Contactless payments can provide speed and convenience when compared to the traditional card swipe or EMV chip, and they offer a safer payment alternative in our post-COVID world. There are several types of contactless technology, all of which have different hardware and software requirements. It’s important that merchants and software providers are familiar with the various contactless payment options to ensure that they implement the best solution for the business.
<center>
<figure id="attachment_27444" aria-describedby="caption-attachment-27444" style="width: 300px" class="wp-caption alignnone"><img loading="lazy" class="wp-image-27444 size-medium" src="https://s4dev.wpengine.com/wp-content/uploads/2021/09/retail_mobile-payments-300x198.png" alt="Retail Mobile Payment" width="300" height="198" srcset="https://s4dev.wpengine.com/wp-content/uploads/2021/09/retail_mobile-payments-300x198.png 300w, https://s4dev.wpengine.com/wp-content/uploads/2021/09/retail_mobile-payments-768x507.png 768w, https://s4dev.wpengine.com/wp-content/uploads/2021/09/retail_mobile-payments.png 872w" sizes="(max-width: 300px) 100vw, 300px" /><figcaption id="caption-attachment-27444" class="wp-caption-text">Contactless NFC Payment</figcaption></figure>
</center>
Near-Field Communication (NFC) 
Typically, when people mention contactless payments, they are talking about NFC transactions, which allow the cardholder to “tap” their card or mobile phone on the payment terminal. When the card is close enough to the receiver, it transmits the payment information without needing to swipe it (hence contactless). There are two main ways to accept NFC payments:
<ul>
<li>NFC cards are physical credit or debit cards that have an NFC transmitter inside of them. Customers simply tap the card on the receiver of the terminal, instead of swiping or inserting the card.</li>
<li>Mobile wallets like Apple Pay, Google Pay, and Samsung Pay are services that allow the cardholder to connect the payment card to their smartphone, which becomes the actual payment method in place of the physical card.</li>
</ul>
Both of these are still considered card-present transactions and require the merchant and cardholder to have a few specific tools to complete the transaction in this way. The merchant needs to have a payment terminal that is equipped with an NFC sensor to read the card data and the cardholder needs to have a contactless card or mobile wallet that can act as an NFC transmitter.
<center><img loading="lazy" class="alignnone wp-image-27703 size-full" src="https://s4dev.wpengine.com/wp-content/uploads/2021/09/QRPay-TentCard-Counter-Restaurant-1.webp" alt="" width="900" height="524" srcset="https://s4dev.wpengine.com/wp-content/uploads/2021/09/QRPay-TentCard-Counter-Restaurant-1.webp 900w, https://s4dev.wpengine.com/wp-content/uploads/2021/09/QRPay-TentCard-Counter-Restaurant-1-300x175.webp 300w, https://s4dev.wpengine.com/wp-content/uploads/2021/09/QRPay-TentCard-Counter-Restaurant-1-768x447.webp 768w" sizes="(max-width: 900px) 100vw, 900px" /></center>
QR Code Payments 
Quick response (QR) code payments are a fast-growing alternative to NFC. For these types of transactions, the customer scans a unique QR code — which is basically a square barcode – with their mobile phone. When scanned, the QR code directs the customer to a URL, opening a web page or an application to complete payment. This has been adapted to payments in a few different ways:
<ul>
<li>Shift4’s <a href="https://www.shift4.com/contactless">QR Pay</a> solution allows customers to pay their bill by simply scanning a unique code with their smartphone. The code can be printed on a paper bill or receipt or can be displayed on the payment terminal’s screen. The customer then completes the transaction through the mobile web browser on their phone via Shift4’s secure mobile payment web page. They can use Apple Pay, Google Pay, or manually enter their card information.</li>
</ul>
<img loading="lazy" class="alignnone wp-image-26777 size-large" src="https://s4dev.wpengine.com/wp-content/uploads/2021/08/qr-pay-889x1024.png" alt="" width="750" height="864" srcset="https://s4dev.wpengine.com/wp-content/uploads/2021/08/qr-pay-889x1024.png 889w, https://s4dev.wpengine.com/wp-content/uploads/2021/08/qr-pay-260x300.png 260w, https://s4dev.wpengine.com/wp-content/uploads/2021/08/qr-pay-768x885.png 768w, https://s4dev.wpengine.com/wp-content/uploads/2021/08/qr-pay.png 1212w" sizes="(max-width: 750px) 100vw, 750px" />
<ul>
<li>QR code payments can also be utilized as a mobile ordering function. With a QR code placed on the table or menu at a restaurant, guests can scan the code to open an ordering interface, where they can place their order and pay without having to wait for staff.</li>
<li>WeChat Pay and Alipay are highly popular QR code-based payment methods in China. Their widespread use has led to rising demand for U.S. merchants to add support as an easy and comfortable payment option for customers traveling overseas. These solutions land between mobile wallets and QR code payments, as they require the consumer to be set up with a separate application, but still only need their phone to scan the code and complete the transaction.</li>
</ul>
QR code payments are popular for a few reasons. They don’t require the merchant or customer to have as much specialized hardware as they would with an NFC transaction. The cardholder just needs a smartphone, which typically has a QR scanner built right into the camera application. The merchant doesn’t have to have a particular POS terminal with a physical NFC sensor, just a device that is able to display the QR code, or the ability to print the QR code on a receipt. And since that functionality is typically software-based, it is possible to update some existing hardware to add that capability.
As part of our <a href="https://www.shift4.com/end-to-end-processing/">end-to-end solution</a>, Shift4 Payments offers free contactless EMV terminals that support all of the above-mentioned types of NFC- and QR code-based transactions. These free terminals include our innovative SkyTab® mobile point-of-sale solution as well as a variety of third-party device options. We also offer SkyTab Online, which is fully integrated with the POS system for a seamless online ordering experience and is available completely free!
Visit <a href="https://www.shift4.com/contactless">shift4.com/contactless</a> to learn more about our additional contactless options.

Understanding Contactless Payments

A key component of the recently passed Coronavirus Aid, Relief, and Economic Security Act (CARES Act) is the Paycheck Protection Program (“PPP”), which authorizes up to $349 billion in forgivable loans to small businesses to pay their employees during the COVID-19 crisis. These loans are now available from numerous participating lenders.
Complete details on the PPP, including a list of participating lenders, is available on the US Small Business Administration&#8217;s (SBA) website <a href="https://www.sba.gov/funding-programs/loans/paycheck-protection-program-ppp">here</a>. To find your closest participating lender, <a href="https://www.sba.gov/paycheckprotection/find">click here</a>.
We also included direct links to online applications and PPP landing pages for some large financial institutions below:
<ul>
<li><a href="https://recovery.chase.com/cares1">JP Morgan/Chase</a></li>
<li><a href="https://about.bankofamerica.com/promo/assistance/latest-updates-from-bank-of-america-coronavirus/small-business-assistance?cm_sp=EBZ-BAC-Announcement-_-BACAnnouncement-_-AMT2H45Q00_SB_Engagement_Banner_COVID19_SB_JCRLink">Bank of America</a></li>
<li><a href="https://apply.usbank.com/applications/business/InquiryForm">US Bank</a></li>
<li><a href="https://online.citi.com/US/JRS/pands/detail.do?ID=paycheck-protection-program">Citi</a></li>
<li><a href="https://update.wf.com/coronavirus/paycheckprotectionprogram/?_ga=2.195353324.1714863641.1585935104-54371702.1585935104">Wells Fargo</a></li>
<li><a href="https://www.pnc.com/en/customer-service/paycheck-protection-program.html">PNC</a></li>
<li><a href="https://www.citizensbank.com/small-business/paycheck-protection-program.aspx">Citizens Bank</a></li>
</ul>
The SBA is also offering an Economic Injury Disaster Loan Emergency Advance. The loan advance provides up to $10,000 of economic relief to businesses that are currently experiencing temporary difficulties. You can learn more about the EIDL Emergency Advance by visiting the SBA’s <a href="https://www.sba.gov/funding-programs/loans/coronavirus-relief-options/economic-injury-disaster-loan-emergency-advance">website</a>.
We encourage all of our customers and partners to take advantage of this loan program and apply for these funds as they are being fulfilled on a first come, first served basis.

Are You Taking Advantage of Paycheck Protection Program and Economic Injury Disaster Loans?

Tanglewood Resort sits alongside Lake Texoma in northern Texas, right on the border with Oklahoma. Because of their location, the full-service resort and conference center has incorporated a unique combination of lakeside views, fine dining, spa services, lake activities, a championship golf course, and a host of outdoor activities like hiking, boating, fishing, horseback riding, and more. Tanglewood is often the destination for large groups of guests, and their experienced staff is there to make sure the stay is memorable.
<h2>Taking the Leap to Single-Source Payments</h2>
In 2018, Tanglewood Resort made the decision to switch to the complete payment processing solution from long-time partners Shift4 Payments and Springer-Miller Systems. The resort was already a customer of Shift4 and Springer-Miller, using their secure payment gateway and property management system, respectively. However, this new offering from the partnership delivered additional services that tied it all together: merchant services, secure gateway, P2PE-enabled card readers, device injection and management, auditing, accounting, reporting, and much more.
Combining these services opens up possibilities to eliminate redundant costs. Prior to moving to a single-source solution, Tanglewood Resort had been utilizing a piecemeal approach to their payment processing, meaning they coordinated with (and got a bill from) a different service provider for each of their payment services separately. When they started utilizing the all-in-one approach from Shift4 and Springer-Miller, they found out how much easier and cost-efficient their payments could actually be.
Shift4 Payments and Springer-Miller Systems deliver an integrated solution that helped Tanglewood Resort cut costs and improve operations with:
• Waived gateway fees, saving $400 per month 
• Free EMV devices, with lifetime free replacement 
• Full integration with Springer-Miller Systems suite of hospitality software 
• Streamlined support with one point of contact for all payments needs 
• Lowest total cost to process payments 
• Business intelligence and analytics to improve the guest experience 
• A single solution that unifies payments and simplifies business operations
<hr />
<blockquote>
“When a group of 300 guests arrives at the property, it’s really nice not having to worry about our payments and just focus on the guest experience. The products from Springer-Miller Systems and Shift4 Payments work really well together and are always reliable.”
&#8211; Magan Crowley 
Guest Relationships Manager &amp; Memberships Coordinator, Tanglewood Resort
</blockquote>
<hr />
<h4><img loading="lazy" class="alignnone wp-image-28230 size-full" src="https://s4dev.wpengine.com/wp-content/uploads/2019/10/Tanglewood-Resort-Photo-adj-1024x313-1.jpeg" alt="" width="1024" height="313" srcset="https://s4dev.wpengine.com/wp-content/uploads/2019/10/Tanglewood-Resort-Photo-adj-1024x313-1.jpeg 1024w, https://s4dev.wpengine.com/wp-content/uploads/2019/10/Tanglewood-Resort-Photo-adj-1024x313-1-300x92.jpeg 300w, https://s4dev.wpengine.com/wp-content/uploads/2019/10/Tanglewood-Resort-Photo-adj-1024x313-1-768x235.jpeg 768w" sizes="(max-width: 1024px) 100vw, 1024px" /></h4>
<h4></h4>
<h2>The Advantages of Bringing Payment Services Under One Roof</h2>
Although making such a significant change was intimidating, the execution and implementation were completed on schedule, without any issues or system downtime, and the benefits went into effect immediately. From waived gateway fees alone, the property was able to save an average of $400 per month. Additionally, they were able to replace every PIN pad device on the entire resort with EMV- and P2PE-capable payment terminals, including signature capture devices at the front desk to reduce chargebacks.
Another one of the major operational improvements the resort experienced was streamlined customer support. As an all-in-one payments provider, Shift4 gives businesses one number to call to resolve any issues, as opposed to having to make multiple calls to various providers to track down which was responsible for the issue.
After a successful integration, installation, and pilot, Tanglewood Resort is experiencing daily the countless benefits that have come with uniting their payments through the proven partnership of two industry leaders.
<hr />
“Shift4’s support is amazing! When we experienced a power outage, they orchestrated with IT, the communications provider, software provider, and the hotel to resolve the issue impeccably.”
<blockquote>
&#8211; Rachel Heumann 
Controller, Tanglewood Resort
</blockquote>
<hr />
<blockquote>
“Our goal was to create the future of integrated payments, where any business can find simplicity in an otherwise complicated industry – and save money at the same time. Through this partnership, Shift4 Payments and Springer-Miller Systems provide customers with a one-stop shop that takes care of all their payments needs.”
&#8211; Jared Isaacman 
CEO, Shift4 Payments
</blockquote>
<hr />
<a href="https://www.shift4.com/pdf/Shift4-Springer-Miller-Tanglewood-Case-Study.pdf">Click here</a> to view and download a PDF of this customer case study.

Customer Success Story: How All-in-One Payments Lowered Costs and Improved Operations for This Lakeside Texas Resort

Shift4 Payments is pleased to announce the <a href="https://www.shift4.com/company/newsroom/content/pr-s4-announces-general-availability-of-new-RESTful-api.cfm">general availability of our new RESTful API</a>. With the introduction of this new integration option, our new and existing independent software provider (ISV) partners can now integrate their point of sale or property management systems much faster to Shift4’s payment gateway and network, including our suite of secure payment technologies that support a wide range of payment types, devices, functions, and back-office accounting capabilities. <a name="more"></a>
If you currently have an integration with Shift4 or are interested in starting one, check out the following information to see how this affects you:
What Is RESTful API? 
RESTful (Representational State Transfer) is a modern API that many developers are familiar with. Our REST API simplifies client-server communication using HTTP verbs and endpoints, making the interface more intuitive.
Why Should I Use RESTful API?
<ul>
<li>Flexible and commonly used JSON data format</li>
<li>REST endpoints more easily define the request being performed when compared to function request codes, for example “POST/transactions/sale” is more intuitive than FRC 1B</li>
<li>We built the exeption handling into our REST API so our partners don’t have to — that means less coding and less testing to get an interface designed and certified</li>
<li>Easier to add new fields and functionality while maintaining backward compatibility</li>
</ul>
Who Can Use Shift4’s RESTful API? 
Current integration partners who have an existing payment interface with Shift4 will be given the option to recertify to the new REST API. Shift4 Payments will use the new RESTful API as a standard going forward for all new integration partners. We will continue to support all functionality through the Shift4 legacy API, however some newer features may only be offered on the new REST API format.
When Is it Available? 
Shift4’s REST API is available now. For the past year, we have carefully tested with multiple successful pilots and have now released the API as generally available.
How Do I Integrate? 
<a href="https://myportal.shift4.com/index.cfm?action=development.shift4api">Click here</a> to visit Shift4’s API corner and review the complete REST API document. For additional information, contact your Shift4 Channel Sales Director or email <a href="mailto:partnersupport@shift4.com?subject=Inquiry:%20Shift4%20Payments%20Introduces%20RESTful%20API">partnersupport@shift4.com</a> to schedule a call with one of our integration engineers.

Shift4 Payments Introduces RESTful API

New Look and Feel, Same Reliable Features 
In terms of functionality there aren&#8217;t any changes to the user interface. You&#8217;ll get to enjoy the benefits of the updated design without losing any of the features you know and love. These include:
<div style="margin-left: 25px;">Features and Functionality</div>
<ul>
<li>Centrally manage transactions from a single screen for all revenue centers and locations</li>
<li>Omni-channel payments support: in-store, online, gift card, and mobile transactions</li>
<li>Fraud monitoring and reporting</li>
<li>Easy-to-use virtual terminal</li>
<li>Batch settlement tools and assistance</li>
</ul>
<div style="margin-left: 25px;">Auditing, Accounting, and Reporting</div>
<ul>
<li>Pre- and post-settlement auditing</li>
<li>24-month rolling transaction archive</li>
<li>Prevents costly fees by eliminating erroneous or duplicate transactions</li>
<li>Reduces monthly reconciliation time</li>
<li>User-friendly interface to easily identify errors</li>
<li>Unlimited users at no extra cost</li>
</ul>
If you have questions or need additional guidance, feel free to reach out to our Customer Support team at <a href="mailto:support@shift4.com?subject=Re: DOLLARS ON THE NET Is Getting a New Name and Design">support@shift4.com</a>.

DOLLARS ON THE NET Is Now Lighthouse Transaction Manager

By Stephen Ames, CISA, CISSP – Senior Director, Security Compliance, Shift4 Corporation
⚠ Update 05/10/2018: Beginning May 10, 2018, Shift4 Payments will be officially ending support of TLS versions 1.1 and earlier. If you are a merchant still using one of these unsupported versions,  you will not be able to use any of our gateway services. Please contact Shift4’s Customer Support team immediately at 702.597.2480, option 2, or email <a href="mailto:support@shift4.com">support@shift4.com</a>. 
We are rapidly approaching a day that I hope will not “live in infamy.” June 30, 2018. This is the day we must shut down early TLS on all of our production gateway interfaces.
Why should you care? Because you may not be able to process payments through Shift4’s systems after June 30, 2018. Fortunately, there will be no impact on UTG-encrypted transactions.
I encourage you to get this article to your IT support staff and/or your PMS/POS system vendor. Suffice it to say that if your PMS or POS system is using TLS 1.0, you have about a year to either modernize it to use TLS 1.2, or replace it.
I first warned you about using early TLS back in July 2016. If you are new to the payments industry or have forgotten about the cutoff date for early TLS usage, I encourage you to go back and review my previous <a href="http://blog.shift4.com/2016/07/warning-for-sslv3-and-some-tls-users.html" target="_blank" rel="noopener noreferrer">Executive Insight</a> on this subject. I’m nudging everyone toward using TLS 1.2. Remember, TLS 1.2 itself is an 8-year-old spec – an eternity in IT lifecycle terms – and it too has cipher suites that are no longer considered secure.
Before I go any further, let&#8217;s review some basic terminology:
<ul>
<li>SSL and TLS (or Secure Sockets Layer and Transport Layer Security): SSL and TLS are protocols used to encrypt communication between a client (or a browser) and a web server or application server. The SSL protocol has been deprecated in favor of the more secure TLS protocol.</li>
<li>Cipher Suite: A cipher suite is a set of cryptographic algorithms that specifies a unique algorithm for key exchange, bulk encryption, and message authentication as well as the protocol in use.</li>
<li>Key Exchange: Key exchange algorithms are used to protect information required to create shared keys. The algorithms are asymmetric, and are generally used for small amounts of data.</li>
<li>Bulk Encryption: Bulk encryption algorithms encrypt the messages exchanged between clients (or browsers) and servers. The algorithms are symmetric and are generally used for large amounts of data.</li>
<li>Message Authenticator: Message authentication algorithms generate message hashes and signatures to ensure integrity of the message.</li>
</ul>
<div></div>
<div></div>
So exactly what is early TLS? The PCI Security Standards Council’s definition is vague and based on <a href="https://www.pcisecuritystandards.org/document_library" target="_blank" rel="noopener noreferrer">PCI DSS</a> version 3.1, which was superseded by version 3.2 in April 2016. They refer the reader to <a href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-52r1.pdf" target="_blank" rel="noopener noreferrer">NIST Special Publication 800-52 Revision 1</a>, which is itself a 3-year-old document, not to mention a common cure for insomnia. The SSC&#8217;s supplemental guidance on <a href="https://www.pcisecuritystandards.org/documents/Migrating_from_SSL_Early_TLS_Information%20Supplement_v1.pdf" target="_blank" rel="noopener noreferrer">Migrating from SSL and Early TLS</a> provides a fleeting definition:
<blockquote class="tr_bq">&#8220;Fifteen years ago, SSL v3.0 was superseded by TLS v1.0, which has since been superseded by TLS v1.1 and v1.2. To date, SSL and early TLS no longer meet minimum security standards due to security vulnerabilities in the protocol for which there are no fixes. It is critically important that entities upgrade to a secure alternative as soon as possible, and disable any fallback to both SSL and early TLS.&#8221;</blockquote>
To further complicate things, let&#8217;s review PCI DSS Requirement 4.1:
<blockquote class="tr_bq">&#8220;Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks…&#8221;</blockquote>
We then find the definition of strong cryptography in the <a href="https://www.pcisecuritystandards.org/documents/PCI_DSS_Glossary_v3-2.pdf?agreement=true&amp;time=1496687409863" target="_blank" rel="noopener noreferrer">PCI DSS Glossary</a>:
<blockquote class="tr_bq">&#8220;Cryptography is a method to protect data and includes both encryption (which is reversible) and hashing (which is “one way”; that is, not reversible). It is recommended that all new implementations use a minimum of 128-bits of effective key strength.&#8221;</blockquote>
The reader is then referred to yet another NIST Special Publication – <a href="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf" target="_blank" rel="noopener noreferrer">800-57 Part 1, Revision 4</a> this time. Are you still with me? At this point, we still don’t have a clear definition of early TLS. We can’t simply say early TLS is TLS 1.0.
Here’s why. All TLS versions have vulnerabilities, be it weak bulk encryption ciphers or man-in-the-middle exploits. For example, there’s a new variant of the original <a href="https://en.wikipedia.org/wiki/POODLE" target="_blank" rel="noopener noreferrer">POODLE</a> attack that exploits implementation flaws of CBC – Cipher Block Chaining – encryption ciphers. This is not an SSL 3.0 downgrade attack as previously noted. The <a href="https://en.wikipedia.org/wiki/Logjam_(computer_security)" target="_blank" rel="noopener noreferrer">Logjam</a> attack exploits implementations of the Diffie-Hellman key exchange process. There are also a handful of exploits against <a href="https://en.wikipedia.org/wiki/RC4" target="_blank" rel="noopener noreferrer">RC4</a>-based encryption ciphers. And the list goes on. So unfortunately, early TLS is not that easy to define.
Shift4’s definition of early TLS is as follows: 1) TLS 1.0, 2) encryption algorithms with key strengths of less than 128-bits, and 3) vulnerable cipher suites. The following cipher suites are currently in production.
<table style="width: 600px;" border="0">
<tbody>
<tr>
<td width="40"></td>
<td width="137">TLS 1.2</td>
<td width="389">TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.2</td>
<td>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.2</td>
<td>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.0, 1.1, 1.2</td>
<td>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.0, 1.1, 1.2</td>
<td>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.2</td>
<td>TLS_RSA_WITH_AES_128_CBC_SHA256</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.2</td>
<td>TLS_RSA_WITH_AES_256_CBC_SHA256</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.0, 1.1, 1.2</td>
<td>TLS_RSA_WITH_AES_128_CBC_SHA</td>
</tr>
<tr>
<td width="40"></td>
<td>TLS 1.0, 1.1, 1.2</td>
<td>TLS_RSA_WITH_AES_256_CBC_SHA</td>
</tr>
</tbody>
</table>
So, what will happen on June 30, 2018? As of this writing, we will be forced to shut down TLS 1.0 or risk operating as a noncompliant Level 1 Service Provider. Since that date falls on a Saturday, we will perform this action earlier that week, as we don’t make significant changes in production on weekends or around holidays.
Again, it is extremely important that you get in touch with your IT support staff and/or your PMS/POS system vendor and have them ensure you will not be affected when we shut down TLS 1.0 during the last week of June 2018.
As always, feel free to reach out to me directly at <a href="mailto:pci@shift4.com?subject=4Sight Inquiry: Are You Still Using Early TLS? It's Time to Take Action!">PCI@shift4.com </a> for clarification on the information I provided here or with any other questions that you may have.

Are You Still Using Early TLS? It’s Time to Take Action!

By Stephen Ames, CISA, CISSP – Senior Director, Security Compliance, Shift4 Corporation
Riding on the fantastic <a href="http://blog.shift4.com/2016/12/shift4s-p2pe-solution-will-soon-be-pci.html">news</a> that Shift4’s True P2PE® solution is PCI validated, which means that you may be able to significantly reduce the scope and time of your PCI DSS assessments by using the <a href="https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2-SAQ-P2PE-rev1_1.pdf?agreement=true&amp;time=1492443398093" target="_blank" rel="noopener noreferrer">Self-Assessment Questionnaire (SAQ) P2PE</a>, I&#8217;m sure you have a ton of questions about your particular environment. I will try to answer all of your questions as a follow up to my January 2017 Executive Insight, &#8220;<a href="http://blog.shift4.com/2017/01/executive-insight-pci-validated-p2pe.html" target="_blank" rel="noopener noreferrer">PCI-Validated P2PE – What You Need To Know</a>&#8220;. In case you missed it, let’s recap:
First, aside from implementing PCI PIN Transaction Security (PTS) validated POI devices, there is no additional cost to you. If you’ve already done so, you are set. Second, as with the many value-added services that come with our DOLLARS ON THE NET® payment gateway, implementing True P2PE will not require you to change processors. Third, be mindful that not all encryption-at-the-swipe POI devices are created equal, and some don’t qualify for any validated P2PE solution. And finally, depending on your current setup, you may be instantly “grandfathered” in to our PCI-validated True P2PE solution and qualify to use the <a href="https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2-SAQ-P2PE-rev1_1.pdf?agreement=true&amp;time=1492443398093" target="_blank" rel="noopener noreferrer">SAQ P2PE</a>.
How to Qualify for Shift4’s PCI-Validated True P2PE Solution 
If you’re an existing Shift4 customer using True P2PE, flip your POI devices over and match your model and version to a device on the True P2PE solution list <a href="https://www.pcisecuritystandards.org/popups/p2pe_sol_device.php?reference=2017-00127.001" target="_blank" rel="noopener noreferrer">here</a>. If your device does not appear on this list, it doesn’t necessarily mean you’re any less secure, but you do not qualify to use the SAQ P2PE. What it likely means is that you are using a Shift4-supported encryption-at-the swipe device, but it doesn’t have SRED as a function, which is required to qualify for a validated P2PE solution.
Shift4-supported POI devices can be found <a href="https://www.shift4.com/dotn/integration/third-party-devices.cfm" target="_blank" rel="noopener noreferrer">here</a>, but it is highly recommended you choose a device included in the True P2PE validated solution listing. Your best option is to contact Shift4 Customer Support at <a href="mailto:support@shift4.com?subject=4Sight Inquiry: Executive Insight: True P2PE – What You Need To Know (Part 2) ">support@shift4.com </a>or 702.597.2480 (option 2) for advice as to which devices may best suit your environment.
If your device model and version appears on the True P2PE solution list, then search your model and version on the PCI SSC’s <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices">Approved PTS Devices list</a> to confirm that you’re using PTS-validated devices and note their date of expiry. The “Version” column in this list refers to the PTS version for which your device is validated. Why does this matter? Part of your responsibilities for PCI compliance is to maintain an inventory of your True P2PE environment. For more information, refer to merchant responsibilities in the <a href="https://www.shift4.com/PDF/Shift4-P2PE-v2-PIM.pdf">True P2PE Instruction Manual for PCI P2PE</a>.
Why Are the PTS Versions and Expiry Dates Important? 
PTS version 2 device validations will expire on April 30, 2017. If you have version 2 validated devices in your True P2PE environment, you may continue using them until April 12, 2020 – the revalidation date of True P2PE. This is made possible according to <a href="https://www.pcisecuritystandards.org/faqs">PCI SSC Frequently Asked Question</a> #1434. Keep this FAQ handy because after April 30, 2017 your QSA or acquirer might question the validity of your True P2PE environment if you are using PTS version 2 devices. You should plan to replace these devices by April 12, 2020.
Don’t Have a PTS-Approved Device Yet? Don’t Worry 
We encourage you to take advantage of the SAQ P2PE available when using True P2PE with <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/pin_transaction_devices">approved SRED PTS devices</a>. However, it’s important to note that there have been no changes to our product that should interfere with you continuing to leverage a smaller PCI DSS footprint whether or not you qualify for a validated P2PE solution. So, if you aren’t able to upgrade your devices just yet, don’t worry. It is our recommendation however that you check with your PCI Qualified Security Assessor (QSA) or similarly qualified advisor to make sure.
As always, feel free to reach out to me directly at <a href="mailto:pci@shift4.com?subject=4Sight Inquiry: &lt;em&gt;True&lt;/em&gt;P2PE – What You Need To Know (Part 2)">PCI@shift4.com </a>for clarification on the information I provided here or any other questions that you may have.

Executive Insight: True P2PE – What You Need To Know (Part 2)

Big news! Our advanced point-to-point encryption solution, True P2PE, is now on the list of PCI-validated P2PE technologies. By encrypting cardholder data (CHD) at an <a href="https://www.shift4.com/thirdpartydevices">approved payment terminal</a> or device you can prevent CHD from entering your system. Now, you can continue taking advantage of same speed, security, and reliability of True P2PE with the added benefit of saving time and money by the use of the Self-Assessment Questionnaire (SAQ) P2PE “short form.” Click <a href="https://www.shift4.com/company/newsroom/content/pr-s4-announces-pci-validation-of-enhanced-p2pe-solution.cfm" target="_blank" rel="noopener noreferrer">here</a> for official announcement.

True P2PE Is Now PCI Validated!

More security, added versatility – and a new look, too. Shift4’s 4Word gives merchants a way to share and control cardholder data (CHD) with a trusted third party so that payments can be processed according to the merchant’s business requirements or need, whether that third party is a Shift4 customer or not. We’ve recently completed a major update to the 4Word web app that helps merchants increase login security and the application’s usability – especially for those doing business internationally.
Check out what’s new:
<ul>
<li>Multifactor Authentication – Administrators can require multifactor authentication (MFA) for anyone they invite to use the 4Word web app. This provides a more secure way to verify a user’s identity at login. We highly recommend that you enable MFA for any user who has access to see unmasked CHD. To get the benefits of MFA, you can use Shift4’s own <a href="https://www.shift4.com/dotn/veri4/" target="_blank" rel="noopener noreferrer">veri4</a> iOS app or Google Authenticator.</li>
<li>Four Words, a TrueToken, or Either – Even though it is more secure to obtain four words from a TrueToken to reveal CHD to third parties, Shift4 has answered a merchant request by now offering in the 4Word web app the ability to directly enter a TrueToken to temporarily reveal CHD (instead of requiring a third-party to enter only four words). This enhancement may make it easier for global businesses where the dominant language is not English to process payments in countries that Shift4 may not yet process, or as a “stop-gap” measure prior to obtaining an updated version of your POS/PMS system that supports the generation of four words. In our commitment to your security, this feature is controlled by administrative settings in DOLLARS ON THE NET where you can set the preference to four words, TrueToken, or either, for any user that you invite.</li>
<li>Delegates – When you invite a user to the 4Word web app, you can now optionally allow that user to create delegates. A delegate is someone at a third party whom the merchant allows to invite other users. The permissions the merchant has designated for that delegate will be honored for any users the delegate invites to use the 4Word web app, but they will not be able to create other delegates.</li>
</ul>
You can set any of these new features when you use DOLLARS ON THE NET to invite users to the 4Word web app. In addition, the settings in Shift4’s Merchant Configuration Vault will need to be updated by Shift4&#8217;s Account Setup team to support the TrueToken functionality previously mentioned. And, if you’re not taking advantage of 4Word already, they can assist you with adding it to your account. If your POS/PMS cannot yet obtain four words, let us know and we will give them a shout out to do so!
For detailed information about how to use these new features, see the Account Administrator Guide in DOLLARS ON THE NET Help. Additionally, the 4Word Reference Guide is a new document available to the users you invite. You can access it in DOLLARS ON THE NET Help and they can access it in the 4Word web app.

Introducing the New 4Word

We’ve added some useful new options to the UTG and DOLLARS ON THE NET. Here&#8217;s what&#8217;s new:
With this UTG update, merchants processing directly to American Express (AMEX) will be able to more accurately and securely verify AMEX cardholders using online PIN verification (if supported by the card) instead of relying solely on a signature.
We’ve also added the ability for POS vendors to provide you with a “disable EMV” option for individual transactions. If implemented, this feature will allow the processing of specialized payment cards via a different merchant ID/account (MID) other than the primary one for which your primary EMV payment terminals are configured. For example, if you process high risk transactions for part of your business via a separate MID, you can use this option to process these payments on any of your terminals instead of requiring designated terminals.
In DOLLARS ON THE NET, if you can view unmasked card numbers, you may have noticed that we are now suggesting that you enable multifactor authentication (MFA) to increase login security. Although this is an option right now, we will soon be requiring MFA for all users that have the ability to view unmasked card numbers. So, we encourage you to enable MFA sooner rather than later! You can use Shift4’s own <a href="https://www.shift4.com/dotn/veri4">veri4 </a>iOS app, or Google’s Authenticator.
If you have any questions or want to learn more about these features, call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight Inquiry: New Options in the UTG and DOLLARS ON THE NET">support@shift4.com</a>.

New Options in the UTG and DOLLARS ON THE NET

As you are well aware, hackers and scammers pose an ongoing threat to your payment data. A single data breach can do enough damage to your company’s brand and finances to last years – if not bring an end to, or at least greatly hamper, your business operations. This is one of the reasons why we suggest layering the strongest payment security tools available. But, it also doesn’t hurt to stay up to date on the methods that are being used to steal payment data. AARP recently <a href="http://www.aarp.org/money/scams-fraud/info-2017/fraud-scam-speak-terminology-guide.html" target="_blank" rel="noopener noreferrer">put out an informative article</a> detailing some common scamming terms that you should be aware of. Knowing what types of attacks to look for can make all the difference between staying protected and letting the bad guys right in the front door.
Brute-force attack: A hacking method to find passwords or encryption keys by trying every possible combination of characters until the correct one is found.
Catfish: Someone who creates a fake online profile to intentionally deceive you.
Drive-by download: The downloading of a virus or malware onto your computer or mobile device when you visit a compromised website — it happens without your clicking on anything at the site.
Ghosting: Theft of the identity of a deceased person to fraudulently open credit accounts, obtain loans or get utility or medical services in the person&#8217;s name.
Hash busters: The random words or sentences contained in spam emails that allow these emails to bypass your spam filters.
Keylogger: A clandestine program that logs sequential strokes on your keyboard and sends them to hackers so they can figure out your log-in credentials.
Malvertising: Malicious online advertising that contains malware — software intended to damage or disable computers.
Man-in-the-middle attack: When a fraudster secretly intercepts and possibly alters messages between two parties who believe they are securely communicating with each other.
Pharming: When hackers use malicious programs to route you to their own websites (often convincing look-alikes of well-known sites), even if you&#8217;ve correctly typed in the address of the site you want to visit.
Phishing: The act of trying to trick you, often by email, into providing sensitive personal data or credit card accounts, by a scammer posing as a trusted business or other entity.
Scareware: A program that displays on-screen warnings of nonexistent infections on your computer to trick you into installing malware or buying fake antivirus protection.
Skimming: The capture of information from the magnetic stripe on credit and debit cards by &#8220;skimmer&#8221; devices that are secretly installed on card-reading systems at gas pumps, ATMs and store checkout counters.
Smishing: Phishing attempts that go to your mobile devices via text message, telling you to call a toll-free number. Named for SMS (short message service) technology.
Spear-phishing: Phishing with personalized email, often appearing to be from someone you know.
Spoofing: Any situation in which a scammer masquerades as a specific person, business or agency, but typically meaning the manipulation of your telephone&#8217;s caller ID to display a false name or number.
Spyware: A type of malware installed on your computer or cellphone to track your actions and collect information without your knowledge.
Vishing: Short for &#8220;voice phishing,&#8221; the use of recorded phone messages intended to trick you into revealing sensitive information for identity theft.
Whaling: Phishing attempt on a &#8220;big fish&#8221; target (typically corporate executives or payroll departments) by a scammer who poses as its CEO, a company attorney or a vendor to get payments or sensitive information.

Fraud Speak: Learn the Lingo to Beat Scammers

Did you know that fake authorization codes are the number one cause of suspended batches? No one wants to take the time to call a card issuer’s voice authorization center to get a referral code when facing a line of customers. But, when a busy clerk enters a fake code to force an authorization, it doesn’t just cause problems with that transaction in DOLLARS ON THE NET, it causes a portion of the batch – or even the entire batch of transactions – to suspend, leaving your auditor stuck with extra work or even a delay in funding.
But, we’ve got good news. The new “Referrals Only” option in DOLLARS ON THE NET allows auditors to quickly investigate these transactions without weeding through every single one in a batch. Here’s how it works:
<ul>
<li>On the Current Transactions page, your auditor can select Referrals Only when auditing a batch. This option reveals all transactions that received a referral (voice authorization) response, allowing your auditor to quickly check the authorization codes for these transactions to make sure the codes entered look authentic.</li>
<li>Here’s a tip: Suspicious auth codes typically include repetitive numbers, patterns, or common number sequences, such as “123456”, “1111”, or any other suspicious set of numbers. Also, auth codes are almost always six characters, so anything less should be considered suspicious. Your merchant services provider (MSP or merchant bank) can give you guidance on what a standard authorization code is.</li>
<li>When your auditor reviews referral transactions, they can efficiently fix or void these transactions depending on your company policy.</li>
<li>After resolving any suspicious authorization codes or voiding these transactions, the auditor can remove the filter to view all of the transactions in the batch and finish any further auditing that may be required prior to settlement.</li>
</ul>
All in all, this viewing option makes for an efficient way to resolve or remove forced authorizations from a batch, so we highly recommend you try it if you’ve had any previous trouble with suspended batches.
If you want to learn more or need help using the Referrals Only viewing option when auditing transactions, our Customer Support team can help. Call 702.597.2480 (option 2) or email <a style="color: #6e289d;" href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Avoid%20Suspended%20Batches%20Using%20New%20DOLLARS%20ON%20THE%20NET%20Viewing%20Option">support@shift4.com</a>.

Avoid Suspended Batches Using New DOLLARS ON THE NET Viewing Option

We’ve added a few enhancements to our UTG 2290 release. If you use EMV with Verifone PIN pads, then you’ll be excited to learn we’re giving you more control over handling debit and credit cards in EMV processing (if the customer’s card allows for it). With support from your POS or PMS, you can set preferences for processing transactions by credit or debit. For example, if you want all transactions to be processed via credit, or if you want all transactions over $100 to be processed via debit, you can. Using the “Prefer US Common Debit” option in DOLLARS ON THE NET for EMV devices, the UTG will automatically select the U.S. common debit application (AID) if it’s present on the card so the transaction will route over the debit network instead of the global (credit card) network. This can help you reduce your interchange fees!

Enhanced Support for Verifone PIN Pads in the Latest UTG Update

If your hotel supports EMV and accepts reservations or purchases via an app, website, or call center, please be sure to authorize each guest’s card at check-in to avoid falling prey to an increasingly popular fraud scheme.
As we’ve <a href="http://blog.shift4.com/2016/04/executive-insight-emv-6-months-later.html" target="_blank" rel="noopener noreferrer">previously mentioned</a>, EMV doesn’t authenticate cards in card-not-present (CNP) scenarios. So these days, when fraudsters buy card data in bulk online, they’re increasingly targeting e-commerce retail businesses and hoteliers that support purchases by phone (e.g., phone reservations) and pay-in-advance online purchases (i.e., guaranteed reservations).
We know it’s sometimes nice to avoid asking for a card at check-in to give a “VIP” experience to your guests. And for some hoteliers, the benefits of providing this type of customer experience might outweigh the risks. But, if you’re taking reservations or purchases via an app, website, or call center, taking the simple step of inserting the guest’s card during check-in and letting EMV do its job can protect you from accepting fraudulent cards. (And there&#8217;s a bonus – card-present transactions generally cost less than CNP due to the reduced risk for fraud and chargebacks.)
If you are not yet EMV ready, Shift4 can help. <a href="https://www.shift4.com/insight/EMV/#MerchantsSection" target="_blank" rel="noopener noreferrer">Learn more here</a>.

