s rsrt Case study: payment card security - - PowerPoint PPT Presentation

❊❝♦♥♦♠✐❝s ♦❢ ❈②❜❡rs❡❝✉r✐t②

Case study: payment card security

Tyler Moore

Two-sided market structure

Cardholder Merchant Issuing bank Acquiring bank

In the beginning

◮ There was no protection for cardholders against fraud ◮ Then the US passed the Truth in Lending Act of 1968,

implemented by Federal Reserve as Regulation Z, which absolved consumers of liability for fraud

◮ While the banks didn’t like it initially, consumer adoption of

credit cards accelerated as a a result

Security in a two-sided market

◮ Two-sided markets impose extensive barriers to entry ◮ This makes displacing successful ones, like payment-card

networks, very difficult

◮ Hard for the dominant platform to justify investing in more

secure technologies

◮ Assigning responsibility for security is fraught with difficulty,

and can easily degenerate into a fight over liability dumping

Towards improved card security? The case of EMV

◮ Credit cards encode the number in the card’s magnetic stripe

and rely on a signature for verification

◮ Fraudsters can copy the number and forge a signature ◮ The payment card industry developed a more secure

standard, EMV, using smartcards and PIN-based verification

◮ Adoption was slow, because merchants did not want to

spend large sums of money on upgrading terminals when the cost of fraud was borne by issuers.

◮ Adoption took off only when liability rules were changed to

make merchants reimburse fraud from non-EMV payments

◮ But did the investment in security pay off?

But does EMV improve security?

Data from UK Payments Administration; figure courtesy Steven Murdoch

PCI DSS as ex ante self regulation

◮ In addition to improving the security of payment cards

themselves, one can also focus on the operational security of participants

◮ The Payment Card System Data Security Standard (PCI

DSS) is a self-regulatory approach designed to improve

• perational security of merchants

◮ Merchants who fail to get PCI accreditation are assigned

liability for fraud

What about breach disclosure?

◮ Many data breaches in the news involve payment cards ◮ We know about these due to breach-disclosure laws ◮ These laws correct an information asymmetry between

cardholders and merchants

◮ They definitely pressure companies to invest in security

But what about card fraud losses?

◮ Disclosing when a merchant loses customer payment card

information gives an indication of the threat

◮ But doesn’t the amount of fraud carried out matter more? ◮ A few countries publish this information, but not all ◮ Its wider publication could be used to evaluate security

investments like EMV

Beware indirect costs of insecurity

◮ Payment card fraud losses matter – they eat into bank

profits and finance criminal operations

◮ Yet we must also consider indirect costs, which may dwarf

the direct losses

◮ If people refuse to shop online or limit the use of card

payments due to fears of fraud, the costs to society likely dwarf what the criminals make

◮ These costs should be considered when weighing security

investments

Thank you for your attention!

Please post any questions you may have on our discussion forum.