Consumers and organizations have a variety of options for making and receiving payments. While these payment types share the ultimate goal of transferring funds from payer to payee, the path those funds travel and the approaches employed for safely and securely completing transactions vary. The Secure Payments Task Force developed the Payment Lifecycles and Security Profiles as an educational resource and to provide perspectives related to:
- The lifecycles of the most common payment types, covering enrollment, transaction flow and reconciliation
- Security methods, identity management controls and sensitive data occurring at each step in the payment lifecycles
- Relevant laws and regulations, and other references, as well as challenges and improvement opportunities related to each payment type
The profiles employ a consistent format for describing the lifecycle of each payment type. The lifecycle template is not designed to represent the nuances of specific payment transaction flows, but as a broad taxonomy that can be applied across different payment types for understanding and comparing controls and risks. The profiles are not all-encompassing in describing the layered security strategies that may be employed by specific networks, providers or businesses and shouldn’t be considered an assessment of overall security of different payment types. The improvement opportunities noted in the profiles highlight areas for further industry exploration and are not intended as guidance or specific solutions to be implemented.
These valuable resources were developed through the collaborative efforts of more than 200 task force participants with diverse payments and security expertise and perspectives. It is the hope of the task force that by helping industry stakeholders better understand these payments processes, the security and risks associated with these processes, and potential improvement opportunities, they will be well positioned to take action to strengthen their payment security practices.
Note: These materials were created by the Secure Payments Task Force and are intended to be used as educational resources. The information provided in the Payment Lifecycles and Security Profiles does not necessarily reflect the views of any particular individual or organization participating in the Secure Payments Task Force. The document is not intended to provide business or legal advice and is not regulatory guidance. Readers should consult with their own business and legal advisors.
Feedback and/or questions related to the Payment Lifecycles and Security Profiles can be submitted by using the “provide feedback” form.
Contactless Definition: A payment card (e.g. credit or debit) funded transaction whereby the cardholder typically presents a physical smart card (e.g. credit or debit card), key fob, or a mobile device or wearable (e.g. smartphones, smart watches) where the payment data is exchanged by placing the payment device in proximity of the point of sale to complete the transaction.Enrollment
Payer ID / Enrollment
Enrollment of a payer includes identity (ID) proofing, management of users (enrollment, de-enrollment, and changes) and determination of authority based on role
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Individual or organization requests account with issuer. Issuer verifies customer information in accordance with their Know Your Customer (KYC) program.
The PIN associated with the account may be communicated to the cardholder via direct outreach, email, or physical mail
Overview of Security Methods and Associated Risks
Security Methods
Issuer verifies the individual during enrollment before issuing an account.
Know Your Customer (KYC), Customer Identification Program (CIP) background checks, etc.; ID verification of a ‘carbon-based life form’
Employee training
Issuers may utilize anomaly and fraud detection tools to help identify suspicious or fraudulent activity associated with a specific account or group of accounts.
Risks
Social engineering (e.g. call center or end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Account takeover
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Synthetic Identity: Use of stolen identity information combined with fraudulent information to create a new ‘synthetic’ identity which is used to open fraudulent accounts and make fraudulent purchases. Strong enrollment processes may help mitigate synthetic identity risk throughout the transaction process.
Knowledge-based questions can be compromised
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Sensitive data used to enroll or open an account:
Name
Date of Birth
Address
Zip Code
Social Security Number
Demand Deposit Account Number (DDA)
Signature
Sensitive data used during token provisioning:
Name
Address
PAN
Expiration Date
CAV2/CVC2/CVV2/CID
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes.
Payee ID / Enrollment
Enrollment of a payee includes identity (ID) proofing, management of users (enrollment, de-enrollment and changes) and determination of authority based on role
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Acquirer approves merchant
Merchant is registered in advance and identification data is attributed when registered by the acquirer
Overview of Security Methods and Associated Risks
Security Methods
Acquirer (or the agent of the acquirer) verifies the individual(s) or organization enrolling as a merchant before establishing a merchant ID (KYC, CIP, Background checks, etc.)