Fight Fraud: Authorize Every Guest’s Card at Hotel Check-In

<div style="padding-right: 20px; padding-top: 10px;">We routinely update our solutions to optimize your payment processing efficiency, security, and cost savings. As such, we’ve recently added a few new features to our DOLLARS ON THE NET payment gateway.
<ul style="clear: both;">
<li>Ability to Require Multifactor Authentication – Account administrators can now require multifactor authentication (MFA) for select users when they log in to DOLLARS ON THE NET. This allows account administrators to better secure staff members’ logins by prompting them to enter a unique six-digit passcode via their smart device in addition to the merchant account number, username, and password. We recommend requiring this setting for all administrator-type users.
<div style="height: 10px;"></div>
Account administrators who want to require MFA can find the instructions in the Account Administrator Guide in DOLLARS ON THE NET Help. Staff members who need to enable MFA for their account should read the Changing Your Profile document in DOLLARS ON THE NET Help.</li>
<li style="margin-top: 10px;">Login Help – If you forget your account number, username, or password – or if you were unable to generate a passcode using MFA, our new Login Help feature can help you reset it right from the DOLLARS ON THE NET login page. The process is pretty easy, but if you’d like to learn more, the directions are available in the Logging in to DOLLARS ON THE NET document in DOLLARS ON THE NET Help.</li>
<li style="margin-top: 10px;">Custom Date Range Option for Consolidated Totals Report – Administrators for centralized accounts (i.e., accounts that allow administrator-type users to view transactions and print reports for multiple accounts) can now select a custom date range when generating a Consolidated Totals Report. Find out how in the Centralized Accounts document in DOLLARS ON THE NET Help.</li>
<li style="margin-top: 10px;">View Referrals – A “referrals only” viewing option is now available on the current transactions and archived transactions pages in DOLLARS ON THE NET. This viewing option allows auditors to see all of the transactions that received a referral response within a selected time period, so they can investigate them and ensure that no fake or inaccurate authorization codes were entered.</li>
</ul>
If you have any questions or want to learn more about these features, call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Updated%20Features%20in%20Our%20Latest%20DOLLARS%20ON%20THE%20NET%20Release">support@shift4.com</a>.
</div>

Updated Features in Our Latest DOLLARS ON THE NET Release

If you are you using an old web browser or a server-to-server setup to connect with Shift4’s DOLLARS ON THE NET payment gateway and/or our i4Go solution, you will soon be required to update to the TLS 1.2 protocol. If you do not make this update, your payment processing may be impacted. 
Please Note: Most DOLLARS ON THE NET users will not be affected by this requirement. If you are unsure whether this notification applies to you, please read <a href="http://blog.shift4.com/2016/07/warning-for-sslv3-and-some-tls-users.html" target="_blank" rel="noopener noreferrer">this Executive Insight</a> by Shift4’s Senior Director of Security Compliance, Stephen Ames, for clarification.
Last summer, we announced that on March 31, 2017, we would turn off support for SSLv3 and early TLS (i.e., TLS v1.0 and v1.1). These older protocols were used to secure communications between a user’s web browser and a website but have become vulnerable to exploit by numerous malware attacks, including Heartbleed, Freak, POODLE, Shellshock, and others.
As a leader in payment security, Shift4 is committed to completing our transition away from these outdated protocols long before the PCI SSC’s June 2018 deadline, at which time merchants still using them will no longer be able to maintain PCI DSS compliance. We removed SSL and early TLS from our internal environment two years ago and eliminated support for the protocols in our external test environments during the fall of last year.
Now that we’re getting close to completely dropping support for SSL and early TLS in live transaction processing, we are providing a phased schedule by product so you won’t experience any surprises.
<ol>
<li>Direct server-to-server via HTTPS (does not affect Universal Transaction Gateway implementations) – April 4, 2017</li>
<li>HTTPS to/from 4Res – April 11, 2017</li>
<li>HTTPS to DOLLARS ON THE NET – April 18, 2017</li>
<li>HTTPS to IT’S YOUR CARD – April 25, 2017</li>
<li>HTTPS to 4Word – May 2, 2017</li>
<li>HTTPS to i4Go – May 9, 2017</li>
</ol>
If you think you might still be using SSL or early TLS to connect with Shift4, please contact Shift4 Customer Support immediately at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20IMPORTANT%3A%20You%20May%20Be%20Required%20to%20Update%20to%20the%20TLS%201.2%20Protocol">support@shift4.com</a> for guidance.

IMPORTANT: You May Be Required to Update to the TLS 1.2 Protocol

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
The U.S. payments industry has been talking about EMV for years, but it’s still the subject of a lot of inaccuracy and misinformation. I’d like to make a few comments about something that I read recently.
The Quote That Started It All 
I came across <a href="http://www.digitaltransactions.net/news/story/How-EMV-Related-Chargebacks-Drove-Florida-Merchant-Duo-to-Sue-Networks-And-Issuers" target="_blank" rel="noopener noreferrer">this article about the U.S. EMV rollout in Digital Transactions</a>. While reading it, my initial thought was, “There’s nothing new here. They’re simply documenting how the EMV rollout went (and still is going) for many U.S. merchants.” Then, in the final paragraph, I read a quote from Molly Wilkinson, executive director of the Electronic Payments Coalition, a lobbying group based in Washington D.C. that represents card networks and issuers:
<center>“Merchant groups have known about the transition to EMV cards for five years, but 
instead of getting their act together, they have tried to delay, obfuscate, and reject 
this solution – all while leaving customers exposed to hackers and counterfeiters.”</center> 
This statement has so many flaws that I’m not sure where to start, and it clearly demonstrates the ignorance of the coalition – or is altogether pushing a blatant lie. Please allow me to dissect this quote one piece at a time.
My First Qualm: Merchant Groups 
Let’s start with the mention of “merchant groups” in the quote. Simply put, these are advocates for the merchants, not tools for the card brands’ mandates. They have no control over what the networks support, the various requirements of physically performing an EMV transaction, or the certification requirements of EMV solutions. In fact, merchant groups have little to no role in the supposed five-year preparation window. I’ll delve deeper into this later. But, I would be interested in hearing exactly how these merchant groups supposedly delayed or obfuscated the U.S. EMV rollout.
My Second Qualm: The “Rejection” of the “Solution” 
Now let’s discuss this so-called rejection of the solution. There were certainly valid reasons for the objections to the EMV rollout strategy. In my opinion, the largest factor of the U.S. EMV rollout failure was a lack of forethought by the card brands and EMVCo in recognizing the differences in the U.S. marketplace when compared to the way payments work in the rest of the world. EMV for the most part has been a great success in Europe and it was assumed that the EMV “blueprint” could be lifted from Europe and plopped into the U.S. as-is. The problem here is that the European blueprint included a thorough end-to-end testing of the “solution ” – but the solution here is much more complex.
In Europe, a majority of the EMV solutions are simply stand-beside terminals with little or no integration to POS/PMS systems, so certifying a couple of terminal solutions with the limited number of banks in each country is no big deal. However, here in the U.S., there is a diversity of banks, processors, and terminals unseen anywhere else in the world, and a majority of the marketplace here uses fully or semi-integrated solutions with the POS. This translates into an exponentially larger number of “solutions” to certify in the U.S. compared to Europe’s deployment of EMV .
My point is not that one continent’s payments practices are better than another’s, but that they are significantly different – and EMVCo and the card brands failed to recognize this. The blame certainly doesn’t fall on merchant groups, who were simply the bystanders in this situation.
My Third Qualm: The Five-Year Window 
Let’s revisit the five-year EMV preparation window. The card brands scheduled out various deadlines mandating when banks and processors should be EMV ready, as well as a liability shift for merchants on October 1, 2015. There were multiple issues here. First of all, as long as a processor could demonstrate a working EMV solution (I’m unsure if certification was required or not at this point), then the mandates were considered to be met. For many processors, their host specifications supporting EMV were not published to their integration partners (like gateways) until around May or June of 2015, just a few months shy of the liability shift date for merchants.
Knowing all of this, it certainly appears that service providers were given an impossible deadline. Most EMV solutions initially took between 4-12 months to certify. It’s a little better now, but not by much. Assuming the specs were published in May, allowing for a 30-90 day development cycle plus a six-month certification, means the average “solution” would have been certified and production ready no earlier than February or March of 2016 – this is a good 4 or 5 months after the EMV liability shift.
Then, we have the October liability shift date itself. Why October? Who picked it? This was just before the holiday shopping season when most merchants (at least larger ones) have technology freezes in place, since it’s their busiest time of year. To me, this seemed like an objectively poor choice to impose this liability shift.
The Cherry on Top 
Going back to the quote in question, here’s the doozy: “all while leaving customers exposed to hackers and counterfeiters.” This propagates the misbelief that EMV secures payment data, which it absolutely doesn’t. EMV is a card-present authentication mechanism only. Authentication guarantees (relatively speaking) that the card is authentic and was not forged; it does not stop criminals from stealing the account number and expiration date as it flows through in the clear. You must add point-to-point-encryption (P2PE), sometimes also referred to as end-to-end-encryption or E2EE, to secure the data at physical points of sale, and tokenization to further protect that data in storage – which is why Shift4 requires this type of layered security in our EMV implementations. The U.S. was already making a shift to P2PE, but the problem was that incorporating EMV meant a new batch of uncertified terminals entering into the solution certification chain. In this respect, EMV has actually delayed the adoption of technologies that can give merchants stronger payment security.
As you can see, EMV cannot be brought to the U.S. by taking what worked in Europe, throwing it into our complicated payments industry, and planning on working out the kinks later. It boggles my mind that it is such a headache a year and a half later. With just a little more forethought and careful planning, many of these lingering issues could have been avoided.
For the most accurate and reliable take on EMV, visit our extensive <a href="https://www.shift4.com/insight/EMV/index.cfm" target="_blank" rel="noopener noreferrer">EMV</a> site.

Executive Insight: Don’t Be Misled by False Claims About EMV

Many servers in the U.S. are still vulnerable to the Heartbleed Bug and other malicious software. It’s time to say goodbye. On March 31, Shift4 is ending support for SSL and TLS 1.1 and older. If you’re still using these outdated encryption methods, your payment processing – and PCI compliance – is at risk. <a href="http://blog.shift4.com/2016/07/warning-for-sslv3-and-some-tls-users.html" target="_blank" rel="noopener noreferrer">Read on</a> to find out what you need to do.

52 Days Until We End Support for SSL and Early TLS

As dedicated merchant advocates, we routinely update our solutions to optimize your payment processing efficiency and security. As such, we’ve recently made a few enhancements to our Universal Transaction Gateway (UTG). 
Here’s the lowdown on what’s included in the most recent release:
<ul style="clear: both;">
<li>Faster PIN Pad Reset Capability – Our enhanced PIN pad reset capability could save you and your customers time at the point of purchase. If a customer wants to add another item, change their payment method, or cancel a transaction, the clerk can now force the PIN pad into idle – instantly resetting it, rather than having to wait for the terminal to time out. This function is supported for both Ingenico RBA and Verifone MX PIN pads. Check with your point-of-sale or property management system provider to see if they support this feature.</li>
<li>Updated Options in UTG TuneUp – We’ve removed a few options in UTG TuneUp that are no longer in use to make it easier for you to navigate. So, don’t be worried if things look a little bit different.</li>
<li>Ended Support for Six Legacy Payment Devices – Following our <a href="http://blog.shift4.com/2016/08/you-may-need-to-replace-your-payment.html" target="_blank" rel="noopener noreferrer">previous announcement</a> that we’re ending support for a few payment devices that are no longer PCI PTS validated, this release officially ends our support for the following:
<ul>
<li>Ingenico 3070</li>
<li>Ingenico 6550</li>
<li>Ingenico 6780</li>
<li>Verifone 1000</li>
<li>Verifone MX 850</li>
<li>Verifone MX 870</li>
</ul>
</li>
</ul>
If you have any questions or want to learn more about these enhancements, feel free to call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Faster%20PIN%20Pad%20Reset%20and%20More">support@shift4.com</a>.

Faster PIN Pad Reset and More

By Stephen Ames, CISA, CISSP – Senior Director, Security Compliance, Shift4 Corporation
Riding on the fantastic <a href="http://blog.shift4.com/2016/12/shift4s-p2pe-solution-will-soon-be-pci.html">news</a> that Shift4’s True P2PE (point-to-point encryption) solution will soon be PCI validated, I want to impart some important information you need to know, regardless of whether or not you choose to implement True P2PE.
<div style="clear: both;">Validated P2PE: Requirements for Merchants 
First and foremost, did you notice this note in Shift4’s <a href="http://blog.shift4.com/2016/12/shift4s-p2pe-solution-will-soon-be-pci.html" target="_blank" rel="noopener noreferrer">blog post</a>?
</div>
“There is no cost to you, aside from implementing PTS v2 (or higher) approved POI devices with SRED as a function.” 
 
This is huge! Since I’m a Shift4 insider, I can tell you firsthand that the time and expense required to implement hardware security module (HSM) technology will represent a huge capital expenditure for us. But, that’s what Shift4 does. We’re constantly adding value to our payment gateway, DOLLARS ON THE NET, at no additional cost to you, our merchants. That’s right, no extra charge for P2PE services. I wonder if any other P2PE provider can say the same thing. I seriously doubt it!
Second, as with the many value-added services that come with DOLLARS ON THE NET, implementing True P2PE will not require you to change processors. Why is this important? Well, there are both PCI-listed and non-listed P2PE solutions that would actually require you to change processors. At first glance, that may not seem like a big deal to you. However, if you go back and review your agreement with your <a href="https://www.shift4.com/insight/glossary/index.cfm?searchterm=This%20organization%20handles" target="_blank" rel="noopener noreferrer">merchant services provider</a> (MSP), you might be locked into their preferred processor arrangement. If that is the case and you want to get P2PE, your only course of action might be to either renegotiate or terminate your current agreement, which is easier said than done. Fortunately, with True P2PE, you can keep your current processor. So, why go with any other solution?
Third, you have to be mindful of the PCI SSC’s P2PE standard because not all “encryption-at-the-swipe” POI devices are created equal – and some don’t actually qualify to be included in a validated P2PE solution. To make sure that your devices will qualify, you’ll want to carefully review Shift4’s <a href="https://www.shift4.com/dotn/integration/third-party-devices.cfm" target="_blank" rel="noopener noreferrer">third-party device list</a> and select “SRED” under the “features” filter. The POI device specifications and suppliers can be found by opening the PDF provided to the right of the device in the list.
Almost there! After you have done your research and have selected the best SRED POI model for your environment, you will need to contact your supplier of choice to ensure the devices you order are certified to at least version 2 of PCI’s PTS standard.
How to Qualify for Validated True P2PE 
If you’re already using our True P2PE solution, you may be wondering what you need to do to qualify for validated P2PE. If you are using PTS-approved POI v2 (or higher) devices as described above, just sit back and relax, because there’s nothing else for you to do to except notify your MSP. All of the changes we need to make to validate P2PE will take place in our data centers and won’t have any impact on you at all. In fact, you won’t notice a thing.
If your POI devices are not approved as described above, don’t worry! The changes we make in our data centers will not affect you either. However, I encourage you to replace your current POI devices with a model that will qualify you for validated P2PE and the benefits it brings.
You now have all the information you need to know about the future of Shift4’s True P2PE solution. The next major announcement about True P2PE will be when it appears on PCI’s list of validated P2PE solutions. Should you have questions about any of the information I have provided, feel free to email <a href="mailto:PCI@shift4.com?subject=4Sight%20Inquiry%3A%20Executive%20Insight%3A%20PCI-Validated%20P2PE%20%E2%80%93%20What%20You%20Need%20to%20Know">pci@shift4.com</a>.

Executive Insight: True P2PE – What You Need to Know

This month’s UTG update enables you to set a minimum and maximum number of digits for manual card entry (MCE), giving you more control over the types of cards your staff members can manually enter. For example, you can allow MCE for only gift card, employee card, and/or loyalty card numbers. You can also set a maximum number of digits to catch keying errors before you attempt to process a 17-digit credit card number, saving you from additional transaction fees.

Set Limits for Manual Card Entry With the UTG 2287 Update

Our True P2PE is already faster, more secure, and more reliable than any other point-to-point encryption solution in the industry. And, it will soon be one more thing: PCI validated!Yes, you read that right. If you’re already using True P2PE with PTS-approved, SRED compliant devices, you’ll soon be benefiting from a listed, PCI-validated P2PE solution – without making any changes to your existing setup.
Security Without Compromise 
We have never advocated a “checkbox” security mindset (don’t worry, we never will). But, we also know that ticking this particular checkbox is very important to many of you, our merchant customers, because it potentially makes it possible for you to use the SAQ P2PE “short form” – and makes things easier for your Qualified Security Assessors (QSAs), which could end up saving you time and money on assessments. Therefore, we’ve been working behind the scenes to create a solution that allows for PCI validation while retaining the security posture that we’ve created via our 100% proprietary products.
We’ve Worked With the Industry’s Top QSAs 
True P2PE has been repeatedly assessed to perform as well as or better than the currently listed P2PE solutions. As QSA company Dara Security has reported in a recent assessment:
“Shift4’s True P2PE solution meets, and in most cases, exceeds all other security requirements of PCI P2PE 2.0 domains 5 and 6, key management and decryption processes.”
We’ve previously taken issue with the PCI P2PE guidelines because they require a hardware security module (HSM), which is basically a tamper-proof computer server, to be installed in our data center for encryption key management. This gave us pause for a couple reasons: HSMs have the potential to negatively impact the speed we’ve worked so hard to develop and take pride in delivering; and, HSMs could create a single point of failure – a threat to our unrivaled uptime.
Dara Security also noted that our P2PE data decryption keys (DDK) exceed the security available in HSMs:
“[True P2PE] employs a software-based key management system in the decryption environment and does not utilize HSMs for any other P2PE process. In the end, that is a distinction without a difference. In fact, introducing an HSM to the key management system would actually diminish DDK security and introduce more attack vectors.”
Without getting into the technical mumbo jumbo, we’ve resolved every concern we had about using HSMs thanks to the hard work our team has done with some of the payments industry’s top QSAs. This enables us to implement an HSM in a unique way that preserves our highest standards for speed, security, and reliability while meeting PCI’s standard as well.
Don’t Wait to Be Secure 
If you’re not currently using True P2PE, we encourage you to start. Here are a few reasons why you should not delay:
<ul>
<li>There is no cost to you, aside from implementing PTS-approved POI v2 (or higher) devices with SRED as a function.</li>
<li>True P2PE is faster and more reliable than any other P2PE solution in the industry. In fact, we have numerous patents on the point-to-point encryption process, so there isn’t another payments provider out there that can do what we can.</li>
<li>Although True P2PE hasn’t previously been PCI validated, QSA assessments of our P2PE solution by <a href="https://www.shift4.com/PDF/Shift4_P2PE_Merchant_Security_Assessment_Report_20130903.pdf" target="_blank" rel="noopener noreferrer">Coalfire</a> and <a href="https://www.shift4.com/PDF/Shift4-True-P2PE-PCI-Scope-Reduction.pdf" target="_blank" rel="noopener noreferrer">Dara Security</a> show that no cardholder data has been found in our merchant customers’ payment processing environments or POS/PMS partners’ systems when True P2PE was correctly implemented.</li>
<li>Since True P2PE will soon be PCI validated, making a switch to another solution would take longer and cost more to implement – not to mention you would sacrifice the service level and feature set you’ve grown accustomed to with Shift4.</li>
</ul>
And soon, you’ll be able to add PCI validation to that list of benefits. So if you aren’t already using True P2PE, what are you waiting for?
As QSA company Coalfire noted, DOLLARS ON THE NET users can receive the scope reduction and security benefits of True P2PE for no additional cost:
“Shift4’s P2PE solution provides merchants with a much more economical alternative to a validated and listed P2PE solution and offers dramatic risk reduction as well as dramatic scope reduction.”
Contact our Customer Support team today at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%E2%80%99s%20P2PE%20Solution%20Will%20Soon%20Be%20PCI%20Validated">support@shift4.com</a> or 702.597.2480, option 2, to learn more about how you can implement True P2PE.
We’re aiming for validation early next year, so stay tuned for more updates in our 4Sight newsletter!

Shift4’s P2PE Solution Will Soon Be PCI Validated

With the holiday shopping season in full swing, millions of businesses will see a spike in payment activity. And unfortunately, many of them will see a spike in data theft, too. This is a vital time of year for merchants to take a look at their payment security strategy and ask themselves if they are truly doing everything they can to protect their customers’ payment 
data – and their brand – from the devastating effects of a data breach.The Layered Approach Is the Best ApproachCrafty hackers are often one or more steps ahead of their victims, so why wouldn’t you want to use every bit of payment protection you can? Shift4 provides the most advanced payment processing solutions – and our security tools are comprehensive. If you aren’t using all the tools available to your environment, you should be. After all, they’re included at no additional cost. Here are a few:
<ul>
<li>True P2PE encrypts sensitive cardholder data from the moment it first interacts with the payment device, whether it’s swiped, inserted, keyed, or tapped (as with mobile wallets like Apple Pay), helping to simplify PCI compliance.</li>
<li>4Go is a PA-DSS-validated product that can assist in securing legacy POS/PMS systems by working to keep card data out of those programs. 4Go is a good first step in reducing the risk of data breach, but should always be combined with our other security solutions.</li>
<li>TrueTokenization replaces cardholder data for storage with a random, alphanumeric value, also known as a token, while the actual card data is stored in Shift4’s secure, offsite data centers.</li>
</ul>
There’s no silver bullet when it comes to payment security. Our solutions are specifically designed to work together to secure your environment from ever-changing attack vectors. Each of these solutions plays a role in protecting your business throughout the transaction process. Don’t settle for a service provider that gives you subpar security, leaving your system vulnerable.
Layered Security Done Right 
Here’s an example. Shift4 merchant customers who are currently using 4Go can continue enjoying the benefits that the solution brings, while enhancing their payment security with TrueTokenization and True P2PE.
For a more in-depth look at Shift4’s security tools, check out <a href="http://blog.shift4.com/2016/01/executive-insight-3-ways-merchants-can.html" target="_blank" rel="noopener noreferrer">this article</a>.
Just remember: you can never have too much security. To find out how Shift4 can help enhance your security posture, contact our Customer Support team at 702.597.2480, option 2, or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20It%E2%80%99s%20Time%20to%20Start%20Layering%20Your%20Payment%20Security%20Solutions">support@shift4.com</a>.

It’s Time to Start Layering Your Payment Security Solutions

The transition to EMV is a journey – and thanks to our vast experience, we’re reducing the number of bumps you may experience along the road. (After all, we want it to be a journey you’re glad you took.) 
So, while adopting EMV isn’t exactly “plug and play,” Shift4 is making it much simpler for our merchant customers. Here’s how:
<ul style="clear: both;">
<li style="margin-top: 10px;">We’ve got the expertise you need to make your transition as smooth as possible. Implementing EMV is prone to hiccups, made worse by the incredible amount of rush and confusion that exists in the industry. Shift4 can guide you through this complicated process. We’ve been processing EMV for six years in Canada and the United States with more processors and more business types than anyone else in the industry. We have a thorough understanding of exactly what’s required before you process a single EMV transaction, including which POS updates are required, how to purchase devices, which key injection facilities to use, how to update device firmware, which Shift4 software updates are necessary, required processor configuration changes, and more. (Yeah, we told you there’s a lot to it.) We use this knowledge to save you as much trouble as possible by passing the things we’ve learned on to you – and this helps to make your transition to EMV a lot smoother.</li>
<li style="margin-top: 10px;">We’re successfully processing EMV transactions with more processors and devices than anyone else in the industry. Some vendors are selling cookie-cutter EMV solutions – what we call “one size fits no one.” We understand that each payment processing environment is unique, so we’ve done the work to make a flexible solution that fits your business. With Shift4, you won’t have to change your financial relationships to get started because we’re currently certified with eight processors (with even more certifications on the way). We also support 13 secure payment devices by Ingenico Group and Verifone, so you can easily find a solution to implement today and prepare your business for tomorrow.</li>
</ul>
When you want EMV, we’re the team you need on your side (and good news – as your merchant advocate, we’re already there). We’ve encountered just about every situation, so we’re the most adept partner to make changes or advise you about what’s needed to resolve any problems you may encounter as you embark on your journey to adopt EMV. To get on the road to EMV acceptance, you can reach our 24/7/365 Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight Inquiry: EMV Is a Journey, Not a Destination">support@shift4.com</a> or 702.597.2480 (option 2).

EMV Is a Journey, Not a Destination

Add new revenue centers and make paying for goods or services more convenient for your customers with Ingenico’s sleek and secure new iSMP4 Companion, which (pardon the pun) happens to be a great companion to Shift4’s VT4 mobile point-of-sale (mPOS) solution. (Bonus: our Universal Transaction Gateway already supports it.) This smart mobile point-of-sale device is out now and Ingenico is currently seeking pilot opportunities. If you are interested, please email <a href="mailto:shift4.support@ingenico.com?subject=4Sight%20Inquiry:%20Shift4%20Supports%20Ingenico%E2%80%99s%20New%20Mobile%20Terminal&amp;cc=marketing@shift4.com">shift4.support@ingenico.com</a>. You can learn about all of the cool features of the iSMP4 Companion in <a href="https://www.ingenico.com/press-and-publications/press-releases/all/2016/10/first-of-its-kind-enterprise-class-mpos-solution.html" target="_blank" rel="noopener noreferrer">Ingenico’s press release</a>

Shift4 Supports Ingenico’s New Mobile Terminal

Last year, we put out an article explaining how the arrival of EMV essentially killed the concept of swipe ahead. With EMV, customers have to wait until all items are rung up and a total is calculated before inserting their cards – and then wait 15-20 agonizing seconds for processing before they can remove their card. Good news! This no longer has to be the case.
We recently added <a href="https://www.shift4.com/company/newsroom/content/pr-s4-provides-shorter-wait-times-w-quick-chip.cfm" target="_blank" rel="noopener noreferrer">EMV quick chip</a> support with all of the major card brands to combat lengthy EMV transactions. And, with EMV swipe ahead (yes, it probably should be insert ahead, but that doesn’t sound quite as catchy), you can allow consumers to insert their EMV chip cards while the clerk continues to ring up their items. Best of all, they can remove the card after only a few seconds, resulting in happier customers who spend less time staring at the terminal waiting for something to happen.
Quick chip (which reduces transaction times on its own) can be used in tandem with swipe/insert ahead functionality to cut down your transaction times even further. Every second counts in the checkout line.
Quick chip can be enabled in Shift4’s DOLLARS ON THE NET after a simple UTG update, but you need to check with your POS or PMS vendor to make sure that they support swipe/insert ahead. If they don’t, urge them to add support for the functionality so that your customers can enjoy the full benefits of faster EMV transaction times.

Ready for Faster EMV Transactions?

Shift4 was honored by the Payment Card Industry Security Standards Council (PCI SSC) last month for supporting the Council since the very beginning, 10 years ago. While we were in attendance at their conference, we picked up a pair of helpful guides that we’d like to pass along to all of our merchant customers. All businesses could benefit from reviewing their <a href="https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf" target="_blank" rel="noopener noreferrer">Small Merchant’s Guide to Safe Payments</a> and the latest <a href="https://www.pcisecuritystandards.org/documents/PCIDSS_QRGv3_2.pdf?agreement=true&amp;time=1474989448632" target="_blank" rel="noopener noreferrer">PCI DSS Quick Reference Guide</a>.

Payment Security Tips From PCI

As a leader in the payments space and a dedicated merchant advocate, Shift4 routinely updates our Universal Transaction Gateway (UTG) in response to industry trends and merchant feedback. While some of these changes are minor tweaks and behind-the-scenes improvements, others may have a larger impact on your business.
We’ve made some recent enhancements to our UTG. Check it out – and update to UTG 2285 today!
<ul>
<li>EMV for Self-Service Environments – We’ve added support for the Ingenico iUC285, a secure smart device specifically designed for self-service checkouts, such as vending machines or kiosks. You can learn more about the iUC285, and the other EMV devices Shift4 works with, <a href="https://www.shift4.com/dotn/integration/third-party-devices.cfm?EMV" target="_blank" rel="noopener noreferrer">here</a>.</li>
<li>Barcode printing capability for certain Ingenico devices – You can now print barcodes using Ingenico 
iWL 252 or iWL 258 devices.</li>
<li>Generate certificates in UTG TuneUp – We’ve made acquiring an SSL/TLS certificate one step easier by adding the ability to generate certificates straight from UTG TuneUp. Now, the same certificate will be used every time you restart the UTG, so if you’re using a browser-based point of sale (POS) or property management system (PMS), a clerk will only be prompted to accept the security certificate the very first time they use it.</li>
<li>Ability to obtain device info – You can already use UTG TuneUp to verify the correct P2PE and debit keys are injected in your Ingenico or Verifone terminals. Now, Ingenico device users can also view a variety of device health stats, including the number of swipes, failures, and more, via a simple API call. Contact your POS or PMS provider to request support for this function.</li>
</ul>
If you have any questions, you always can reach out to our 24/7/365 Customer Support team at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20UTG%20Update%20Supports%20New%20EMV%20Device%20and%20More">support@shift4.com</a>.

UTG Update Supports New EMV Device and More

Are you tired of EMV transactions taking so long? Shift4 now fully supports EMV quick chip with Visa, Mastercard, American Express, and Discover. 
This greatly speeds up the EMV checkout process, as it allows consumers to remove their cards after only a few seconds. You can view the full announcement <a href="https://www.shift4.com/company/newsroom/content/pr-s4-provides-shorter-wait-times-w-quick-chip.cfm" target="_blank" rel="noopener noreferrer">here</a>.

Shift4 Speeds Up EMV With Quick Chip

Introducing the newest member of the Shift4 product family: <a href="https://www.shift4.com/lp/authenticator/" target="_blank" rel="noopener noreferrer">Shift4 Authenticator</a>.
This mobile app helps secure your Lighthouse Transaction Manager and MyPortal accounts by generating an additional credential – a unique, six-digit passcode that you can enter along with your account number, username, and password. For added security, this passcode changes every 30 seconds. Shift4 Authenticator is available for iOS and Apple Watch. <a href="https://itunes.apple.com/us/app/veri4-multifactor-authentication/id1142404119?mt=8" target="_blank" rel="noopener noreferrer">Download it today </a>to better secure your account.

Increase Account Security With Shift4 Authenticator

As a leader in the payments space and a dedicated merchant advocate, Shift4 routinely updates our Universal Transaction Gateway (UTG) in response to industry trends and merchant feedback. While some of these changes are minor tweaks and behind-the-scenes improvements, others may have a larger impact on your business. 
We’ve made some recent enhancements to the UTG that will allow you to take control of the checkout experience. Check it out – and update to UTG 2284 today!
<ul>
<li>Get EMV quick chip – New quick chip options from Visa, Mastercard, American Express, and Discover will speed up the EMV process at the point of purchase – no more lengthy waiting required! Shift4 knows this capability is important to you, so we were first in line to support EMV quick chip with all four major credit card brands and completed our certifications the day they were available.*</li>
<li>“Swipe” or “insert” ahead – Whether swiped or inserted, your customers can now remove their card from the payment terminal while you continue ringing up their items. Combine it with quick chip for the fastest EMV checkout experience. Ask your POS or PMS vendor if they support it (and urge them to work with us to add support if they don’t).</li>
<li>Use U.S. common debit instead of global debit – If you’re EMV enabled, transactions will automatically route over the PIN debit networks instead of the global (credit card) network if your customer’s card allows for it. This saves you and your customers time by eliminating another selection screen – and may save you money in interchange fees!*</li>
<li>The option to bypass PIN – If you want to give your customers the option to authorize a purchase with a signature instead of their PIN on EMV transactions, you can. Keep in mind that bypassing PIN authentication may result in increased fraud liability and open up a security hole where a lost or stolen card can be easily used – so be sure the benefits outweigh the risks for your business.*</li>
<li>The ability to bypass the “Amount OK” screen – If getting your customers’ agreement to a final transaction amount is unnecessary for your business, you can skip the “Amount OK” selection screen.</li>
<li>Enhanced language configuration options for Ingenico RBA devices – Now, you can customize your default language settings to English, French, or Spanish on Ingenico RBA devices.</li>
<li>iWL 250 series printer support – Want to add a mobile point of purchase? The Ingenico iWL 250 series can do it all – and we now support the built-in printer, too.</li>
</ul>
*These options will be configurable in the upcoming DOLLARS ON THE NET release.
If you have any questions, you can always reach out to our 24/7/365 Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20UTG Update Brings New EMV Options and More">support@shift4.com</a>.

UTG Update Brings New EMV Options and More

As dedicated merchant advocates, we listen to your feedback and regularly update our payment solutions to optimize your payment processing efficiency and security. In the last month, we’ve released software updates for our Universal Transaction Gateway® (UTG®), DOLLARS ON THE NET® payment gateway, and VT4® mobile point-of-sale solution.
<div style="clear: both;">Here is a breakdown of the major additions:</div>
UTG
<ul>
<li>Additional Devices – The UTG officially supports two additional wireless Ingenico payment devices: <a href="https://www.shift4.com/pdf/Shift4-Ingenico-iWL252.pdf" target="_blank" rel="noopener noreferrer">iWL 252</a> and <a href="https://www.shift4.com/pdf/Shift4-Ingenico-iWL258.pdf" target="_blank" rel="noopener noreferrer">iWL 258</a>.</li>
</ul>
DOLLARS ON THE NET
<ul>
<li>Multifactor Authentication – Merchants now have the option to use multifactor authentication to further secure their account. When enabled, DOLLARS ON THE NET will prompt the user to enter a unique, six-digit passcode in addition to the account number, username, and password. This passcode can be obtained from the Google Authenticator app on your smartphone or tablet.</li>
<li>Custom Batches – We’ve added the ability to create a custom batch by selecting one or more transactions to be include in a separate batch. This gives merchants more granular control over their settlements.</li>
<li>Highlight Modified Transactions – Transactions that have been modified within DOLLARS ON THE NET will now be highlighted, making them easier to identify and review. You can even use the new “modified only” viewing option to see all of the transactions that have been changed in Current Transactions and Archived Transactions.</li>
<li>Batch ID – We’ve replaced “Archive ID” with “Batch ID” in all cases, so don’t be surprised when you no longer see Archive ID.</li>
<li>New EMV Device Settings – We have added more EMV device settings and functionalities, allowing you to customize your implementation, including an offline option and support for five cardholder verification methods.</li>
<li>New Viewing Options – We’ve added six new viewing options to the Current Transactions and Archived Transactions pages, allowing you to customize the transactions displayed by card security code (CSC) and Address Verification System (AVS) results.</li>
<li>IT’S YOUR CARD® (IYC) Enhancements – There are a few new options for merchants who use SiteBuilder for their IYC website. Also, when creating a batch of IYC cards, you can now set a specific expiration date.</li>
</ul>
For more information about how to use these new features, don’t forget to check out DOLLARS ON THE NET Help.
VT4
<ul>
<li>EMV Enhancements – We’ve made some improvements to our EMV support in VT4, including updates to signature capture and PIN pad capabilities.</li>
<li>Room Charge Support – VT4 is the first mobile payment solution to use the HTNG room charge standard, allowing hoteliers to bill transactions directly to a guest’s room folio.</li>
<li>Demo Mode – Run mock transactions to familiarize yourself with VT4 before setting up an account with Shift4.</li>
<li>Multiple Tax Rates – Create multiple tax profiles for items and services with inclusive and exclusive tax rates, allowing you to accurately charge for products and services depending on state, county, item-specific, and other tax rates.</li>
<li>New Gift Card Functionality – In addition to accepting payments with gift cards, you can now purchase, activate, refund, cash out, and check the balance of gift cards using VT4.</li>
<li>Advanced Reporting – Generate transaction and tax reports, giving you more reporting and auditing options.</li>
<li>Refund Options – You can now enter a reason when processing refunds, giving you another level of customization and improving your record-keeping.</li>
<li>Session Timeout Notice – VT4 will now alert you before your session times out, keeping you from being logged off unexpectedly.</li>
</ul>
If you have any questions or want to learn more about these enhancements, feel free to call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight Inquiry: Don't Miss Out On Our Extensive Software Updates">support@shift4.com</a>.

Don’t Miss Out On Our Extensive Software Updates

Starting next year, <a href="https://www.mastercard.us/en-us/issuers/get-support/2-series-bin-expansion.html" target="_blank" rel="noopener noreferrer">Mastercard will be rolling out new payment cards</a> that begin with the number “2” (typically, they start with “5”). 
This will create a new Bank Identification Number (BIN) range of 222100 – 272099 that merchants will need to accept. A BIN makes up the first six digits of a card number, and is used to identify the card brand (Visa, Mastercard, etc.) and card type (credit, debit, or gift card).
Mastercard will begin conducting field tests in June 2017 to verify that merchants are able to accept the new 2-series cards. Merchants who are found to be out of compliance could be fined up to $25,000 per month until they are able to accept these cards.
We’ve Got You Covered 
But never fear! Merchants are Shift4’s priority, so we take changes like this seriously. Not only have we already made the necessary updates to have you ready to accept these new cards, but we’ve actually had you ready for almost a year!
We’ve seen several conflicting deadlines from Mastercard about when merchants actually need to be ready to support cards within the new BIN range, including October 2016, January 2017, and July 2017. We aimed for (and beat) the earliest deadline so that there is no confusion about whether or not you can accept the new cards.
What You Should Do Next 
Even though we’ve made the proper updates, we still encourage you to check with your point of sale (POS) or property management system (PMS) provider as soon as you can to ensure that your POS/PMS software does not have any BIN restrictions. And, in the rare case that you have an internal software tool that reads BIN data before it is passed to Shift4 – such as loyalty programs – you should promptly confirm that your system is up to date and prepared to accommodate the new BIN range.
If you have any questions, please contact our 24/7/365 Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Ready%20for%20Card%20Numbers%20Starting%20With%202%3F">support@shift4.com</a>.

Ready for Card Numbers Starting With 2?

As you already know, Shift4 is committed to securing your business, your brand, and your customers’ card data. As part of our mission to help you stay secure and PCI complaint, we’ll be sunsetting support for six payment devices effective January, 1, 2017:
<ul style="margin-left: 165px;">
<li>Ingenico 3070</li>
<li>Ingenico 6550</li>
<li>Ingenico 6780</li>
<li>Verifone 1000</li>
<li>Verifone MX 850</li>
<li>Verifone MX 870</li>
</ul>
These devices are no longer PCI PTS validated, which means that PCI discourages their use and that some card brands won’t consider their use PCI compliant.
What Devices Should I Get? 
If you’re replacing devices, it’s a good time to consider purchasing an EMV-capable device that supports Shift4’s True P2PE™. Be sure to read our <a href="http://blog.shift4.com/2016/08/emv-devices-which-ones-shift4-supports.html">EMV devices article</a> to find out more about these secure, feature-rich terminals, and learn where and how you can order them.
If you have any questions, please contact our 24/7/365 Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight Inquiry: You May Need to Replace Your Payment Devices">support@shift4.com</a> or call 702.597.2480 (option 2).

You May Need to Replace Your Payment Devices

Many of you have been looking into purchasing new payment devices to accept EMV chip cards. Shift4 has carefully selected a variety of secure EMV devices. And, with nearly a dozen different device options currently offered, you can customize your EMV setup to fit your specific business.
New! Direct Link to Our EMV Device List 
To make it easier for you to see which EMV-capable devices we support, we’ve <a href="https://www.shift4.com/dotn/integration/third-party-devices.cfm?EMV" target="_blank" rel="noopener noreferrer">created a direct link to an up-to-date list</a>. To the right of the model name, you’ll find a PDF brochure with a picture of the device, details about its unique features, and information about how to order. We hope you find this handy!
All of these devices work with our True P2PE™ (point-to-point encryption) and TrueTokenization® solutions to ensure that you never store, process, or transmit sensitive cardholder data. And yes, they are PCI PTS-validated and SRED-compliant, too – so when you use them, you can feel confident you’re using the most comprehensive security available.
If you have any questions about the process or are unsure how to order devices, we’re always here to help! You can contact our 24/7/365 Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight Inquiry: EMV Devices: Which Ones Shift4 Supports and How to Get Them">support@shift4.com</a> or 702.597.2480 (option 2).
Don’t Forget – VT4 Supports EMV, Too! 
Adding a new mobile profit center can enhance your customers’ experience – and increase your revenue! Our VT4® mobile payment solution turns any internet-connected device into a P2PE-secured point of sale that can be used in tandem with the traditional payment devices you’re already using. And, VT4 supports all of the most popular payment methods, including EMV, NFC/contactless, and whatever comes next. Want to learn more? <a href="https://www.shift4.com/dotn/VT4" target="_blank" rel="noopener noreferrer">Check it out.</a>

EMV Devices: Which Ones Shift4 Supports and How to Get Them

By Stephen Ames, CISA, CISSP – Senior Director, Security Compliance, Shift4 Corporation
As you already know, we at Shift4 are fanatics about having the strongest security possible which is why we build security into everything we do from the ground up. More than a year ago, we <a href="http://blog.shift4.com/2015/03/shift4-doesnt-use-ssl-and-you-shouldnt.html" target="_blank" rel="noopener noreferrer">eradicated SSL and early TLS from anywhere it remained in our environment</a>; however, we’ve still been supporting these protocols for a small number of merchants.Our goal is to turn off support for SSLv3 and early versions of TLS as soon as possible, but no later than March 31, 2017. This means that if you are using SSLv3 or TLS version 1.1 or older, you need to update your setup. Here’s why – and how.
Are You Still Using SSLv3, Early TLS? 
When the PCI Data Security Standard (DSS) version 3.1 was released back in April 2015, the PCI SSC decreed that SSLv3 and early versions of TLS are no longer considered strong encryption for the transport of cardholder data over public networks or for non-console administrative access to your cardholder data environment (CDE). This means that if you’re still using SSLv3 and early versions of TLS as of June 30, 2016, your CDE may be non-compliant with PCI DSS – not to mention the fact that your payment security operations will be at risk.
The PCI SSC revised their standing on these protocols in April 2016 when they released PCI DSS version 3.2, which offered the following conditions for continued use of SSL and early TLS:
<ul style="margin-bottom: 15px; margin-top: 15px;" type="disc">
<li>You may continue using SSLv3 and early versions of TLS until June 30, 2018, but you must maintain a formal Risk Mitigation and Migration Plan.</li>
<li>You may continue using SSLv3 and early versions of TLS for your card-present point-of-sale terminals beyond June 30, 2018, if it can be verified they are not susceptible to any known exploits for SSLv3 and early versions of TLS. You must also maintain a formal Risk Mitigation and Migration Plan.</li>
<li>Any new installations in your CDE may never use SSLv3 or early versions of TLS.</li>
</ul>
What Are SSLv3 and Early TLS? 
SSL, or Secure Sockets Layer, refers to a type of encryption that was once used to secure communications between a user’s web browser and a website in order to protect transmitted data from eavesdropping or tampering. Early TLS, or Transport Layer Security, refers to versions 1.0 and 1.1, themselves 17- and 10-year-old protocols, respectively – ancient by IT terms. They’re also deemed insecure by the PCI SSC and the <a href="http://www.nist.gov/information-technology-portal.cfm" target="_blank" rel="noopener noreferrer">National Institute of Standards and Technology</a>. Indeed, some scary TLS exploits can be found at the <a href="https://cve.mitre.org/find/index.html" target="_blank" rel="noopener noreferrer">Common Vulnerabilities and Exposures</a> website.
Most DOLLARS ON THE NET Users Don’t Need to Worry 
Fortunately, most cardholder data destined for our DOLLARS ON THE NET® payment gateway is transported by the Universal Transaction Gateway® (UTG®), which uses PCI-defined strong cryptography to encrypt data at the packet level and is required for all of our e-commerce, point-of-sale, and property management system integrations. The UTG also uses Derived Unique Key Per Transaction with Moving Target Encryption (DUKPT w/MTE) – our proprietary encryption methodology that delivers the fastest and most secure payment processing in the industry – to transfer data over private, high-speed leased lines. (You can read all about it <a href="https://www.shift4.com/pdf/Shift4-UTG.pdf" target="_blank" rel="noopener noreferrer">here</a>.)
This means that there are only two areas of concern with SSLv3 and early versions of TLS that remain at Shift4: older browser connections and server-to-server connections to DOLLARS ON THE NET and i4Go®.
<ul style="margin-bottom: 15px; margin-top: 15px;" type="disc">
<li>Browser Connections: Chances are you are already using a modern browser that supports TLS v1.2. All major browsers (Chrome, Firefox, Internet Explorer, Opera, and Safari) now support TLS v1.2 by default. If this is the case, that’s great. Just be sure that you’re running the most current version of your browser and keep it updated with the latest patches. If not, you can <a href="https://www.shift4.com/browsers.cfm" target="_blank" rel="noopener noreferrer">update your browser using the links available on our website</a>.</li>
<li>Server-to-Server Connections: If you have a server-to-server interface to DOLLARS ON THE NET and/or i4Go, you should check to make sure that the negotiated HTTPS sessions are using the PCI-approved version of TLS v1.2, which is defined in <a href="https://www.ietf.org/rfc/rfc5246.txt" target="_blank" rel="noopener noreferrer">RFC 5246</a>. If the HTTPS sessions are not using TLS v1.2, you will be required to maintain a Risk Mitigation and Migration Plan for the PCI DSS until you migrate to TLS v1.2. (See <a href="https://www.pcisecuritystandards.org/document_library?category=pcidss&amp;document=pci_dss" target="_blank" rel="noopener noreferrer">PCI DSS v3.2</a>, Requirement 4.1 and Appendix A2.) You should also contact Shift4 Customer Support for guidance.</li>
</ul>
To help make sense of all this, the PCI SSC released <a href="https://www.pcisecuritystandards.org/documents/Migrating-from-SSL-Early-TLS-Info-Supp-v1_1.pdf" target="_blank" rel="noopener noreferrer">Migrating from SSL and Early TLS</a> in April 2016.
If you are still running SSLv3 or early versions of TLS, you should contact Shift4 Customer Support at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Warning%20for%20SSLv3%20and%20Some%20TLS%20Users">support@shift4.com</a>, for guidance. And, of course, if you’re not already, you should consider using True P2PE™ with EMV to encrypt all transactions at the point of swipe or insertion to ensure that your payments are as secure as they can be.

