas

Editor in Chief

atlas@frontiertimes.ca

The Frontier Times Team

Editor in Chief

Adam N. Atlas: atlas@frontiertimes.ca

Managing Editor

Valerie L. Fox: fox@frontiertimes.ca

Senior Associate Editor

Stacy Denton: denton@frontiertimes.ca

Associate Editors

Lena E. Atlas: lena@frontiertimes.ca

Lionel Perez: perez@frontiertimes.ca

Layout*Graphics*Illustration

centre TYPO: edaley@centretypo.com

Artistic Conceptualization

Michal Katz: pichkom@yahoo.com

Production

centre TYPO: edaley@centretypo.com

Contact us:

The Frontier Times

Canada’s Electronic Transactions Journal

2000 Mansfield, Suite 1400

Montreal, Quebec, Canada

H3A 3A2

Voice: 514-282-8463

Fax: 514-842-9371

E-mail: info@frontiertimes.ca

The Frontier Times: Canada’s Electronic Transactions Journal is free to all subscribers. Any copying or reproduction of any part or all of this publication is strictly prohibited without prior express written consent from The Frontier Times.

To subscribe, advertise or contribute to The Frontier Times, please fill out the form attached with this edition or write to: info@frontiertimes.ca

© The Frontier Times: Canada’s Electronic Transactions Journal, 2004.

ISSN: 1710-4505 The Frontier Times: Canada’s Electronic Transactions Journal (Print)

ISSN: 1710-4513 The Frontier Times: Canada’s Electronic Transactions Journal (Online)

[Cover story]

Truncating Fraud: Canadian Credit Card Security

How many complete credit card numbers, expiry dates and cardholder names did you throw away today? A 2003 Ipsos-Reid survey of consumers reveals how comfortable (or uncomfortable) Canadians feel in regards to payment security. Of those consumers who used debit and credit cards as a form of payment, half felt concerned that their card information would be intercepted, both at the point of sale (POS) and in database storage.

This discomfort is not ill-placed. According to the Canadian Bankers Association, credit card fraud rose approximately 18% between 2000 and 2002, and while debit fraud appears to be quickly increasing, even surpassing credit card fraud in some Canadian cities, the average consumer holds 3 credit cards and would most likely have a vested interest in avoiding this kind of payment fraud.

What measures are being taken to insure the security of Canadian credit card users? Elizabeth Allen, a spokesperson for the Financial Consumer Agency of Canada (FCAC), points out that this particular agency does not have specific regulations in regards to the securing of credit card information itself, but the parties affected (the consumer and card companies) are cooperating. One of the main strategies of the FCAC is consumer education (see “Playing it Safe” on the FCAC website), where credit card fraud, tips for consumer protection and steps to take in the event of stolen information are all discussed. Allen also pointed out that by providing “zero liability” to cardholders in cases of proven fraud, major card associations like VISA, MasterCard and American Express are making a significant “public commitment” to protecting the cardholder from the ill effects of fraud. The fact that the cardholder is relieved of liability places a greater burden on merchants and acquiring banks and associations to develop and implement fraud prevention mechanisms. Surprisingly, when contacted by the FT, the Canadian Payments Association (CPA), an association of Canadian banks and financial institutions created through federal legislation, had no opinion on the matter. Could this be an indicator of the laxity of the Canadian banking industry in relation to credit card fraud?

While the zero liability commitment of credit card companies may be of some comfort in the unfortunate event of fraud, the prospect of losing one’s information in the first place is ever present. As mentioned earlier, a key concern for Canadian consumers is the retrieval of card information by fraudsters at the POS: what can be done to help alleviate this risk? One of the most obvious answers is the truncation of credit card numbers on receipts. Truncation of credit card numbers is the practice of expressly deleting key elements of the credit card number on the customer copy of a transaction slip. Terri Tweddle of VISA Canada said that “In Canada, VISA is in the process of mandating the suppression of at least four numbers on” consumer receipts for “serviced, refurbished and…deployed POS terminals by March 2004.” This is slightly earlier than VISA’s global mandate of April 2007, a mandate that “recognizes the diversity of countries and merchants” involved with VISA payments. PAN truncation, being the removal of all but the last four numbers on a receipt, is also widely used by Canada’s VISA merchants, and as a whole is “increasingly being phased in by the merchant community”, Tweddle notes. MasterCard Canada merchants also use PAN truncation and have a global deadline of April 1, 2005. Kevin Stanton, MasterCard’s Senior Vice President of Strategy and Market Development, noted that while MasterCard has this deadline for its merchants to update their POS technology, it is already being implemented by merchants in advance of the deadline. Based on the mix of merchants, the upgrade of POS technology to provide truncation capabilities is a gradual process, with cost issues as a major factor. For example, number of stores, number of check-outs, and number of POS devices are all factors that influence a merchant’s ability to deploy the new technology. PAN truncation points to “MasterCard’s drive to protect customer security,” Stanton said. While MasterCard’s global mandate is sooner, VISA’s truncation policies in Canada are already being implemented, despite the later deadline. According to Dawn Gordon from American Express, POS terminals that truncate numbers are marketed in Canada, as per the “industry standards of our US parent company”.