Employee training
Risks
Synthetic Identity: Use of stolen identity information combined with fraudulent information to create a new ‘synthetic’ identity which is used to open fraudulent accounts and make fraudulent purchases. Strong enrollment processes may help mitigate synthetic identity risk throughout the transaction process.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Sensitive data used to enroll or open a merchant account:
Name
Date of Birth Address
Social Security Number
Demand Deposit Account Number (DDA)
Signature
Business Name
Tax ID Terminal information (IDs, entry capability, etc.)
Risks Associated with the Sensitive Payment Data
Onboarding Merchant:
If compromised, someone that is not a merchant could create a fake merchant account. This could also occur if the merchant account is not fully vetted / authenticated prior to setting up the merchant account.
Transaction*
Payer Authentication
Verification of payer when originating payments
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Cardholder and card verification methods include Primary Account Number (PAN), expiration date, Dynamic Card Verification Value (DCVV), out-of-band authentication/verification Application Transaction Counter (ATC) with additional cardholder verification potentially required based on transaction request amount, EMV Application Cryptogram.
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Initiation: Access Mode / Network
Environment in which the payment origination is requested
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Point of Sale (POS), in-person
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Initiation: Device / Method Used to Initiate Payment
Type of interaction or device used to enter payment account information
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Contactless reader or scanner at the Point of Sale (POS), contactless form factor (e.g. card, sticker, mobile device, wearable etc.)
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Initiation: Funding Account for Payment
Entry and/or identification of the funding account (with formatting checks
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Demand Deposit Account (DDA) or credit account
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Initiation: Payment Initiation Mechanism
Payment network, system and/or third-party accessed
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Merchant, acquirer, association or network, processor
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Payer Authorization: Payment Network Traversed
“Rails” used to route authorization requests to the holder of the funding account
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Online authorization occurs through payment networks (e.g. credit and debit networks).
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Payer Authorization: Transaction Authorization
Determination of whether to approve or decline transaction including authorization time-frame obligations, and any recourse decisions
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Transactions are approved or declined within payment network service level agreements (SLAs)
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Format Exchange
payment instructions, rules and formatting
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Payment network rules dictate format exchange.
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Receipt: Acknowledgement / Guarantee
Notification and confirmation of payment completion including terms for use
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Transaction is confirmed but fulfillment may be delayed until authorization (guarantee of funds).
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
Payee Authentication
Mode of access to funds (or accounts)
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Acquirer authenticates merchant
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Merchant ID
Terminal ID
Terminal address
Merchant Category Code (MCC)
Terminal country code
Transaction currency code
Transaction type
Terminal entry capability
Merchant name
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
If compromised, data may be used to submit fraudulent payments into the payments system, especially for card testing purposes.
If compromised, someone that is not a merchant could spoof a legitimate merchant.
Clearing and Settlement: Settlement / Exchange of Funds
Actual movement of funds to settle funding arrangements and applicable fees
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Settlement occurs per payment network rules (e.g. credit and debit networks).
Overview of Security Methods and Associated Risks
Security Methods
Participants in the payment transaction (e.g. merchants, acquirers/processors, payment networks, and issuers) may utilize anomaly and fraud detection tools to help identify risks and mitigate fraudulent transactions. Anomaly and fraud detection tools may include transaction risk scoring, risk-based authentication, transaction history and real-time authorization/decline capabilities among others.
Validate the integrity of the payment message. Review message format for inconsistencies.
Employee training
Consumer and corporate customer education
Strong key management is necessary using secure rooms and environments to store and load encryption keys into PIN entry devices (PEDs).
Use of data encryption (end-to-end) solutions where the card data is encrypted from the point of initiation to the acquirer. Physically secure devices which meet international security standards.
Tokenization may be used for card data storage and used for future returns or loyalty.
As payments and technology continue to change, risk-based authentication is a way to continually evaluate and apply optimal security methods.
Risks
Using Primary Account Number (PAN) for part of the remaining processes (these are keys to access money)
Imposter apps/mobile apps/third party/contactless emulation may be used to compromise account data (PAN expiry) and used in contactless environment.
Interception of contactless transmission
Account takeover risk
Social engineering (e.g. end user) which could include business email compromise, masquerading fraud, imposter fraud, etc.
Machine takeover (payee, financial institutions, network/operator, payer)
Transaction data may be altered or spoofed (e.g. counterfeit transactions, credit master attacks, brute force attacks, etc.).