Executive Insight: Warning for SSLv3 and Some TLS Users

You probably take your smartphone with you wherever you go, so it should come as no surprise that mobile payments usage has been steadily increasing. But, with all of the different mobile technologies out there, we know that it can sometimes be confusing and overwhelming. 
Here’s a closer look at some of the mobile payments technologies we support – including how they work and how you can secure them.
<ul style="clear: both;">
<li style="margin-bottom: 15px;">Mobile Wallets – Mobile wallets are essentially the digital version of your old, leather, pocket-filling billfold. Mobile wallets typically involve one or more cards that a consumer has entered into a single application on their mobile device, allowing payments to be made using one of the methods below. The biggest examples of these are Apple Pay®, Android Pay®, and Samsung Pay®. Years ago, when <a href="http://blog.shift4.com/2012/10/the-buzz-about-mobile.html" target="_blank" rel="noopener noreferrer">we discussed how there are two types of mobile payments</a>, we predicted that the popularity of mobile wallet applications would grow, and this has definitely rung true. According to Statista, as of October of last year, nearly half of U.S. consumers (41%) had heard about making a purchase via mobile and 32% of consumers had actually made a mobile payment.</li>
<li style="margin-bottom: 15px;">NFC – Short for near-field communication, NFC is a way to transfer payment information without requiring a physical swipe or insertion. This is similar to the key fob technology that you may use to get into your car without putting the key into the door. Most mobile wallets use NFC technology to transmit payment information. Coin, a mobile payment device that – scarily from a security perspective – combines your credit, debit, and gift cards into a single instrument, also uses NFC to process payments. If you want to accept NFC payments so that your customers can put their mobile wallets to use, simply select a payment device that supports the “Contactless/NFC” feature on our <a href="https://www.shift4.com/dotn/integration/third-party-devices.cfm" target="_blank" rel="noopener noreferrer">third-party devices</a> page and double-check with your point-of-sale (POS) provider whether your software needs to be updated to support it.</li>
<li style="margin-bottom: 15px;">Magnetic Secure Transmission (MST) – MST is also known as Magnetic Loop to pay homage to the company that invented the technology, LoopPay (since acquired by Samsung). MST emits a magnetic signal when a consumer is physically present at a POS. Like NFC, it is a contactless technology, but because it uses a magnetic signal, it works at locations that have an MSR swipe and don’t support NFC. This technology should be accepted at nearly all terminals with a card reader, but some payment terminals may require software updates to support it. The only mobile wallet using MST is Samsung Pay, which can also use NFC.</li>
<li style="margin-bottom: 15px;">Contactless – Simply put, a contactless payment is when a mobile technology requires a consumer to be physically present at a POS, but doesn’t require an instrument, such as a card or device, to physically touch or be inserted in to a POS. NFC and MST are technologies that allow for contactless payments. However, the word “contactless” has also been used by banks and card issuers to refer to EMV cards that are contactless. At this time, contactless EMV is rare in the United States, largely because the cards cost issuers twice as much as regular EMV cards to produce.</li>
<li style="margin-bottom: 15px;">Tap-to-Pay – Tap-to-pay is just a fancy way of saying contactless – no actual tapping required. (We suppose “wave-around-until-you-hear-a-beep-to-pay” didn’t sound as catchy.)</li>
<li style="margin-bottom: 15px;">Secure Element – Secure element is a type of mobile-device-based security, used by both Apple Pay and Samsung Pay, which stores fingerprint data and a “token” within a chip on the smartphone. This secure element is separated from the phone’s software, so the idea is that if someone hacks into your phone’s operating system, there isn’t a way to extract the financial information, and this element shuts down if it is tampered with.</li>
<li style="margin-bottom: 15px;">Host Card Emulation (HCE) – HCE is another type of mobile-device-based security that stores payment card information in the cloud, allowing consumers to use “tokenized” credentials directly from the phone for payment. This technology, which is used by Android Pay and also supported by Samsung Pay, stores the payment application in the device’s software while the data is hosted in the cloud, bypassing the device’s secure element.</li>
<li style="margin-bottom: 15px;">Mobile Point of Sale (mPOS) – Unlike the previous technologies, which are all about consumers making payments, an mPOS gives merchants the ability to accept payments in new ways and new locations. An mPOS solution gives merchants the ability to open up new revenue centers whenever and wherever their business needs dictate. And, with our mPOS solution, VT4®, you don’t need to purchase specialized mobile devices to get an mPOS out on the floor – VT4 turns any internet-connected device into a secure point of sale. Find out more at <a href="http://vt4.com/" target="_blank" rel="noopener noreferrer">vt4.com</a>.</li>
</ul>
Related – But Significantly Different – Security Technologies 
While consumer-facing mobile payments are handy for your customers to use and are becoming increasingly important for you to support, they may also introduce vulnerabilities and increase your card data environment (and therefore PCI scope). That’s why the topic of these consumer-facing mobile technologies, which are largely provided by companies having their first foray into payments, can’t be discussed without underscoring the importance of EMV, point-to-point encryption (P2PE), and tokenization.
This trifecta of payment security technologies protects you, the merchant, against instances of credit card fraud while also encrypting data at the point a card or mobile wallet interacts with the payment terminal, so card data never enters your environment. As long as you don’t hold the encryption keys on site, you can completely remove the burden of storing, processing, and transmitting sensitive card data thanks to our True P2PE™ and TrueTokenization® solutions together with EMV.
To find out how you can get EMV and use Shift4’s True P2PE to secure all of the latest payments technologies, contact our Customer Support team at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Making%20Sense%20of%20Mobile%20Payments">support@shift4.com</a>.

Making Sense of Mobile Payments

Shift4 is proud to offer EMV with more device and processor combinations than any other gateway provider. More than 70 of our valued point-of-sale and property management system partners who have integrated their systems with our DOLLARS ON THE NET® payment gateway have now made the tweaks necessary to certify those solutions for EMV. 
Check out the impressive list below. If you’re a Shift4 merchant customer and your solution provider is listed, you are on the fast-track to EMV acceptance. If you’re not, then what are you waiting for? Contact us today to get EMV and the most powerful and secure payment gateway available.
If your solution provider is not yet on the list and can’t provide you with EMV capability, have them contact us and we’ll skip them to the front of the line for certification.
Hospitality and Spa:
<ul>
<li style="list-style-type: none;">
<ul>
<li>Abacus POS</li>
<li>ASSD®</li>
<li>AutoClerk®</li>
<li>AVPM®</li>
<li>Book4Time</li>
<li>Cenium</li>
<li>Computerized Valet Parking Systems (CVPS)</li>
<li>Easyrent</li>
<li>Execu/Tech Systems, Inc.</li>
<li>Exnelo</li>
<li>GuestTracker</li>
<li>INNfinity®</li>
<li>iTesso</li>
<li>It Just Works Software (IJWS)</li>
<li>Maestro PMS</li>
<li>Optima</li>
<li>myHMS</li>
<li>OneTechSolutions</li>
<li>RCC</li>
<li>Resort Data Processing</li>
<li>ResortSuite</li>
<li>RoomKeyPMS</li>
<li>roomMaster</li>
<li>Sabre Hospitality Solutions</li>
<li>SkyTouch Hotel OS®</li>
<li>Skyware® PMS</li>
<li>SkyWire® POS</li>
<li>Springer-Miller Systems</li>
<li>TAC Reservation Assistant</li>
<li>TimeShareWare SecurePay</li>
<li>WebRezPro</li>
</ul>
</li>
</ul>
Retail:
<ul>
<li style="list-style-type: none;">
<ul>
<li>accesso Passport® mPOS</li>
<li>Club Automation</li>
<li>Command Retail</li>
<li>Epicor BisTrack™</li>
<li>Innsoft Fusion</li>
<li>JDA Software</li>
<li>Mi9 Retail</li>
<li>Mi9 Retail Raymark</li>
<li>Microsoft Dynamics AX</li>
<li>Microsoft Dynamics RMS</li>
<li>Mini Storage Executive</li>
<li>Multidev Technologies, Inc.</li>
<li>Nebraska Book Company</li>
<li>NetSuite® POS</li>
<li>OmniTicket Network</li>
<li>Planet Bingo, Inc.</li>
<li>Retail Realm Distribution, Inc.</li>
<li>Retail Pro®</li>
<li>RICS POS</li>
<li>Starmount Customer Engagement Suite™</li>
<li>STORIS, Inc.</li>
<li>TallySales®</li>
<li>The Assistant Manager® (TAM)</li>
<li>VideoKing</li>
<li>VISION BeanStore</li>
</ul>
</li>
</ul>
Food and Beverage:
<ul>
<li style="list-style-type: none;">
<ul>
<li>Dinerware®</li>
<li>SilverWare POS</li>
<li>SMS|Touch POS</li>
<li>Squirrel Systems</li>
</ul>
</li>
</ul>
Golf:
<ul>
<li style="list-style-type: none;">
<ul>
<li>Club Prophet Systems</li>
<li>Clubessential</li>
<li>Jonas Club Management</li>
<li>Northstar Club Management Software</li>
<li>Total e Integrated, Inc.</li>
</ul>
</li>
</ul>
ISVs that are tired of waiting in line for EMV should email <a href="mailto:info@shift4.com?subject=Inquiry:%20Shift4%20Announces%20EMV%20Expertise">info@shift4.com</a> or call 800.265.5795 to find out how they can certify with Shift4 quickly and take advantage of our seven existing EMV processor certifications.
Merchants, want to learn more about Shift4&#8217;s EMV solution? Visit <a href="https://www.shift4.com/emv">shift4.com/EMV</a> today!

Shift4 Offers Fast-Track to EMV Acceptance

Most merchants are familiar with partial authorizations on gift card transactions. A customer eats dinner at your restaurant, pays their bill with a gift card, and then $25 is taken off their bill and your point of sale (POS) asks for another form of payment to take care of the remaining balance.But did you know that some banks and processors allow for partial authorizations on other types of cards, too? In fact, some of you may have already noticed that your POS has authorized a partial amount on a credit, debit, or prepaid card transaction. 
Why Accept Partial Authorizations? 
When a customer doesn’t have enough funds to pay, it can cause problems for merchants – anything from a customer getting embarrassed to a lost sale. Partial authorizations help solve these problems by allowing a customer to use more than one form of payment to settle a bill. 
How It Works 
Card issuers can approve a partial payment if a cardholder doesn’t have enough funds in their account to pay for the entire transaction. If your processor, merchant services provider (MSP), and POS system provider support partial authorizations, you will receive an authorized payment for an amount less than the total, and then a remaining balance will display on your POS screen. Another form of payment will then need to be provided to complete the transaction. 
For example, if a customer is purchasing a $100 hat, but they only have $60 left until they hit their credit limit, their card issuer can authorize a $60 payment and then your POS will display that $40 remains on the bill. This still allows the customer to buy the hat, but they’ll need to pay for the remaining balance with another credit card, a debit card, cash, or check. 
Who We Support 
Shift4 supports partial authorizations for the following card types with these processors: 
Credit, Debit, and Prepaid Cards:
<ul style="margin-top: 0;">
<li>American Express: United States/International</li>
<li>Chase Paymentech: Tampa</li>
<li>Elavon: USA</li>
<li>Fifth Third Bank/Vantiv</li>
<li>First Data Merchant Services: FDMS Nashville/6000</li>
<li>First Data Merchant Services: ValueLink (Standard)</li>
<li>First Data Rapid Connect</li>
<li>Heartland Payment Systems</li>
<li>TSYS</li>
</ul>
Only FSA/HSA/IIAS Cards:
<ul style="margin-top: 0;">
<li>First Data Merchant Services: FDMS North</li>
</ul>
If you use any of the above processors, then there is a chance you may already be receiving them. If you aren’t getting partial authorizations and you use one of the processors named above, then you may need to contact your MSP and/or POS to enable your system to accept them. 
As always, you can also reach out to our Customer Support team for help at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Partial%20Authorizations%20Explained">support@shift4.com</a>.

Partial Authorizations Explained

Shift4 supports the latest and greatest payments technologies to optimize your payment processing efficiency and security. As such, we listen to your feedback and update our <a href="https://www.shift4.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway® (UTG®)</a> on a regular basis. 
While some of these changes are minor tweaks and behind-the-scenes improvements, others may have a larger impact on your business, so we’re highlighting the most notable changes from our recent update.
UTG 2282 was made available on May 25, 2016. If you have not already made this update, please do so at your convenience. When you do, you will have access to all of our most recent features and additions.
If you use Ingenico RBA devices, then there are also some specific changes that you should be aware of:
<ul>
<li>EMV Transactions – We have made some general enhancements to how Ingenico RBA devices handle EMV transactions, including changes to EMV debit handling that will make the end-user experience less confusing. This change will, however, require cardholders to enter their PIN number when presenting a debit card that is EMV capable on a terminal that supports PIN. This is more secure, helps minimize the merchant’s liability for card fraud, and will likely benefit merchants on interchange fees as well.</li>
<li>More BIN Range Override Options – In a previous update, we allowed merchants to bypass CVV and expiration date prompting as well as Luhn Mod 10 validation for specific BIN ranges. Now, if you’re using Ingenico RBA devices, you can also override the street number and postal code. This means that if you need to manually enter card information, you can require these verification methods for credit cards, but bypass them for gift cards. If you want to configure your BIN override settings, you can do so under the Devices tab in UTG TuneUp.</li>
</ul>
If you need assistance updating the UTG, or if you have any other questions, call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Recent%20UTG%20Updates">support@shift4.com</a>. We’re always happy to help!

Recent UTG Updates

Shift4 provides the latest and greatest payments technologies to keep your business thriving and your customers happy. We listen to your feedback and regularly update our <a href="https://www.shift4.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway® (UTG®)</a>, keeping your payment security, efficiency, and business operations in mind with each new UTG build. While some of these updates are minor tweaks and behind-the-scenes improvements, others may have a larger impact on your business, so we&#8217;d like to highlight the most notable new UTG features.
Our most recent UTG release, 2281, was made available on April 4, 2016. If you have not already performed the update, please do so at your convenience. When you do, you will have access to all of our most recent features and additions, including:
<ul>
<li style="list-style-type: none;">
<ul>
<li>New Prompt Feature – If a customer is in-store, but you don&#8217;t have the item they want in stock, you can enable a new prompt to initiate a purchase through your online store. Customers can input information, such as their street address, ZIP code, or card expiration date, so your online store or warehouse can process a card-not-present transaction. Shift4 creates a temporary token for this information until the order is fulfilled and the transaction is complete. (Please note that your point-of-sale system may require additional coding and certification to begin using this feature.)</li>
</ul>
</li>
</ul>
<ul>
<li>Signature Capture Enhancement – Since a signature is not required with EMV &#8220;No-CVM-Required&#8221; transactions, we&#8217;ve updated the UTG so that it no longer prompts the cardholder for their signature in these cases, improving EMV device functionality and saving time at the checkout counter.</li>
</ul>
If you need assistance updating the UTG, or if you have any other questions, call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:marketing@shift4.com?subject=4Sight Inquiry%3A What's New With the UTG?">support@shift4.com</a>. We&#8217;re always happy to help!

What’s New With the UTG®?

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
EMV.
If you are in the payments industry, you probably cannot remember the last time you went a full day without hearing this word. I certainly can&#8217;t. 
And, if you are anything like me, EMV has likely given you more than your fair share of headaches and maybe even a few sleepless nights.
For years, EMV in the U.S. was discussed in the future tense. Merchants would talk about what things will be like when EMV is implemented. You would think that with all of the preparation, everyone would have been ready when it came, right? Not even close.
April marks six months since the liability shift, and I’d like to give my two cents on how U.S. EMV is going. I’ll give you a sneak peek – it’s not going to be pretty. As a whole, the implementation of EMV and its <a href="http://blog.shift4.com/2016/04/chargebacks-fraud-or-fiction.html" target="_blank" rel="noopener noreferrer">liability shift</a> was a disaster, and the payments industry is still trying to get to where it purportedly should have been last year.
So, kick off your shoes and let me tell you a story – the story of EMV.
Chapter 1: A Brief History of EMV 
Our story begins in 1995. The movies Braveheart and Casino were all the rage, AOL and beepers were considered cutting-edge technology, and the first version of EMV had just been released by EMVCo, an organization made up of and regulated by the world’s leading card brands. You see, even though it is just making its way to the United States, EMV technology has been around for more than two decades and has already become commonplace around the world, including most of Europe – the &#8220;E&#8221; in EMV does stand for Europay, after all. In fact, EMVCo claims that 33% of global transactions last year were processed using EMV cards.
So why is the U.S. so late to the game? The U.S. market is extremely complex for several reasons. First, the sheer size of the market and the number of individuals and groups involved made EMV an enormous undertaking. Most nations have a handful of government-backed banks that govern payments; in the U.S., there are hundreds. Also, many merchants outside the U.S. use independent, standalone payment terminals, while most U.S. merchants have more complex, integrated payment systems. Finally, EMV is much more than a simple new feature; it is a complete paradigm shift for the industry. The rules for payment processing changed, and EMV certification requires a great deal of coding and system restructuring.
In the U.S., sights were set on the liability shift date of October 1, 2015. The card brands expected – or at least hoped – that all U.S. merchants would be EMV-ready by this date. It was a slow start, given the fact that roughly 8% of U.S. merchants were actually accepting EMV cards on day one. This number has since grown, but the majority – especially small to medium-sized businesses – were left behind.
Chapter 2: The Empty EMV Promise 
EMV was touted as a new technology that was going to propel the U.S. into the next generation of secure payments. It came during “the year of the data breach” and was billed as the panacea to prevent another Target- or Home-Depot-level breach. Unfortunately, this is not what EMV was designed to do. EMV covers only one area of payments – card-present fraud. EMV does nothing in terms of actually securing payment data. The main function of the EMV chip is to authenticate credit and debit cards in order to prevent the use of lost, stolen, or counterfeit cards.
A potential side effect of EMV is that, while it reduces card-present fraud, we may see a rise in card fraud and data breaches in card-not-present environments where EMV cannot be used. Hackers are a very adaptable bunch. If you lock a door, they will try to climb through a window. To stay protected, merchants need to be one step ahead of the bad guys. It’ll be interesting to see if fraud in e-commerce businesses increases in the U.S. because of EMV, as it has in other markets where EMV has been adopted.
It is easy to pick on EMV because it is new, but I think it has potential to be a valuable addition to the payment space once it gets past its growing pains. Time will tell, but as it stands six months later, EMV has yet to make the impact on the industry that many thought it would.
Chapter 3: The Many Ways U.S. EMV Went Wrong 
Now to the big one. The promises that EMV still hasn’t delivered.
The biggest folly in the EMV rollout is how difficult it has been for most merchants to adopt it. The certification process alone takes months. Large big-box retailers with virtually unlimited influence and resources had little problem getting set up by October 1, while everyone else has been left with a huge uphill battle.
To add to the confusion, several processors have jumped the gun by adding new requirements to their EMV certifications midstream. For example, Visa suggested a policy – after the October liability shift date, mind you – that merchants who want to process EMV should also be equipped to accept NFC (near-field-communication) by 2018. The processors heard this and took it as “do it now!” This meant that ISVs, device manufacturers, and service providers who were in the middle of their EMV certifications had to go back to the development process to incorporate more than a dozen additional use cases supporting contactless forms of payment in their coding before they could complete their certification. This knee-jerk reaction by the processors is further delaying merchant adoption of EMV today for the sake of supporting contactless EMV which, by Visa’s own admission, is still years away.
I’m seeing another concerning trend in the industry. As merchants scramble to find an EMV solution as soon as possible, their acquirers take advantage of the situation by pushing them into installing standalone terminals. While these standalone solutions may work as a “quick fix” for merchants, they provide a long list of significant disadvantages, including added costs, more work, and a higher risk of a data breach. As we’ve advised merchants before – <a href="http://blog.shift4.com/2015/06/executive-insight-take-time-to-do-emv.html" target="_blank" rel="noopener noreferrer">take the time to do EMV right.</a>
The marketed purpose of EMV promised to make things easier and safer. Merchants would get hit with less fraud and fewer chargebacks, and consumers could have one more security barrier between them and the hackers that want their card numbers. Why, then, are payments providers having such a difficult time getting through the certification process? The complexity of the U.S. payments market combined with the short and unrealistic lead time that the industry was given to prepare has led to significant and costly confusion.
As of right now, it seems like EMV has caused the industry more problems than it has solved. In the words of Obi Wan, “You were the chosen one. You were supposed to bring balance to the Force, not leave it in darkness.”
Chapter 4: The Lessons We Learned 
Now that the dust is settling after the liability shift date, let’s take a look at what we can learn from it. The bottom line is that EMV is not the security cure-all that it was marketed to be. Most merchants have shiny new terminals, but are they really more secure than they were before EMV? The sad truth is – no. At least not if they haven’t taken the additional steps necessary to ensure that their environments have a comprehensive security solution in addition to EMV’s added authentication capabilities.
The best approach to EMV is to think of it as one piece in your payment security “suit of armor.” You can have the best helmet around, but it does you very little good when someone is attacking your legs. Merchants should layer additional solutions on top of each other to protect as many entry points as possible. Modern payment processing environments are becoming more complex and unique, and there simply isn’t one magical solution that will cover every access point you have.
Merchants who rely solely on EMV leave their environments so vulnerable that it is a near certainty that they will be breached at one point or another. Like I said, EMV protects against card-present fraud; it doesn’t do anything related to card data security in your systems or network. In fact, some EMV terminals actually push card data in cleartext on the back end – so much for security! For this reason, we strongly urge our merchant customers to use EMV with point-to-point encryption (P2PE) and tokenization solutions. We call this the payment security trifecta.
<ol>
<li style="list-style-type: none;">
<ol>
<li>Tokenization is a technology that Shift4 knows a thing or two about, given the fact that we invented it in 2005. Our <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> solution replaces cardholder data (CHD) with a random, alphanumeric value, or TrueToken®. This token does not have a one-to-one or mathematical correlation with the card number, and therefore cannot be unencrypted and used for future fraudulent transactions in the case of a data breach.</li>
</ol>
</li>
</ol>
<ol>
<li style="list-style-type: none;">
<ol>
<li>P2PE is a vital layer of security for any card-present payment processing environment, including mobile points of sale. Shift4’s <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> encrypts CHD at its first point of interaction with the payment terminal. By doing this, the actual card data never enters or travels through the merchant’s payment system.</li>
</ol>
</li>
</ol>
<ol>
<li><a href="https://www.shift4.com/insight/EMV/" target="_blank" rel="noopener noreferrer">EMV</a> helps to prevent instances of card-present fraud by using a microchip to authenticate the card or cardholder.</li>
</ol>
With these three technologies working together, merchants are able to protect their card data from every direction. Merchants have so much to lose from a data breach – time, money, customer trust in their brand. Why would they not do everything they can to protect themselves? The more solutions a merchant can employ, the better equipped they will be against the bad guys.
EMV Epilogue 
I recently went to a sandwich shop that had an EMV terminal. There was a piece of paper sticking out of the EMV slot that read “Sorry. Not Yet.” This should not be happening in April. Six months is more than enough time to implement a piece of technology that we’ve been talking about for years. How was this mishandled so badly?
From my perspective, the card brands are trying to do too much too soon with EMV. The priority should have been to first get it out in the wild, and then fill in the cracks with new features and updates. Instead, merchants were left in the dust while their service providers jump through hoop after hoop trying to certify. Meanwhile, millions of EMV terminals go unused. This is not a case of trying to walk before we can run; we’re trying to fly a jet before we’re potty trained.
EMV has promise – when it’s part of a complete solution. Shift4 can help you implement the full trifecta and we can do it today. We currently support EMV with five processors and more are expected in the coming weeks and months. Call us and let us get you on the path to EMV AND true security.

Executive Insight: EMV – 6 Months Later

<div>
If you sign in to your Lighthouse Transaction Manager account using the word “Admin” or “Administrator,” then you’re the king of the mountain, queen of the castle, ruler of the roost – or at the very least, a financially responsible individual at your business. Each Lighthouse Transaction Manager account allows only one Admin user, and that account is assigned during your account setup process with Shift4. This user has special roles, including the ability to create additional administrator-type users to support the person in charge. We want to share some friendly reminders about how you can get the most out of your Admin account.
</div>
<div>
<ol>
<li style="list-style-type: none;">
<ol>
<li>Don’t share it. 
The Admin user is the only user that has access to many of the settings in your account that can have a financial impact on your business. This is one of the key reasons why we urge our customers not to identify an IT or MIS individual as the Admin. To name just a few of the Admin user’s functions, it’s the only user that can make global changes to your Lighthouse Transaction Manager account, set up Fraud Sentry notifications, and select PCI-compliant security settings. It’s also the only account that can create and manage the permissions for Administrator and Standard users or activate IP address restrictions (and allow certain users to bypass them). The Admin user has the ability to configure additional settings depending on your account’s setup, such as whether you use EMV devices, <a href="https://www.shift4.com/dotn/iyc/" target="_blank" rel="noopener noreferrer">IT’S YOUR CARD</a>, 4Go, and more. Let’s just say, it’s a very important account – so you don’t want it to fall into the wrong hands. Keep your password complex and never share it. In fact, we recommend that whenever you update your password, you write the new password down and put it into a locked safe!</li>
</ol>
</li>
</ol>
<ol>
<li style="list-style-type: none;">
<ol>
<li>Don’t audit with it. 
The purpose of the Admin user account is essentially to be the “man behind the curtain.” It’s solely for account setup, maintenance, and creating Administrator user accounts, so you should never use it to access Lighthouse Transaction Manager’s auditing features. If you’re really hands-on or a small-business owner that needs to perform some auditing functions, make sure you have a separate administrator-type account designated for that purpose. If you haven’t already set up a second user account for yourself and selected “Administrator” as the user type, then don’t hesitate to reach out to us for help.</li>
</ol>
</li>
</ol>
<ol>
<li style="list-style-type: none;">
<ol>
<li>Make good use of Administrator and Standard user types. 
Administrator and Standard user types are the ones most commonly used in Lighthouse Transaction Manager. These user types help you carry out the functions that you won’t be doing through your Admin account.
<ul style="list-style-type: disc;">
<li>Administrator users are for those in your organization that you truly trust – your right-hand man or woman. You might have more than one, depending on your business size. Administrators can create and edit user types and configure user settings, such as which merchant the user can access and whether they can add or modify refunds, (they can’t create or edit other administrator-level users). If one of your night auditors locks herself out of her account, an Administrator can restore her access. This can be really helpful to avoid getting woken up in the middle of the night or interrupted on vacation to unlock a user’s account. Administrators can also access auditing functions if you give them those abilities.</li>
<li>Standard users are for general auditing functions only. You can select and modify their permissions based on their auditing functions, including whether or not they can add sales, process refunds, submit batches, and more.</li>
</ul>
Remember: It’s very important that every person that logs in to your Lighthouse Transaction Manager account has their own username. This makes your account much more secure and helps you whittle down each user’s permissions according to their actual responsibilities. It also creates a digital “paper trail” in the event of worst-case scenarios that may require them.</li>
</ol>
</li>
</ol>
<ol>
<li style="list-style-type: none;">
<ol>
<li>Apply Fraud Sentry settings. 
Using Fraud Sentry is a great way to stop fraud before it happens by flagging possible duplicate transactions, unverified refunds, and a variety of suspicious fraudulent card uses by both customers and even your trusted employees. Best of all, these settings are configurable to meet your specific business needs – and naturally, that’s done through your Admin account. Sharing this ability could <a href="http://blog.shift4.com/2015/01/dont-lose-1-million-activate-fraud.html" target="_blank" rel="noopener noreferrer">expose you to serious risk</a>. If you aren’t using Fraud Sentry, then you should be. It’s a free way to help ensure that these types of fraudulent behaviors aren’t overlooked.</li>
</ol>
</li>
</ol>
<ol>
<li>Check and confirm your settings periodically. 
Since the Admin account is used for very specific purposes, it may be easy to forget about because you probably don’t use it often. But it’s important to <a href="http://blog.shift4.com/2014/04/spring-clean-your-dollars-on-the-net-account.html" target="_blank" rel="noopener noreferrer">visit your Admin account every once in a while</a> not just to make sure you don’t forget your password, but also to be certain that your user settings are up to date and that your general settings are exactly the way that you want them to be.</li>
</ol>
</div>
<div>
Want More Information? 
Sign in to your account and select Lighthouse Transaction Manager Help from the Help menu to access Account Management guides and Account Administrator tutorials.
If you have any questions, you can reach out to our Customer Support team 24/7/365 at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight Inquiry%3A 5 Musts For Dollars On The Net Admin Users">support@shift4.com</a>.
</div>

5 Musts for Lighthouse Transaction Manager Admin Users

There is no silver bullet when it comes to payment data security, which is why Shift4 layers numerous security tools to protect our merchant customers in both card-present and card-not-present scenarios, as well as call centers and other specialized environments. Payment security is a constantly moving target and must be monitored and updated frequently to combat new and evolving threats. Shift4 recommends a layered security approach that protects more entry points and reduces the risk of experiencing a data breach.
Therefore, we strongly advise that you review the Shift4 security solutions you are currently using and consider adding additional layers of security to protect your customers’ data and your brand.
<ul>
<li><a style="color: #6e298d;" href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go</a>® is a software application that provides a layer of security in card-present environments</li>
<li><a style="color: #6e298d;" href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization</a>® replaces cardholder data with a random, undecryptable alphanumeric value to be stored for returns, incremental authorizations, and more</li>
<li><a style="color: #6e298d;" href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE</a>™encrypts cardholder data as it enters the payment terminal so the actual card data never enters or travels through a merchant’s payment systems</li>
<li><a style="color: #6e298d;" href="https://www.shift4.com/insight/EMV/" target="_blank" rel="noopener noreferrer">EMV</a> uses a microchip to help prevent the use of counterfeit cards and other forms of card fraud</li>
</ul>
No single solution is adequate to address today’s advanced threats; you need them all working together. We understand that adding more solutions requires additional costs – such as the cost of buying new payment terminals – but keep in mind that it is a small price compared to the costs of a data breach, which include time, money, and damage to your brand.
If you need to make adjustments or additions to your payment environment to maximize protection, contact our 24/7/365 Customer Support team at 702.597.2480 (option 2) or <a style="color: #6e298d;" href="mailto:support@shift4.com?subject=Alert Inquiry: Use Layered Security Tools and Secure Practices to Minimize Risk">support@shift4.com</a>.

ALERT: Use Layered Security Tools and Secure Practices to Minimize Risk

I watched an interesting and entertaining Twitter dialogue unfold late last month between two payments industry experts. Ian Kar, who covers the payments industry for online news publication Quartz, was covering PayPal’s earnings call when he heard PayPal CEO Dan Schulman make a pretty bold claim:
<blockquote class="twitter-tweet" data-lang="en">
<div dir="ltr" lang="en">Schulman: Rest of payment industry is following us into tokenization</div>
— Ian Kar (@iankar_) <a href="https://twitter.com/iankar_/status/692478939575508992">January 27, 2016</a></blockquote>
Tokenization 101 
Shift4 introduced the term tokenization to the payments industry at the Transaction Security Summit in Las Vegas in 2005. When our executive team conceived of the technology the year before, we related it to an arcade token. Tokenization exchanges a credit or debit card number, which like a quarter has universal value, for a token that has value only within specific parameters and a specific location, much like an arcade token used to play games in a specific arcade. At that time, my altruistic and admittedly naïve younger self pushed for Shift4 to release tokenization to the industry without a patent. I saw the value it held in addressing the greatest risk to payment data in those days – securing post-authorization card data for long-term storage – and I knew how much the industry needed an answer to that persistent, rising threat. Adoption was rapid and far-reaching – to the point that tokenization can now be considered an industry standard.
Unfortunately, despite becoming an industry standard, tokenization had no standard to mandate how it was deployed or even how it was formed. EMVCo and PCI have both attempted to standardize tokenization over the past few years but neither has succeeded, in part because even they can’t agree what tokens should look like and how they should function.
Blurring Use of the Term &#8220;Tokenization&#8221; 
Just take a look at recent payments news in almost any publication, and you will see an ongoing conversation about what is being called &#8220;EMVCo tokenization,&#8221; mobile payment tokenization (à la Apple Pay), and card-based tokenization. I even saw one article recently that extolled the virtues of point-to-point encryption as a tokenization solution. It’s enough to make almost anyone’s head spin – especially those of us who know what tokenization really is and the specific problem that it solves.
This confusion within the payments industry about tokenization is dangerous because it means that merchants are at risk of being led astray from the very tokenization solutions they need to secure their business. The problem is that the word “tokenization” is being used far too broadly to describe a variety of payment security methods that perform different security functions. Point-to-point encryption as a token? Absolutely not. In fact, tokenization was specifically designed not to be encrypted data, because encrypted data – by definition – is decryptable.
Tokenization Defined 
Tokenization was designed as a random, globally unique, transactional, alphanumeric value that replaces payment card data. Tokenization works differently than encryption because each individual token is created when a transaction takes place, making it organically random with no mathematical pattern to be unlocked. This ensures that tokens aren’t predictable and cannot be reversed. Tokens were designed to never maintain a one-to-one relationship with a card (although we later built additional secure technologies that allowed for tokenized merchants to still track card usage for analytics). Tokenization is not encryption, so it can never be unencrypted. Also, because tokenization is alphanumeric there are enough possible permutations that we will never see a repeated token (collisions in industry parlance) within even the largest payment ecosystem.
Tokenization should reference a specific card number only for a single transaction – and not remain linked to the card as a constant. This varies from what you may have heard about recently in discussions about tokenization in reference to those security features driven by mobile wallets and credit or debit cards, such as EMVCo tokenization. Although referred to as tokenization, these services aren’t tokenization at all, but instead are consumer-based token services that seek to protect the cardholder, not the merchant. (The same is true for the PayPal reference tokens that prompted this whole post.) Having a token that always references the same card number has – in essence – done nothing more than create a new card number that is just as vulnerable to attack as the original data; this is not what tokenization was designed to do.
Tokenization&#8217;s Purpose 
So, what exactly was tokenization designed to do? First and foremost, it was designed to protect merchants from becoming victims of a data breach. Business needs require merchants to store transactional information for a period after the transaction is processed to allow for returns, refunds, etc. In hotels, for example, card numbers often had to be stored from the time an initial reservation was made until after the final checkout when any additional charges (a minibar purchase, for example) might have to be added. For a major e-retailer, the card-on-file database could reach into the millions of cards as consumers selected the “save this card for future use” option – and these cards are essentially stored indefinitely. Tokenization was designed to allow merchants to continue these business practices, simplifying the shopping/checkout experience for their customers without exposing themselves, their brand, and their clients to the dangers of maintaining a huge database of card numbers (a target that became irresistible to cybercriminals in the early 2000s).
By replacing these card numbers with random tokens, Shift4 was able to alleviate this risk. We trademarked the expression They Can’t Steal What You Don’t Have® to explain the benefit to merchants. Tokens could be used only by that specific merchant to process refunds, recurring payments, etc., but outside of their environment (and their specific connection to Shift4’s data centers), held absolutely zero value.
Since introducing tokenization in 2005, Shift4 has processed more than 6.5 billion tokenized transactions. I could post a list tomorrow that included each one of these tokens and hackers would be no closer to breaching Shift4 nor any of our merchants&#8217; systems because of this list. This is due to the nature of tokenization and the limits we placed upon it when we designed the technology. I wish that the same could be said for these other “tokenization-in-name-only” solutions.
Different, But Complementary 
The same consumer-based token (the EMVCo model) can be used across all retailers that accept that payment instrument, giving the token universal value – and therefore universal risk. If one of these consumer-tokenization providers released their full list of tokens tomorrow, you can bet there would be an instant increase of fraud among merchants that accept them.
Now, don’t get me wrong. I am in no way bashing on consumer-based tokens like those PayPal, Samsung, and Apple have been successfully assigning for years. They do offer a certain level of protection to cardholders and have – knock on wood – been relatively effective in preventing mass-scale breaches. My contention with these technologies is simply that they should not be called tokenization. They are much closer to an encryption or cryptographic hash than they are to the arcade token of old.
Fortunately, these technologies can work together to accomplish greater security. Shift4’s TrueTokenization® can and does tokenize – according to the original definition – the consumer tokens that are received from a mobile wallet or other payment instrument. This prevents the merchant from having to maintain a database full of sensitive cardholder data – even if that data in this case is an encrypted surrogate. As we are seeing currently with the Apple vs. FBI media storm, encryption is always vulnerable, which is why the organically random TrueTokenization values will always be more secure.
Merchants that accept mobile wallet and other card-based “tokenization” solutions are delivering modern technology and a “wow-factor” to their clients. This is good for business. However, they must ensure that in so doing they do not put their business at risk of a data breach, which is bad for everyone involved. The risk of calling these new technologies tokenization at all is that Shift4 has been successfully using TrueTokenization for over a decade and we have seen incredible success with it. In merchants’ minds, tokenization equals security for them, and in this case, that isn’t necessarily true.
While we’re not going to launch into a public relations battle with the likes of Apple or PayPal over the use of the term, my warning to merchants is to ensure that the flavor of tokenization you are using protects you and not just your customers.