Returning to the subject of consumer confidence and fraud in general, the Ipsos-Reid poll indicated that Canadian consumers appear to generally have trust and confidence in issuing financial institutions as a whole, but feel a greater risk of fraud by acquiring merchants and institutions involved in accepting payments. An indicator of how the blame for this issue is being passed around is that merchants who accept credit and debit payments lack confidence in the consumer’s ability to secure important, financial information. Regardless of who is to blame, it is reasonable to assume that PAN truncation is a step in the right direction for reducing credit card fraud in Canada.

Stacy Denton, Senior Associate Editor, deton@frontiertimes.ca

NEWS

Desjardins Group Expands

In December 2003, Desjardins Group, the Fédération des caisses populaires de l'Ontario, established a partnership enabling the Ontario caisses to benefit from the same democratic rights as the Québec caisses, as part of Desjardins Group.

The Fédération des caisses populaires de l'Ontario has 65 points of service that include 27 caisses and 38 service centres, with assets of $2.1 billion.

Desjardins Group is an integrated cooperative financial group. With over 5 million members and clients, and overall assets of close to $90 billion as of December 31, 2002, it is the largest financial institution in Québec and the sixth largest in Canada. It comprises a network of caisses and corporate financial centres in Québec and twenty subsidiary companies, many of which are active across the country.

Desjardins' physical distribution network, which is the most accessible, is seconded by virtual access modes like desjardins.com, the most visited financial website in the province, and the second most visited in Canada. Desjardins' strength lies in the skill and commitment of more than 39,000 employees and 8,000 volunteer officers.

ABM Convenience

January 21, 2004- The Royal Bank of Canada and Esso Tiger Express became the largest alliance between banking and gasoline convenience stores in Canada as they revealed that over 500 ABMs have been installed in Tiger Express and On the Run stores. According to a recent news release from the RBC Financial Group, seventy five ABMs were added in 2003, with more than 100 ABMs expected in the next three years. A similar deal announced about four months earlier expanded Scotiabank’s network of ABMs by twenty percent in a deal with Shell Canada Products. This deal allowed for close to 500 ABMs to be installed in Shell’s gasoline and convenience stores throughout Canada.

The RBC/Esso collaboration began in the mid-1980’s.

BCE Emergis Doubles Loblaw Pharmacies Network

March 2, 2004- BCE Emergis announces its expansion of drug claim processing to include all pharmacies that operate under Loblaw’s name. This service will provide a network for pharmacists to submit drug claims to insurance adjudicators and also allows for Loblaw to consolidate its claims transmission process. According to a BCE Emergis press release, this will not only maintain a secure and reliant connection for the transfer of confidential records between pharmacies and adjudicators but will also create a more efficient system for pharmacists to transact and manage their business. In this same release President of eHealth at BCE Emergis, Daniel Baron, asserts that in doubling the number of Loblaw Pharmacies on this network, BCE Emergis’ move helps to bring together the company’s strategy of “universal exchange service” for health care professionals. BCE Emergis’ networking capabilities stretch far enough to include 99% of Canadian pharmacies and all EDI-enabled dentists in Canada.

Two days later, it was announced that BCE Emergis sold its US health care operations to two separate corporations. In a press release from March 4, 2004, President and CEO Tony Gaffney stated that the objective of BCE Emergis is to “strengthen our position as the leading eBusiness provider in Canada”.