First party/theft/lost or stolen transactions
Credential stuffing (e.g. automated injection of breached username/password pairs in order to fraudulently gain access to user accounts)
Sole reliance on a point-in-time compliance statement (minimal, “check the box” compliance does not equal security)
Some POS systems/applications transmit and/or store card data in the clear.
End-to-end encryption is not universally applied in POS systems/applications.
Timely contactless authentication methods may not exist in the U.S.
Inadequately-controlled enrollment often poses additional risk at the time of transaction.
The speed of payment processing and reconcilement may impact the ability to identify fraud in time to recover funds.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Payment Token Data:
Token
Token Expiration Date
Token Type
Dynamic Card Verification Value (DCVV)/Chip Card Security Code (e.g. ICCV, Chip CVC, ICSC)
Card Sequence Number
Card Type
Card PIN (encrypted/offset)
Service Code
Velocity Limits
Signature
Biometric Parameters
Device / Form Factor credentials and IDs
The following data is considered Sensitive Payment Data:
Cardholder Data:
Cardholder data must be protected wherever it is processed, stored or transmitted
Primary Account Number (PAN)
Cardholder Name
Expiration Date
Service Code
Signature
Sensitive Authentication Data:
Sensitive Authentication Data must be protected and must not be stored after authorization of the transaction
Full track data (magnetic stripe data or equivalent on a chip)
Card Verification Values 1
(at this point the token is re-associated with the card PAN by the token service provider and sent to issuer)
PINs/PIN Blocks
Encryption Keys
PIN Offsets
Issuing bank ABA (routing) number
Issuing bank settlement account number
Merchant bank ABA number
Merchant settlement account number
Risks Associated with the Sensitive Payment Data
If compromised, data can be used to fraudulently set up an account at a financial institution and be used for other identity theft crimes. If this information is compromised during token provisioning, card information can be used to make fraudulent card not present transaction.
If compromised, data may be used to make fraudulent debits to the settlement accounts.
Reconciliation
Reconciliation / Exception Handling
Process and responsibilities associated with reconciling and handling any exceptions or problems with a payment
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Disputes are required to be reported/processed within specified timeframe defined by payment network rules and law
Overview of Security Methods and Associated Risks
Security Methods
Participants in the original payment transaction may utilize anomaly and fraud detection tools to identify suspicious patterns of activity that may warrant further investigation or potential modifications to transaction anomaly and fraud detection tools.
Inventory of Sensitive Payment Data and Associated Risks
Sensitive Payment Data (Data that needs to be protected)
Sensitive payment data must be protected wherever it is processed, stored or transmitted
Varies by transaction type/governing body:
Acquirer reference number
Token
Token status
Transaction date
MCC
Merchant name
Transaction amount
Chargeback reason code
Risks Associated with the Sensitive Payment Data
If compromised, someone that is not a merchant could spoof a legitimate merchant.
User Protection / Recourse
Applicable rules, regulations and legal means of recourse
Payment Type Operation
Contactless (Near Field Communications (NFC), Bluetooth, Quick Response (QR) Code, Magnetic Secure Transmission (MST))
Determined by payment network rules and applicable consumer protection laws and regulation
Regulation Z consumer protections apply to consumer credit and Regulation E applies to debit.
Last Updated: 02/21/2018
Footnotes
1Card Verification Values: Card Verification Values represent data elements that are (1) encoded on the magnetic stripe or the chip of a payment card; or (2) printed on the physical payment card and are used to validate the card information during the transaction authorization process. Card Verification Values encoded on the magnetic stripe (e.g. CAV, CVV, CVC, CSC) or on the chip (e.g. dCVV, iCVV) are generated via a secure cryptographic process and may be static or dynamic data used to validate the card during the authorization process. Card Verification Values printed on the physical card (e.g. CID, CAV2, CVC2, CVV2) may be three-digit or four-digit codes printed on the front or back of the physical card that are uniquely associated with the physical card and ties the primary account number to the physical card. Note: Payment network rules and the PCI Security Standards Council provide additional definitions of Card Verification Values.
*Note: Payments/Transfers Flow in Both Directions