Executive Insight: Setting the Record Straight on Tokenization

Last month, we <a href="http://blog.shift4.com/2016/01/microsoft-to-end-support-for-older.html" target="_blank" rel="noopener noreferrer">shared information about Microsoft’s end of support for older versions of Internet Explorer (IE)</a> to make sure you knew that they would be ending support for all but the latest version of IE available for a desktop or server operating system. As a result, we’re recommending that you upgrade to IE 11 or another Shift4-supported browser as soon as possible. If you are an IE user and haven’t already upgraded to version 11, you must do so by February 29, 2016. Here’s why:
<ul>
<li>You May Be Unable to Log In to DOLLARS ON THE NET® 
Since unsupported browsers may not receive necessary security patches, we’ve set February 29 as the lockout date for merchants using IE versions 10 and earlier. This means that if you are not using IE 11 (or another Shift4-supported browser), you will be unable to log in to <a href="http://www.dollarsonthenet.net/" target="_blank" rel="noopener noreferrer">dollarsonthenet.net</a> as of that date. Shift4 has these safeguards in place to prevent unknown and outdated Web browsers from accessing <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a>. This is not only because old browser versions can hinder you from using some of our more advanced features, but more importantly they lack vital security elements that are included with newer browser versions. But, don’t worry. <a href="http://windows.microsoft.com/en-us/internet-explorer/download-ie" target="_blank" rel="noopener noreferrer">Upgrading to IE 11 is free</a>! <a href="http://windows.microsoft.com/en-us/internet-explorer/ie-system-requirements#ie=ie-11" target="_blank" rel="noopener noreferrer">Click here</a> to view system requirements. If an outdated operating system prevents you from upgrading to IE 11, you can find links to download the latest version of another supported Web browser, such as Google Chrome or Mozilla Firefox, <a href="https://www.shift4.com/browsers.cfm" target="_blank" rel="noopener noreferrer">here</a>.</li>
<li>Lack of Security Updates 
Microsoft delivers regular security updates that help users protect their computers from malicious attacks, including patches to resolve vulnerabilities that can be exploited by malware. To ensure that you are maintaining a secure environment, and to help keep your systems safer, it’s essential to receive and implement these security updates on a regular basis. Because Microsoft ended support for older versions of IE on a significant number of operating systems as of January 12, 2016, you may be unable to receive security updates and technical support until you upgrade. Please review <a href="https://support.microsoft.com/en-us/lifecycle#gp/Microsoft-Internet-Explorer" target="_blank" rel="noopener noreferrer">Microsoft’s Support Lifecycle FAQ</a> to find out which version of IE is supported by your operating system.</li>
<li>PCI Compliance Issues 
If you are not running a version of IE that is receiving regular security patches, your compliance with the PCI DSS (Payment Card Industry Data Security Standard) may be affected. Requirement 6.2 of the PCI DSS requires merchants to “ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches” and “install critical security patches within one month of release.” The one-month grace period will soon end. Although Internet Explorer 9 and 10 will still be supported on a few older operating systems (and will therefore remain PCI compliant on those systems), we are urging our merchant customers to upgrade to IE 11 or the latest version of another modern Web browser to keep their systems as secure as possible. So if you haven’t already upgraded, now is definitely the time.</li>
</ul>
As always, we encourage you to regularly update and patch all of your software solutions to <a href="http://blog.shift4.com/2016/01/executive-insight-3-ways-merchants-can.html" target="_blank" rel="noopener noreferrer">ensure a more secure environment</a>. For example, Microsoft recently delivered their last patch to Windows 8 due to security weaknesses that were discovered in that operating system. To read the most up-to-date information about Microsoft’s product support lifecycles, visit the <a href="https://support.microsoft.com/en-us/lifecycle" target="_blank" rel="noopener noreferrer">Microsoft Support Lifecycle</a> page and make note of important dates that relate to the products you use.
If your system limitations absolutely restrict you from upgrading to IE 11, and you cannot switch to another Shift4-supported browser, please reach out to us right away and we may be able to develop a customized solution for your business.
Call our 24/7/365 Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight Inquiry: URGENT: Internet Explorer 10 Users Must Upgrade ASAP">support@shift4.com</a> and we’ll be happy to answer your questions and help you address any issues.

URGENT: Internet Explorer 10 Users Must Upgrade ASAP

Shift4 is proud to sponsor the Science Olympiad program at Centennial High School in Las Vegas, NV, for another year. This program serves as a valuable resource for tech-savvy high school students who want to pursue careers in science and technology fields.
The Program 
Science Olympiad is one of Centennial High School’s STEM (Science, Technology, Engineering, and Math) programs. Each year, students learn and study in preparation for the annual <a href="https://www.soinc.org/" target="_blank" rel="noopener noreferrer">Science Olympiad</a> State Championship. Students build projects individually, collaborate with their peers to solve difficult problems, and demonstrate that they are able to integrate scientific concepts into real-world applications. The knowledge and skills gained through this program can give students a head start on their path to a career in a STEM-related field.
<center> “Science Olympiad teaches more than just science. Students learn the importance of collaboration and communication. They learn the importance of putting what they learn in school to practical use.” 
-Alyson Darby, Science Olympiad Instructor</center>
<div style="text-align: center;"></div>
The Competition 
The events in Science Olympiad competitions include a wide range of academic subjects, including bridge building, astronomy, cell biology, anatomy, chemistry, and fossil research. Nearly every event requires students to work together as a team to successfully solve problems. The events are designed to test the students’ scientific knowledge, technical abilities, and critical thinking skills.
One of the events is called “Write It, Do It” and requires a team of two students. In this event, the first team member observes a small structure that was built beforehand using a variety of pieces, and writes instructions detailing how it was built. The object is then disassembled and the pieces are left with the student’s written directions. The second team member must recreate the structure using their teammate’s instructions.
Centennial High School came in first place at the Science Olympiad Nevada State Championships in 2012 and 2014, and they have also competed in the National Championships.
<center> “Science Olympiad competitions not only encourage individual students to improve their science knowledge, but also require them to work together with other members of their teams.” 
-Nevada Science Olympiad</center>
<div style="text-align: center;"></div>
The Team 
Shift4 is sponsoring the Centennial High School team in the upcoming Science Olympiad State Championships on March 5, 2016, in Reno, NV. They will be competing against high schools from across Nevada. We wish them the best of luck!
To learn more about Shift4’s contributions to the community, visit our <a href="https://www.shift4.com/community-relations/" target="_blank" rel="noopener noreferrer">Pay It 4ward</a> page.

Shift4 Sponsors Centennial High School’s Science Olympiad Program

Shift4 provides the latest and greatest payment technologies to keep your business running smoothly. We listen to your feedback and update our <a href="https://www.shift4.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway® (UTG®)</a> nearly every month, keeping your payment security, efficiency, and business operations in mind with each new UTG build. While some of these updates are minor tweaks, others may have a larger impact on your business, so we’re going to be highlighting new UTG updates every month in our 4Sight® newsletter.
This month’s UTG release, 2280, will be available to you later this month. When you perform this upgrade, you will have access to all of our most recent additions, including:
<ul>
<li>Forms Package to Continue Allowing Manual Key Entry on Ingenico RBA Devices 
If you use Ingenico devices with RBA software, you will need to download new forms to continue allowing manual key entry. A single form (BCOD.K3Z) is being replaced by two forms (CARD.K3Z and CARDM.K3Z). Be sure to install these two new forms before you perform the February UTG update. Just contact our Customer Support team for the link to download the RBA forms package and you’ll be set.</li>
<li>EMV Capability on Select Verifone Devices 
We’re already processing EMV transactions on Ingenico RBA software devices. With this UTG update, merchants using Verifone MX 915 or MX 925 devices can process EMV transactions, too. If your <a href="https://www.shift4.com/certifications" target="_blank" rel="noopener noreferrer">processor and system provider are both certified</a> with Shift4 for EMV and you’re using the latest version of the UTG, call our Customer Support team and we’ll walk you through the required setup to process EMV transactions.</li>
<li>Ability to Inject Up to Five Processor Keys on Ingenico RBA Devices 
Using multiple processors across your property or at various locations? This UTG update allows you to inject up to five processor keys on a single Ingenico RBA device. No need to keep an inventory of devices with separate keys for each processor – just change the debit key index whenever you need to swap them out.</li>
<li>&#8220;Cash Back” Option for Debit Cards on Select Ingenico and Verifone Devices 
Improve the consumer experience with cash back functionality. This update gives you the ability to prompt consumers with a cash back option when they use debit cards for payment on Ingenico RBA devices and Verifone MX 915 and MX 925 devices.</li>
<li>Ability to Prompt for Tips 
The UTG allows merchants to configure tip prompting with or without preset tipping options. Larger touchscreen devices allow for a total of four configurable preset tipping options and smaller format devices enable two preset tipping options due to the physical button limitation. To turn on tipping, go into UTG TuneUp and select the option to enable tip prompting.</li>
</ul>
If you need assistance updating the UTG, or if you have any other questions, call our Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight Inquiry: February Release – Shift4's UTG Update">support@shift4.com</a>. We’re always happy to help!

February Release – Shift4’s UTG® Update

You may have had the experience of attempting to close an open batch of authorized transactions and seeing a notification that one of your batches has been suspended. This means that <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a> has flagged the batch because Shift4 received an error or timeout from the processor indicating a problem with it. When this happens, all or part of the transactions in the batch will remain unfunded until the issue is resolved. Most often, batches are suspended due to a transaction with incorrect or suspicious data that the processor will not accept. We recommend that merchants always examine and correct the transaction data in a suspended batch before settling it.
We’d like to share some tips that can help you reduce the number of suspended batches that you encounter.
<ol>
<li>Avoid false authorizations by making manual (phone) auths a &#8220;manager-only&#8221; function. 
There are times when a clerk attempts to authorize a transaction and the card-issuing bank responds with a request to obtain a voice authorization, also called a voice referral. If this happens, you need to call your merchant bank to acquire an authorization code and enter it into DOLLARS ON THE NET. We’ve seen cases where employees have developed the bad habit of quickly entering a fake authorization code instead of taking the time to call and get an actual authorization. This “quick fix” only causes more inconvenience down the road if the batch is settled without fixing the incorrect data.</li>
<li>Pay close attention to suspicious card numbers to prevent yourself from processing fraudulent cardholder data. 
When reviewing a suspended batch, watch for suspicious card numbers. Examples include any card number that has repeating numbers or other unusual number sequences (e.g., “4444 3333” or “1234 5678”). When examining a suspended batch, these transactions should be removed if they are found to be fraudulent card numbers. Card fraud is a major concern for merchants, so noticing a fraudulent card number before the transaction process even begins can save a merchant time, money, and headaches.</li>
<li>Try not to process reservations with check-in or check-out dates more than a few days in the past. 
For those in the hospitality industry, another cause of suspended batches is incorrect or irregular reservation dates. Processors will reject batches with transactions that contain check-in and check-out dates that are months (or further) in the past. Also, properties that use house accounts, which are accounts often created to process miscellaneous charges or for testing purposes, tend to experience a larger number of suspended batches. This is because the house accounts sometimes use random reservation data that the processor will reject when a settlement is attempted, thus causing DOLLARS ON THE NET to flag the batch. If you process transactions using a house account, make sure that you always use realistic reservation information.</li>
<li>Adopt a “measure twice, cut once” policy, making sure to double check card numbers before submitting them. 
For merchants who manually enter card numbers into a keypad, human error can lead to suspended batches, especially when creating a credit transaction. One incorrect digit on a single transaction can result in the entire batch being suspended, so attention to detail is essential. Taking the time to double check the card numbers after you enter them can save a lot of time and effort down the road.</li>
</ol>
Hopefully with these tips, you will see more batches go through without issue. Not only can this save you time and money, but you and your staff members may form some good habits and policies that can help to catch erroneous card data before it is submitted.
As always, if you have any questions, email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%204%20Ways%20to%20Avoid%20Suspended%20Batches">support@shift4.com</a> or call 702.597.2480 (option 2) to contact our 24/7/365 Customer Support team.

4 Ways to Avoid Suspended Batches

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
For merchants, there is an all too common tendency to &#8220;fire and forget&#8221; when using security tools. You might have just completed your most recent PCI DSS (Payment Card Industry Data Security Standard) assessment, installed new antivirus software, or added EMV. While each of these solutions can offer fortification to your business’ overall security practices, it’s a mistake to think that security is something that can be achieved with a single validation, update, implementation, or the addition of a new process. This issue can also be compounded if a security solution is part of a third-party technology because you may be unfamiliar with these technologies or the requirements for their proper implementation and configuration.
The concept of 100% complete security is a falsehood. Consider your home as an example. Is it secure if you add the most expensive locks to your front and back doors, but then leave your kitchen window open? How strong is the door itself? What if thieves slip in through a side door that you unknowingly left unlocked? The security of payments, as it is in all areas where security needs to be maintained, is a diligent and unending fight. What you need to do is utilize all the tools and practices available to make it so inconvenient for payment card data to be stolen or misused that the bad guys seek easier prey. This is accomplished by using a variety of strong and innovative security solutions combined with daily practices to maintain a consistently secure environment.
As 2016 begins, we encourage you to consider 3 ways that you can reduce your risk and better secure consumers’ payment card data. As always, we’re here to provide guidance as well as the industry’s strongest payment security tools. Here are a few ways that you can assure that consumers’ payment data is as secure as it can be:
<ol>
<li style="list-style-type: none;">
<ol>
<li>Layer payment security tools to minimize risk.There is no silver bullet for data security. That’s one of the reasons we’ve designed our security tools to layer on top of each other. All of the following solutions are available with our <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a> payment gateway. Individually, each tool serves its own specific purpose to shrink the scope of your PCI DSS assessments as well as the risk of experiencing a breach. When used together, they create a much larger security toolbox.
<a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> – True P2PE encrypts all cardholder data (CHD) at the point it first interacts with a payment device, keeping all point of sale (POS), property management systems (PMS), and payment processing environments free from the burden of storing CHD. This leaves nothing but your secure payment devices in scope for PCI DSS assessments. At card-present points of sale, including mobile points of sale, True P2PE assures that CHD never enters your payment processing environment, helping to eliminate significant amounts of vulnerability.
<a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> – TrueTokenization replaces sensitive CHD with a random, alphanumeric value called a TrueToken® to simplify PCI compliance and assure that CHD is never stored in your payment systems. Combined with True P2PE, TrueTokenization allows the business operations that once required payment card data to remain intact while assuring that you never store, process, or transmit sensitive CHD.
<a href="https://www.shift4.com/dotn/4tify/" target="_blank" rel="noopener noreferrer">4tify®, Tokenization Your Way®</a> – Shift4 has adapted our security solutions, including TrueTokenization, to secure the most card data touchpoints in the payment industry. Often times, Shift4 has solved payment security problems that our competitors haven’t even considered yet. When configured and used correctly, the following solutions can provide an additional layer of security for every card data touchpoint in your payment processing environment:
<ul style="list-style: none;">
<li><a href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go®</a> is a patented, Payment Application Data Security Standard (PA-DSS) validated software application that provides an additional layer of security at the Windows driver level to assure that sensitive CHD doesn’t enter your POS application from physical points of entry (i.e., card swipe or dip). 4Go has the ability to work in concert with True P2PE for even greater security, and may help extend the life of non-compliant POS and PMS systems by becoming the system of record for PCI compliance purposes.</li>
<li><a href="https://www.shift4.com/dotn/4tify/i4go.cfm" target="_blank" rel="noopener noreferrer">i4Go®</a> protects Web-based or Web-enabled e-commerce and omni-channel environments from falling victim to hackers by intercepting CHD and replacing it with a TrueToken before it enters your Web server, a hosting provider’s system, and your POS or PMS systems used in card-not-present or call center scenarios.</li>
<li><a href="https://www.shift4.com/dotn/4tify/4res.cfm" target="_blank" rel="noopener noreferrer">4Res®</a> is used primarily by hospitality merchants to remove CHD from a central reservation system and/or global distribution system and replace it with a TrueToken before it enters a merchant’s PMS, keeping the environment free of sensitive CHD.</li>
<li><a href="https://www.shift4.com/dotn/4tify/4Word.cfm" target="_blank" rel="noopener noreferrer">4Word®</a> is a service used together with TrueTokenization that allows a merchant to securely share accepted payment card information with a trusted third party (i.e., another merchant) to process one-time payments on a consumer’s behalf. 4Word keeps the payment processing environment free of sensitive CHD and fully logs all applicable card activity, even if that third-party merchant is not a Shift4 customer.</li>
</ul>
<a href="https://www.shift4.com/insight/EMV/" target="_blank" rel="noopener noreferrer">EMV</a> – The purpose of EMV chip cards is often misunderstood. EMV is not a true security tool, but rather an authentication method at the payment card level, that individually validates the payment card to help protect you from having to shoulder the liability for certain types of payment card fraud. DOLLARS ON THE NET supports the processing of EMV chip cards and also provides the tools you need to prevent CHD from entering your payment systems.</li>
</ol>
</li>
</ol>
Many of our merchant customers have already implemented all of these security tools in order to close that “side door,” making the bad guys move on to other targets where they can more easily find and exploit weaknesses. When employed together and properly configured, our full suite of security solutions help you move into a security framework where CHD doesn’t reside in your payment processing environment, making it incredibly time consuming and inconvenient (if not nearly impossible) for hackers to steal CHD. After all, They Can’t Steal What You Don’t Have®.
<ol>
<li>Vet the tools and operations throughout your entire environment often.You can implement as many security tools as you like, but it’s essential that you vet the tools and operations within your own environment first and check in on them regularly to ensure that you are secure and PCI compliant. Are you properly segmenting your networks? Are you updating your software solutions and patching them on a regular basis? If you haven’t assured that CHD cannot enter your payment systems, then a forgotten server, poorly secured entry point, or weak password can become a pathway for skilled hackers to enter that system and steal CHD. Be sure that the individual you are relying on to maintain the integrity of your operating environment has the ability and clearance to make informed decisions.</li>
<li>Consult the PA-DSS implementation guides to ensure all tools are being implemented and used according to PCI guidelines.When you install new solutions or update existing ones, make sure that the prerequisites are understood and applied according to the PA-DSS implementation guides. These implementation guides are the “PCI gospel” and provide in-depth detail about how your business can implement a payment application securely and accurately, as well as your responsibilities for maintaining security in order to be PCI compliant with a particular security technology.
As explained in the PCI DSS, securely implementing payment applications is a key way for merchants to ensure that they have a compliant environment:
“Use of a PA-DSS compliant application by itself does not make an entity PCI DSS compliant, since that application must be implemented into a PCI DSS compliant environment and according to the PA-DSS Implementation Guide provided by the payment application vendor (per PA-DSS Requirement 13.1).”
These implementation guidelines are an essential part of your PCI DSS compliance. And, although we recommend taking further steps to maintain an environment that provides <a href="https://www.shift4.com/insight/compliance/" target="_blank" rel="noopener noreferrer">Security Beyond Compliance®</a>, being compliant is the minimum standard to meet prior to exceeding it.</li>
</ol>
At Shift4, we continue to make it harder for the bad guys to steal CHD. In addition to offering the most innovative and efficient accounting, auditing, and reporting features, we provide the latest security solutions so that it’s easier for you to be secure (and by extension compliant) while still performing business as usual. But like most things these days, you need to routinely check in to ensure that all is still well with the world as it relates to your payments. The fortification that works perfectly today may have a chink in the armor as time goes on if you are not performing regular checks on your environment. The need to help maintain merchant payment security is one of the primary reasons Shift4 continues to innovate and perfect our services and why we offer so many layers of security technologies. With today’s hackers being organized and even backed by nation states, false nation states, and terrorist organizations, maintaining the security of your payment-processing environment isn’t just harder, it’s more important than ever before.
Remember, rather than an achievable end goal to meet, it’s more accurate to think of security as a constantly moving target. You need to have vigilance and rely on payment solution providers who are vigilant, too. We are here to support you in your payment security and compliance efforts, so if you need any help or guidance at all, just ask.

Executive Insight: 3 Ways Merchants Can Ensure a More Secure 2016

For years, Shift4 has provided small merchants with direct payment processing to American Express (AMEX) along with support for the AMEX OnePoint program. OnePoint catered to merchants that processed less than $500,000 (under a single tax ID) in AMEX charges each year. However, on November 1, 2015, the OnePoint program ended and AMEX began offering a new program called OptBlue. OptBlue provides smaller merchants with some of the same benefits as OnePoint, including same-day funding, a single point of contact for customer service and disputes, streamlined deposits, and one statement for all credit cards (AMEX, Visa, MasterCard, and Discover). Though there are similarities, there are also a few key differences that merchants should consider before deciding if AMEX OptBlue is a good fit for their business.
What Does the Change to OptBlue Mean to You? 
Unlike the OnePoint program, OptBlue is an optional add-on service that is provided by your merchant acquirer (e.g., <a href="https://www.shift4.com/insight/glossary/index.cfm?searchterm=where%20merchants" target="_blank" rel="noopener noreferrer">merchant bank</a>, <a href="https://www.shift4.com/insight/glossary/index.cfm?searchterm=This%20organization%20handles" target="_blank" rel="noopener noreferrer">merchant services provider</a>, or <a href="https://www.shift4.com/insight/glossary/index.cfm?searchterm=independent%20sales" target="_blank" rel="noopener noreferrer">independent sales organization</a>). The qualification requirements and the pricing structure for OptBlue are different from the OnePoint program, which could result in acquirers imposing new fees and payment processing changes on merchants.
<ul style="list-style: none;">
<li>Qualifying for OptBlue 
Merchants that annually process less than $1M in AMEX charges qualify for OptBlue. Merchants with numerous locations can also qualify as long as there is a different tax ID for each location and those individual locations process less than $1M in AMEX charges (e.g., a merchant with 45 locations averaging $150K each for a total of $6.7M in annual AMEX volume).</li>
<li>Paying for OptBlue 
If you sign up for OptBlue, Shift4 will continue to process and secure your AMEX credit card payments, but your acquirer will manage your AMEX account and deliver the program’s features to you. If you decide not to sign up for OptBlue, however, Shift4 will still provide direct processing to AMEX, which will help you avoid some fees associated with the new program.</li>
</ul>
When You Hear From Your Acquirer: Remember That You Have Choices 
When your acquirer reaches out to you about OptBlue, they will likely emphasize the simplified payment processing features and offer an exceedingly low discount rate. While the discount rate may be lower than you currently pay for AMEX charges, beware of hidden fees that may vary month-to-month. Most merchants won’t see these fees until 3-6 months after they’ve signed up for the program. Perhaps the worst aspect of these fees is their unpredictability, potentially causing processing costs to fluctuate on a monthly basis.
You should not feel rushed into signing up for OptBlue, as you may end up with unexpected costs or other undesirable changes to your payment processing. There are benefits, such as having a single statement, but you should weigh whether or not it’s worth paying variable fees on a monthly basis to use the program. These variable, hidden fees could make it difficult to understand the program’s impact on your bottom line.
Shift4 Supports What’s Best for Your Business 
Whichever choice you make regarding OptBlue, Shift4 is capable of supporting your AMEX payment processing. If you haven’t already heard about OptBlue from your acquirer, you may be hearing from them soon. Here are a few things to note:
<ul>
<li>Shift4 Supports OptBlue. If your acquirer says that Shift4 does not support OptBlue, it’s false. We are certified to support OptBlue.</li>
<li>You Don’t Have to Sign Up for OptBlue. You can decline OptBlue and continue to process AMEX credit cards directly through Shift4 at no additional cost. If your acquirer won’t allow direct processing to AMEX, we can assist you in moving to one who will. This is another one of the great benefits of our bank and processor neutrality.</li>
<li>Your Acquirer May Be Pushy. Because AMEX has decided to work with acquirers to manage OptBlue accounts, the various acquirers are now competing with each other for new business. Some acquirers are simply moving their entire OnePoint portfolio over to OptBlue without fully advising merchants or telling them they have a choice as to whether they want to sign up for the program. The terms and conditions of these programs are different, and you absolutely do have a choice.</li>
<li>Ask Questions. As always, we encourage you to ask your acquirer a lot of questions and to get the details in writing before making any decisions. Feel free to consult your business operations team, if you have one, or a legal advisor. You can also reach out to our Customer Support team and we’ll be happy to walk you through how a new agreement may impact your payment processing services.</li>
<li>Your Acquirer May Try to Lock You Into Another Agreement. Your acquirer does not provide the bank and processor neutrality that we do, so they may try to sign you up for another agreement that locks you into a processor or another payment gateway. Sometimes, acquirers share false information in order to convince merchants to sign up for agreements that may not deliver the level of service that is best for your business and may also come with hidden fees.</li>
</ul>
If you have any questions or if you need more detailed information, please call Shift4’s Customer Support team at 702.597.2480 (option 2) or email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20AMEX%20Has%20Replaced%20OnePoint%20With%20OptBlue">support@shift4.com</a>.

AMEX Has Replaced OnePoint With OptBlue

Microsoft <a href="https://www.microsoft.com/en-us/WindowsForBusiness/End-of-IE-support" target="_blank" rel="noopener noreferrer">announced</a> that they’ll be ending support for all but the latest version of Internet Explorer that is currently offered for a desktop or server operating system as of January 12, 2016. If you are not running a version of Internet Explorer that is receiving regular security patches, your PCI DSS compliance status may be affected. Requirement 6.2 of the PCI DSS (Payment Card Industry Data Security Standard) requires merchants to “ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches” and “install critical security patches within one month of release.”
Below is <a href="https://www.microsoft.com/en-us/WindowsForBusiness/End-of-IE-support" target="_blank" rel="noopener noreferrer">Microsoft’s notification</a> for your reference:
<ul style="list-style: none; font-style: italic;">
<li style="padding-bottom: 8px;">What is end of support? 
Beginning January 12, 2016, only the most current version of Internet Explorer available for a supported operating system will receive technical support and security updates. Internet Explorer 11 is the latest version of Internet Explorer, and will continue to receive security updates, compatibility fixes, and technical support on Windows 7, Windows 8.1, and Windows 10.</li>
<li style="padding-bottom: 8px;">Internet Explorer 11 offers improved security, increased performance, better backward compatibility, and support for the web standards that power today’s websites and services. Microsoft encourages customers to upgrade and stay up-to-date on the latest browser for a faster, more secure browsing experience. (For Internet Explorer 11 system requirements, <a href="http://windows.microsoft.com/en-us/internet-explorer/ie-system-requirements#ie=ie-11" target="_blank" rel="noopener noreferrer">visit this page</a>.)</li>
<li style="padding-bottom: 8px;">What does this mean? 
It means you should take action. After January 12, 2016, Microsoft will no longer provide security updates or technical support for older versions of Internet Explorer. Security updates patch vulnerabilities that may be exploited by malware, helping to keep users and their data safer. Regular security updates help protect computers from malicious attacks, so upgrading and staying current is important.</li>
<li style="font-style: normal; padding-bottom: 8px;">Read the <a href="https://support.microsoft.com/en-us/lifecycle#gp/Microsoft-Internet-Explorer" target="_blank" rel="noopener noreferrer">Windows lifecycle FAQ sheet</a> to learn more.</li>
</ul>
To learn more about why it’s important to stop using outdated Web browsers, you can visit our <a href="https://www.shift4.com/browsers.cfm" target="_blank" rel="noopener noreferrer">Browser Beware webpage</a>.

Microsoft to End Support for Older Versions of Internet Explorer

Robot vs. Robot 
Each year, the VEX Robotics students form several small teams that prepare for and compete in local, national, and international <a href="http://www.vexrobotics.com/competition?ref=hometile" target="_blank" rel="noopener noreferrer">VEX Robotics Competitions</a>. In 2015 alone, teams from Faith Lutheran have won two Nevada State Championships, multiple tournament championships, as well as individual awards for design, excellence, innovation, and sportsmanship. In April 2015, four of their teams competed in the VEX World Robotics Championships in Louisville, KY.
In the VEX Robotics Competitions, which are presented by the <a href="http://www.roboticseducation.org/" target="_blank" rel="noopener noreferrer">Robotics Education &amp; Competition Foundation</a>, schools from all over the country compete in various knowledge and skills challenges. In one challenge, they form an “alliance” with another team to compete in “Nothing But Net,” a round of robot soccer against another alliance. In other challenges, their robot needs to perform autonomous actions without any controlled assistance for up to 60 seconds. These challenges require the students to perform countless hours of preparation, programming, and lots of trial and error.
Faith Lutheran High School will be hosting and competing in the VEX Robotics Nevada State Qualifier on January 9, 2016. We wish them the best of luck!

Shift4 Sponsors Faith Lutheran High School’s VEX Robotics Program

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
Last year, the United States experienced what has been dubbed “the year of the data breach.” Now, we’re nearing the end of 2015, and data breaches continue to plague merchants. Some are saying that hackers’ tactics are changing and that remote-access attacks are a new frontier in the fight for payment card data. But, these kinds of attacks aren’t new – what’s changed is the hackers’ strategy.
Around the world, hackers are taking to dark corners of the Web to share tactics and strengthen their attacks. Criminals are joining hacking groups, and some are being formed, backed, and even trained by criminal organizations and nation-states. Others are using this data to fund terrorism. The result is that hacking is becoming much more organized and sophisticated than it once was. There is a war for payment card data, and more needs to be done to help merchants keep their customers’ payment information away from hackers. It requires going beyond what’s needed for Payment Card Industry (PCI) compliance and more than just adding EMV chip cards into the mix.
To win the war for payment card data, merchants need to shield sensitive cardholder information at all three milestones in the life of a transaction: when it’s transmitted, processed, and stored. A trifecta of existing technologies – EMV, point-to-point encryption (P2PE), and tokenization – give merchants the “weapons” they need to win the war. Let’s take a deeper look at each of the components of the payment security trifecta.
EMV 
The much-discussed liability shift associated with EMV was put into effect in October by the various card brands. Supporters of the EMV migration claim that merchants will be protected from the next wave of data breaches in exchange for their investment in new payment terminals and other related EMV migration expenses. However, this isn’t true. EMV does not secure payment card data when it is in transit or held in merchant systems or networks, so it won’t prevent data breaches from occurring. Also, since EMV chips specifically work with card-present payment terminals, the technology won’t protect against fraud in card-not-present environments, such as e-commerce, the case of keyed-in information, or in subsequent card usage like incremental authorizations used in hotels.
While EMV alone is not a complete security solution for merchants, it is an essential component of the payment security trifecta because it helps to identify the cardholder’s card as authentic, in an effort to prevent merchants from processing card-present payments with counterfeit, lost, or stolen payment cards. When used with an EMV-capable point-of-sale (POS) terminal, EMV chip cards go through an authentication protocol that verifies either the card or the cardholder as well, if the cardholder’s card was issued with a PIN. Although not foolproof, this process helps stop criminals from committing card-present counterfeit, lost, or stolen fraud better than payment cards with a traditional magnetic stripe.
The problem is that when EMV cards are processed, payment card information is still exposed in plain text as it flows out of the secure payment device to be authorized. This leaves consumer payment information vulnerable to attacks from hackers – unless the merchant implements P2PE.
Point-to-Point Encryption (P2PE) 
P2PE encrypts payment card data from the moment a credit or debit card is first processed until it is authorized. In card-present environments, including traditional and mobile points of sale, P2PE protects the merchant’s communication channels where EMV does not: between the payment device and the processing network.
When a customer’s payment information is keyed, swiped, inserted, or tapped (such as when using mobile payment solutions like Apple Pay™, Samsung Pay™, or Android Pay™), P2PE immediately encrypts the sensitive data at the point it interacts with a secure payment terminal. This ensures that the sensitive data is secured before it is transmitted to the merchant’s POS system, protecting consumers’ payment information – and the merchant’s environment – from a variety of attacks, including malware infections in the POS terminal or system. In the best implementations of these solutions, the merchant has no control over the decryption of the cardholder data.
By using P2PE, a merchant can limit their exposure to hackers who are constantly searching for weaknesses in the merchant’s system. Also, the merchant’s PCI scope will be dramatically reduced. In other words, when merchants don’t have cardholder data in their possession, there is nothing for hackers to steal because They Can’t Steal What You Don’t Have®.
Tokenization 
Tokenization resolves the vulnerability issues associated with the long-term storage of payment card data from the moment of authorization and throughout the lifecycle of a payment card’s usage. This assures protection for subsequent and incremental payment card usage in environments such as e-commerce, online reservations, and recurring billing or usage scenarios. When done correctly, tokenization replaces payment card data with a random, alphanumeric value – a token – that is meaningless to all but a select few. That way, if tokens were to ever get into the wrong hands, there would be no way for hackers to use them. Importantly, for tokens to be truly meaningless to hackers, they must be dynamic (with a new randomized token for each transaction processed), they cannot have a mathematical or one-to-one relationship with a card, and they must not be able to be decrypted. Tokenization is not encryption.
Tokenization ensures that merchants no longer have to rely on the use and storage of cardholder data to carry out the daily business functions that once relied on this sensitive information. A well-designed tokenization solution enables merchants to safely access their customers’ transaction data for future use, including returns, card-on-file, recurring billing, incremental authorizations, and other uses without exposing their environment to the vulnerability of storing that sensitive information.
Creating a Strong Security Posture 
Implementing the payment security trifecta of EMV, P2PE, and tokenization provides merchants with the peace of mind that they have taken the best steps toward protecting their customers – and their business – from fraudsters who attempt using fake, lost, or stolen cards in card-present environments and from data thieves who are intent on stealing sensitive payment information in bulk. Therefore, merchants migrating to EMV today should ensure these three solutions are in use together so that transactions are secured at the card’s point of interaction with a payment device. When a merchant then entrusts that sensitive data to a dedicated payment solutions provider, not only is their environment protected, but the burden of protecting cardholder data is also alleviated. At the end of the day, we want merchants to be able to focus on what matters most to their business: their services, products, and customers.

Executive Insight: Winning the War for Payment Card Data

It’s beginning to look a lot like the holiday season – and for millions of holiday shoppers that means purchasing decorations, food, and gifts that make the season bright. According to the National Retail Federation, “Despite the challenges that still exist in our economy, it looks as if consumers are eager to celebrate the holidays with friends and family this year.”1 And with the rush of holiday purchases comes some aspects of the holidays no one looks forward to: long lines and customer frustration.
Line Busting and Secure Payments Made Easy 
I’m Dreaming of a Secure mPOS
This holiday season, whether you’re running the city’s biggest holiday promotion or line busting that early morning coffee queue, our <a href="https://www.shift4.com/dotn/VT4/" target="_blank" rel="noopener noreferrer">VT4® mobile point-of-sale (mPOS) solution</a> has you covered! VT4 is a versatile mPOS solution that can help businesses of any size in any industry quickly, accurately, and securely process payments anywhere their customers may be.
Using any Internet-connected smartphone, tablet, or laptop, your staff can use VT4 to decrease wait times, shrink long lines, and keep your business running smoothly. You’re also able to add staff on the fly to expedite sales and manage their permission levels in real time – perfect for those businesses hiring seasonal help. Best of all, mobile devices running VT4 never store, process, or transmit sensitive payment card data, which makes VT4 ideal for Bring-Your-Own-Device (BYOD) environments.
Simple, Swift, Secure 
There’s No mPOS Like VT4 for the Holidays
VT4 comes with the industry-leading speed, security, and reliability you’ve come to expect from Shift4. Our TrueTokenization® and True P2PE™ solutions secure payment card data both in transit and at rest, so your customers can shop with confidence knowing that their payment information is secure. And VT4 supports the latest payment technologies such as EMV, contactless, Apple Pay™, Samsung Pay™, and Android Pay™.
VT4 provides the ability to display your logo and brand colors, in addition to supporting an unlimited number of items, categories, item modifiers, and full-color photos, and allowing your employees to enter in notes so a customer’s order is received exactly the way they want it. And with VT4 you’re able to add an unlimited number of users or devices at no additional cost!
Enjoy All the Features VT4 Has to Offer 
All I Want For Christmas Is VT4
VT4 allows you to: securely accept payments when and where you need; remotely add, disable, or configure users and their permissions; accept EMV or contactless transactions; audit, edit, report, batch, and settle transactions with DOLLARS ON THE NET®; establish thresholds for offline transactions and securely complete transactions even during no-signal situations with our Secure Offline Stand-In® (SOS) feature; keep your existing P2PE-enabled terminals and swipe devices; reduce your breach profile; and so much more.
If you would like to see how VT4 can improve your customers’ shopping experience, contact us today at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20%E2%80%98Tis%20The%20Season%20For%20Secure%20Mobile%20Payments!">support@shift4.com</a>.
<div>
<div id="ftn1">
1 Grannis-Allen, K. (2015, October 20). Retailers in for a Very Digital Holiday Season, According to NRF Survey.
</div>
</div>

‘Tis The Season For Secure Mobile Payments!

At Shift4, we value our customers’ payment data security above all else. Every product and technology we provide was created knowing that data breaches and fraud are real threats that can happen to anyone at any time. With that in mind, we want to make sure that all of our payment solutions are as secure as possible. Recently, we approached Dara Security, an award-winning information security services firm and PCI Qualified Security Assessor (QSA), about performing an in-depth technical assessment of the performance and security of our point-to-point encryption (P2PE) solution, <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a>.
Dara Security found that Shift4’s method of cardholder data encryption “provides the same risk and scope reduction as that of a validated P2PE solution.” True P2PE is not a PCI 2.0 validated solution simply because we don’t use hardware security modules (HSMs) to decrypt cardholder data. Instead, we have “invented key management methods where whole Data Decryption Keys are never written to disk, even in encrypted form.”
<div style="color: #6e298d; font-size: 0.9em;" align="center">“Shift4’s True P2PE solution meets and in most cases exceeds all other security requirements of PCI P2PE 2.0.” 
-Dara Security Assessment </div>
At Shift4, we will always choose a high level of security for our merchant customers over a simple PCI checklist. Some companies might think checking boxes is good enough, but unfortunately it doesn’t always equate to real-world security. We believe in Security Beyond Compliance®.
You can read Dara Security’s full assessment <a href="https://www.shift4.com/pdf/Shift4-True-P2PE-Key-Management-Assessment.pdf?ad=D" target="_blank" rel="noopener noreferrer">here</a>.
To learn more, call us at 702.597.2480 (option 2), email <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Dara%20Security%20Assesses%20True%20P2PE">support@shift4.com</a>, or visit <a href="https://www.shift4.com/index.cfm" target="_blank" rel="noopener noreferrer">shift4.com</a>.

Dara Security Assesses True P2PE™

In March, <a href="http://blog.shift4.com/2015/03/heads-up-extended-support-for-windows.html" target="_blank" rel="noopener noreferrer">we warned merchants that Microsoft’s extended support for Windows Server 2003 would be ending</a>. In July, this extended support period expired. On August 20, 2015, Visa issued a Security Bulletin about the Windows Server 2003 end of life for acquirers, issuers, processors, merchants, and agents. We’re sharing that bulletin below for your reference. Please share it with anyone in your organization who may need to be made aware of its contents.
Visa Security Alert: Windows Server 2003 End of Life
Summary 
Microsoft will no longer support or issue security fixes for Windows Server 2003 after July 14, 2015. This date references the end of Microsoft’s “extended support” period and Microsoft will no longer offer any technical support for this platform, except for-fee custom contracts for a limited period.i This poses a greater risk to the data security of a company utilizing Windows Server 2003. Furthermore, as of July 15, 2015 companies using this software may no longer be in compliance with Payment Card Industry Data Security Standard (PCI DSS). It is recommended that all companies using Windows Server 2003 upgrade to Windows Server 2012 R2.
Historically, Windows Server 2003 has been vulnerable to multiple attack vectors including unauthorized privileged escalation or the execution of malicious code. In the first half of 2015 alone Microsoft identified 36 vulnerabilities attributed to Windows Server 2003, and hackers will continue to target and exploit these vulnerabilities since security patches will no longer be issued.
Another aspect of Windows Server 2003’s obsolescence involves interdependent applications. Many applications in use by companies are likely to be past their rational support life and newer versions may not function with the older Windows Server 2003. This includes cloud based products from Microsoft itself as they likely require a 64-bit solution opposed to the 32-bit option which is how most Windows Server 2003 instances have been installed.
Vulnerabilities 
Systems can fall out of compliance with the PCI DSS. PCI DSS Version 3.1, Requirement 6 states:
“Unscrupulous individuals use security vulnerabilities to gain privileged access to systems. Many of these vulnerabilities are fixed by vendor-provided security patches, which must be installed by the entities that manage the systems. All systems must have all appropriate software patches to protect against the exploitation and compromise of cardholder data by malicious individuals and malicious software.”ii
Unpatched Windows Server 2003 systems will be open to attacks through malware that cannot be detected by anti-virus or anti-malware software. Hackers will also have a greater ability to remotely access the networks utilizing Windows Server 2003. These issues have been observed in the past for Windows Server 2003 and hackers are likely to continue to exploit these known vulnerabilities.
A compromised server on the network leaves an open door for the rest of the environment to be harmed from malicious attacks. All servers should be upgraded to a currently supported operating system before the end of life date.
Operating system platforms often share application code, and malware that affects Windows Server 2012 can also harm older versions like 2003. However, while the 2012 version can be patched, there is nothing to protect Windows Server 2003.
Mitigation 
The best way to protect against attacks on Windows Server 2003 is to upgrade to currently supported version of Windows Server. Windows Server 2012 R2 is the most recent platform and is recommended by Microsoft. There are also many other options including cloud based servers.iii Once the system is migrated it is best to update all security patches and fixes immediately in order to ensure the maximum protection for your company. Ensure that the operating system is hardened to industry standards and fulfills all PCI DSS requirements as well.
Additional Resources
<ul style="padding-top: 0; margin-top: 0;">
<li><a href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf" target="_blank" rel="noopener noreferrer">Payment Card Industry Data Security Standard Version 3.1</a></li>
<li><a href="http://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/default.aspx?WT.srch=1&amp;WT.mc_ID=SEM_Bing_USEvergreenSearch_Cloud%7CBing%7CSEM%7CTTD%7CWindows+Server+Legacy%7CBrand%7CUS_MSFT" target="_blank" rel="noopener noreferrer">Microsoft.com EOS announcement</a></li>
</ul>
For more information, please contact Visa Risk Management: <a href="mailto:cisp@visa.com">cisp@visa.com</a>
iMicrosoft <a href="http://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/" target="_blank" rel="noopener noreferrer">http://www.microsoft.com/en-us/server-cloud/products/windows-server-2003/</a> 
iiPayment Card Industry Data Security Standard Version 3.1 
iii <a href="https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf" target="_blank" rel="noopener noreferrer">https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-1.pdf</a>

Support for Windows Server 2003 Is Over

The U.S. EMV migration liability shift date, October 1, 2015, is almost here. Are you on the road to EMV chip card acceptance? Earlier this year, we shared a <a href="https://www.shift4.com/pdf/Shift4-EMV-Road-Map.pdf" target="_blank" rel="noopener noreferrer">road map</a> to give merchants and independent software vendors (ISVs) a quick look at how to get ready for EMV. Now, we’re sharing the steps merchants, ISVs, banks, and processors need to follow on the home stretch to EMV. <a href="https://www.shift4.com/pdf/Shift4-The-Home-Stretch-to-EMV.pdf" target="_blank" rel="noopener noreferrer">Click here</a> to learn what to do to accept EMV cards.
What Is the U.S. EMV Migration? 
The four major card brands, Visa, MasterCard, American Express, and Discover, have all designated October 1, 2015, as the U.S. EMV liability shift date. After that date, merchants should begin to see increasingly more consumers paying with credit and debit cards with microchips on them.
Cards with EMV microchips will interact differently with payment terminals, requiring customers or merchants to insert or “dip” the card into the payment terminal instead of swiping the magnetic stripe. Compared with a magnetic stripe credit or debit card, an EMV card will provide better authentication of the card or the cardholder, so it is expected to reduce the number of fraudulent transactions accepted at card-present points of sale.
If you have any questions, visit our <a href="https://www.shift4.com/insight/EMV/" target="_blank" rel="noopener noreferrer">EMV microsite</a> for more information or contact our Customer Support team 24/7/365 at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Get%20in%20Gear%20for%20EMV">support@shift4.com</a> or call 702.597.2480 (option 2).