Scotiabank and Paymentech Launch First VISA Chip Card

Scotiabank recently launched the first VISA cards in Canada containing a chip that is both protected by a Personal Identification Number (PIN) and provides customers new payment options. Paymentech Canada has participated in the pilot by providing special chip enabled point-of-sale (POS) terminals to Paymentech merchants in selected areas across Canada. "At Scotiabank, we are committed to developing the latest technology to provide our customers with the best possible services. Chip technology offers greater convenience and security while providing a variety of payment options on one card", says Alberta Cefis, Executive Vice-President of Retail Lending Services, Scotiabank.
"Paymentech is pleased to become the first Canadian payment processor to enable the use of 'smart' credit cards through our customers’ point-of-sale terminals," said Drew Brown, President of Paymentech Canada.

IP Applications Acquires Soft Tracks Enterprises Ltd.

January 14, 2004- IP Applications, an outsourcing company based in Vancouver, announced the acquisition of Soft Tracks Enterprises Ltd. Specializing in the market of Internet services, IP Applications boasts AOL Canada Inc., Navigata Communications Inc., and Sprint as some of its customers. Soft Tracks, a software technology provider for wireless communications and electronic payment industries, may be remembered for Skypay, a software program that helped facilitate wireless payment options for Bell Mobility customers. The arrangement was announced in 2002, and with the help of Scotiabank and SaskTel, became the first of its kind in Canada.

PaySystems and Valutec Partnership

December 17, 2003 - Montreal-based PaySystems Corporation, a worldwide provider of payment processing and merchant services, has recently partnered with Valutec Card Solutions, a leading provider of electronic gift and loyalty card solutions. Unmistakably, the partnership creates a powerful precedence and allows PaySystems to provide flexible gift and loyalty card programs that respond to merchants much demanded needs.

Philip Fayer, President and Chief Executive Officer of PaySystems stated:

“This strategic partnership allows PaySystems to offer its merchants a powerful profit driver which is proven to help increase revenue, build brand recognition and increase customer retention".

National Bank of Canada Outsourcing Cash

March 2, 2004- The National Bank of Canada has signed an outsourcing deal with INTRIA Items, a company jointly owned by Fiserv Inc. and CIBC. The deal is valued at $368 million, for over a ten year period.

This agreement involves the supply of cheque, bill payment and currency services (processing for deposits and ABM envelopes, cash supply for ABMs) for The National Bank of Canada. In addition to currency processing, INTRIA will supply cheque and lockbox processing with this deal. INTRIA Items is building a process center in Lasalle, Quebec in order to integrate its Montreal operations, including some of The National Bank of Canada’s new business.

FEATURES

Canadian Debit Payment: High and Rising?

In a small section entitled “Debit Cards Popular in Canada”, Edupage states that Canada’s “use of debit cards is soaring”, with “33 million transactions in June alone”; this newsletter was dated 3 August 1995. Just eight years later The Strategic Counsel polled Canadians, finding 85% to have used Interac Direct Payment (IDP) for purchases. The highest percentage of users fall in the 18-24 age group (74%) and the lowest falling in the 65+ group (23%). As a whole, Canadians use IDP as their preferred payment method for 49% of their purchases and cash for only 27%. Where is IDP being used, and how do Canadian debit payments compare to the rest of the world?

According to Edupage’s newsletter, the most popular place for Canadians to have used debit payment in 1995 was in a supermarket, a trend that Interac confirms for 2003. After supermarkets, restaurants/bars/fast food and specialty clothing stores comprise the next two highest types of IDP transactions. All three make up approximately 48% of total recorded IDP transactions and 49% of the total value of IDP transactions.

In 2003, 19.2 million Canadians used IDP on a monthly basis. The highest concentration of these users fell in the Ontario and Quebec provinces (889.4 million and 629.3 million transactions, respectively), and the lowest in Prince Edward’s Island and Newfoundland (42.8 million and 12.5 million transactions, respectively). These statistics are perhaps indicative of both the number of POS terminals and merchants within these provinces, and unsurprisingly, Canada’s dispersed population in general. Also according to Interac’s statistics, the reliance on debit forms of payment at the point of sale puts Canada far ahead of the United States and countries of the European Union (71.7 transactions per Canadian on average in 2001, as compared to the 52.7 average of some EU countries and the 43.7 US average).