Get in Gear for EMV

Malware attacks have become increasingly common for merchants who process payments using remote-access systems, according to a recent alert from the Financial Services Information Sharing and Analysis Center (FS-ISAC). In the past year, there has been a significant increase in reports of malware that invades point-of-sale (POS) or property management systems (PMS) and creates a back-end channel, allowing hackers to steal sensitive cardholder data. We recommend that our merchant customers <a href="https://www.fsisac.com/sites/default/files/news/Alert%20--%20Securing%20Merchant%20Terminals%20Remote%20Access%20FINAL%207%20July%202015.pdf" target="_blank" rel="noopener noreferrer">review the full alert</a> to view the full list of recent malware families.
The security alert was a joint effort between the FS-ISAC, the Retail Cyber Intelligence Sharing Center, and the United States Secret Service, with the support of Visa.
In the alert, the FS-ISAC also provided merchants with a list of recommended security measures to ensure that their remote-access payment processing systems are more secure. Hackers typically seek out the “low-hanging fruit” of merchants with weak security systems in place. With a few quick actions, you can make your environment much less vulnerable to malware attacks. Please take note of the following recommendations and make the necessary changes to stay protected from new and evolving security threats.
Login Information
<ul style="margin-top: 0; padding-top: 0;">
<li>Use a multi-factor authentication process. Appendix C of the alert provides detailed instructions for setup.</li>
<li>Evaluate and limit the number of third parties who have access to your system.</li>
<li>Regularly change login credentials, especially around the holidays.</li>
<li>Encourage those who have system access to create complex passwords.</li>
<li>Avoid using outdated operating systems that no longer receive updates, such as Windows XP.</li>
<li>Enable account locking after multiple failed login attempts.</li>
<li>Monitor and report suspicious login activity.</li>
</ul>
System Access
<ul style="margin-top: 0; padding-top: 0;">
<li>Restrict all Internet access that is not directly related to the essential functions of the POS or PMS.</li>
<li>Employ up-to-date firewall, virus protection, and intrusion-prevention systems.</li>
<li>Do not rely solely on anti-virus software, as hackers are able to make some malware undetectable.</li>
<li>Do not allow external media devices, such as USB drives, to be connected to the terminal.</li>
</ul>
Shift4 Further Protects You From Malware 
In addition to the precautions listed above, the FS-ISAC recommends that merchants employ tokenization and point-to-point encryption (P2PE) to further protect their card data from hackers. Shift4’s <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a> payment gateway provides merchants with unmatched security services, including:
<ul>
<li><a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization</a>® – Shift4 invented payment data tokenization and was the first company to introduce a tokenization solution to the market. TrueTokenization replaces credit, debit, and gift card transaction data with a randomized, alphanumeric value that is impossible to replicate and meaningless if stolen.</li>
</ul>
<ul>
<li><a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE</a>™ – Our P2PE solution encrypts card data at the point a payment card interacts with a payment device, so that sensitive cardholder data never enters your system in the first place.</li>
</ul>
These solutions, along with our full suite of security options, including <a href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go</a>®, <a href="https://www.shift4.com/dotn/4tify/i4go.cfm" target="_blank" rel="noopener noreferrer">i4Go</a>®, and <a href="https://www.shift4.com/dotn/4tify/4res.cfm" target="_blank" rel="noopener noreferrer">4Res</a>®, provide the best possible protection against data theft for any card-present or card-not-present merchant environment. Even if your system were to become infected with malware, there won’t be any data there that is valuable to hackers. After all, They Can’t Steal What You Don’t Have®.
To learn more about how Shift4 can help secure your environment, contact our Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Don%27t%20Fall%20Victim%20to%20Malware">support@shift4.com</a> or 702.597.2480 (option 2).

Don’t Fall Victim to Malware

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
Last month, we talked about how some organizations are pressuring merchants to rush into EMV solutions instead of urging merchants to <a href="http://blog.shift4.com/2015/06/executive-insight-take-time-to-do-emv.html" target="_blank" rel="noopener noreferrer">take the time to adopt a strategic approach to EMV</a>. This month, I’ll review some of the nuances of the EMV liability shift and recommend a thoughtful approach to security using the trifecta of point-to-point encryption (P2PE), EMV, and tokenization.
EMV Fraud Liability Remains Murky 
The largest segment of fraud the EMV liability shift relates to is counterfeit card fraud. This is because according to Visa®, whose logo is on the largest segment of credit and debit cards, the liability shift <a href="http://www.emv-connection.com/emv-migration-driven-by-payment-brand-milestones/" target="_blank" rel="noopener noreferrer"> pertains only to counterfeit fraud</a>, not to fraud from lost or stolen cards. The problem is, merchants haven’t historically had access to this type of detailed fraud information (e.g., whether the card used at their location to commit fraud was counterfeited, lost, or stolen), and it is very difficult to pinpoint.
The approach to EMV in the U.S. by the card brands appears to be stating that there is “no end in sight to data breaches.” And now, merchants are expected to shoulder a burden to implement a technology that will in most cases only protect them from a very specific segment of fraud that they as merchants cannot qualify or quantify. This is concerning for a few reasons:
<ol>
<li>EMV chip cards have a particular element in the track called the “discretionary data area” that identifies those cards as EMV capable when swiped. Those tracks can be compromised, and the payments industry must anticipate that many will be.</li>
<li>The card brands do not appear to have made a distinction between a “traditional swipe track” and those EMV swipe tracks for the purpose of tracking fraud.</li>
<li>A fraudster could create a counterfeit chip card by using card stock, a fake chip that will fail to read, and a counterfeit track. Because the payment device will be unable to read or write to the fake chip, the device may ask for the counterfeit card to be swiped as a fallback.</li>
</ol>
Considering this scenario, as in other cases, it remains unclear where the liability will fall. Is an EMV swipe fallback with a counterfeit card, if accepted, part of this fraud liability shift? If the merchant is EMV capable, does the liability remain with the issuer because EMV was attempted or fall to the merchant bank or the merchant because it was a swiped transaction? It’s anyone’s guess at this point.
Who Will the EMV Liability Shift Benefit? 
One can’t help but question whether the liability shift itself is an attempt to completely divert liability away from those organizations that both issue cards and serve as a merchant bank. After all, those are the organizations that are already issuing the largest numbers of EMV cards. Traditionally, one side or the other would have shouldered the burden of this type of card fraud, but EMV is possibly increasing the profitability for these large banks that are both issuers and merchant banks by lessening their liability, allowing them to simply wash their hands of it even in cases where liability remains unclear. This lack of clarity is only furthered by organizations advertising that the EMV technology is foolproof, which it isn’t.
Who Will Shoulder the Greatest Burden? 
As the liability shift deadline approaches, there are three groups that may stand to shoulder the greatest burden: merchants, small card issuers, and small merchant banks. Merchants cannot qualify or quantify counterfeit fraud, but must invest in EMV-compliant terminals and system solutions at a substantial cost. Further, merchants may potentially and <a href="http://blog.shift4.com/2015/05/when-your-acquirer-comes-to-call-about.html" target="_blank" rel="noopener noreferrer">inadvertently sign agreements that bind them</a> into the very liability shift that may not have been theirs to accept.
On the other hand, small issuers and co-issuers are also burdened with the costly retooling of the cards they have to issue. EMV cards are much more expensive to produce than traditional magnetic stripe cards. And, if they move to issue contactless EMV cards, these can cost up to two times more than a non-contactless EMV card. Finally, small merchant banks, independent sales organizations (ISOs), and agents have very little control or say over the makeup of the payments industry and stand to lose the most by this liability shift if they cannot effect change or get their merchant customers prepared for EMV.
EMV Is Authentication, Not Security 
As we discussed last month, some organizations are putting a lot of pressure on merchants to get ready for EMV immediately as though the liability shift date in October will bring an onslaught of fraudulent charges. However, this is probably unlikely, as after EMV is “in the wild” it is much more likely that fraud will result from poor implementations of EMV, e-commerce, and other card-not-present scenarios. Whether the industry wants to accept it or not, the U.S. EMV migration will take years. Therefore, merchants should get ready for EMV, but when they do, they shouldn’t do it out of fear, uncertainty, or doubt. EMV is a complicated authentication tool, and it needs to be implemented correctly. Merchants must make a concerted effort to become EMV compliant the right way, as a step in the path to true security, not as a security solution in and of itself.
What Merchants Can Do to Implement EMV Correctly 
EMV technology was created more than two decades ago and doesn’t account for the proficiency with which hackers, some of which are now working in large groups and are backed by nation-states, are compromising payment systems today. 
Therefore, a well-thought-out EMV solution requires the use of layered security to protect sensitive cardholder data. We recommend covering all bases: remove that sensitive data from the merchant environment entirely by layering EMV with the security of P2PE and tokenization. This ensures that you can accept EMV cards, but that your environment is also protected from becoming the source of a breach.
Here are some tips regarding what to look for when seeking support during your EMV migration:
<ol>
<li>Use a solutions company, such as Shift4, which takes a mindful and business-oriented approach to security and compliance. Even before PCI and EMV, Shift4 has always balanced the business needs of its merchant customers with their need to securely process transactions. The end result is our supply of best-in-class payment solutions that optimize business processes and provide unrivaled security with compliance as a side effect.</li>
<li>Implement tokenization. It is essential to remove all card data from the merchant environment and place the burden of storing that sensitive data on a proven and vigilant organization that considers the security of their merchant customers’ transactions its primary job. To do this, merchants must implement a “security” or “storage”-based tokenization solution like Shift4’s TrueTokenization®, which protects the merchant’s environment by replacing sensitive cardholder data with non-decryptable information that is meaningless to hackers. This type of payment data tokenization differs from the recently popularized consumer-based “payment token” solutions, such as is found with Apple Pay™ and other mobile payment providers. While these sister solutions do provide merit from the consumer level, merchants need to ensure that their environment is protected with a comprehensive tokenization solution.</li>
<li>Implement P2PE. No matter the payment type, it is important to encrypt all transactional material from the time it is keyed, swiped, inserted, or tapped (such as when using mobile payment solutions like Apple Pay). Merchants should use a device that encrypts at the point of interaction so that no transactional information is ever in the clear and exposed to hackers. This reduces much of the PCI-DSS burden, a burden that still remains with EMV, no matter what the press or the merchant banks are telling the world. Again, EMV would not have stopped the breaches at Target or Home Depot, nor will it prevent future breaches.</li>
<li>Implement EMV. Though it’s true that Shift4 has very real concerns over the tactics used by some in our industry to drive the EMV payment hype, it doesn’t mean that EMV doesn’t have merit for authenticating card-present transactions. As part of the merchant advocacy stance and commitment to overall merchant protection that Shift4 truly believes in, we urge merchants to implement EMV in a strategic fashion with the layered security you need in spite of the pressures and interference you may be fielding from third parties.</li>
</ol>
Shift4’s Solution for EMV 
When a merchant accepts EMV credit and debit cards, card-present transactions are authenticated, but when a merchant uses tokenization and P2PE alongside EMV, true security begins. Here is what will happen during an EMV transaction when a merchant implements it using Shift4’s layered security solution for EMV:
<ol>
<li>The EMV chip authenticates the transaction. In the case of a chip and signature EMV card, this virtually ensures (but does not guarantee) that the card is genuine, and in the case of a chip and PIN EMV card, this verifies (but does not necessarily guarantee) the card and the cardholder are genuine.</li>
<li>Our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> solution encrypts all data at the point of interaction, when a consumer’s card interacts with the payment device, including any data that results from processing an EMV transaction.</li>
<li>Our <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization</a> solution protects data at rest, ensuring card data is never held in the merchant’s environment, which reduces the merchant’s PCI scope and also protects them from experiencing brand-damaging breaches. Our TrueTokenization solution ensures this data is protected while still allowing the merchant to perform business as usual, including returns, recurring billing, and incremental authorizations.</li>
</ol>
By adding P2PE and tokenization to your EMV solution, your EMV implementation will not only authenticate cards, but also help to lower your breach profile. This is the type of solution merchants should aim for, and if an entity is putting the pressure on you to do something different, you have to question who they are really looking out for. Be careful out there. And, as always, if you ever have any questions, Shift4 is here to help.
<style>h3.post-title{ max-width:520px !important; } </style>

Executive Insight: Take the Time to Do EMV Right (Part 2)

Tokenization has become more of a household name as of late, as more companies adopt the technology and as sister technologies like the consumer-based “payment tokens” of mobile wallets take shape. Shift4, on the other hand, has been using tokenization long before anyone else. After all, we invented it a decade ago! How was tokenization invented? Let’s take a trip back to the mid-2000s:
After years of attending the annual Hospitality Industry Technology Exposition and Conference (HITEC), Shift4’s founders had been in numerous conversations with hoteliers about security and data breaches. These hoteliers would share the challenges they were encountering while trying to secure cardholder data. The pioneers of tokenization kept coming back to one thought:
“Why is it that people think they need to store cardholder data?” they asked themselves. “Why don’t we just give them some other value that’s meaningless, so they won’t have to?”
And thus began the thought process that led to creating our <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> technology, which would provide a practical security solution that supported merchants’ everyday business operations while relieving them of the burden of storing and trying to secure cardholder data. The tokenization of payment card data is based on a concept that stretches back to Shift4’s earliest days and was developed out of our company founders’ core belief that our technologies should make processing payments more efficient and secure for our merchant customers. For years, we developed better ways to secure payment card data, and these concepts evolved into what we called tokenization.
Shift4 officially introduced the technology and the term “tokenization” to the public at our Transaction Security Summit in Las Vegas in September 2005 to improve security practices throughout the payments industry.
Flash forward to <a href="https://www.shift4.com/promotional/HITEC15.cfm" target="_blank" rel="noopener noreferrer">HITEC 2015</a>, when we <a href="https://www.shift4.com/company/newsroom/content/pr-20150617-s4-10th-anniversary-6-billion-tokens.cfm" target="_blank" rel="noopener noreferrer">shared the exciting news</a> about our 10th anniversary of TrueTokenization. Now, not only is TrueTokenization used by tens of thousands of merchants across North America, but we’ve officially reached (and surpassed) the milestone of six billion tokenized transactions!
A Simple Solution to Solve a Complex Problem 
When Shift4 introduced tokenization to the industry in 2005, the official meaning of tokenization was defined by Shift4 as the concept of using a non-decryptable piece of data, or “token,” to represent, by reference, sensitive or secret data. In the payment card industry context, tokens are used to reference cardholder data that is stored in a separate database, application, or offsite secure facility.
In order to meet merchant needs and provide the strongest security against hackers, the original tokenization solution, TrueTokenization, was designed to be:
<ul>
<li>Random – Because a TrueToken® is not mathematically-derived, it cannot be decrypted.</li>
<li>Globally Unique – By not allowing universally-accepted tokens, the security is increased for both merchants and consumers.</li>
<li>Transactional – A TrueToken is generated for each transaction to increase the security of your organization’s networks even further.</li>
<li>Alphanumeric – By combining a nearly infinite amount of numbers and letters, a TrueToken is a string of data hackers can&#8217;t predict and will never match a real credit card number.</li>
<li>Organic in Nature – TrueTokenization works pragmatically within the merchant environment to support analytics and loyalty programs while ensuring security.</li>
</ul>
We Tokenize in More Environments Than Anyone Else 
The success of tokenization has not only been how quickly it has caught on with our 24,000+ merchants and its influence in the payments industry, but also how many adaptations of the security technology we have developed to suit a variety of environments. No other company has customized tokenization in this way to ensure that any merchant can reduce their breach profile and shrink their PCI scope, no matter their industry or size.
When properly implemented and combined with <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a>, TrueTokenization ensures the best defense against hackers by not allowing any sensitive cardholder data to enter your environment in the first place. In order to accommodate any environment, we’ve released a full suite of tokenized security solutions, including:
<ul>
<li><a href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go®</a> – Add additional security to prevent your point-of-sale (POS) or property management system (PMS) solution from ever handling sensitive cardholder data.</li>
<li><a href="https://www.shift4.com/dotn/4tify/i4go.cfm" target="_blank" rel="noopener noreferrer">i4Go®</a> – Protect cardholder data in e-commerce and omni-channel environments by intercepting sensitive cardholder data before it ever enters a merchant’s site or hosting provider’s system.</li>
<li><a href="https://www.shift4.com/dotn/4tify/4res.cfm" target="_blank" rel="noopener noreferrer">4Res®</a> – Make sure sensitive cardholder data is removed from central reservation systems and tokenized before it enters your PMS.</li>
<li><a href="https://www.shift4.com/dotn/4tify/4Word.cfm" target="_blank" rel="noopener noreferrer">4Word®</a> – Support guest services by securely sharing credit or debit card information with a trusted third party to process a one-time payment on your guest’s behalf while keeping your own environment free of sensitive data.</li>
</ul>
Learn more about TrueTokenization by watching this short video, <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm?video=true" target="_blank" rel="noopener noreferrer">Tokenization for Beginners</a>, or by visiting our <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization page</a>. If you have any questions, contact our Las Vegas-based Customer Support team 24/7/365 at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%20Celebrates%2010th%20Anniversary%20of%20Tokenization!">support@shift4.com</a> or call 702.597.2480 (option 2).

Shift4 Celebrates 10th Anniversary of Tokenization!

From a payments point of view, hospitality environments are particularly complex. Typically, hotels keep payment card information on file for booking guarantees, advanced deposits, refunds, incremental authorizations, and more. This makes the hospitality environment at hotels, resorts, and motels particularly vulnerable to data thieves, who target these environments to retrieve payment card information held within the network.
Shift4 Secures Complex Hospitality Environments 
As a Shift4 merchant customer, however, you don’t have to worry about a thing. <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a> includes a full suite of payment security technologies that can secure your enterprise from booking engine to back office. And, with <a href="https://www.shift4.com/dotn/VT4/" target="_blank" rel="noopener noreferrer">VT4®</a>, our mobile point of sale (mPOS), you can extend your reach even further by securely accepting payments wherever your guests are.
Hospitality Payment Security Blueprint 
In fact, there are 12 common touchpoints where payment card data is introduced into the hospitality environment – and Shift4 has created multiple solutions to secure each one. Together, these technologies ensure that your cardholder data environment is limited to the secured payment-device level, dramatically reducing your breach profile and PCI scope. Just check out our <a href="https://www.shift4.com/PDF/Shift4-Hotel-POI.pdf" target="_blank" rel="noopener noreferrer">Hospitality Payment Security Blueprint</a> to find out how.
Learn more about how Shift4 can simplify and secure your environment by contacting our Las Vegas-based Customer Support team 24/7/365 at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%2012%20Hospitality%20Touchpoints%20Secured%20by%20Shift4">support@shift4.com</a> or call 702.597.2480 (option 2).

12 Hospitality Touchpoints Secured by Shift4

Visa® recently sent out a security alert to inform merchants of an increase in malware attacks targeting point-of-sale (POS) integrators. We encourage our merchant customers to take note of the following information, and to <a href="http://usa.visa.com/download/merchants/alert-pos-integrators.pdf" target="_blank" rel="noopener noreferrer"> review the Visa security alert</a> and pass it along to the appropriate departments or individuals.
What Is a POS Integrator? 
A POS integrator is a company that uses remote connections to manage the POS software and hardware used by merchants. This includes both POS system solutions and property management system (PMS) solutions. As Visa’s security alert explains, POS integrators resell, install, configure, and maintain this software and hardware, and may also provide IT support and ongoing maintenance using remote connections. If you’re using a third-party vendor to supply remote desktop access, then you will want to take action to minimize your risk.
Keep Your Eye Out for Suspicious Emails 
Malware attachments are showing up in emails disguised to look like they’re from LogMeIn, a cloud-based solutions company that provides remote access services. Like most malware attacks, these emails typically contain a link or attachment that, when activated, disables your anti-virus software and creates a channel into your POS or PMS in an attempt to steal your customers’ payment card information. If you regularly receive emails from LogMeIn, make sure you’re extra careful before opening them. There are some recurring pieces of content in these phishing attempts, so watch out for emails from LogMeIn, especially those referring to the following:
<ul>
<li>Automatic payment failure or credit card rejection</li>
<li>Subscription expiration</li>
<li>New security update or certificate</li>
</ul>
If you’ve received a questionable email from LogMeIn and are uncertain whether or not it may contain malware, contact LogMeIn customer support at 1.866.478.1805.
Increase in Targets of POS Integrators 
Visa’s security alert says that these new phishing scams discovered by LogMeIn point to a larger campaign involving hackers targeting remote access applications in general. Therefore, it is important to make sure that any third-party application you use is compliant with the Payment Card Industry Data Security Standard (PCI DSS) and to also share basic precautions with your employees about how to prevent becoming a target.
Tips to Prevent Malware 
Visa suggested several ways merchants can protect their environment against becoming a victim of these malware threats. Whenever possible, you should:
<ul>
<li>Avoid single-factor authentication. Quick logins are appealing because of their convenience, but they can provide an easy “cyber-lock” to pick.</li>
<li>Reduce the connection time of always-online and remote access services when not in use. Log out from your connected systems when they are not in use to cut down the amount of time your information may be exposed to hackers.</li>
<li>Update your software. Make sure your programs are running the latest version, so that any patches that provide protection against new malware families are included.</li>
<li>Configure your firewall. Restrict access to your POS or PMS so that only known IP addresses can access it.</li>
<li>Avoid common usernames and passwords. Make your login credentials tricky and nearly impossible to guess. Also, don’t use the same password on multiple accounts. The convenience of having the same password for everything is not worth the hassle of being compromised.</li>
</ul>
Shift4 Helps to Render Malware Useless 
Don’t leave anything behind for hackers to steal. With Shift4’s full suite of security solutions properly implemented, including <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer"> True P2PE™</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a>, sensitive payment card data never enters your environment. This leaves no payment data in your environment to be stolen and used by hackers, even if malware were to enter your POS or PMS. And, with <a href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go®</a>, <a href="https://www.shift4.com/dotn/4tify/i4go.cfm" target="_blank" rel="noopener noreferrer">i4Go®</a>, <a href="https://www.shift4.com/dotn/4tify/4res.cfm" target="_blank" rel="noopener noreferrer">4Res®</a>, and <a href="https://www.shift4.com/dotn/4tify/4Word.cfm" target="_blank" rel="noopener noreferrer">4Word®</a>, you’ll have a much higher level of security when you process transactions on traditional, e-commerce, and even mobile points of sale. Our goal is to keep you one step ahead of those who want your customers’ card data. After all: They Can’t Steal What You Don’t Have®.

Visa® Warns of New Malware Threats

How to Use eSignatures with Sertifi &amp; Shift4&#8217;s DOLLARS ON THE NET® 
Tuesday, Jun 23, 2015, 11:00-11:30 a.m. PST 
<a href="https://attendee.gotowebinar.com/recording/338699426783160321" target="_blank" rel="noopener noreferrer">View the Recording</a>
Are you ready to automate your contract and payment process? If so, we invite you to join our 30-minute webinar to find out how you can collect both signed agreements and secure customer payments up to 90% faster.
By using Sertifi together with Shift4’s DOLLARS ON THE NET® payment gateway together, you allow customers to quickly sign agreements using eSignatures and securely pay for products or services simultaneously. The online session is convenient and simple for customers, taking just a couple of minutes!
The integrated solution enables organizations to streamline the contract and payment process, while reducing PCI liability and risk. Organizations that use it are no longer burdened with credit card authorization forms, fax lines, or fear of a credit card data breach.
Benefits of Using Sertifi and Shift4’s DOLLARS ON THE NET®:
<ul style="margin-top: 0; padding-top: 0;">
<li style="margin-top: 0; padding-top: 0;">Improves sales efficiency</li>
<li>Reduces PCI scope</li>
<li>Recognizes revenue faster</li>
<li>Reduces high costs associated with paper</li>
<li>Builds credibility and trust with customers</li>
</ul>
What to expect on the 30-minute webinar:
<ul style="margin-top: 0; padding-top: 0;">
<li style="margin-top: 0; padding-top: 0;">Intro &#8211; Who is Sertifi?</li>
<li>Importance of eSignatures and PCI Compliance</li>
<li>How the Integration Works</li>
<li>Attendee Q&amp;A Session</li>
</ul>

WEBINAR: How to Use eSignatures with Sertifi & Shift4’s DOTN

Recently, Trend Micro published a brief on their blog about malware named MalumPOS. This blog post is based on a 2014 report and is most likely referencing 2013 or prior data in order to refer clients to their own endpoint-monitoring software. The post details a specific piece of malware that targets payment data as it passes through the memory (RAM) of a computer. While most of the report focuses on a single POS as the target, the article also refers to Shift4’s <a href="https://www.shift4.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway® (UTG®)</a> as a target, too.
Shift4 Is Targeted? No Need to Worry 
Shift4 wants to assure our merchant customers that there is no reason to worry about the information contained in this blog post. Every day, Shift4 securely processes credit, debit, and gift card payments for more than 24,000 merchant customers via traditional, e-commerce, and mobile points-of-sale throughout North America. Of course we are a target. In today’s climate, everyone who processes cardholder data is a target. This is why so many merchants entrust the burden of securing that sensitive payment card data to us – because Shift4 specializes in simplifying and securing cardholder data – and we have for over 20 years.
Being a target is what we expect and why our merchant customers know they can trust our vigilance to ensure their customers’ data is protected all day, every day. It’s why we take the time and care to include ironclad security methods and technologies as an essential component of each transaction we process, as well as the new payment processing solutions we develop and implement.
What You Need 
We have some advice for how you can ensure that you are protected with Shift4’s solutions:
<ol>
<li>Make sure that you are using the most current version of the UTG.</li>
<li>If you haven’t already, upgrade to use <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a>. When combined, Shift4’s True P2PE and TrueTokenization solutions ensure that our merchant customers never store, process, or transmit sensitive cardholder data. After all: They Can’t Steal What You Don’t Have®.</li>
<li>Take advantage of Shift4’s full security suite, including <a href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go®</a> to provide an additional layer of security at the keyboard driver level, <a href="https://www.shift4.com/dotn/4tify/i4go.cfm" target="_blank" rel="noopener noreferrer">i4Go®</a> to intercept cardholder data in e-commerce and omni-channel environments, <a href="https://www.shift4.com/dotn/4tify/4res.cfm" target="_blank" rel="noopener noreferrer">4Res®</a> to tokenize payment information contained in reservation requests from third parties, and more. Wherever you have a potential entry point for cardholder data, we’ve created a solution to secure it.</li>
</ol>
If you have any questions at all about Shift4’s payment security technologies, please contact our 24/7/365 Las Vegas-based Customer Support team at <a href="mailto:support@shift4.com?subject=Inquiry%3A%20Shift4%20Response%20to%20MalumPOS%20Malware">support@shift4.com</a> or call 702.597.2480 (option 2). We’re here for you!

Shift4 Response to MalumPOS Malware

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
U.S. a Unique EMV Market 
Four years ago, when the major issuing banks announced their timeline for transitioning to EMV in the U.S., payments industry insiders knew that the U.S. EMV migration would be more complicated than previous implementations around the globe had been. Accounting for more than half of the world’s payment transactions, and being an unregulated payments space, the U.S. market encompasses a wide variety of payments industry players, from merchants, processors, and payment terminal manufacturers to independent software vendors, merchant banks, credit and debit card issuers, and more. The sheer magnitude and unique consumer market lends itself to making the U.S. EMV migration much more complex than implementations in other countries.
Some Organizations Seek to Generate Fear 
Now, as issuers and merchants in the U.S. are adopting EMV, we’re seeing frequent reports that large numbers of U.S. merchants are “unaware” of or “unprepared” for EMV acceptance. Industry trade groups are contesting different aspects of the U.S. EMV liability shift, processors need more staff to process certifications, and on top of all of this – we are learning that EMV won’t solve all of our security problems, namely the data breaches that retailers and others have been plagued with in recent years.
The thing is, these complications in the U.S. EMV migration process were to be expected and had been noted by many experts in the field following the first announcement of the migration in 2011. Since that time, there have been numerous predictions that the U.S. will slowly migrate to EMV, with an estimated completion date of approximately 2020. Yet, as is typical in the way things work, when issuers, merchants, acquirers, or even consumers start worrying that the U.S. may be “behind” and that merchants may be slow to adopt EMV, a variety of industry players have sought to capitalize on this divide, creating a not-so-comical Chicken Little scenario. The result has been that many merchants are getting pressured to make large investments in implementing EMV the wrong way simply to be able to accept EMV cards according to a perceived “mandate” and by a perceived “deadline.”
Yes, EMV is coming. But no, the sky isn’t falling. I can’t express this enough. The EMV liability shift date is coming and – still – the sky isn’t falling.
Remember: EMV Implementations Must Be Done Correctly to Bring Value 
This isn’t to say that EMV doesn’t have a purpose and place in improving how we authenticate transactions at the point of sale. It absolutely will help to prevent the use of fraudulent cards in stores much better than traditional magnetic stripe cards. However, EMV is not 100% secure, EMV implementation is a complicated process, and upgrading payment terminals can be expensive. Implementing EMV right the first time is important. Merchants need to know that if someone is pressuring them to make a large investment or sign a new contract as a component of their migration to EMV, it is essential to take a step back, consider what’s being proposed, and consult their business operations and legal teams appropriately in order to take the precautions necessary to make the truly correct move for their business – not what organization A, B, or C is trying to sign them up for to become EMV-capable exactly by October 1, 2015.
As Hall of Fame basketball player John Wooden once proposed: “If you don’t have the time to do it right, when will you have time to do it over?” and he adds to the sentiment with, “Be quick, but don&#8217;t hurry.”
The True Nature of the EMV Liability Shift 
EMV marketing ploys, especially after the Target and Home Depot breaches last year, have exacerbated the confusion surrounding EMV. And, as the EMV liability shift date gets closer – which at this time is absolutely not a mandate – the various parties pressuring merchants to adopt EMV urgently are creating a misplaced sense of panic, leading merchants to adopt the quickest EMV solution possible, not necessarily the correct solution.
For example, in some cases:
<ol>
<li>Merchants are being urged to adopt EMV solutions that don’t incorporate point-to-point encryption (P2PE) or tokenization. These technologies can help prevent breaches and simplify PCI compliance. Further, they can help prevent sensitive payment card data from being stolen in the first place, which is the primary source of counterfeit cards. Additionally, the implementation of these systems may in fact put merchants in harm’s way, as some of the solutions may expose networks and other POS infrastructures to card data and change their PCI-DSS landscape.</li>
<li>Merchants are being pressured to move from an integrated payment solution to a standalone solution simply because an organization they work with has certified for EMV with a standalone payment terminal, but not an integrated payment terminal.</li>
</ol>
In either of these cases, how would moving to a solution that further exposes the merchant’s environment to breaches or that removes key time- and money-saving accounting and security functionalities be a move forward? The possibility of moving to a poor implementation of EMV is especially concerning when all merchants get in return is protection from a very specific segment of fraud that they may not be liable for anyway.
After all, the key shift in liability at stake with EMV is from the card issuers to the acquirers, also known as the merchant banks where merchants hold their accounts – not directly to the merchants themselves. If a merchant bank is not supporting EMV as of October 1, 2015, then that merchant bank will assume the liability. However, if the merchant bank is EMV capable, then the fraud liability remains with the card issuer.
Merchant Banks Need Their Merchants to Be EMV Ready 
How does a merchant bank become EMV ready? The merchant bank must make sure that all technologies related to EMV are certified, able to process and pass all data elements, and perform the processes necessary to accept an EMV payment. In practical terms, this means that the merchant holding an account at that bank must accept EMV cards and use an EMV-capable processing solution in order to “make the merchant bank EMV ready.” <a href="http://blog.shift4.com/2015/05/when-your-acquirer-comes-to-call-about.html" target="_blank" rel="noopener noreferrer">This is why some merchant banks are calling merchants and pressuring them to get ready for EMV fast. 
</a> 
Check Your Contracts – Are You Liable? 
But, the fact is that EMV may not even be accounted for in a merchant’s current contract. It is very possible that this type of fraud was traditionally considered “zero liability” (liability that was just part of the issuer doing business) and that a merchant’s agreements do not reflect or even anticipate this type of fraud. This means that, based on a merchant’s current contracts, it may not even be possible for the merchant to shoulder the responsibility for that fraud – unless that merchant signs a new contract that waives their protection from it. This is one very important reason why merchants need to be wary of any schemes that require them to re-sign a contract or get into a new contract related to updates for EMV, because any new or updated contract may also be asking the merchant to sign up for more liability than their current contract allows for.
Coming Soon 
Next month, I’ll go into more detail about the nature of the fraud liability shift and describe the actions merchants can take to ensure that their EMV implementation not only authenticates cards, but also helps to lower their breach profile as part of a true security solution. In the meantime, be wary of any organization forcing a single option for EMV on you – telling you that you must use this one type of device, be ready by this exact date, implement EMV without encryption and tokenization, etc. In these cases, one has to wonder whose benefit the organization is really looking out for, because no two merchant environments are exactly the same.
If you have any questions about EMV, visit our <a href="https://www.shift4.com/insight/EMV/" target="_blank" rel="noopener noreferrer">EMV microsite</a> or reach out to our Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Executive%20Insight%3A%20Take%20the%20Time%20to%20Do%20EMV%20Right">support@shift4.com</a> or 702.597.2480 (option 2). We’re here to help you 24/7/365.
<style>h3.post-title{ max-width:520px !important; } </style>

Executive Insight: Take the Time to Do EMV Right (Part 1)

The hospitality environment is unique in its handling of the payment card data of their guests. Large hotels and resorts generally involve hundreds, sometimes thousands, of touchpoints where payment card data can enter their systems – from reservations, retail stores, and valets to the front desk, restaurants, and snack stands. Resorts small and large often rely on storing cardholder data (CHD) for booking guarantees, advanced deposits, refunds, incremental authorizations, and more. Small resorts also sometimes use standalone payment terminals that require manually keying and auditing transactions, an often time-consuming process that is prone to errors and leaves sensitive CHD exposed. But, recent high-profile breaches in the hospitality space show these practices introduce risk to the hospitality environment.
P2PE and Tokenization Take the Target Off Your Back 
Shift4&#8217;s <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a> payment gateway delivers the secure, integrated payment technologies hoteliers need to protect themselves from becoming the next target of data thieves. When our tokenization and point-to-point encryption (P2PE) solutions are combined, hoteliers never store, process, or transmit sensitive CHD while still keeping normal hospitality business functions intact.
Our proprietary tokenization solution, <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a>, was the first payment tokenization solution on the market. This year, TrueTokenization celebrates its 10th anniversary and remains the most sophisticated tokenization solution available, with more than six billion successfully tokenized transactions processed to date. By replacing sensitive CHD with a 16-character, globally unique, randomized, alphanumeric value, TrueTokenization provides all the business functions hoteliers need without the burden of storing and securing sensitive payment data.
Our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> solution encrypts payment data at the payment device so sensitive CHD never enters your systems. That encrypted data is sent to Shift4’s secure data centers and Shift4 returns a representation of that card’s information, called a TrueToken®, to use for subsequent transaction needs. Shift4 hosts the actual CHD for you – which greatly reduces your breach profile and simplifies PCI compliance.
By using these two solutions together, your environment is protected because there is no sensitive CHD left for hackers to steal. This means that even if your system is compromised by malicious code or malware, the fraudsters can’t get to your guests’ payment data. After all, They Can’t Steal What You Don’t Have®.
Hundreds of Integrations in Hospitality 
Shift4 connects to nearly every bank and processor in North America, works with dozens of the top payment devices, and integrates with <a href="https://www.shift4.com/partner/integration/" target="_blank" rel="noopener noreferrer">hundreds of the most advanced point-of-sale (POS) and property management system (PMS) solutions</a>, including:
<ul>
<li>InfoGenesis™ POS and Lodging Management Systems (LMS) by Agilysys</li>
<li>MICROS 3700 and 9700 by MICROS Systems</li>
<li>SMS|Host and SpaSoft by PAR Springer-Miller</li>
</ul>
Whether you’re a boutique hotel, motel chain, mega-resort, restaurant, retailer, spa, or private club, DOLLARS ON THE NET can secure and simplify your payments. We’ll be at <a href="https://www.shift4.com/HITEC15" target="_blank" rel="noopener noreferrer">HITEC</a> this year in booth #1623. If you plan to attend, be sure to stop by and say hello!
Find out more about how Shift4’s payment security technologies can reduce your breach profile and simplify PCI assessments by contacting our 24/7/365 Las Vegas-based Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%20Has%20Innovative%20Solutions%20to%20Prevent%20Breaches%20in%20Hospitality">support@shift4.com</a> or call 702.597.2480 (option 2).

Innovative Solutions to Prevent Hospitality Breaches

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
If there’s one word we hear too often in the payments industry, it’s “compliance.” Too many security officers, IT directors, and other business leaders hold to the term like Linus from the Peanuts gang clings to his blanket. And – as dozens of major breaches over the past few years have proven – compliance offers them about the same guarantee of protection as a child’s security blanket.
Compliance has never been the right term to pair with security. Why? Because at its root, it implies a checkbox approach to security. The verb “comply” comes from the Latin complere – “to fill up.” So complying with a security standard literally means filling up that standard by checking off all of its requirements. This would be great if there were a standard that offered 100 percent (complete) security, but security experts around the globe agree that complete security is a fallacy. So, the belief that complying with a security standard will guarantee your security is akin to trying to fill up a bucket that has a hole in the bottom. It may work for an instant, but the moment you stop adding water, you will no longer have a full bucket, and, for the sake of our analogy, you will no longer be in compliance.
In the payments industry, this fact was perfectly (although painfully) illustrated by the <a href="http://www.verizonenterprise.com/pcireport/2015/" target="_blank" rel="noopener noreferrer">2015 PCI Compliance Report</a>, published by Verizon Enterprise Solutions. According to Verizon, 80 percent of merchants assessed as PCI compliant last year fell out of compliance within one year of their assessment. Verizon’s report also stated, “Of all the companies investigated by our forensics team over the last 10 years following a breach, not one was found to have been fully PCI DSS compliant at the time of the breach.”
Clearly there’s a hole in the PCI compliance bucket, so just filling it up to the level of compliance is not sufficient. Instead, you need constant monitoring and the steady addition of water to keep that bucket full. This persistent stream of effort is the difference between compliance and vigilance. Vigilance comes from the Latin vigil, which means “watchful, awake” and from vigilantem, which adds “anxious and careful” to that definition. Vigilance is the answer to our security woes. It is what will ultimately stop the breaches that have run rampant over the past 18 months. Unfortunately, it is not a simple solution.
Vigilance requires great effort and great expense. It requires constant improvement – not a “one-and-done” approach. For Shift4, it requires that 4% of our gross revenues (not our net profit, our overall gross) be reinvested immediately into security. It is the reason that we have <a href="https://www.shift4.com/company/newsroom/content/pr-20150429-shift4-commitment-merchant-security.cfm" target="_blank" rel="noopener noreferrer">nearly a dozen Certified Information Systems Security Professionals</a> (CISSPs) on staff, when most payment organizations 10 times our size only have one or two.
Our vigilance is also evident in our product development. We are not always first-to-market because we take the time to do things right and to ensure that our products have security built in from the very beginning. Too many companies throw together a new program and then try to bolt-on an existing security solution that may not fit perfectly. This is neither careful nor anxious – and therefore not vigilant. And, it is evident in our onboarding process; we freely admit that we are not the quickest or simplest gateway to get started with, but that is because we are cautious and watchful every step of the way.
Finally, our vigilance is the reason we are so often at odds with the industry standards bodies when they aim to apply a single Draconian standard and then haphazardly force merchants to modify business practices and technologies to comply with it. This is not how we operate. Instead, we provide security solutions that are tailored to our merchants and their unique business needs. We believe that compliance should come as a natural result of security, not instead of it.
The greatest challenge on the road to vigilance is realizing that for some, true vigilance may be unattainable without outside assistance. I understand that for nearly all small businesses – and even most mid-sized businesses – the resources required for around-the-clock monitoring of your card-data environment are cost prohibitive. Even for many of the large merchants that we work with, assuming full responsibility for their own customers’ data is too great of a risk with little to no payoff. This is why for many businesses the wisest and most vigilant decision is to entirely remove the burden of protecting cardholder data by ensuring that payment data never enters your environment in the first place. When you do this, it is essential that you entrust a company with a proven track record in the payments industry and an uncompromising commitment to maintaining the strictest security in terms of protocols and product development on your organization’s behalf.
By implementing Shift4’s <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> point-to-point encryption solution, merchants can prevent card data from ever getting past the secure swipe device – meaning it never enters your point of sale, networks, etc. – and when that is layered with <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="new" rel="noopener noreferrer">TrueTokenization®</a> to prevent the long-term storage of card data, merchants can entrust their sensitive data to an organization that is ever-vigilant and committed to the relentless pursuit of security.
Ultimately, in an era of organized criminal attacks against card data environments and state-sponsored attacks on businesses, you cannot afford not to be vigilant. If costs or business structure precludes you from maintaining this level of security, then it is your responsibility to find a partner who can provide it for you. Yes, vigilance is expensive, but compliance can be much more costly.

Executive Insight: The Cost of Vigilance Versus Compliance

A survey by Newtek Business Services, Inc., shows that 71% of small businesses do not know about EMV and how it applies to them. Are you included? If you run a small business, then we have a primer on what the October 2015 fraud liability shift means for you and how Shift4 is helping you reduce your fraud liability with EMV, and reduce your breach risk and PCI scope with <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a>.
What Is EMV? 
EMV is a payment card technology that will soon be used in the U.S. to replace magnetic stripe credit and debit cards. EMV cards are sometimes called “chip cards” or “smart cards” because they have a computer chip on them that helps to prevent the use of counterfeit, skimmed, lost, or stolen credit or debit cards at card-present payment terminals. These cards will be inserted (dipped) into payment terminals instead of swiped, allowing the terminal to verify the card and write a security code back to the chip. If there is any unusual activity, the card will stop working. Also, EMV cards are more expensive and difficult to copy than traditional magnetic stripe cards, so EMV cards are much less likely to be duplicated by criminals.
What’s the Problem With EMV? 
EMV cards issued in the U.S. will still have the magnetic stripe for a few years, until the change to EMV is completed nationwide. Note that in no countries where EMV has been previously implemented has it reached 100% adoption. Also, because EMV is a 20-year-old technology, it doesn’t account for point-to-point encryption (P2PE), so most EMV terminals still introduce clear-text card data into the merchant environment. This means that fraudsters can still steal card information from businesses that have not implemented P2PE, even after the U.S. migration to EMV is completed. This stolen card information can be used to create counterfeit magnetic stripe cards and used in-store, online, or in mail order/telephone order environments until they are identified as fraudulent and cancelled, just as they are today. This is why it is so important for merchants to ensure that their EMV terminal also supports P2PE so that while they are ensuring fraud doesn’t happen on the front-end, they are not leaving cardholder information exposed in their environment. For more detail about what EMV cards can and cannot do, please check out our <a href="https://www.shift4.com/insight/EMV/" target="_blank" rel="noopener noreferrer">EMV Web page</a>.
EMV Is Not a Requirement by PCI 
There are some rumors going around that if a merchant does not accept EMV cards by the liability shift date, then they will not be considered PCI compliant. This is false. <a href="https://www.pcicomplianceguide.org/will-emv-make-you-pci-compliant/" target="_blank" rel="noopener noreferrer">PCI at this time has no requirements related to EMV</a>. However, the card brands do have a binding statement about a change in how they will be handling the liability for fraud. The major credit card brands Visa, MasterCard, Discover, and American Express have been carrying a large financial burden for credit and debit card fraud. Thus, as of October 1, 2015, in the U.S., the liability for fraud may move to an issuing bank, processor, or even a merchant if a fraudulent transaction is placed and EMV was not supported. Essentially, the liability for the fraudulent transaction will fall to the “weakest link in the EMV liability chain” due to a lack of support for EMV or poor implementation.
What Small Businesses Need to Know 
Large retailers who already face a high rate of chargebacks as a result of fraud and those who sell high-ticket merchandise are some of the first merchants getting ready for EMV. Jim Daly in Digital Transactions Today notes: “Big-box retailers and national restaurant chains are much further along than small merchants.” But, what does this mean for small merchants?
Fraud has a way of moving to those areas that are less protected. This could mean not only e-commerce, where there will be no EMV, but also merchant locations that do not support EMV after the liability shift deadline. Newtek estimates 80% of U.S. merchants are expected to be EMV ready by October, but we think this estimate is very high – the card brands are saying 50% of U.S. merchants will be EMV compliant by 2020. In the meantime, merchants who are not ready for EMV may face higher fraud liability than they have before. This is why it’s very important that every merchant – both large and small – evaluate their previous fraud and chargeback levels, and potential risk level, and weigh it against their investment in new EMV-capable payment terminals.
If you aren’t ready for EMV but want to start preparing, you can <a href="https://www.shift4.com/insight/emv/index.cfm?section=merchants" target="_blank" rel="noopener noreferrer">find the steps you need to take here</a>. If you have some questions about EMV and want a better understanding, please reach out to our 24/7/365 Customer Support team, who are here to help you at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20EMV%20for%20Small%20Businesses">support@shift4.com</a> or 702.597.2480 (option 2).
Shift4 Makes EMV Simple 
Again, EMV cards help prevent fraud – not breaches. But, don’t worry. Shift4 makes it easy for you to prepare for EMV and ensure that you have True P2PE and TrueTokenization in place. We currently have <a href="http://blog.shift4.com/2015/04/which-emv-device-is-right-for-you.html" target="_blank" rel="noopener noreferrer">7 payment devices that are being certified for EMV – and more on the way</a>. The best part is that every device Shift4 is certifying will already have Shift4’s encryption keys injected to support True P2PE when purchased from one of our authorized vendors. Plus, combined with TrueTokenization, you can ensure you’re not only prepared for EMV, but also that you will never store, process, or transmit sensitive cardholder data in your environment, reducing your PCI scope and leaving nothing for hackers to steal. Support for True P2PE and TrueTokenization is already included with DOLLARS ON THE NET®, so if you don’t have these features set up, then you should!
We’re always here to answer any questions you may have about EMV and about Shift4’s secure payment solutions. Contact our 24/7/365 Las Vegas-based Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20EMV%20for%20Small%20Businesses">support@shift4.com</a> or call 702.597.2480 (option 2).

EMV for Small Businesses

Connecting mobile devices to your company network can introduce security risks to the environment if you aren’t careful. However, if you follow these simple rules for smartphone usage, provided by the Financial Services Information Sharing and Analysis Center (FS-ISAC), your environment will be much better off for it. 
By 2017, the number of smartphone users in the U.S. is expected to surpass 200 million, nearly 65 percent of the population.i. Negotiating security in the face of an ever-growing implementation of mobile devices presents serious challenges for organizations. Risks include the growth of Bring Your Own Device (BYOD) (coupled with a lack of security controls for these devices), loss or theft of devices, and the proliferation of mobile malware.
Users need to understand the risks and the steps they can take to minimize them, particularly as cybercriminals often use employees as the entry point into an organization’s network. Below are some key actions users can take to help minimize the likelihood of a successful cyber attack.
Regularly update your device. 
Mobile malware increased 75% in 2014 from 2013, and further increases in malware are expected in 2015, particularly in mobile ransomware.ii. Updated operating systems and security software are critical in protecting against emerging threats.
Enable encryption. 
Enabling encryption on your smartphone is one of the best ways to safeguard information stored on the device, thwarting unauthorized access.
Use a passcode. 
In case your phone ever does fall into the wrong hands, don’t make it easy for someone to access all your important information! Enable strong password protection on your device and include a timeout requiring authentication after a period of inactivity. Secure the smartphone with a unique password – not the default one it came with. Do not share your password with others.
Do not use public Wi-Fi. 
Do not log into accounts and do not conduct any sensitive transactions, such as shopping or banking, while using public Wi-Fi. Disable the “automatically connect to Wi-Fi” setting on your device.
Install applications from trusted sources. 
Last fall, Gartner issued a prediction that more than 75 percent of mobile applications will fail basic security tests through 2015.iii. When downloading apps, be proactive and make sure that you read the privacy statement, review permissions, check the app reviews and look online to see if any security company has identified the app as malicious.
Install a phone locator and remote erase app. 
Misplacing your device doesn’t have to be a catastrophe if it has a locater app. Many such apps allow you to log on to a computer and see on a map exactly where the device is. Remote erase apps allow you to remotely wipe data from your device, helping to minimize unauthorized access to your information in the event you cannot locate the device.
Disable unwanted services when not in use. 
Bluetooth and Near Field Capabilities (NFC) can provide an easy way for an unauthorized user nearby to gain access to your data. Turn these features off when they are not required.
Carefully dispose of mobile devices. 
With the constant changes in the smartphone market, many users frequently upgrade to new devices. Make sure you wipe the information from your smartphone before disposal. For information on how to do this, check the website of your mobile provider or the manufacturer.
Also remember that if you do sync with a cloud, don’t keep any information you want to keep private, including personal information and photos, on your device. And, make sure to use an extremely long and complex password. It’s always recommended that your password be more than four characters and that you do not reuse passwords for multiple accounts.
Don’t forget to follow these steps and share them with your employees to help maintain the security of your environment.
<hr />
<div style="font-size: 0.8em;">
<div id="ftn1">i. <a href="http://www.emarketer.com/Article/2-Billion-Consumers-Worldwide-Smartphones-by-2016/1011694" target="_blank" rel="noopener noreferrer">http://www.emarketer.com/Article/2-Billion-Consumers-Worldwide-Smartphones-by-2016/1011694</a></div>
<div id="ftn2">
ii. <a href="http://www.cnbc.com/id/102338872" target="_blank" rel="noopener noreferrer">http://www.cnbc.com/id/102338872</a>
</div>
<div id="ftn3">
iii. <a href="http://www.gartner.com/newsroom/id/2846017" target="_blank" rel="noopener noreferrer">http://www.gartner.com/newsroom/id/2846017</a>
</div>
</div>

Cyber Security Tips for Smartphone Usage

EMV: What It Is and What It’s Not
U.S. EMV is coming. Are you prepared? In the simplest terms, EMV is a special chip embedded on a credit or debit card that helps to prevent card-present fraud. The EMV chip prevents counterfeiting, skimming, and the use of lost or stolen credit or debit cards. The specification for EMV chips was first created in 1994 by the credit card brands Europay, MasterCard, and Visa (EMV) and is now owned by American Express, JCB, MasterCard, UnionPay, and Visa. For more than two decades, EMV chip cards have been in use in every major market in the world – except the U.S.
What It Is: 
More specifically, EMV defines how a payment terminal interacts with a chip card. The EMV chip, which is similar to a cell phone SIM card, is embedded on a credit card. When properly implemented, the EMV card will authenticate each transaction, preventing card-present fraud. In the U.S., each credit card brand has developed its own chip-functionality specifications and theoretically, for the convenience of both consumers and merchants, U.S. EMV chip cards will retain a magnetic stripe for a few years until EMV adoption is 100%. But note, even in areas where EMV has been implemented for years, <a href="http://www.emvco.com/documents/EMVCo_EMV_Deployment_Stats1.pdf" target="_blank" rel="noopener noreferrer">not a single EMV-compliant country has reached 100% adoption</a>.
While most global markets have required that EMV cards be issued with PINs (known as chip and PIN), the U.S. market is unregulated and the credit card issuers may adopt signature verification at the point of sale, known as chip and signature, instead of a PIN. This has benefits in terms of not requiring consumers to memorize another PIN and not requiring PIN devices at restaurants, but it also has major drawbacks, namely that a PIN is a much more secure verification of a cardholder than a signature.
However, the largest benefit of EMV is in its ability to allow an EMV-capable device to write a security code to an EMV chip whenever a transaction is completed. This technology allows for any unusual activity in the card’s card-present transaction history to disable the card, which will prevent fraudulent card-present transactions from taking place. Another benefit is that because EMV chips are used worldwide, issuing EMV chip cards in the U.S. will allow for improved global credit card acceptance.
What It’s Not: 
EMV is not a cure-all for security – Merchants will still need to foster daily security practices and implement layered security with technologies like our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization</a>® solutions to protect their environment from fraud and breaches.
EMV is not a new technology – EMV has been in use for more than 20 years and as of the end of 2013, <a href="http://www.emvco.com/documents/EMVCo_EMV_Deployment_Stats.pdf" target="_blank" rel="noopener noreferrer">according to EMVCo</a>, more than 2 billion EMV cards were already in use worldwide prior to the start of U.S. EMV migration.
EMV is not a foolproof solution for preventing fraud – Has credit card fraud disappeared from those countries? Actually, no. Card-present fraud has been greatly reduced, but because EMV is not universally accepted and does not secure card-not-present fraud, EMV is no silver bullet for preventing fraud. In countries where EMV has been implemented, <a href="https://www.internetretailer.com/2015/03/05/card-not-present-fraud-rates-will-rise-question-when" target="_blank" rel="noopener noreferrer">the frequency of card-not-present fraud has risen</a>.
EMV is not a complete replacement for the magnetic stripe – Payments industry experts predict that the EMV migration in the U.S. won’t be completed until 2020. Even in areas where EMV has been implemented since 1994, <a href="http://www.emvco.com/documents/EMVCo_EMV_Deployment_Stats1.pdf" target="_blank" rel="noopener noreferrer">there is still not 100% market saturation</a>. This means that there are still many places where non-EMV cards are accepted.
EMV is not a method for preventing breaches – EMV is specifically a tool to help prevent card-present fraud. Most EMV-capable payment devices still output clear text data, which means that your environment is just as susceptible to breaches after implementing EMV – unless technologies like True P2PE and TrueTokenization are in use.
EMV is not a mandate – There is not a requirement that merchants become EMV compliant. Unlike the PCI DSS and PA-DSS, which are PCI requirements for merchants who want to accept credit and debit cards, the EMV specification is a capability for card acceptance recommended by the card brands. This recommendation involves a shift in liability that will make the “weak link in the EMV capability chain” liable for any fraudulent transactions that are not processed according to the EMV specification, meaning that instead of the banks being liable for instances of fraud, it may shift to the bank, processor, or merchant, if those organizations do not have EMV in place.
Shift4 Provides Security Beyond Compliance® 
Shift4 supports EMV. And, combined with our True P2PE and TrueTokenization solutions, our merchant customers never store, process, or transmit payment card data <a href="https://www.shift4.com/dotn/4tify/" target="_blank" rel="noopener noreferrer">from any entry point</a> into their environment, reducing PCI scope and leaving nothing for hackers to steal. They Can’t Steal What You Don’t Have®.
Connect With Shift4
Check back for regular updates as we continue to prepare our merchant customers and business partners for the migration to U.S. EMV. And, if you have any questions, <a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">contact Shift4 today</a>.

EMV: What It Is and What It’s Not

EMV: What It Is and What It’s Not
U.S. EMV is coming. Are you prepared? In the simplest terms, EMV is a special chip embedded on a credit or debit card that helps to prevent card-present fraud. The EMV chip prevents counterfeiting, skimming, and the use of lost or stolen credit or debit cards. The specification for EMV chips was first created in 1994 by the credit card brands Europay, MasterCard, and Visa (EMV) and is now owned by American Express, JCB, MasterCard, UnionPay, and Visa. For more than two decades, EMV chip cards have been in use in every major market in the world – except the U.S.
What It Is: 
More specifically, EMV defines how a payment terminal interacts with a chip card. The EMV chip, which is similar to a cell phone SIM card, is embedded on a credit card. When properly implemented, the EMV card will authenticate each transaction, preventing card-present fraud. In the U.S., each credit card brand has developed its own chip-functionality specifications and theoretically, for the convenience of both consumers and merchants, U.S. EMV chip cards will retain a magnetic stripe for a few years until EMV adoption is 100%. But note, even in areas where EMV has been implemented for years, <a href="http://www.emvco.com/documents/EMVCo_EMV_Deployment_Stats1.pdf" target="_blank" rel="noopener noreferrer">not a single EMV-compliant country has reached 100% adoption</a>.
While most global markets have required that EMV cards be issued with PINs (known as chip and PIN), the U.S. market is unregulated and the credit card issuers may adopt signature verification at the point of sale, known as chip and signature, instead of a PIN. This has benefits in terms of not requiring consumers to memorize another PIN and not requiring PIN devices at restaurants, but it also has major drawbacks, namely that a PIN is a much more secure verification of a cardholder than a signature.
However, the largest benefit of EMV is in its ability to allow an EMV-capable device to write a security code to an EMV chip whenever a transaction is completed. This technology allows for any unusual activity in the card’s card-present transaction history to disable the card, which will prevent fraudulent card-present transactions from taking place. Another benefit is that because EMV chips are used worldwide, issuing EMV chip cards in the U.S. will allow for improved global credit card acceptance.
What It’s Not: 
EMV is not a cure-all for security – Merchants will still need to foster daily security practices and implement layered security with technologies like our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization</a>® solutions to protect their environment from fraud and breaches.
EMV is not a new technology – EMV has been in use for more than 20 years and as of the end of 2013, <a href="http://www.emvco.com/documents/EMVCo_EMV_Deployment_Stats.pdf" target="_blank" rel="noopener noreferrer">according to EMVCo</a>, more than 2 billion EMV cards were already in use worldwide prior to the start of U.S. EMV migration.
EMV is not a foolproof solution for preventing fraud – Has credit card fraud disappeared from those countries? Actually, no. Card-present fraud has been greatly reduced, but because EMV is not universally accepted and does not secure card-not-present fraud, EMV is no silver bullet for preventing fraud. In countries where EMV has been implemented, <a href="https://www.internetretailer.com/2015/03/05/card-not-present-fraud-rates-will-rise-question-when" target="_blank" rel="noopener noreferrer">the frequency of card-not-present fraud has risen</a>.
EMV is not a complete replacement for the magnetic stripe – Payments industry experts predict that the EMV migration in the U.S. won’t be completed until 2020. Even in areas where EMV has been implemented since 1994, <a href="http://www.emvco.com/documents/EMVCo_EMV_Deployment_Stats1.pdf" target="_blank" rel="noopener noreferrer">there is still not 100% market saturation</a>. This means that there are still many places where non-EMV cards are accepted.
EMV is not a method for preventing breaches – EMV is specifically a tool to help prevent card-present fraud. Most EMV-capable payment devices still output clear text data, which means that your environment is just as susceptible to breaches after implementing EMV – unless technologies like True P2PE and TrueTokenization are in use.
EMV is not a mandate – There is not a requirement that merchants become EMV compliant. Unlike the PCI DSS and PA-DSS, which are PCI requirements for merchants who want to accept credit and debit cards, the EMV specification is a capability for card acceptance recommended by the card brands. This recommendation involves a shift in liability that will make the “weak link in the EMV capability chain” liable for any fraudulent transactions that are not processed according to the EMV specification, meaning that instead of the banks being liable for instances of fraud, it may shift to the bank, processor, or merchant, if those organizations do not have EMV in place.
Shift4 Provides Security Beyond Compliance® 
Shift4 supports EMV. And, combined with our True P2PE and TrueTokenization solutions, our merchant customers never store, process, or transmit payment card data <a href="https://www.shift4.com/dotn/4tify/" target="_blank" rel="noopener noreferrer">from any entry point</a> into their environment, reducing PCI scope and leaving nothing for hackers to steal. They Can’t Steal What You Don’t Have®.
Connect With Shift4
Check back for regular updates as we continue to prepare our merchant customers and business partners for the migration to U.S. EMV. And, if you have any questions, <a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">contact Shift4 today</a>.
<div id="emv-section2Text" class="emv-article-section">
Shift4 Makes EMV Easy for Merchants
Shift4 makes getting ready for U.S. EMV easy for merchants. Here’s how:
<ul>
<li>Shift4’s support for EMV is complemented by our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> (point-to-point encryption) and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization</a>® solutions, ensuring our merchant customers get the strongest payment data security available.</li>
<li>Merchants using DOLLARS ON THE NET can choose from premier <a href="http://blog.shift4.com/2015/04/which-emv-device-is-right-for-you.html" target="_blank" rel="noopener noreferrer">payment devices</a> that are both EMV capable and that come with Shift4’s encryption keys for True P2PE already injected.</li>
<li>Since Shift4 is completely bank and processor neutral, merchants can quickly and safely switch banks or processors as needed.</li>
<li>Shift4 features <a href="https://www.shift4.com/dotn/integration/" target="_blank" rel="noopener noreferrer">350+ integrations with the leading POS and PMS solutions</a>, so merchants can be assured that their POS or PMS will be supported to accept EMV transactions.</li>
</ul>
Are You Ready for EMV?
Check for regular updates on <a href="https://www.shift4.com/insight/emv/" target="_blank" rel="noopener noreferrer">our EMV microsite</a>. For more detailed information, <a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">contact Shift4 today</a>.
</div>
<div id="emv-section3Text" class="emv-article-section">
Shift4 Makes EMV Easy for ISVs
Shift4 makes getting ready for U.S. EMV easy for ISVs with a simple certification for EMV. Here’s how:
<ul>
<li>Shift4’s <a href="https://www.shift4.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway® (UTG®)</a> controls the payment devices connected to it, so ISVs who are currently certified with Shift4 for debit will be able to offer U.S. EMV without making any significant changes to their existing software.</li>
<li>Because of the UTG’s device control, ISVs certified with Shift4 will automatically receive EMV certifications for each device and processor we support, so there is no need for them to do a separate certification for each device. This saves ISVs about six months of development time (approximately $250,000 or more) plus certification fees (which can vary from $4,000 to $15,000 per pass) for each device and processor.</li>
<li>The UTG also offers no-cost, no-hassle system updates, including updates to stay compliant with the industry’s regulations, resulting in approximately $100,000 cost savings or more in ongoing development costs.</li>
<li>In Canada – and now in the U.S. – Shift4’s PA-DSS-validated UTG stands in the place of the POS or PMS solution in the certification process as the payment application of record. This means ISVs can focus their time and money (and development cycles) on other features.</li>
<li>Our full suite of technologies allows vendors to often entirely remove their application from PCI DSS scope – meaning costly PA-DSS validations may no longer be required.</li>
</ul>
Are You Certified With Shift4 for EMV?
<a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">Contact Shift4 today</a> to ensure you are certified with Shift4 for U.S. EMV and check our <a href="https://www.shift4.com/insight/emv/" target="_blank" rel="noopener noreferrer">EMV microsite</a> for regular updates.
</div>
<div id="emv-section4Text" class="emv-article-section">
Shift4 Makes EMV Easy for Payment Device Manufacturers
Shift4 makes getting ready for U.S. EMV easy for payment device manufacturers. Here’s how:
<ul>
<li>Because Shift4’s integrations to the various POS and PMS solutions allow us to stand in for them as the payment application of record, we have the ability to also stand in for the POS and PMS solution in EMV certifications. This means that after we’ve certified a device to a given processor, it is certified no matter which POS or PMS solution a merchant uses (so long as they are integrated to <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET</a>). This can save payment device manufacturers months of work and tens of thousands of dollars. Also, it gets certified devices to market faster.</li>
<li>Shift4 satisfies the 600+ flows required by the processors for EMV certification with a simplified, &#8220;one-and-done&#8221; approach. When device manufacturers certify a device with us – once – they’re good to go.</li>
<li>Certifying a payment device with Shift4 will increase exposure to merchants across every industry in North America. We work with more than 24,000 merchants across over 100,000 locations throughout the U.S., Canada, and the Caribbean.</li>
<li>Shift4 provides payment device manufacturers with freedom for innovation when adding new features and capabilities. Because our unique technologies allow us to stand in for POS and PMS solutions and control the payment devices, all of our integrated POS and PMS solutions will support new device upgrades with no development required from the POS or PMS solution vendor, so long as Shift4 supports the new features. This means innovations can reach more locations, more quickly.</li>
</ul>
Are Your Payment Devices Certified With Shift4 for EMV?
<a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">Contact Shift4 today</a> to ensure your payment device is certified with Shift4 for U.S. EMV. And, check our <a href="https://www.shift4.com/insight/emv/" target="_blank" rel="noopener noreferrer">EMV microsite</a> for regular updates as we continue to prepare our merchant customers and business partners for the migration to U.S. EMV.
</div>
<div id="emv-section5Text" class="emv-article-section">
Shift4 Makes EMV Easy for Processors
Shift4 makes getting ready for U.S. EMV easy for processors. Here’s how:
<ul>
<li>Shift4 will do the legwork of certifying payment devices and ISVs for EMV so processors won&#8217;t have to, saving you time and money. This means that if you certify with Shift4, we will help you reach tens of thousands of merchants who are looking for an EMV-ready solution that works with their POS or PMS solution. (We can also make it simple for merchants to switch to EMV-ready processors who have certified with Shift4.)</li>
<li>Because Shift4 replaces the POS or PMS solution as the payment application of record, a certification to us gives a processor access to our full network of <a href="https://www.shift4.com/dotn/integration/" target="_blank" rel="noopener noreferrer">integrated POS and PMS solutions</a> (350+ and growing), payment devices from all the leading manufacturers, and merchants who are looking for a certified, secure EMV solution.</li>
</ul>
Are You Ready for EMV?
Processors, make sure you put Shift4 at the top of your list for EMV certification. Certifying Shift4 for EMV will save you time and money on EMV certifications and help connect you to Shift4’s integration partners and merchant customers. <a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">Contact Shift4 today</a>.
</div>
<div id="emv-section6Text" class="emv-article-section">
Shift4 Makes EMV Easy for the Credit Card Brands
Shift4 makes the process of preparing for U.S. EMV easier for the credit card brands. Here’s how:
<ul>
<li>If card brands (e.g., Visa, MasterCard, etc.) encourage their vendors to partner with a payment gateway like Shift4’s, it will help to get the U.S. market ready for EMV faster. This is because Shift4 provides processors and payment device manufacturers the help that they need to prepare for EMV and connects them with merchants who desire EMV readiness, as well as the best payment and security solutions.</li>
<li>We understand that EMVCo wants global interoperability of chip-based payment cards. Shift4 offers the best solution since we are proudly bank and processor neutral and are dedicated to reducing the complexities of the U.S. EMV migration for everyone involved.</li>
</ul>
Connect With Shift4
Check our <a href="https://www.shift4.com/insight/emv/">EMV microsite</a> for regular updates as we continue to prepare our merchant customers and business partners for the migration to U.S. EMV. And, if you have any questions, you can <a href="https://www.shift4.com/insight/emv/index.cfm?contact=1">contact Shift4 today</a>.
</div>

EMV Made Simple

Shift4’s SVP of Applications Development, Steve Sommers, was recently invited to San Antonio to speak at the Hotel Technology Next Generation (HTNG) North American Conference. The session he was asked to join, entitled “Securing Payment Data: Tales From the Front,” featured Sommers alongside Rob Martin, the VP of Security Solutions for device manufacturer Ingenico, and Merchant Link’s Director of Product, Christian McMahon. 
Here are the top three takeaways from their session:
1. EMV will not prevent breaches. 
All three payments experts responded with a unified “no” when asked if EMV would solve our nation’s payment data breach problems.
“That’s not what EMV was designed for,” said Shift4’s Sommers. “It was designed to authenticate the card and to reduce card-present fraud. And that’s exactly what it does; pretty much all the security claims beyond that are exaggerated marketing efforts.”
2. Layering real security solutions along with EMV is a merchant’s best bet. 
Ingenico’s Rob Martin described the key distinction between the technologies: “EMV protects you from the fraud that’s already taken place. P2PE and tokenization protect you from becoming the source of new fraud.”
3. The urgency of EMV adoption likely depends on the industry you serve. 
Many merchants are fearful that as of October 1, 2015 – the EMV fraud liability shift date – they will suddenly see a windfall of fraudulent charges and a massive financial liability. In reality, this is true only for merchants who already have a high rate of card-present fraud in their environment and who currently see a high volume of chargebacks.
For retailers, with their historically higher fraud rates, EMV should be top of mind. But, since they’ll need new terminals to read the cards anyhow, they should confirm that their new solutions support tokenization and P2PE as well as EMV.
For hoteliers, the fraud rates are much lower, so the October date seems much less daunting. Merchant Link’s McMahon shared a story from one of his largest hospitality clients. Worried about the liability shift, they had their accounting team research their current fraud rate to see how much the liability shift would affect them. “Their accountant came back with a number that surprised all of us,” McMahon said. “It was 0.03 percent.” This company was about to rush the purchase of hundreds of thousands of dollars in equipment to avoid a fraud liability that measured in the hundredths of a percent.
EMV is not without merit, but for hoteliers, it should come as part of a much larger shift toward securing card payments.
“Hoteliers need to be implementing tokenization and encryption and then saying, ‘oh yeah, let’s add EMV while we’re at it,’” Martin concluded.
Why Shift4 Provides EMV – and More 
At Shift4, we support EMV and NFC payments but also provide the layered security of our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> solutions so that our merchant customers can ensure their environment leaves no payment data for hackers to steal. After all, They Can’t Steal What You Don’t Have®.
For more information about how you can get ready for EMV, <a href="https://www.shift4.com/insight/emv/" target="_blank" rel="noopener noreferrer">visit our EMV page</a> or contact our world-class, Las Vegas-based Customer Support team at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%203%20Things%20Every%20Merchant%20Should%20Know%20About%20EMV">support@shift4.com</a> 24/7/365.

3 Things Every Merchant Should Know About EMV

Many of our merchant customers are looking into purchasing new payment devices to begin accepting EMV chip cards. In this article, we highlight the payment devices we support for processing EMV and a few of their features that may help you determine which one(s) will work best for your business.
Secure, High-Performing EMV-Capable Devices 
Shift4 has carefully selected the following devices for EMV certification due to their strong performance, security, and durability, complete with tamper-resistant and tamper-responsive designs. Each of these devices accepts EMV chip cards, magnetic stripe credit and debit, and contactless payments from mobile wallets like Apple Pay™. They are all SRED compliant and support Shift4’s <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> (point-to-point encryption), which features encryption at the first point of interaction with a terminal, and combines with <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> to provide a significant PCI scope reduction and advanced protection against breaches.
<ul>
<li style="list-style-type: none;">
<ul>
<li>Ingenico <a href="https://www.shift4.com/pdf/S4-Ingenico-iPP320.pdf" target="_blank" rel="noopener noreferrer">iPP320</a> and <a href="https://www.shift4.com/pdf/S4-Ingenico-iPP350.pdf" target="_blank" rel="noopener noreferrer">iPP350</a> 
The iPP320 and the iPP350 are great EMV-capable options if you process high-volume but primarily low-ticket-value transactions at single-lane terminals and an electronic signature capture is not required. The compact, lightweight design of these devices will save you space on your countertop. Plus, they’re “plug and play,” allowing for simple installation and integration to your POS system.</li>
</ul>
</li>
</ul>
The iPP320 and iPP350 are both PCI PTS V3.0 certified. The only difference between them is that the iPP320 has a white backlit LCD monochrome display and the iPP350 has a slightly larger TFT color display.
<ul>
<li style="list-style-type: none;">
<ul>
<li>Ingenico <a href="https://www.shift4.com/PDF/S4-Ingenico-iSC250.pdf" target="_blank" rel="noopener noreferrer">iSC Touch 250</a> and <a href="https://www.shift4.com/pdf/S4-Verifone-MX915.pdf" target="_blank" rel="noopener noreferrer">Verifone MX 915</a> 
For high-volume, multi-lane merchants who sell high-ticket-value items where an electronic signature capture is required, both Ingenico and Verifone have devices that offer the interactivity and rich performance you need. Each of these devices offers an option to electronically sign for payments with a pen-like stylus or using the touch screen.</li>
</ul>
</li>
</ul>
The iSC Touch 250 is a relatively compact solution with a 4.3” color touchscreen to enable merchants to give their customers multimedia experiences to support promotions with images, video, and sound. The device also includes business applications to support electronic signatures not just for payments, but also for contracts, warranty programs, and enrollments. Featuring a large, backlit keypad that is ADA-compliant, the iSC Touch 250 also allows for readability in low-light environments and is produced using an eco-friendly manufacturing model, complete with ISO 14001 certification. This device is among the first POS devices available in the U.S. to meet the latest PCI PTS V4.0 security standards and is SRED V2.0 approved (in non-contactless mode).
Verifone’s MX 915 has a 4.3” color display that offers a feature-rich experience and supports vibrant video to engage customers with sales, brand, and seasonal promotions. The Linux-based operating system provides flexibility to merchants who desire a simple application development environment. This device is PCI PTS V4.0 certified.
<ul>
<li style="list-style-type: none;">
<ul>
<li>Ingenico <a href="https://www.shift4.com/pdf/S4-Ingenico-iSC480.pdf" target="_blank" rel="noopener noreferrer">iSC Touch 480</a> and <a href="https://www.shift4.com/pdf/S4-Verifone-MX925.pdf" target="_blank" rel="noopener noreferrer">Verifone MX 925</a> 
For an impressive visual display with vibrant video on a large multimedia touchscreen device, allowing for rich promotional experiences, merchants with multi-lane environments may want to select the Ingenico iSC Touch 480 or the Verifone MX 925. Both of these devices offer an option to electronically sign for payments with a pen-like stylus or using the touch screen.</li>
</ul>
</li>
</ul>
The Ingenico iSC Touch 480 features a colorful 7” multimedia touchscreen with a powerful hardware video decoder. Similar to the iSC Touch 250, the backlit keypad is ADA-compliant, and with LED lights to guide card insertion or contactless tap, the device is also effective in low-light environments. Business applications included with the device allow for signatures for contracts, warranty programs, and enrollments in addition to payments. This device is ISO 14001 certified for ECO manufacturing and is PCI PTS V4.0 certified.
As for the Verifone MX 925, the high-resolution 7” WVGA color display, graphic processor, and extensive memory will give your customers a vivid look at your current brand and product promotions. Like the MX 915, the device also features a Linux-based operating system with simple development options. The MX 925 is also PCI PTS V4.0 approved.
<ul>
<li>Ingenico <a href="https://www.shift4.com/pdf/S4-Ingenico-iCMP.pdf" target="_blank" rel="noopener noreferrer">iCMP</a> and <a href="https://www.shift4.com/pdf/S4-Ingenico-iSMP.pdf" target="_blank" rel="noopener noreferrer">iSMP Companion 
</a>Add EMV-capable mobile point of sale (mPOS) solutions to your enterprise with Ingenico’s iCMP or iSMP Companion. Both of these devices are portable and secure. Bluetooth connectivity and authentication allows you to connect virtually with any iOS, Android, or Windows-based smartphone or tablet, making it easy to accept any form of electronic payment, including EMV cards, NFC/mobile wallets, and traditional magnetic stripe cards. The iCMP features a lightweight design with a compact form, making it easy to fit into a shirt pocket or holster. The iSMP Companion conveniently integrates a barcode reader and an extended charge-life battery for full-day usage. Both of these devices are PCI PTS V3.0 approved.</li>
<li>Ingenico iWL250 
The iWL250 offers wireless mobility with a variety of wireless options, including GPRS, 3G, WiFi, and Bluetooth Class 1. It offers a lightweight and compact design, fast built-in printer, extended battery life, and a backlit color screen for readability indoors and outdoors. The device is PCI PTS V3.0 approved.</li>
</ul>
Don’t forget that if you are purchasing new devices, you will need to work with one of our authorized vendors in order to ensure you have the correct configuration, including Shift4’s True P2PE encryption keys. You can get more information about selecting terminal devices and contact information for our authorized vendors by visiting <a href="https://www.shift4.com/thirdpartydevices" target="_blank" rel="noopener noreferrer">www.shift4.com/thirdpartydevices</a> or reaching out to our Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Which%20EMV%20Device%20Is%20Right%20for%20You%3F">support@shift4.com</a> or 702.597.2480 (option 2).
More on the EMV Liability Shift 
Finally, it’s important to note that while some of you will want to meet the EMV liability shift requirements as quickly as possible, not all of you face the same level of liability risk for card-present fraud, and therefore it may not be cost effective for you to spend thousands – or tens of thousands – of dollars to upgrade equipment just yet. EMV is specifically designed to prevent fraud from the use of counterfeit, skimmed, and lost or stolen credit or debit cards in card-present environments. Some merchant types are far more susceptible to these kinds of fraud than others, namely retailers and high-ticket merchants. As a result, these merchant types will most likely want to get EMV ready as soon as they can. You can look at your current chargeback and fraud rate to determine how the liability shift may affect you.
We also want to underscore that – contrary to what you may have been told – <a href="https://www.pcicomplianceguide.org/will-emv-make-you-pci-compliant/" target="_blank" rel="noopener noreferrer">EMV capability by the liability shift date is not required for PCI compliance</a>. The credit card brands – who are recommending the migration to EMV in the U.S. and who set the fraud liability shift deadline – are trying to encourage merchants to become EMV-compliant by not requiring PCI assessments if a merchant can prove that more than 75% of their transactions are processed via EMV. However, processors may still require the assessment and the credit card brands and EMVCo, the organization that maintains EMV chip specifications, do not have the authority to eliminate PCI assessments as those are mandated by the PCI Security Standards Council.
For more support selecting EMV-capable devices, contact information for our authorized device vendors, and to learn when your POS/PMS vendor and processor are expected to be ready for EMV, contact our 24/7/365 Las Vegas-based Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Which%20EMV%20Device%20Is%20Right%20for%20You%3F">support@shift4.com</a> or 702.597.2480 (option 2).

Which EMV Device Is Right for You?

You may remember that back in November, we released an alert about <a href="http://blog.shift4.com/2014/11/how-to-protect-yourself-from-poodle-ssl.html" target="_blank" rel="noopener noreferrer">protecting yourself from the POODLE SSL vulnerability</a>. For those of you who are less familiar with SSL, it refers to a type of encryption that was once used to secure communications between a user’s Web browser and a website in order to protect transmitted data from eavesdropping or tampering. However, even the most “recent” version of this security protocol, SSL v3.x, is outdated, and hackers have been taking advantage of its weaknesses to do all kinds of bad things – from stealing payment card information to taking over user accounts if a browser still allows for the use of SSL.
Some websites have continued to support SSL even after new security protocols, including TLS (the first version of which was created back in 1999 to replace SSL), in order to accommodate users who didn’t update their browsers. Hackers have been using this to their advantage. In October of last year, the Google researchers who discovered the POODLE SSL vulnerability, Bodo Möller, Thai Duong, and Krzysztof Kotowicz, specified that there is no way to patch this flaw and that “to achieve secure encryption, SSL 3.0 must be avoided entirely.”
Shift4 Has No SSL in Our Environment 
First of all, we want to make sure you’re aware that Shift4 is immune to any SSL vulnerabilities because it has been completely eradicated from our data centers. We don’t use Web services [https://] to connect point-of-sale systems to Shift4’s DOLLARS ON THE NET®, data centers, or interfaces. Instead, our Universal Transaction Gateway® (UTG®) uses TCP/IP services to securely transport your payment transactions. We’ve also removed SSL from www.shift4.com, www.dollarsonthenet.net, MyPortal, i4Go®, IT’S YOUR CARD®, and all other Shift4-owned services and domains. So, you can rest assured that our servers will negotiate the strongest possible encryption supported in the TLS spec by your browser.
What PCI Is Doing About SSL 
On February 13, 2015, <a href="http://training.pcisecuritystandards.org/pci-ssc-bulletin-on-impending-revisions-to-pci-dss-pa-dss-assessor" target="_blank" rel="noopener noreferrer">PCI SSC announced that the SSL vulnerability discovered last year has prompted them to remove SSL’s inclusion as “strong cryptography”</a> and review their PCI DSS and PA-DSS in response.
Therefore, according to PCI SSC, they will be issuing PCI DSS v3.1 and PA-DSS v3.1 to include their new stance on SSL and “other minor updates and clarifications.” No date is defined for the release, but the revisions will be effective upon release, with “future dated” requirements to allow for implementation. In the meantime, PCI SSC is still looking into how they’ll address current and future submissions for the PA-DSS.
What You Need to Do 
The fast and easy fix is to ensure that your organization no longer has SSL enabled anywhere in your browsers and in your servers. You can follow the directions posted on our original blog about POODLE <a href="http://blog.shift4.com/2014/11/how-to-protect-yourself-from-poodle-ssl.html" target="_blank" rel="noopener noreferrer">here</a>.
About That February 13, 2015, Update to the PCI SSC Definition of SSL? 
We also think it’s interesting to note that PCI defined SSL, which had already been replaced back in 1999, as “strong cryptography” in the first place. This certainly goes to show you that compliance does not always equal security. Be vigilant out there, folks. And know that we’re always using the latest technologies so you can achieve <a href="https://www.shift4.com/insight/compliance/" target="_blank" rel="noopener noreferrer">Security Beyond Compliance®</a>.
If you have any questions, our world-class Customer Support representatives are available 24/7/365 to assist you. Don’t hesitate to contact us at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%20Doesn%27t%20Use%20SSL%20(And%20You%20Shouldn%27t%2C%20Either!)">support@shift4.com</a>.

Shift4 Doesn’t Use SSL (And You Shouldn’t, Either!)

We’re now 7 months away from the EMV liability shift. But, don’t worry. Shift4 is hard at work behind the scenes to make sure your EMV migration is a breeze.
There are three easy steps that you can do today to start preparing for EMV.
#1: Ensure your point-of-sale (POS) or property management system (PMS) vendor is certified for EMV with Shift4. 
If your POS/PMS vendor is already certified for debit with us, they will be able to add support for EMV in just a few simple steps. We recommend checking with them to find out when they’ll be EMV-capable with Shift4 as a first step in preparing for EMV. If your POS/PMS vendor is not yet certified for EMV with us, there’s still time for them to get ready before the liability shift. They can reach out to <a href="mailto:partnersupport@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%20Supports%20EMV%20to%20a%20T">partnersupport@shift4.com</a> to begin this process. After they’re EMV-capable with Shift4, they will gain instant access to all of our EMV processor and device certifications as soon as they are completed. 