From these statistics, it does appear that Canadian consumers rely heavily on debit payment, and at a greater rate than that of consumers in the EU and US. When looking at ABM statistics from 2001, particularly those of Canada and the United States, we note a different trend regarding automatic banking/cash retrieval. While Canada has higher ABM transactions per year, per individual in comparison to European Union countries, the United States has an almost identical transaction average as compared to Canada (47.7 US to 47.8 Canada). Similarly in 2001, both Canada and the United States had almost identical numbers concerning the number of ABMs to one million inhabitants (1142 and 1137, respectively). Considering the sizable population difference between these two countries, it can be inferred that the concentration of ABMs in centralized populations was generally greater in Canada and judging from the transaction averages, these machines are being used more often than by those consumers in the US.

Regardless, these Interac statistics seem to point to the US consumer’s reliance on cash over debit, a striking contrast to the Canadian trends in 2001. The Nilson Report states that in 2002 US consumers used cash as their primary form of payment, a trend that is predicted to follow through 2007. But as Business Week (Nov. 17, 2003) and Fortune (Feburary 23, 2004) have pointed out, the US trend towards higher debit use is steadily increasing, following in the footsteps of its Northern neighbor.

Sources of Statistics: Interac, epaynews.com, Statistics Canada, U.S. Census Bureau

Stacy Denton, Senior Associate Editor, denton@frontiertimes.ca

Spring Break: Boom for Entertainment Processing

If you want to know how it feels to be on Spring Break again, tally up your processing revenues between March 7th and 16th , and get ready to be overwhelmed by that feel-good sensation of school is out. Moneris Solutions recently announced the results of a study of transaction volumes for Canadian merchants during last year’s March break. The data concluded a positive increase in the purchasing activity from March 7-16, 2003, which is a good indication of what merchants could have expected in March 2004.

According to Moneris Solutions, the merchant categories that saw the biggest increases in debit and credit card spending during March break 2003, as compared to a similar time frame immediately preceding March break, were:

Video rental stores up 27%;

Movie theatres up 24%;

Bowling alleys up 24%;

Tourist attractions up 14%;

Music stores up 22%;

Hobby, toy and game stores up 10%; and

Photofinishing laboratories up 6%.

As a whole, the entertainment category increased 14% overall.

On the other hand, some retail sectors experienced a decrease in spending volume during March break 2003, some of which includes:

· Hardware stores (down 31%);

· Household appliance stores (down 17%);

· Glass, paint and wallpaper stores (down 14%).

The data cited above is based on Moneris’ aggregate data of debit and credit card transactions across hundreds of merchant locations in Canada. The numbers and percentages stated are derived from actual sales volumes, i.e. the dollar values of debit or credit card transactions processed by merchants over the annual week-long March break.

No ABMs in Winnipeg Casinos

Earlier this year, the Manitoba Lotteries Corp. (MLC) proposed the installation of ABMs in its two Winnipeg casinos, citing greater customer convenience and safety while accessing their money. However, amidst protest and feedback from the Addictions Foundation of Manitoba, the MLC decided to forego this proposal just a couple of weeks later. The original plan included regulations on how these machines can be used, including the actual placement of the ABMs and method of usage by casino patrons. In regards to the actual placement of the ABMs, the MLC seemed to adopt a stance similar to those taken by British Columbia, Saskatchewan, and Alberta: the machines cannot be placed on the gaming floor itself. But it was the restrictions on how the ABMs can be used that was ultimately defined as providing insufficient deterrence to problem gambling, and thus as unacceptable in Winnipeg. In the original proposal, ABMs were to provide patrons access to their accounts via ABM/debit cards but bar their access to credit card use. Speaking on behalf of the MLC, Scott Smith has said that the MLC was not capable of completely fulfilling this restriction due to Interac ABM regulations.

While Manitoba is not allowing ABMs in the two Winnipeg casinos, the Aseneskak Casino (First Nations Casino) located in Manitoba does host ABMs, with restrictions on ABM usage placed by the issuing banks. According to Liz Stephenson from the Manitoba Gaming Control Commission, ABMs are allowed in this casino because of the sparseness of ABMs located outside the facility. In comparison to Winnipeg where a patron can have access to her or his money more readily at locations outside a casino, the Aseneskak Casino provides ABM services inside on account of a lack of nearby ABMs outside.