#2: Check out our preferred EMV devices. 
The main thing merchants need to do right now is make sure they have payment devices that accept EMV cards. There are a lot of choices out there and we’ve picked the very best. Since many EMV-capable devices themselves still output clear-text card data, we’re also pairing our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">True P2PE™</a> (point-to-point encryption) solution with the following EMV-capable devices so that you’ll have increased protection from breaches. Make sure you order from one of our authorized vendors so that they already have Shift4’s encryption keys injected when you receive them.
<ul style="list-style: none;">
<li>Ingenico: iPP320, iPP350, iSC Touch 250, iSC Touch 480, iCMP, iSMP Companion, iWL250</li>
<li>Verifone: MX 915, MX 925</li>
</ul>
These devices will be available for order with the correct configuration by late spring. So, right now, you can check into which of these devices will best fit your business. You can call our Customer Support team at 702.597.2480 (option 2) for help selecting which EMV-capable devices may work for your business, and how and when you can order them. If you already have EMV-capable devices in use, you can call Customer Support to find out how to get Shift4’s encryption keys injected.
#3: Wait! 
The next step is also pretty easy, because it involves waiting. After you have your EMV-capable devices selected and deployed, there really isn’t anything to do on your end until your processor is configured to run EMV transactions. When your processor is EMV-certified with Shift4, it will become easy for you to start accepting EMV transactions. If you think you can get EMV-capable devices ready and in deployment by the end of the summer, then you’ll be ahead of the game on many accounts. On the other hand, if you are worried that you might not be ready by the liability shift deadline, it is still not a cause for panic. The “liability shift” in October will mainly shift the liability for chargebacks from the banks to merchants, so if you do not encounter a lot of chargebacks, this will probably not impact you greatly.
Shift4 is currently working with U.S. processors as they certify us for EMV. Some processors are further along than others in writing their specs for certifications. And, some processors will not be ready by the deadline, so if your processor is lagging, we can help you switch to one that’s EMV ready. You’ll see more updates in upcoming newsletters as processors complete their EMV certifications with Shift4. That’s another one of the benefits our merchant customers get from our 100% processor neutrality.
Most importantly, there is still a lot of hype about EMV and the upcoming liability shift, but we expect that the migration in the U.S. will be gradual. Some experts in the industry are predicting that the full migration won’t be completed across the U.S. until 2020. The world will not change on October 1, 2015, as a result of the U.S. EMV liability shift. And as always, Shift4 has your back, is ready for EMV, and can support you along the way.
If you have any questions or concerns about EMV, our Customer Support team can help 24/7/365 by phone at 702.597.2480 (option 2) or email at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%20Supports%20EMV%20to%20a%20T">support@shift4.com</a>. Look for more EMV updates in future editions of <a href="https://www.shift4.com/company/newsroom/#4sightnewsletters" target="_blank" rel="noopener noreferrer">4Sight, the Shift4 customer newsletter</a>.

Shift4 Supports EMV to a T

Last year, Microsoft announced that extended support for Windows Server 2003 would end on July 15, 2015. This means that after July 15, Microsoft will no longer deliver any security updates, pay-per-incident support, or support from Microsoft’s Knowledge Base for Windows Server 2003. Most importantly, if you’re still using Windows Server 2003 somewhere in your cardholder data environment (CDE), you must upgrade to a newer product or your PCI compliance status will be at risk. Are you prepared?
About Windows Server 2003 
Windows Server 2003 has been one of the most widely used editions of Microsoft’s server operating systems. Although most users have replaced Windows Server 2003 with a newer product, some of you may still be using the product. It is important that you identify whether Windows Server 2003 is still in use anywhere in your CDE – and if it is, you should plan to upgrade to a supported operating system before the deadline.
This Is Not a Requirement of Shift4 
Microsoft has decided to end support for Windows Server 2003 as a natural transition in the lifecycle of its products. Since newer server operating systems with more advanced technologies have been added, Microsoft is now ending their extended support for this 11-year-old product. Shift4 is sharing this information in order to help our merchant customers, just in case you haven’t been informed by your merchant bank, Internal Security Assessor (ISA), or Qualified Security Assessor (QSA).
Upgrade Now to Ensure PCI Compliance 
As always, Shift4’s security products continue to provide some protection for your payment environment, so your security breach profile hasn’t increased. However, if you do not upgrade those servers using Windows Server 2003 prior to the extended support deadline, your PCI compliance will be impacted. Requirement 6.2 of the PCI DSS version 3.0 requires merchants to “ensure all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches.”
Other Reasons You Should Upgrade 
Let’s just say that technology has changed a lot since Windows Server 2003 was first released. Newer server operating systems are much better equipped to support newer technologies, including cloud, mobile, and more. The approach toward developing server operating systems has also advanced, so you’re looking at gaining a much more advanced product with better performance. Therefore, we recommend that you upgrade to a newer server operating system so you won’t face another potential upgrade soon. For example, mainstream support for Windows Server 2008 ended in January and extended support will end in January 2020.
What to Do 
You can use Microsoft’s <a href="http://migrationplanningassistant.azurewebsites.net/" target="_blank" rel="noopener noreferrer">Windows Server 2003 Migration Planning Assistant</a> to get some preliminary tips on upgrading to a new server operating system. Also, notify your merchant services provider or merchant bank and your ISA or QSA to determine if you need guidance on upgrading your systems from Windows Server 2003.
Again, this is not an upgrade offered by or a requirement made by Shift4 or DOLLARS ON THE NET®. But, if you have any questions, please contact our Customer Support team at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Heads%20Up%3A%20Extended%20Support%20for%20Windows%20Server%202003%20Is%20Ending">support@shift4.com</a> or call 702.597.2480 (option 2).

Heads Up: Extended Support for Windows Server 2003 Is Ending

As an integrated payments provider, Shift4 proudly integrates to <a href="https://www.shift4.com/dotn/integration/" target="_blank" rel="noopener noreferrer">hundreds of point-of-sale and property management systems (PMS/POS)</a> and certifies to new and customized interfaces to support our merchant customers’ business needs. Many of you work with third-party application program interface (API) developers on interfaces that enable communications between your PMS/POS and DOLLARS ON THE NET®. In order to further secure these communications, also known as API requests, we have set up a process that will authorize an interface whenever an API request is made, such as when your POS requests a sale or refund to be processed. After following a few simple steps, an Access Token will accomplish this for you.
When Does This Apply to Me? 
A Shift4 merchant customer will need to give an interface the permission to retrieve an Access Token during interface installation after the API developer has certified or recertified an interface with Shift4.
What Is an Access Token? 
An Access Token grants permission for an interface to process API requests through your DOLLARS ON THE NET account. An Access Token identifies a specific interface to a profit center or merchant identification number (MID) at the application level.
How Access Tokens Secure Your Environment 
There are a few benefits to using Access Tokens to authorize communications between an interface and your PMS/POS:
<ul>
<li>Access Tokens provide an added layer of security that prevents unauthorized access to your payment processing environment.</li>
<li>A unique Access Token corresponds to each interface that interacts with a MID. For example, if your DOLLARS ON THE NET account has 100 MIDs using one interface, each MID will require that interface to present the correct Access Token to receive API requests. Conversely, if a single MID uses 20 different interfaces, each of those interfaces will have a unique Access Token to present when responding to an API request from that MID. This ensures that your PMS/POS only communicates with trusted interfaces.</li>
<li>Your DOLLARS ON THE NET account administrator will have control over which interfaces are granted access, their access levels, and expiry options.</li>
<li>In the event an Access Token is ever compromised, it will be limited to a single MID. The account administrator can generate a new Access Token and revoke the compromised token without experiencing an interruption in processing transactions.</li>
</ul>
Giving Vendors Access Tokens 
After an interface has been certified or recertified with Shift4, your DOLLARS ON THE NET account administrator needs to generate an Auth Token (used for authentication) for that interface for each MID. The interface installer will then set up their interface to exchange that Auth Token with Shift4 for an Access Token. After that time, the interface will use the Access Token to respond to API requests from your PMS/POS, ensuring a truly secure payment environment.
For more information and detailed instructions about how to use Access Tokens, reach out to our 24/7/365 Customer Support team by emailing <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20Shift4%20Secures%20Your%20Environment%20With%20Access%20Tokens%20for%20API%20Requests">support@shift4.com</a> or calling 702.597.2480 (option 2).

Securing Your Environment With Access Tokens for API Requests

Something troubling happened last month. News broke of a hotel manager being arrested for stealing almost a million dollars from her employer over the course of seven years. Even more troubling was that it happened to one of Shift4’s merchant customers – a merchant just like each of you. Saddest of all, this entire fraud scheme could have been prevented by <a href="https://www.shift4.com/dotn/fraudSentry/" target="_blank" rel="noopener noreferrer">Fraud Sentry®</a>, a technology that is included with every installation of <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET</a>®.
<div style="clear: both;">The Source of “Trusted-Employee” Fraud 
Shift4 was made aware of this case by federal agents who were gathering evidence and preparing to make an arrest. Through the course of that investigation, and the one we performed internally, it was determined that this nearly million-dollar fraud loss came in small increments over the course of several years. The general manager (GM) in question was issuing refund credits for customers who had already paid, only she wasn’t issuing them back to the customers’ cards – she was issuing the credits back to cards she controlled.</div>
A Skipped Step, a Missed Opportunity 
How did this business not catch the problem sooner? The answer is painfully simple. When they signed up for Shift4 and went through the account setup process, they did not add any email addresses for Fraud Sentry reports during their initial administrator training. That single skipped step in the process resulted in nearly one million dollars in fraud losses for this business.
“Trusted-employee” fraud is not a new threat. In fact, Shift4 has been actively combatting this type of scam for more than a decade with our Fraud Sentry technology, which was designed in the late 1990s in coordination with another Shift4 merchant customer who suspected internal fraud was happening in a few of their properties and came to us for help in tracking down exactly where and how it was occurring. As a result, we created Fraud Sentry and made it a part of DOLLARS ON THE NET for all of our merchant customers to use.
Activate Fraud Sentry to Avoid Making the Same Mistake 
Please don’t make the same mistake. If you are an auditor, an account administrator, owner, or manager and do not currently receive Fraud Sentry reports, contact <a href="mailto:support@shift4.com?subject=4Sight Inquiry: Don't Lose $1 Million – Activate Fraud Sentry Today!">support@shift4.com</a> and request that your email address be added to the Fraud Sentry alerts list.
Also, we highly recommend having at least two people on this distribution list. If the GM is the only person receiving fraud alerts and happens to be the one committing fraud, then our alerts cannot help you.
Shift4 is committed to supporting merchants with the very best fraud-prevention and security tools available in the industry. We give them to you at no additional cost because security is core to what we do and is vital to your business. Please put them to work for you and avoid becoming the next victim of a breach or act of fraud. If you have additional questions about any of these technologies, Shift4’s Customer Support team is available to help you 24/7/365 at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight Inquiry: Don't Lose $1 Million – Activate Fraud Sentry Today!">support@shift4.com</a>.

Don’t Lose $1 Million – Activate Fraud Sentry® Today!

Consumers don’t just love giving gift cards – they also love receiving them. According to the <a href="https://nrf.com/media/press-releases/holiday-shoppers-spend-more-31-billion-gift-cards-this-year-according-nrf" target="_blank" rel="noopener noreferrer">National Retail Federation</a>, gift cards have been at the top of consumers’ wish lists for the past eight years in a row. And, <a href="http://www.executiveboard.com/exbd/financial-services/tower-group/gift-cards/index.page" target="_blank" rel="noopener noreferrer">CEB TowerGroup’s recent study</a> found that 65% of those who receive them spend 38% more than the gift card value when using them to purchase goods or services.
Why You Need a Gift Card Program 
Selling gift cards can drive sales by increasing your brand’s exposure to new customers while rewarding loyal ones. With that said, offering a gift card program requires thoughtful planning to make sure it’s a success for your business.
Shift4 Introduces a Helpful Guide to Gift Cards 
As your loyal merchant advocate, Shift4 created <a class="TrackLink" title="Gift-Card-Best-Practices-Brochure.pdf" href="https://www.shift4.com/PDF/Gift-Card-Best-Practices-Brochure.pdf" target="_blank" rel="noopener noreferrer">How to Get the Most Out of a Gift Card Program</a>, useful best practices guidelines that will help your organization introduce a gift card program for the first time or update the program you currently have. Based on Shift4’s 20+ years of experience in the payments space, this document provides a central reference point to find the rules and regulations governing gift cards in the United States. It also has a convenient checklist of the features you should look for when choosing a gift card solution.
A Simple Solution: IT’S YOUR CARD® 
This year’s <a href="http://dig.ismretail.com/i/418941/7" target="_blank" rel="noopener noreferrer">Integrated Solutions for Retailers Retail Tech Spending Survey</a> shows that businesses want to make omni-channel efforts more manageable by centrally managing payments across multiple profit centers and implementing effective reporting capabilities. This is where Shift4 comes in. <a href="https://www.shift4.com/dotn/iyc/" target="_blank" rel="noopener noreferrer">IT’S YOUR CARD (IYC)</a> is a fully-hosted, integrated, Web-based gift card solution that provides businesses with a simple and affordable way to customize gift cards for card-present and card-not-present environments. IYC is a full-featured, processor-neutral gift card solution that integrates seamlessly with Shift4’s DOLLARS ON THE NET® payment gateway, delivering the unrivaled security and advanced reporting you’ve come to expect from Shift4.
Visit <a href="https://www.shift4.com/dotn/iyc/" target="_blank" rel="noopener noreferrer">www.shift4.com/IYC</a> to learn more about what IYC can do for you or contact us by emailing <a href="mailto:myaccount@shift4.com?subject=4Sight Inquiry: How to Get the Most Out of a Gift Card Program">myaccount@shift4.com</a> or calling 702.597.2480 (option 4).

How to Get the Most Out of a Gift Card Program

The chip cards are coming! We are now just 10 months away from the October 2015 liability shift date for U.S. EMV. That’s the date the card brands set to have all U.S. merchants supporting EMV (Chip card) technology. After that date, whichever organization breaks the “EMV chain” will be held responsible for fraudulent card activity that could have been prevented had they supported EMV. In practical terms, that means the liability for fraud could shift to the banks if they do not offer chip-embedded smart cards to their merchants, or to the processor if they are not certified to receive the EMV transaction, and of course, it could shift directly to the merchant if all other players are EMV ready but the merchant does not process the transaction through a certified EMV terminal.
Since we first heard about the U.S. rollout of EMV, we have been very vocal in declaring that <a href="https://www.shift4.com/blog/post.cfm/why-emv-isn-t-the-answer-to-breach-at-target" target="_blank" rel="noopener noreferrer">EMV alone is not the solution to the recent high-profile breaches</a>, and that <a href="https://www.shift4.com/blog/post.cfm/executive-insight-emv-is-coming-gradually" target="_blank" rel="noopener noreferrer">merchants should not rush into EMV</a> without thoughtful consideration. In spite of our lack of enthusiasm for the project, we’ve promised all along that we would be ready in advance of the deadline and would ensure that any of our merchant customers who make the effort can be prepared.
Here’s a quick update on our efforts:
<ol>
<li>We already support EMV in Canada with the Ingenico iPP320 through Global, Moneris, and American Express.</li>
<li>We are members of the U.S. EMV Migration Forum – actively participating and sharing best practices and insights with other payments industry players about the move to EMV in this country.</li>
<li>We are currently working on U.S. EMV certifications with processors First Data (RapidConnect) and Chase Paymentech. We are certifying with the Ingenico iSC250 and Verifone MX915 devices. More certifications will be coming as the processors finalize their specifications and as additional devices are made available.</li>
<li>We are actively working to <a href="https://www.shift4.com/blog/post.cfm/emv-silver-bullet-or-red-herring" target="_blank" rel="noopener noreferrer">combine EMV with P2PE</a> in order to provide the true security that is missing from the current EMV specification.</li>
<li>Finally, our friends and partners in the point-of-sale and property management system space will be happy to hear that we have enhanced our receipt text capabilities to help our vendor partners comply with processor-specific requirements for receipt content.</li>
</ol>
If you didn’t see your processor listed in point #3 above, don’t worry. Some of the processors are still tweaking their EMV specifications and we’re holding out until they are as bug-free as possible before we dive into the certification process.
As for devices, we expect to also have Ingenico’s full Telium line (iPP320, iPP350, iSC250, iSC350, iSC480) and Verifone’s MX925 certified by this time next year. If you think we should consider an additional device, feel free to email <a href="mailto:info@shift4.com?subject=4Sight Inquiry: EMV Update">info@shift4.com</a> and let us know which EMV terminals you’d like to see supported. While we can’t guarantee we’ll be able to write to every terminal in the next 10 months, we always appreciate your feedback and will do our best to accommodate your needs.
Look for more EMV updates in future editions of <a href="https://www.shift4.com/company/newsroom/#4sightnewsletters" target="_blank" rel="noopener noreferrer">4Sight, the Shift4 customer newsletter</a>.

EMV Update

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation 
This piece is part three of a series on the differences between fraud and breaches. The first article in the series can be found <a href="http://blog.shift4.com/2014/10/executive-insight-fraud-or-breach.html" target="_blank" rel="noopener noreferrer">here</a> and the second article in the series can be found <a href="http://blog.shift4.com/2014/11/executive-insight-have-you-actually.html" target="_blank" rel="noopener noreferrer">here</a>.
In our previous two articles, we talked about <a href="http://blog.shift4.com/2014/10/executive-insight-fraud-or-breach.html" target="_blank" rel="noopener noreferrer">the difference between card fraud and a card data breach</a> and also <a href="http://blog.shift4.com/2014/11/executive-insight-have-you-actually.html" target="_blank" rel="noopener noreferrer">how you should respond when you suspect that either may have occurred</a>. To help you ensure you’re using all of the security tools in <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a>, I will provide an overview. Many of you have already implemented these solutions to secure your environment, so as I review these features, I will also add a few reminders about how and why you should use them.
Preventing Card Fraud With Verification and Best Practices 
Stopping fraud at the point-of-sale (POS) or property management system (PMS) starts with verifying the authenticity of a card and the identity of the cardholder. This is accomplished by correctly setting up your payment processing system and training your employees to recognize and avoid fraud. To protect against customer fraud in stores and online, Shift4 provides address verification services (AVS) and full support of cardholder verification value (CVV2, the three-digit code printed on the back of credit cards, also known as CVC2 or CID). Although CVV2 codes have historically been used only for card-not-present transactions, such as those online, Shift4 provides these tools to all types of merchants. Running verifications can be particularly beneficial for organizations that have large ticket averages or that run tabs or open authorizations. Remember that you should always run AVS and CVV2 checks and configure your POS or PMS to decline transactions if the CVV2 is declined.
There are a number of additional best practices that should be used to prevent in-store fraud, which should be incorporated into employee training and posted as a reminder to employees who interface with customers at the POS or PMS. We have included a number of these best practices in our <a href="https://www.shift4.com/cc101" target="_blank" rel="noopener noreferrer">Credit Card 101</a> tutorial.
Monitor Internal Fraud and Fraud Trends With Fraud Sentry® 
Unfortunately, internal fraud or “trusted-employee” fraud is one of the most common types of fraud experienced by merchants. And, because it involves employees an organization typically believes are reliable, this type of fraud can go undetected for months, even years, when proper precautions are not taken. <a href="http://www.statisticbrain.com/employee-theft-statistics/" target="_blank" rel="noopener noreferrer">According to Statistic Brain</a>, U.S. businesses lose 50 billion dollars each year as a result of employee theft. Monitoring transactions is an essential part of protecting your business against becoming a part of this statistic. <a href="https://www.shift4.com/dotn/fraudSentry/" target="_blank" rel="noopener noreferrer">Fraud Sentry</a> provides real-time transaction monitoring and immediate notification of suspicious card activity so your bottom line is protected. Fraud Sentry includes customizable settings so you can manage notifications and automatically block suspicious transactions or track them in order to build a case or for disciplinary reasons. Advanced users can also configure Fraud Sentry to recognize fraudulent patterns that may signal sophisticated fraud.
Just like DOLLARS ON THE NET, Fraud Sentry can be set up for a single location or for your entire enterprise. Even if it is not implemented at the local profit center level, you can still take advantage of these protections at the enterprise level. Check out <a href="http://blog.shift4.com/2012/11/executive-insight-take-advantage-of-fraud-sentry.html" target="_blank" rel="noopener noreferrer">this handy article on Fraud Sentry</a> for tips on double-checking your settings.
Support for Third-Party Fraud Prevention Tools: EMV, Apple Pay™, NFC 
Shift4 has been a leading innovator in the payments industry since we launched the first card-present payment gateway back in 1994. We continue to pave the way so our merchant customers are ready for whatever the industry or consumers expect. As you may have heard, EMV is coming, and NFC and mobile wallets like Apple Pay™ are becoming more commonly preferred by consumers. Each of these payment methods comes with its own type of consumer-based fraud protection. Shift4 supports these payment methods and also goes a step further with our own merchant-based security protections.
Protecting Merchants From Breaches With P2PE and Tokenization 
In the last two articles as I’ve discussed identifying and investigating fraud and breaches, I’ve made a point of mentioning Shift4’s breach-prevention tools, specifically our <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">point-to-point encryption (P2PE)</a> and <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> solutions. If you aren’t taking advantage of these tools today, you should. Last year, Coalfire, an independent Qualified Security Assessor (QSA) firm, analyzed our P2PE and TrueTokenization solutions at work together within a major retailer’s environment and published a <a href="https://www.shift4.com/pdf/Shift4_P2PE_Merchant_Security_Assessment_Report_20130903.pdf" target="_blank" rel="noopener noreferrer">white paper</a> showing that no sensitive card data was stored, processed, or transmitted with these solutions properly implemented.
Using P2PE and TrueTokenization reduces your breach risk and simplifies your PCI compliance because sensitive card data never enters your environment, but is instead encrypted at the point of swipe and only decrypted within our fully secure, <a href="http://blog.shift4.com/2014/06/our-new-data-center-at-switch-supernap.html" target="_blank" rel="noopener noreferrer">PCI-compliant data centers</a>. Security is at the core of what we do at Shift4, and as true merchant advocates, we provide solutions that are an essential part of securing your enterprise.
The Last Yard in a Thousand-Mile Journey 
Shift4’s specialized security solutions, which are included in DOLLARS ON THE NET as a part of <a href="https://www.shift4.com/dotn/4tify/" target="_blank" rel="noopener noreferrer">4tify®</a>, are designed to ensure our merchant customers do not store, process, or transmit cardholder data. These tools, combined with our TrueTokenization and P2PE solutions, help to create a zero-card-data environment for our merchant customers.
The journey to complete payment processing security is a long and complicated one. While tokenization and P2PE can help you cover miles, it is these specialized solutions – the ones that our competitors in the payment space haven’t even thought of yet – that secure the last yard in your 1,000-mile journey to security.
For card-present and Web-based transactions, Shift4 has created <a href="https://www.shift4.com/dotn/4tify/4go.cfm" target="_blank" rel="noopener noreferrer">4Go®</a> and <a href="https://www.shift4.com/dotn/4tify/i4go.cfm" target="_blank" rel="noopener noreferrer">i4Go®</a> to prevent actual card data from entering your POS, PMS, or Web servers. For securely accepting third-party reservations without bringing unsecured card data back into your environment, Shift4 has created <a href="https://www.shift4.com/dotn/4tify/4res.cfm" target="_blank" rel="noopener noreferrer">4Res®</a>. And, to securely share customer data with trusted third-party merchants (without revealing that data in your environment and bringing your system back into PCI scope), Shift4 has created <a href="https://www.shift4.com/dotn/4tify/4Word.cfm" target="_blank" rel="noopener noreferrer">4Word®</a>.
Last month, we also added an e-signature integration with Sertifi that enables those of you who accept faxed or emailed credit card authorizations for payment to instead do so through DOLLARS ON THE NET, further limiting your exposure to sensitive card data.
I hope this refresher on how Shift4’s security tools prevent fraud and breaches has been useful to you. Remember to check your settings or turn these features on if you have not already done so. And, if you have any questions, Shift4 is always here to help.

Executive Insight: Tools for Preventing Fraud and Breaches

We told you last month that adding support for Apple Pay™ was going to be quick and easy, and it was. We’re happy to announce that Shift4 now supports Apple Pay contactless (NFC) payments. In fact, a few of our customers have already starting processing Apple Pay transactions.
No additional development is required for you to start accepting this new payment method – as long as you meet these three important criteria:
<ol>
<li>You are currently using a supported NFC-enabled payment terminal. 
(A <a href="https://www.shift4.com/partner/integration/Third_Party_Devices.cfm" target="_blank" rel="noopener noreferrer">full list of Shift4-supported devices</a> can be found on our website – just look for options with a green “Yes” next to the Contactless/NFC feature.)</li>
<li>Your terminal devices are controlled by Shift4’s <a href="https://www.shift4.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway® (UTG®)</a>. 
Don’t worry, almost all of our merchant customers who have NFC devices are set up this way.</li>
<li>Your processor has certified Shift4 to process NFC transactions. 
If your processor doesn’t want to certify with us for NFC, but supporting Apple Pay is important to you and your customers, the beauty of <a href="https://www.shift4.com/dotn/neutrality/" target="_blank" rel="noopener noreferrer">Shift4’s 100% neutrality</a> is that you can always change to one of the several processors that already have this certification in place.</li>
</ol>
If you’re not sure whether you fit any of these criteria, our Customer Support team is happy to help you figure it out. You can contact <a href="mailto:support@shift4.com?subject=4Sight Inquiry: Shift4 Now Supports Apple Pay">support@shift4.com</a> or call 702.597.2480 (option 2) for assistance 24 hours a day, 7 days a week.
And for those of you who are interested in using Apple Pay for in-app payments on your proprietary mobile applications, hang tight – support for that is coming soon.

Shift4 Now Supports Apple Pay

According to the National Retail Federation, for the 2014 holiday season, retailers in the United States can anticipate a 4.1 percent increase in sales volumes compared with 2013, resulting in an expected $616.9 billion in total sales. As it is already November, the season is just kicking into gear. While the holidays are a time of increased volume, it’s also the time when merchants are most susceptible to fraud. Shift4 is here to help make your payments run smoothly and securely during the season. We also have a friendly reminder about three things you need to do to prepare your payment processing in advance of the big holiday rush.
<ol>
<li>The first thing you should do is refresh yourself and your employees on the ways to combat fraud during the holidays. Seasonal hires are a mainstay of the holiday shopping season. And, unfortunately, so is theft! There are some criminals who take advantage of seasonal staff who may have minimal training or even seasoned employees who are busier than usual during the holiday sales. Shift4 has already published a few articles that would serve you well to review, including: <a href="http://blog.shift4.com/2013/11/hiring-for-the-holidays-5-security-tips-you-need-to-know.html" target="_blank" rel="noopener noreferrer">Hiring for the Holidays? 5 Security Tips You Need to Know</a>, <a href="http://blog.shift4.com/2011/11/tis-the-season-to-be-vigilant.html" target="_blank" rel="noopener noreferrer">‘Tis the Season to be Vigilant</a>, <a href="http://blog.shift4.com/2011/11/simple-clues-to-early-detection-of-a-computer-breach.html" target="_blank" rel="noopener noreferrer">Simple Clues to Early Detection of a Computer Breach</a>, and this <a href="http://blog.shift4.com/2011/11/voice-auth-refresher.html" target="_blank" rel="noopener noreferrer">Voice Authorization Refresher</a>. We also have tips that we recommend sharing with all employees about preventing fraud in our <a href="https://www.shift4.com/insight/index.cfm?cc101" target="_blank" rel="noopener noreferrer">Credit Card 101</a> tutorial. Check out the section on fraud.</li>
<li>It is also important to ensure that your DOLLARS ON THE NET® account settings are up to date prior to the holiday shopping and travel season. Make sure that only those current employees who should have access to log into your account have authorization. Next, check your <a href="https://www.shift4.com/dotn/fraudSentry/" target="_blank" rel="noopener noreferrer">Fraud Sentry®</a> settings to protect yourself from “trusted-employee” fraud. Also, to prepare for any unexpected connectivity issues during your busiest time of year, you may want to activate <a href="http://blog.shift4.com/2010/12/stand-in-offers-utg-users-enhanced-offline-processing.html" target="_blank" rel="noopener noreferrer">Secure Offline Stand-In®</a>, which allows you to set a threshold at which your employees can process transactions while working offline.</li>
<li>Finally, it is beneficial to identify days or periods when you might anticipate extremely high sales volumes, such as a day when sales might increase to three times more than a typical day or when your hours will be significantly extended. Don’t forget to give Shift4 a quick heads-up if you are expecting a large variance in sales or hours during a big holiday promotion, on Black Friday, or during the increasingly popular Cyber Monday. Shift4 is always here to ensure that your payments are ready to roll, but informing our Customer Support team about an expected increase in transaction volume or extended hours gives us a chance to cater support to meet your specific business needs.</li>
</ol>
As usual, Shift4’s team of payments experts will be here throughout the entire season. If you have any questions, contact our world-class 24/7/365 Customer Support department at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Prepare%20Your%20Payments%20for%20the%20Big%20Holiday%20Rush:%203%20Things%20You%20Need%20to%20Do">support@shift4.com</a> or 702.597.2480, option 2.

Prepare Payments for the Big Holiday Rush: 3 Things to Do

There’s a new, major Internet security vulnerability that you need to be aware of. It’s called POODLE, and it essentially allows hackers to intercept encrypted data sent from your Web browser (e.g., Internet Explorer) to secure websites (your bank, email account, etc.).
POODLE is an attack against SSLv3, a security protocol that has been around for close to two decades. SSL was upgraded and replaced by a more secure protocol known as TLS in 1999, but because they didn’t want to cut off users who were running extremely outdated browsers, many important websites still allow for SSL-secured sessions on their secure pages. 
 
What Do You Need to Do? 
As a user, the easiest way to protect yourself from POODLE is to turn off support for SSLv3 in your browser. For most users, this fix involves getting into your browser’s settings menu and unclicking a checkbox. (Google Chrome users actually have to cut and paste a snippet of code, but it’s still not terribly difficult.) The links below provide official directions and discussion from each browser manufacturer as to how to disable SSLv3 in their product(s).
<a href="https://technet.microsoft.com/en-us/library/security/3009008.aspx#sectionToggle3" target="_blank" rel="noopener noreferrer">Microsoft Internet Explorer</a> 
<a href="https://productforums.google.com/forum/#!topic/chrome/dpiPu9B1cBI" target="_blank" rel="noopener noreferrer">Google Chrome</a> 
<a href="https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/" target="_blank" rel="noopener noreferrer">Mozilla Firefox</a> 
<a href="https://discussions.apple.com/thread/6597955" target="_blank" rel="noopener noreferrer">Safari</a> 
<a href="http://blogs.opera.com/security/2014/10/security-changes-opera-25-poodle-attacks/" target="_blank" rel="noopener noreferrer">Opera</a>
For those who are less technical, sites such as <a href="https://disablessl3.com/" target="_blank" rel="noopener noreferrer">DisableSSL3.com</a> and <a href="https://zmap.io/sslv3/browsers.html" target="_blank" rel="noopener noreferrer">ZMap</a> have slightly more user-friendly walkthroughs of this process.* 
 
NOTE: There are still sites on the Internet that do not support the more secure TLS option and that only use SSL security. Disabling SSLv3 in your browser will cause these sites not to load. Here’s a list of the most <a href="https://poodle.io/#ssl3only" target="_blank" rel="noopener noreferrer">popular webpages that do not currently support TLS security</a>.
You should also contact any service providers whose websites you access frequently to ensure they support TLS and that they are planning to drop support for SSLv3 completely. For your information, Shift4 does support TLS and defaults to the highest security settings supported by your browser. We have already removed support for SSLv3 from our public-facing testing/certification environment and will be removing it from DOLLARS ON THE NET®, Shift4.com, MyPortal, i4Go®, IT’S YOUR CARD®, and all other Shift4-owned services and domains in the next few weeks. Thanks to the redundant nature of our systems, these updates should not affect your ability to process transactions.
In the unlikely scenario that you experience any service issues, our world-class Customer Support representatives are available 24/7/365 to assist you. Don’t hesitate to contact us at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight Inquiry: How to Protect Yourself From the POODLE SSL Vulnerability">support@shift4.com</a>.
<hr />
*At the time of publication, our examinations of these sites did not find any malware or misinformation. However, due to the ever-changing nature of the Internet, Shift4 cannot be held liable for the information contained on these pages

How to Protect Yourself From the POODLE SSL Vulnerability

Many of our customers have multiple revenue centers. Some of these are resort properties in the hospitality industry with a front desk, retail stores, restaurants, and a spa. Others are omni-channel providers with both brick-and-mortar and e-commerce sales. Still, others are universities with multiple revenue centers, including a campus store, on-campus housing, restaurants, and student services. The point of listing these examples is this: Shift4 is committed to saving our customers time and money by unifying multiple revenue centers under Shift4’s “protective roof.” We work with hundreds of brands and businesses of every type to efficiently and securely process all of their credit, debit, and gift card transactions.
Our Customer Support team was recently contacted by one customer who greatly appreciated Shift4’s <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">point-to-point encryption</a> solution, which they used at one revenue center on their property, because of the reduction it gave them in PCI scope. The customer outlined multiple revenue centers, both brick-and-mortar and e-commerce, which they hoped could be brought under the protection of Shift4 in order to receive the same class of security and functionality that they have been pleased with.
Our answer? Of course!
Shift4 can streamline payments for all revenue centers in your business or all businesses that you own. <a href="https://www.shift4.com/dotn/" target="_blank" rel="noopener noreferrer">DOLLARS ON THE NET®</a> can unify your payments across multiple revenue centers of all types, including revenue centers in a single business, multiple businesses, and even multiple businesses in different industries. In fact, there are numerous benefits to doing so that will save you time and money.
Benefits of Using DOLLARS ON THE NET for Multiple Revenue Centers
<ul>
<li>True, simplified enterprise-wide accounting and auditing – both pre- and post-settlement</li>
<li>A single source for transaction data for defending chargebacks</li>
<li>A single point of contact with our world-class 24/7/365 Customer Support team based in Las Vegas</li>
<li>Industry-leading security at no additional cost
<ul>
<li><a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">Point-to-point encryption (P2PE)</a></li>
<li><a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a></li>
<li><a href="https://www.shift4.com/dotn/fraudSentry/" target="_blank" rel="noopener noreferrer">Fraud Sentry®</a></li>
</ul>
</li>
<li><a href="https://www.shift4.com/dotn/integration/" target="_blank" rel="noopener noreferrer">Integrations with over 350 POS/PMS providers</a></li>
<li>Credit card processing for brick-and-mortar, e-commerce, and omni-channel businesses all billed at the same rate, compared with most other gateways that usually charge more for e-commerce</li>
<li>Dramatically reduced PCI scope with cardholder data hosted offsite in Shift4’s secure, PCI-compliant data centers</li>
<li>Our fee of only pennies per transaction is based on your total transaction volume, which means that bringing your revenue centers together into a single payment system may lower your rate and end up saving you more money</li>
<li>Complete bank and processor neutrality, so you can process different revenue centers using different banks or processors and get the best possible rates</li>
</ul>
As many of you already know, Shift4’s DOLLARS ON THE NET provides gateway services to merchants of all sizes and industries for credit, debit, and gift card transactions. We currently deliver secure payment processing to leading organizations in most industries including hospitality, food and beverage, retail, auto rental, e-commerce, education, healthcare, mail order/telephone order, transportation, utilities, and more.
If you would like to learn more about how you can unify multiple revenue centers under the Shift4 roof, please feel free to leave a comment here or contact our Customer Support department at 702.597.2480 (option 2) or <a href="mailto:support@shift4.com?subject=4Sight Inquiry: Unify Your Enterprise Payments Under Shift4">support@shift4.com</a>.

Unify Your Enterprise Payments Under Shift4

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation 
This piece is part 2 of a series on the differences between fraud and breaches. The first article in the series can be found <a href="http://blog.shift4.com/2014/10/executive-insight-fraud-or-breach.html" target="_blank" rel="noopener noreferrer">here</a>.
Last month we talked about <a href="http://blog.shift4.com/2014/10/executive-insight-fraud-or-breach.html" target="_blank" rel="noopener noreferrer">the difference between card fraud and a card data breach</a>, and I warned you that they typically warrant very different responses. Today, I will lay out my recommendations as to how you should respond with a preliminary investigation if you suspect either may have occurred. Before I delve into this topic, let me make an immediate and complete disclaimer that Shift4’s advice does not replace the guidelines of your merchant services provider (MSP) or processor, nor does it supersede the requirements given by the PCI Council; this is simply advice based on my 20+ years in the payment processing industry.
First, a quick recap: Last month we defined that – at least in the payments space – fraud is any illicit method used to access or use another person’s credit card, while a breach is more narrowly defined as an exploitation of security measures to access and/or compromise a merchant’s cardholder data environment.
Do You Suspect a Breach May Have Occurred? Call Your MSP 
Your first step when you suspect you might be the victim of either fraud or a card data breach is to contact your MSP. (An MSP is the person or organization that set up your merchant account.) Your MSP should then guide you through the other required steps. This initial call fulfills the reporting requirements that are usually written into your merchant services agreement and even if it’s as simple as “we’re seeing some unusual activity and just want to give you a heads up that we’re looking into it internally,” it can go a long way in helping you avoid future issues and potential fines.
Begin an Internal Investigation 
Next, you will want to launch an internal investigation. Verify that your antivirus program is up-to-date and check for malware/virus alerts. Review all your audit records and see if you can spot anything unusual. Do you have any <a href="https://www.shift4.com/dotn/fraudSentry/" target="_blank" rel="noopener noreferrer">Fraud Sentry®</a> alerts from Shift4 you might have overlooked? After that, watch for any suspicious trends. Were all the affected customers in your spa or retail location on the same day? Were they helped by the same employee(s)? Were the affected e-commerce customers shopping on a certain day noted with suspicious trends? In addition to your internal investigation, you will also want to review your surveillance videos.
Enlist Your Trusted IT Employees to Help Investigate 
If you have trusted IT administrative staff, get them involved in reviewing your firewall and systems logs. They should also check if there are any rogue/unidentified application programs on your payment systems. This can be a tricky task because a rogue program, such as a memory scraper, typically won’t appear in your programs list. However, these are all steps that can help you to begin narrowing down the source of the problem and possibly rule out a full-scale breach.
Identify the Likelihood of Fraud or a Breach 
What if you find no malware or rogue programs and no indication of a massive theft of your customers’ payment card data? Perhaps only a few customers have contacted you to report a potential issue. This is still something to take seriously, but experience tells me in these cases it is more likely to be internal fraud committed by one of your employees than a full-blown breach. Fraud is usually much more limited in scope than a data breach. While it is occasionally perpetrated by external crooks, most fraud in the industry today involves a rogue employee within your organization.
In case of a major breach, you would more likely be contacted by your MSP, your bank, or one of the card brands rather than by a handful of concerned customers. With a major breach, the first contact may occasionally come from law enforcement.
Be Wary of Phishing Scams 
Now, I’m sad to report that there is a known phishing scam in which people call in, reporting to be from the bank or even the Secret Service, and claim they are investigating a breach. They will then ask for your merchant account information, which they can later use to defraud you. That’s why we recommend you do your homework when someone contacts you unexpectedly and makes these claims. You can request that law enforcement send a local officer out to meet with you in person. You can ask for an email or fax on company letterhead. A lot of times the easiest way is to ask if you can call them back. If you call the local Secret Service office or your MSP’s fraud department using the number listed on their website and they tell you they’ve never heard of the person who called you, then that tells you that it was probably a phishing scam.
Follow Appropriate Procedures for Fraud or Breach 
So, whether it’s a call from the card brand or your own internal investigation that determines your environment has actually been breached, the response is the same. Your response to a breach is strictly regulated by PCI, the card brands’ procedures, and (in most cases) the state and federal government. When you contact your MSP, ask them if they will be contacting the card brands or if you need to do it. Likewise, work with them to inform the proper authorities. They will also advise whether you need to enlist the support of a PCI Forensic Investigator (PFI) to track down the source of the breach. Depending on the magnitude of a breach, one or more of the card brands may automatically direct a full investigation by a PFI.
With a fraud situation, you have a little more discretion in how you proceed. A dishonest employee stealing a handful of card numbers probably doesn’t warrant a call to the Secret Service or spending tens of thousands of dollars on a forensic investigation. You should inform your MSP and they will advise whether you need to inform the card brands, and – of course – you may also want to turn the evidence over to your local police. But, dealing with the problem on your own and alerting your MSP is usually sufficient unless your preliminary investigation points to a major compromise of your environment (either malware that has been taking card data out of your system or some other major theft of customer information).
Don’t Panic 
One more point on these preliminary investigations: please do them. Before you panic and before you call in the cavalry, take the time to really look at what’s going on. A few years ago, we had a customer panic after receiving a few calls from concerned customers reporting suspicious activity on their cards after staying in their hotel. The hotel called the police, the card brands, their attorneys, and their PR team – all before they did any investigation into the problem. After careful examination, it turned out that they had not been breached at all; the restaurant a few miles up the road had been compromised, and many of their customers had eaten there. This company spent thousands of dollars to bring in significant outside resources that proved entirely unnecessary.
How Shift4 Can Help 
Please note that this guidance is by no means intended to be a comprehensive to-do list. What I have provided are the vital questions you need to get answered and early steps to get you moving down the right road. Card data breaches are serious crimes and they can be costly and time consuming to recover from. This is why we are so diligent in encouraging our merchant customers to reduce their breach profile by implementing the <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> and <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">point-to-point encryption (P2PE)</a> technologies that are included with our offering.
Next month I’ll delve deeper into the tools that Shift4 provides to prevent both card fraud and card data breaches. Most of you already have many of these tools implemented, but there may be a few tools you are not yet using, so I’ll help you figure out the next step toward complete security. In the meantime, be diligent. And, know that Shift4 is always here to help.