As each province is responsible for the regulation of casinos, the rules for things like ABM placement/usage in gaming varies. While it appears that ABMs are required to be separate from game play in all provinces, the restrictions placed on the ABMs themselves seem to vary. For example, in British Columbia the Lottery Commission (BCLC) allows for casinos to install ABMs, but under the discretion of the provider. The responsibilities of the provider include “Decisions on the number of machines permitted, contracts and administration of ABMs”, according to Consumer Services of the BCLC. While the machines are allowed to be implemented by individual providers, they cannot be in view of casino patrons while they are on the “gaming floor”. Similarly, Alberta wishes to create a “clear interruption of play” by placing ABMs “sufficiently apart or away from the playing area” for patron usage (Alberta Gaming Licensing Review, 2001). Information addressing problem gambling is also to be displayed at the ABM..

Thanks to Rhys Stevens of the Alberta Gaming Research Institute.

Stacy Denton, Senior Associate Editor, denton@frontiertimes.ca

Ptack vs. American Express

Case Comment

Sheri Aberback Ptack was tired of paying financial charges to American Express. Ptack was accruing late fees on her monthly credit card bill not because her payment was late, but because she chose to pay her bill on the Internet. In Ptack’s case, there were “several months in a row” where the bill was paid, confirmed, and listed on bank statements as remitted on or before the actual due date, says Arthur Wechsler, attorney for the class action suit filed against American Express this month.

According to the suit filed with the Superior Court in Quebec, customers that choose to use the Internet as a way to pay their American Express bill are subject to terms that are in violation both the Consumer Protection Act (Quebec) (CPA)and signed card agreements. The CPA provides that customers are allowed twenty one days to pay their credit card bill without fault, i.e. to not be charged additional fees. How, then, do late fees show up for those who pay their bills online, on time? Attorney Wechsler points out that with a traditional payment method like checks, the consumer is not charged a late fee provided she or he makes sure the check physically arrives at American Express on the due date specified: the consumer is notified that their payment may take “3 to 5 processing days” upon arrival, but the customer is not penalized for those extra days. With the Internet payment method, a method that is “encouraged” by the Amex, according to Wechsler, the transaction appears to be received instantaneously by the Amex (hence the confirmation appearing in the customer’s debited bank account), but the customer is not allowed that extra processing time that they would be afforded with a more traditional payment method, such as a check. This violates the twenty one day time frame mandated through the CPA. If a customer wishes to engage in the hassle of revoking these late charges, as Ptack did between the months of October 2003 and February 2004, the damage is still done by accumulating interest on the fee balance, Attorney Wechsler notes, not to mention the value of time spent by the customer.

Regardless of the agreement American Express has with the financial institution in charge of its Internet payments, the “float” time between consumer payment and American Express retrieval is “not relevant as far as the consumer is concerned”, Attorney Wechsler said. He went on to state that any benefit that may be gained by online payment is lost under these current fee implementations.

When asked about the estimated damages that American Express may be looking at as a result of this suit, Attorney Wechsler said it was “impossible” to say at this point, as “thousands of Canadians” may be in the same situation that Ptack repeatedly found herself in. While American Express may decide to “reverse fight or settle, it is too premature to tell”, Attorney Wechsler stated, but this situation is “so flagrant” that American Express will have “to do what is corporately right.”

In addition to the Ptack’s requested payment of $223.67, each member of the suit will be requesting $200 plus fee reimbursement. A full copy of the motion to file a class action suit can be found online at www.frontiertimes.ca as well as contact information.

Stacy Denton, Senior Associate Editor, denton@frontiertimes.ca

Frontier Directory

Business Name	Type of Business	Telephone Number	URL
Beanstream Internet Commerce Inc.	payment and authentication services provider	250-472-2326	www.beanstream.com
Datacap Systems, Inc.	integrated payment solutions for cash registers and POS devices	757-496-6478	www.dcap.com
ETAC	Electronic Transactions Association of Canada	514-282-8463	www.electran.ca
Ingenico Canada Ltd.	secure transaction terminal software, network and gateway services	416-245-6700	www.ingenico-ca.com
Merchant Card Acceptance	Canadian ISO selling card processing, gift, loyalty, ATMs	888-799-0368	www.merchantsales.com
Telpay Incorporated	Internet bill payment service for major utilities, governments, businesses, banks	800-665-0302	www.telpay.ca
Mercury Payment Systems	merchant service provider and front-end processor	970-247-5557; toll free: 800-846-4472	www.mercurypay.com
Global Payment Systems of Canada, Ltd.	bank card processor	416-445-7151	www.gps.ca/
Adam Atlas Attorney at Law	law firm specializing in electronic transactions law	514-842-0886	www.adamatlas.com

(insert sign-up form on back cover)