Executive Insight: Have You Actually Been Breached?

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
Fraud and breach are two words that no merchant wants to hear in relation to their business. Confusing fraud for a breach – or assuming they are the same thing – can lead to panic, overreaction, and unfortunate unintended consequences. To help you avoid overreactions and costly mistakes, I want to cover the difference between fraud and a breach and what each means to your business. In future articles I will cover how you should respond to each as well as the most effective tools and methods to prevent them in the first place.
Dictionary.com defines fraud as “deceit, trickery… perpetrated for profit” and breach as “a gap made in a wall, fortification.” In our industry, those definitions have evolved somewhat, but still hold relatively true to their origins. In the payments space, fraud is any illicit method used to access or use another person’s cardholder data, while a breach is more narrowly defined as an exploitation of security measures to access and/or compromise a merchant’s cardholder data environment.
To put it simply, if hackers bypass your Internet security defenses and firewalls and infect your computers with card-stealing malware, that’s a card-data breach. If they engage in some other shady activity in order to steal card data – or use data stolen previously – that’s better defined as fraud.
Why the important distinction? Well, frankly, it’s because one is bad news and the other is really bad news. Fraud perpetuated in your business is often the result of rogue employees. This can be dealt with much more quickly and with much less expense than a security breach of your cardholder data environment and resultant card-data theft that is (these days) more likely the result of an organized criminal element rather than a few disgruntled individuals.
Typically, card fraud within a business is on a much smaller scale than an all-out security breach, which is why the two require entirely separate responses. While I will cover appropriate responses in depth in next month’s article, I’ll give you a hint today. If you believe your business is experiencing fraud or has fallen victim to a security breach, the first step is to call your merchant services provider (MSP) and advise them that you are investigating suspicious activity. (This call goes a long way to protect you from potential future fines and liabilities.) The next step is to actually investigate and get a decent understanding of what is going on. You may not get to the bottom of it, but you need to get far enough to figure out who can provide any additional help and information you might need. Again, more on that next month. Until then, be vigilant!

Executive Insight: Fraud or Breach?

Gift card sales are growing. Increasingly tech-savvy and choice-driven customers want to let gift recipients take a hop into the driver’s seat by selecting their own presents through the use of gift cards for birthdays, holidays, and other special occasions. On the merchant side of things, offering gift cards is a proven method for driving sales, promoting customer loyalty, and enhancing marketing efforts. 
If you’ve decided to implement a gift card program, there are a few steps that you should follow in order to ensure it’s a success. Here are four things to consider before implementing your gift card program:
1: Find Which Rules &amp; Regulations Apply to Your Business 
Your company’s legal department or an outside counsel or specialist will be your first point of contact regarding the different requirements that apply to your gift card program, depending on your industry and the state in which you live.
For industry requirements, you can reach out to one of the following associations for information about gift cards:
<ul type="disc">
<li>Hospitality: Hospitality Financial and Technology Professionals (<a href="http://www.hftp.org/Home.aspx" target="_blank" rel="noopener noreferrer">HFTP</a>), American Hotel &amp; Lodging Association (<a href="http://www.ahla.com/" target="_blank" rel="noopener noreferrer">AH&amp;LA</a>)</li>
<li>Retail: National Retail Federation (<a href="http://www.nrf.com/" target="_blank" rel="noopener noreferrer">NRF</a>), Retail Industry Leaders Association (<a href="http://www.rila.org/pages/default.aspx" target="_blank" rel="noopener noreferrer">RILA</a>)</li>
<li>Food &amp; Beverage: National Restaurant Association (<a title="http://www.restaurant.org/" href="http://www.restaurant.org/" target="_blank" rel="noopener noreferrer">NRA</a>)</li>
</ul>
State and federal regulations relating to gift card programs may also be found at the following sites and/or by using the following search terms:
<ul type="disc">
<li>Credit Card Accountability Responsibility and Disclosure Act of 2009 (<a href="http://www.gpo.gov/fdsys/pkg/PLAW-111publ24/pdf/PLAW-111publ24.pdf" target="_blank" rel="noopener noreferrer">111-24</a>)</li>
<li>National Association of Unclaimed Property Administrators (<a href="http://unclaimed.org/" target="_blank" rel="noopener noreferrer">NAUPA</a>)</li>
<li>National Association of Attorneys General (<a href="http://www.naag.org/about_naag.php" target="_blank" rel="noopener noreferrer">NAAG</a>)</li>
<li>Federal Trade Commission (<a href="http://www.ftc.gov/" target="_blank" rel="noopener noreferrer">FTC</a>)</li>
<li>State websites and law libraries – look for “escheatment” or “unclaimed property” laws</li>
<li>Gift card business practices – rules on “dormancy fees,” “expiration,” and “registration”</li>
<li>State liability and jurisdiction laws – if you have properties that cross state borders</li>
</ul>
You will want to research and stay up to date on the rules and regulations that apply to your business by periodically checking for updates and changes.
2: Learn the Financial Considerations of Running Your Gift Card Program 
In order to prepare for the launch of your gift card program, there are a few gift card-related reports that your finance department will want to be familiar with, including how to report income from card redemptions, deferred income or liability reports for outstanding card balances, and how to handle inactive cards with dormancy fees and expiration capabilities. You will also want to plan how you will track gift card sales, retain gift card monies, merge card balances, eliminate cash buy-outs, and void gift cards that have been purchased fraudulently.
If you have multiple properties, you will want an enterprise-wide solution for tracking and settling cross-property sales and redemptions.
3: Implement Gift Card Technology 
Shift4 recommends a gift card program that fully integrates with your point-of-sale (POS) or property management system (PMS) because this will enable one-step activation, redemption, and balance inquiries, as well as the ability to swipe the gift card like a credit card.
Also, using a hosted, web-based system to manage your gift card program can limit your software and hardware investment, minimize upgrade costs, and allow your gift cards to be delivered instantly via online sale and/or sold where there is not a POS (e.g., through a concierge).
You should also consider adding security measures, such as a non-sequential numbering system and security code/PIN number requirements. These types of security considerations can be crucial in preventing the creation of fraudulent cards and securing access for your customers to check their balance and register gift cards on the Web.
4: Market Your Gift Card Program 
Creating a look and feel for your gift card program will be essential to maintaining your brand, promoting sales, and building customer loyalty. If this is your first time implementing gift cards, you may choose to run a limited-time promotion or to mail prepaid cards as part of the promotion.
Further, you will want to consider how you will market your cards, including selling gift cards in specific dollar amounts or flexible values, and whether you will sell gift cards or e-certificates through your website. You can also consider tracking gift cards as they relate to seasonal promotions and allowing customers to register gift cards so that you can tailor promotions and evaluate spending trends with activity reports.
Of course, if you want to make things really easy for yourself, then you can take advantage of Shift4’s full-featured gift card solution, <a href="https://www.shift4.com/dotn/iyc/" target="_blank" rel="noopener noreferrer">IT’S YOUR CARD® (IYC)</a>. A seamless integration with DOLLARS ON THE NET® allows IYC to leverage Shift4’s unrivaled speed and security while giving you ultimate control over how you deploy and utilize your gift card program with both physical and electronic gift cards.
If you have any questions about implementing a gift card program in your business, please email <a href="mailto:myaccount@shift4.com?subject=4Sight%20Inquiry:%204%20Things%20to%20Consider%20When%20Implementing%20a%20Gift%20Card%20Program">myaccount@shift4.com</a> or call 702.597.2480 (option 4).

4 Things to Consider When Implementing a Gift Card Program

It seems like we’re hearing about a new major card-data breach on an almost weekly basis. It’s both incredibly frustrating and incredibly sad to see millions of people paying the price for businesses’ failures to adequately secure their data. What’s even more concerning is that it’s happening so often that we’ve heard people say, “Breaches are just part of the cost of doing business these days.” This is absolutely not true. Security technologies do exist that can protect merchants (and consumers) from the attacks that are becoming more common.
While the majority of the recent major breaches have all used memory-scraping malware to capture card data as it enters the point of sale (POS), the methods used to install that malware have varied from case to case. At least two, though, have stood out as unique. In those attacks it wasn’t the company that was breached directly, it was a trusted vendor. For Target, it was an HVAC contractor whose Internet-connected heating and air conditioning equipment allowed hackers access to Target’s network. And for the recently announced Jimmy John’s breach, it was actually the POS company that was breached. With stolen credentials, these cybercriminals were able to remotely update Signature Systems’ POS to add memory-scraping malware.
This POS security failure resulted not only in 200+ Jimmy John’s locations falling victim to the breach, but also another 100+ smaller restaurants that were using the same POS system. Many of these were local restaurants and bakeries, rather than national chains. We hope these smaller organizations will be able to bear the financial costs of the breach and the brand damage they may incur as a result of their POS company’s security failure.
What do we learn from these two examples? That we can’t rely on other organizations to be secure. This is another reason that <a href="https://www.shift4.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">point-to-point encryption (P2PE)</a> and tokenization are so important. With these solutions in place, card data never would have reached the POS, leaving the hackers with nothing to steal. It is also a great wake-up call to POS and property management system (PMS) manufacturers on the unprecedented need to build support for Shift4’s security technologies into their systems.
Payment Card Industry Data Security Standard (PCI DSS) <a href="https://www.shift4.com/insight/security/" target="_blank" rel="noopener noreferrer">Requirement 12.8</a> says that merchants are responsible for managing any service providers that will have access to cardholder data. Wouldn’t you prefer to work with a POS/PMS vendor that cares enough about your business to invest in the very best security? If your POS or PMS developer has been slow to add support for <a href="https://www.shift4.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> or P2PE, this might be a good article to share with them. The development costs for them to add support for P2PE and tokenization would be miniscule in comparison with the potential liability of a class-action lawsuit if they faced a breach.
If you’d like our help in approaching your POS/PMS manufacturer and encouraging them to support TrueTokenization and Shift4’s P2PE solution, email <a href="mailto:info@shift4.com?subject=4Sight%20Inquiry:%20100%20Businesses%20Breached%20in%20One%20Attack">info@shift4.com</a> and we’ll be happy to work with you.

100 Businesses Breached in One Attack

In a globally connected world, businesses of every size need to think not just about their compliance with PCI, but also about how to combat the persistent threat of skilled cybercriminals beyond the scope required by compliance. We hope you know that the Shift4 family is always prepared with the most innovative and comprehensive security for payment card data across your enterprise. 
With that said, we are happy to reaffirm our commitment to providing you with the most stringent data protection throughout the payment process with CISSP® certification for 10 more Shift4 employees!
What Is CISSP? 
Issued by the International Information Systems Security Certification Consortium, more commonly known as (ISC)2®, the Certified Information Systems Security Professional (CISSP) credential is an information security qualification that is recognized globally for requiring mastery of ten domains: access control; telecommunications and network security; information security governance and risk management; software development security; cryptography; security architecture and design; operations security; business continuity and disaster recovery planning; legal, regulations, investigations and compliance; and physical (environmental) security.
Who Is Being Certified? 
Typically, the CISSP certification is reserved for senior IT and Information Security leadership, but we are thrilled that our company-wide dedication to providing the highest level of security is well represented by the number of employees from the Director-level down earning CISSP.
Four employees are now joining Stephen Ames, Senior Director, Security Compliance, as full-fledged CISSPs:
<ul>
<li>Chris Mech – Director of Data Center Security Operations</li>
<li>Mark Dunaisky – Director, Project Management</li>
<li>Jeff Baran – Information Security Analyst</li>
<li>Dan Hoolmaa – Director of Information Technology</li>
</ul>
Also, six more employees have already passed their examinations and are just waiting for their paperwork to roll in during the coming weeks:
<ul>
<li>Aaron Avila – Senior Network Administrator/Architect</li>
<li>Mat Martz – Technical Relationship Manager</li>
<li>Cameron Marshall – Software Release Manager</li>
<li>Mike Baker – Information Security Analyst</li>
<li>Robert Sheppard – Systems Administrator II</li>
<li>Ryan Parker – Systems Administrator I</li>
</ul>
What Does This Mean for You, Our Merchants? 
Long story short, having 11 CISSP-certified employees on the Shift4 staff further expands the expertise that we already provide to you in securing payment data solutions that suit your needs as a merchant – no matter your business size or industry.
“Shift4 is proud of our employees’ commitment to providing top-tier security for our merchants by earning the reputable CISSP credential,” said Shift4 CEO Dave Oder. “This type of dedication is a hallmark of Shift4’s ongoing commitment to providing our merchants with payment data security that is leaps and bounds above what is currently provided by many in the industry.”
If you have any questions about how Shift4 can provide true security for your enterprise, please contact <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Shift4%20Mints%2010%20More%20CISSPs">support@shift4.com</a> or call 702.597.2480 (option 2).

Shift4 Mints 10 More CISSPs

Recently announced by Apple®, Apple Pay™ is a mobile payments tool that uses near-field communication (NFC) to communicate with NFC-enabled terminal devices. Apple Pay will be delivered to the iPhone® 6 in an update scheduled later this month and to the Apple Watch™ upon its release in early 2015. Shift4 currently supports several NFC payment options including Google Wallet™ and Softcard™ (formerly Isis Wallet™), so adding support for Apple Pay’s NFC-based, in-store transactions should be relatively quick and easy on our side. You will need an NFC-enabled payment device that is supported by both Shift4 and your point-of-sale or property management system to process payments using this technology. (A <a href="https://www.shift4.com/partner/integration/Third_Party_Devices.cfm" target="_blank" rel="noopener noreferrer">full list of supported devices</a> can be found on our website – just look for options with a green “Yes” next to the Contactless/NFC feature.)
In addition to NFC-based, in-store payments, Apple Pay also offers an in-app payment functionality, whereby devices with Apple Pay enabled can use the phone’s provided token to complete purchases through apps running on Apple devices. However, it appears there will be significant development required by Shift4 and each of the processors we work with (and possibly from the app developers as well) to support Apple Pay’s in-app payment functionality.
We’ll know more about both of these technologies once we receive the official specifications from Apple, and will update you at that time with a projected launch date(s).

Shift4’s Plan for Apple Pay

For years, we’ve been warning merchants about the brand damage that can come as a result of a card data breach, and recently a series of articles and research studies have made it clear just how harmful it can be. If you’re not currently taking full advantage of our suite of security technologies, including both <a href="https://www.blogger.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a> and <a href="https://www.blogger.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">point-to-point encryption</a> (P2PE), here are a few reasons to make the change. 
An <a href="http://www.aciworldwide.com/2014fraudsurvey.aspx" target="_blank" rel="noopener noreferrer">international study by banking firm ACI Worldwide</a> revealed that 29% of consumers around the globe do not trust retailers to protect their data. That’s almost three out of every ten shoppers who may feel uncomfortable checking out with a card in your business because they don’t know that you take data security seriously.
Furthermore, 45% of consumers surveyed don’t believe brick-and-mortar merchants employ any security systems to protect their financial data, and 38% doubt the security of merchants’ websites. Pair those numbers with <a href="http://www.truste.com/us-internet-of-things-index-2014/" target="_blank" rel="noopener noreferrer">TRUSTe’s report from earlier this year</a> that found 89% of consumers say they would avoid doing business with a company that they do not believe protects their privacy, and the results could be devastating.
As we continue to see more merchants breached and more records compromised, it is likely that these percentages will increase. A <a href="http://www.nclnet.org/datainsecurity_report" target="_blank" rel="noopener noreferrer">Javelin research study</a> commissioned by the National Consumers League showed that consumer fraud has a serious ripple effect across the industry. Case in point,“59% of respondents whose data was breached at a retailer expressed ‘significantly decreased’ trust in [other] retailers who failed to protect their information.”
As a Shift4 merchant customer, you have access to <a href="https://www.blogger.com/dotn/4tify/" target="_blank" rel="noopener noreferrer">the best security technologies available today</a>. Not only do we secure your data, we use TrueTokenization and P2PE to remove it entirely from your environment so you can focus on your daily business while we focus on protecting your customers’ sensitive payment information. And, in case you still aren’t convinced, Shift4 provides these technologies at no additional cost to all DOLLARS ON THE NET® users. Yes, we said all users. Even if you’re not using our tokenization solution, or if your point-of-sale (POS) or property management system (PMS) vendor has not yet included support for it in their integration, Shift4 still generates a token for every single transaction we process. Don’t let them go to waste. Contact your POS or PMS vendor and encourage them to finish their Shift4 integration and help you secure your customer data and protect your brand by leveraging all of Shift4’s technologies.
If we can help you in any way to enhance the security of your card data environment, please let us know by emailing <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry:%20Consumers%20Care%20About%20Card%20Data%20Security">support@shift4.com</a> or calling 702.597.2480 (option 2).

Consumers Care About Card Data Security

Every year, over 90% of U.S. consumers purchase or receive a gift card. In a study conducted last year, 41% of consumers reported having tried a retail store, restaurant, or hotel for the first time because they received a gift card for that business. Of that group, 72% returned to that business. Oh, and don’t forget that 70% of consumers spend more than the value of the card. Looking at these numbers, implementing a gift card solution for your business seems like common sense – and we’ve made it easy. 
Here are the top six benefits of Shift4’s <a href="https://www.blogger.com/dotn/iyc/" target="_blank" rel="noopener noreferrer">IT’S YOUR CARD®</a> (IYC) gift card program:
1) IYC integrates directly with DOLLARS ON THE NET, giving you the ability to sell, reload, and redeem gift cards all from a platform you already know and love. There’s no need to learn new software and no additional costs for gift card reporting. (Many third-party gift card processors charge thousands of dollars per year for the kinds of reports we offer for free.)
2) You keep the money. With IYC, the merchant has control of the funds received from gift card sales. Many third-party solutions hold the funds until the card is redeemed.
3) IYC supports almost every gift-card type imaginable: traditional and electronic gift cards, prepaid cards, merchandise return cards, limited-time offers, teen cards, discount cards, employee expense account cards, and more. It also works with any existing gift card program you may already have in place.
4) Shift4’s SiteBuilder lets you sell gift cards online without investing additional time and money into developing an entirely new Web page. We do all the heavy lifting, you just go through a simple setup process and then enjoy all the benefits of an online gift card program.
5) IYC saves you money. First, we have clearly defined costs for gift card processing (the same pennies per transaction you pay for credit or debit). Also, aside from a small setup fee, there is no additional cost to run IYC for as long as you are a Shift4 customer. And we continue our commitment to neutrality by letting you shop around and choose your own vendor for plastic cards – guaranteeing the best available rates.
6) IYC can be sold across your enterprise (used at every property in a chain), or limited to a specific location or even a specific revenue center (only the spa within your hotel, for example) – the choice is yours.
More than 80% of holiday shoppers plan to purchase at least one gift card in the upcoming season. Prepare now to take advantage of this market. Contact <a href="mailto:myaccount@shift4.com?subject=Six%20Reasons%20to%20Love%20Shift4%E2%80%99s%20Gift%20Card%20Solution">myaccount@shift4.com</a> to put IT’S YOUR CARD to use in your business.

Six Reasons to Love Shift4’s Gift Card Solution

Buying secondhand (used) credit card PIN pad devices as a way to save money could come with a lot of headaches and limitations – and not nearly the cost savings you might expect. 
Shift4 is all about helping our merchant customers save money and avoid additional fees when it comes to credit card processing. We help you identify and <a href="https://www.blogger.com/blog/post.cfm/avoiding-visa-s-most-costly-downgrade" target="_blank" rel="noopener noreferrer">avoid the most common downgrades</a> and fines, we empower you to <a href="https://www.blogger.com/blog/post.cfm/6-steps-to-finding-the-best-msp-or-processor-for-your-business" target="_blank" rel="noopener noreferrer">negotiate for better rates with your MSP</a>, and <a href="https://www.blogger.com/blog/post.cfm/communication-costs-we-pick-up-the-tab-for-you" target="_blank" rel="noopener noreferrer">we pick up the tab for your communications costs</a>. These are all great ways to save money without sacrificing necessary services or functionality. Used devices, on the other hand … not so great.
Here are a few of the reasons why:
The information that needs to be loaded onto these devices is very specific and can be complex. At least one – and often two – proprietary encryption keys need to be installed by certified vendors.
First, in order to process debit transactions, an encryption key needs to be loaded onto your device through a process we call “injection.” This key changes depending on several variables and is unique to your merchant services provider (MSP). Buying a debit device that has someone else’s debit key on it means you’ll have to send that device to a certified rekeying facility for reinjection.
Second, with most of our merchants moving toward devices that support point-to-point encryption (P2PE), an entirely separate encryption key is required to work with our P2PE solution. This is true whether you’re using a debit device or not.
Finding a device that has both of these keys already injected on it – well, let’s be honest, it’s not going to happen. So your only option would be to get your secondhand device rekeyed by mailing it to an injection facility that is certified by both your MSP and by Shift4 (or taking the time to send it to two different places for each to inject their own key). Obviously, this would take significant time and, typically, the costs savings at the end of the process would be negligible. For most of you, it’s going to be faster, easier, and not much more expensive to just order the product brand new from one of our authorized distributors.
In addition to encryption keys, Shift4 has a specific set of forms that must be loaded onto PIN pad devices in order for them to function properly. You also have to consider the platform (operating system) that the device is running and the software build version that is currently installed. Are those versions supported by Shift4? Even our most simple P2PE swipe devices – the ones with no screens and no buttons – require a specialized set of keys that are programmed directly to the internal chip by the manufacturer.
As you can see, this is not the place to go it alone to try and save a few pennies. Our authorized distributors can help you get the right products, running the right software, injected with the proper keys, and can save you from days of frustration.
The distributor you should contact will vary depending on the devices you want to use as well as the number of locations you plan to install. As you work closely with the Shift4 account setup team (or with MyAccount if you’re already a customer), we will help you to determine which vendor is best for you and provide you with the specific product number and SKU you will need to order the device(s) you need with the correct keys injected.
For your reference, a full list of devices supported by Shift4 can be found <a href="https://www.blogger.com/partner/integration/Third_Party_Devices.cfm" target="_blank" rel="noopener noreferrer">on our website.</a>
And while we’re on the subject of new devices, be sure to properly dispose of your old ones when you upgrade. Not having your merchant data wiped from the devices before selling or disposing of them, could <a href="https://www.blogger.com/blog/post.cfm/don-t-let-old-terminals-leave-you-open-to-fraud" target="_blank" rel="noopener noreferrer">leave you open to fraud</a>.
If you have any further questions, feel free to contact <a href="mailto:support@shift4.com?subject=Used%20Credit%20Card%20Devices%3F%20Bad%20Idea">support@shift4.com</a>, or call us a 702.597.2480, option 2.

Used Credit Card Devices? Bad Idea

By Steve Sommers – Senior Vice President of Applications Development, Shift4 Corporation
There’s a lot of buzz in the payments industry about uptime and how many “nines” you should be looking for in a potential service provider. To make sure we’re all on the same page, let me explain what I mean by uptime and what exactly these nines signify. 
Uptime is simply the percentage of the time a given system was up and running over the last year. For many years, the ideal that we all strove for (but few actually reached) was the impressive 99.99% uptime. We called this “four nines” (99.99) and it was an incredibly difficult standard to reach – four nines meant your system could be down no more than 52 minutes per year, or about one minute per week.
Uptime should not be confused with availability, which is the percentage of the time users can actually access a system. Availability is affected by the stability of the entire ecosystem. For Shift4, this would mean availability includes not only our uptime, but also the uptime of our merchant customers’ ISPs, processors, banks, etc. We work with one processor that goes down for an hour of maintenance every single night. For customers using that processor, availability is about 96%. Fortunately, we know which hour they’re going to be down each night, so we advise customers to only use that platform if they’re never going to process batches between 2 and 3 a.m. For a retailer that processes between 6 and 7 p.m. every night, the nightly downtime is irrelevant. However, for a 24/7 operation like a hotel or international website that always processes its batches in the middle of the night, it could be devastating.
Today, there are companies advertising five-nines availability, or 99.999% uptime. These companies claim less than 5.26 minutes per year of downtime, which works out to less than one second per day on average. Now, can a company go a whole day without a second of service interruption? Absolutely. Can they go a week? If their system is well designed, yes. But can they sustain that standard for a year or more? That is exponentially more difficult to guarantee.
Here’s how they get away with it. First, they write their contracts very carefully. The processor I just told you about with the hour of nightly maintenance doesn’t count that time as part of their advertised uptime. Their uptime is “net of scheduled maintenance.” Scheduled maintenance – essentially any downtime announced in advance – is written out of their service level agreement (SLA) contract, so it doesn’t count against their advertised percentage. Add it back in, and even if they never had a single minute of downtime outside of their hour window, they’d have only 95.83% uptime.
Another important thing to consider is what they guarantee versus what they advertise. Some are hazy on the difference between the two. Shift4 is careful to differentiate between what our SLA guarantees (99.7% uptime) and what we average (99.98+%). What’s funny about that average is that it’s cumulative for the last decade, but as our technology has steadily improved over that time, so has our uptime. In fact, DOLLARS ON THE NET has not had any measureable downtime since December 2009.
Let me say that again for the skeptics: in the last five years, we have recorded 100% uptime – a stat unrivaled by any other organization in the payments industry.
Why don’t we start guaranteeing that, or at least advertising it? Because that’s not the way Shift4 works. You can’t surpass five years with zero downtime without being incredibly cautious and meticulous. We’ve built our system on redundant servers, running in redundant data centers, with redundant power supplies. We’ve built adaptive routing technology into our Universal Transaction Gateway® and “taught” it how to find the best route from the merchant back to Shift4 – and how to avoid slowdowns and dropped connections. That being said, we’re not arrogant enough to believe we’re infallible. We know we’re good, and we’ll likely never drop below 99.99, but we don’t sell “likely,” we sell facts.
The facts are simple. Not one of the processors we interface to can match our uptime over the last five years. Their uptime is the limiting factor on the availability our merchant customers experience through DOLLARS ON THE NET. Our technology and infrastructure is meticulously designed and constantly monitored and improved upon as new capabilities become available.
What I’m saying is this: any company can claim five-nines uptime and can tell you they’re more reliable than Shift4 because we only guarantee 99.7 in our SLA. But the competition is not over who can write a sneakier contract or who can find the best way to skew their statistics. We’re confident in saying that no other payments company can match what we’ve actually provided to our merchant customers over the past five years – and what we fully expect to continue providing. We’ve had no merchant-impacting downtime in the last five years, and we expect <a href="https://www.blogger.com/blog/post.cfm/our-new-data-center-at-switch-supernap" target="_blank" rel="noopener noreferrer">our new data center at Switch SUPERNAP</a> to make our solution even more reliable – although we haven’t figured out yet how you trump 100%.

Executive Insight: The Truth About Uptime

We recently came across an article published by Digital Transactions that discussed “<a href="http://digitaltransactions.net/news/story/4611" target="_blank" rel="noopener noreferrer">The Furious Battle to Control Tokenization</a>.” The article laid out the politics and power struggles within the payments space and did a good job of explaining the current state of the industry. 
The author explains that with all the headaches and confusion around U.S. EMV, it almost certainly won’t be ready in time for the liability shift in October 2015. All the confusion around EMV led to inaction; merchants and processors were waiting for the dust to settle before they moved to adopt the new technology.
Race for Relevancy 
This lull left a bit of a power void in the industry. EMVCo (owned by the card brands) thought they had everything going their way and then, suddenly, it was anybody’s game again. With EMV now exposed for what it is (a partial solution to card-present fraud, but certainly not the silver bullet to payment security), merchant groups, card brands, and security vendors have all rushed in to create the new global standard for card data security.
The early leader in this push – and the solution we’ve been promoting for the last five years or more – is the combination of tokenization, P2PE, and EMV. This combination helps merchants reduce their PCI scope while providing true security against an ever-growing threat of a data breach. Steve Mott, the payments industry consultant who wrote this op-ed piece, was dead-on with that analysis.
“Adding tokenization (and deploying the full, end-to-end encryption option) to EMV has the potential to make this global standard palatable for U.S. merchants and banks, and might actually produce a return on the $8 billion-to-$10 billion investment projected for chip-based infrastructure they are expected to pay,” Mott said.
We would add a caveat that while this is the best solution so far proposed, it is not a simple one because – to date – no EMV device manufacturer has enabled P2PE for EMV transactions. Sure, some devices on the market claim to be both EMV and P2PE capable, but that’s only because they still have back-up magnetic swipe readers that are P2PE enabled. No manufacturer has yet released a device that can encrypt data from an EMV card at the point of entry.
Our 4Go® technology can encrypt that data at the system driver level, before it reaches the POS/PMS, which is a step in the right direction. However, in order to be considered a complete P2PE environment, and to gain the promised PCI scope reductions, that encryption needs to take place within the actual EMV terminal.
Moss also had us nodding in agreement with his talk of “the wretched excess and ineffectiveness of PCI” and his observation that allowing the card brands to lead any future card-security initiatives would be as naïve as “letting the fox guard the henhouse.”
Too Good to be True 
Overall, it was a well-written article and we appreciate the message it conveyed. Where Mott lost us, though, was when he tried to explain tokenization. Here is an industry analyst – obviously well-versed in the payments industry, including the players, politics, and technologies – whose knowledge of tokenization appeared to be limited to a single provider whose offering is both limited and costly.
First, Mott says that tokenization came on the scene about five years ago – obviously he missed it when we released that technology to the industry nearly a decade ago. And he must have missed our announcement last year about having processed more than five billion tokenized transactions since introducing the technology. When an expert has done this kind of research into a topic, is it too much to expect them to at least mention our having invented the technology? Strange oversight, if you ask us.
Mott also warned merchants that tokenization “costs a little more.”
“Merchants might pay a penny or two to tokenize a transaction, and 3 cents to 5 cents to detokenize it when needed to research a problem or analyze a customer account,” he said.
Wait… what? People charge extra for tokenization? And more than double their rate for reversing the token for chargeback defense? Merchants put up with this? Wow. Tokenization is vital to security. Security is vital to payment processing. Therefore, tokenization is a vital part of what we do – it’s a core element of our offering. Vendors shouldn’t charge extra for something that is essential to their offering.
How We Do It 
That’s yet another reason you can be happy you’re part of the Shift4 family. Other companies charge an additional 4-7 cents per transaction for just one of the many services we include at no additional cost. We also simplify EMV, drastically reduce your PCI headaches, and otherwise do all that we can to isolate you from the ridiculousness that occasionally befalls the payments industry. That’s part of our commitment to merchant advocacy.
If you have questions about tokenization, P2PE, EMV, or anything else mentioned in this article, please contact <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20The%20Fight%20for%20Tokenization">support@shift4.com</a> or call 702.597.2480 (option 2).

The Fight for Tokenization

In the wake of the major retail breaches late last year, the card brands (and a few of the larger issuing banks) dumped huge amounts of money into PR campaigns that positioned EMV as the solution to our card-data security troubles. Now, those of you who follow our blog closely will remember that we very quickly spoke out and warned that this is not true and that <a href="https://www.blogger.com/blog/post.cfm/why-emv-isn-t-the-answer-to-breach-at-target" target="_blank" rel="noopener noreferrer">EMV wouldn’t have stopped the recent breaches</a>. 
Yet, for some reason, the issuing banks and card brands continue to promote EMV as a cure-all. Why? Probably because it will allow them to shift billions of dollars in liability for fraudulent charges off of their books and onto merchants. Now, EMV is not totally without merit, but as we told you back then, the claims we’re being sold seem seriously exaggerated.
The University of Cambridge recently released a study on EMV security that suggests the cards are not as foolproof and secure as we’ve been promised. Researchers found a pair of vulnerabilities related to the “nonce,” a 32-digit security code that the card passes to the POS or ATM to prove it’s a valid card. In the most simple sense, hackers figured out how to fake that code or how to determine exactly what the code would be at some future date, allowing them to use a cloned card with a “real” nonce code. They were also able to process transactions without entering the correct PIN.
Keep in mind that this research came out of the U.K., where EMV has been the standard for the last decade; so by the time the U.S. version hits next year, this will likely have been patched. But, it’s not the actual vulnerability that scared us about this report. What was truly frightening was the reaction from the banks:
“We can now explain at least some of the increasing number of frauds in which victims are refused refunds by banks which claim that EMV cards cannot be cloned and that a customer involved in a dispute must therefore be mistaken or complicit,” the report reads.
Yes, you read that right. Consumers are going to their bank to report fraudulent use of their cards and are being told that either they’re wrong or else they must be part of the scam! Can you imagine?
This is the danger of marketing a silver bullet. Those of us who actually understand security recognize that there’s no such thing as a silver bullet, but the average person might just buy it. They might genuinely start to believe that EMV is invincible and that it will stop all card fraud dead in its tracks. They might believe it so much that it becomes the proverbial red herring – the distraction that draws people away from the real solution.
If merchants begin to rely so much on EMV that they fail to implement point-to-point encryption (P2PE), tokenization, and the other security technologies that actually help stop breaches, then we’re really in trouble.
Does EMV play a small part in an effective overall security strategy? Yes; it will likely reduce instances of card-present fraud because it makes it much more difficult (though not impossible) to use duplicated cards. Will it stop breaches like the ones we’ve been plagued with recently? Absolutely not.
Be smart out there, don’t believe everything you’re told, and feel free to contact us at <a href="mailto:info@shift4.com?subject=4Sight%20Inquiry%3A%20EMV%3A%20Silver%20Bullet%20or%20Red%20Herring%3F">info@shift4.com</a> if you have any questions.

EMV: Silver Bullet or Red Herring?

Target, Michael’s, Neiman Marcus, White Lodging, and now P.F. Chang’s. It seems like every month there is a new, major data breach making headlines. In the most recent case, P.F. Chang’s appears to have been compromised for close to nine months, and experts say more than seven million card numbers may have been stolen. 
In the weeks after their announcement, the restaurant chain reverted to processing card payments using the old carbon imprinting (knuckle-buster) machines, which led to speculation that they may have been dealing with a new piece of malware that the experts hadn’t seen before and weren’t sure how to stop.
At this point, it’s all still speculation. We can’t say with surety what the attack vector was or what security technologies may (or may not) have been in place at P.F. Chang’s. What we can tell you is that this trend of large-scale attacks shows no signs of slowing down.
A Growing Problem 
In the wake of the Target breach, the FBI issued a memo to major retailers warning them that attacks on POS systems would likely increase in the near future – in spite of law enforcement’s best efforts.
We can also tell you what we learned from our friends at <a href="https://www.blogger.com/coalfire" target="_blank" rel="noopener noreferrer">Coalfire® labs</a> (a leading QSA firm). Late last year, they were at a conference where the U.S. military presented on cyber security. The military officer giving the presentation told attendees that they now assume that all networks are flat. That essentially means that the U.S. military assumes that all of their networks have already been compromised and that our enemies can see any information we post there in an unencrypted state.
While the fact that it has come to that is terrifying from a political perspective, from a security standpoint it’s actually a good practice. If you assume that hackers are already in your environment, would you be more careful in what data you allow to flow through your networks? Would you ensure that everything was encrypted or tokenized? Of course you would, and that’s the point of us sharing this information with you.
A Logical Solution 
Much of PCI DSS is focused on keeping your networks secure and limiting access, but – as we have clearly seen in the last year – that’s not working. Shift4’s security technologies focus on removing the sensitive data from your environment so that there’s nothing for the hackers to target. After all, “They can’t steal what you don’t have.®”
So the question for you is simple: are you taking advantage of all of the security capabilities offered to you as a Shift4 merchant customer? Many of you are using <a href="https://www.blogger.com/dotn/4tify/trueTokenization.cfm" target="_blank" rel="noopener noreferrer">TrueTokenization®</a>, but haven’t yet implemented <a href="https://www.blogger.com/dotn/p2pe/" target="_blank" rel="noopener noreferrer">point-to-point encryption (P2PE)</a>, others have both of those technologies in place at their front desk, but have left their onsite restaurant out in the cold with no protection.
Which capabilities are available to you depend on which POS and/or PMS you are using and what the vendor included in their certification. If your POS/PMS vendor isn’t supporting the latest technologies, encourage them to start now. Completing a debit certification with Shift4 and adding support for our <a href="https://www.blogger.com/dotn/utg/" target="_blank" rel="noopener noreferrer">Universal Transaction Gateway®</a> (UTG®) opens up our <a href="https://www.blogger.com/dotn/4tify/" target="_blank" rel="noopener noreferrer">full suite of security technologies</a>, and ensures you’ll be ready for <a href="https://www.blogger.com/insight/EMV/" target="_blank" rel="noopener noreferrer">U.S. EMV</a> as soon as the processors give us a spec to certify to.
If you’re not sure which technologies are supported, or want to know what your options are for additional security, give us a call or drop us an email. As always, Shift4 Support is here for you 24/7/365 at <a href="mailto:support@shift4.com?subject=4Sight%20Inquiry%3A%20EMV%3A%20Are%20Constant%20Breaches%20the%20New%20Norm%3F">support@shift4.com</a> or 702.597.2480 (option 2).

Are Constant Breaches the New Norm?

Last year, <a href="https://www.blogger.com/blog/post.cfm/shift4-s-data-center-expansion-means-even-faster-processing" target="_blank" rel="noopener noreferrer">we told you about plans for a new data center</a> that would provide another layer of redundancy for Shift4’s DOLLARS ON THE NET® payment gateway, which equates to even more reliable payment processing for you, our merchant customers. And now we’re proud to announce the new data center in the <a href="http://www.supernap.com/index.html" target="_blank" rel="noopener noreferrer">Switch SUPERNAP</a> facility is officially up and running! In fact, it has been processing a portion of our <a href="https://www.blogger.com/company/newsroom/content/pr_20140124_5billion.cfm" target="_blank" rel="noopener noreferrer">hefty transaction volume</a> since the beginning of the year.
Building a new data center requires months of intense planning, strategizing, and analyzing. Then comes the difficult task of actually building and configuring the new servers. Connecting over 100 servers to 100+ networking devices doesn’t sound so bad, but doing it in a way that meets Shift4’s incredibly stringent standards for design, redundancy, and security becomes a little more complicated.
To give you an idea how complicated, let’s take the network cables as an example. Our new data center at Switch SUPERNAP is less than 50 feet long, yet it is home to a little over three miles of network cable. That’s 800+ cables, divided into 13 different color-coded categories and routed to 15+ distinct networks based on the type of data they will carry and the security requirements of that specific type of data.
If that’s not enough to make your head spin, our new data center also boasts:
<ul style="margin-top: 0px; padding-top: 0px;">
<li style="margin-top: 0px; padding-top: 0px;">1,500+ feet of fibre optic cable</li>
<li style="margin-top: 0px; padding-top: 0px;">650+ power cords that would stretch nearly 2,000 feet if laid end to end</li>
<li style="margin-top: 0px; padding-top: 0px;">15+ distinct networks running on 100+ devices</li>
<li style="margin-top: 0px; padding-top: 0px;">¾ of a mile of Velcro wraps to keep thousands of wires bundled together and looking tidy</li>
</ul>
Why Multiple Data Centers? 
Well, the first question we have to answer is, “why do we have multiple data centers to begin with?” Of course, anyone with an IT background knows that it’s for redundancy. Redundancy means we always have a backup, so that no single point of failure can affect our ability to process your transactions.
Shift4 has operated our own redundant data centers for several years, and when we initially added the second location, we made sure that it was far enough away from the first to be on an entirely separate power grid. (Again, no single point of failure. Should a transformer fail or a car knock over a pole, at least one of our data centers would be unaffected.)
After power, the next thing to consider is natural disasters. Now, Vegas is considered a very safe location when it comes to these types of disasters. We don’t get blizzards, tornadoes, hurricanes, or tsunamis, and earthquakes worth worrying about happen maybe once every 50 years. The one thing we do deal with here is heat. We’re talking 115-plus-degree days every summer. That makes climate control a very important proposition when building a data center in Las Vegas.
In order to trust Switch SUPERNAP to host our data center, we had to be sure they could provide the same level of protection for our servers that we do at our onsite data centers. Switch did more than earn our trust – they impressed us. Their founder and CEO actually holds patents on innovative cooling processes and data center designs that create the most stable ecosystem and have set a new standard for the way these environments are controlled. That’s when we realized they were a perfect fit for us, because patenting innovative technologies that set new standards is our specialty, too. (For more on how Switch SUPERNAP controls their ecosystem, <a href="http://www.supernap.com/ecosystems.html" target="_blank" rel="noopener noreferrer">click here</a>.)
So, by now you’re probably wondering what SUPERNAP is. According to their website, Switch SUPERNAP “is the world&#8217;s leader in data center ecosystem design, development, and mission-critical operations, providing unrivaled independent solutions for colocation, connectivity, cloud, and collaboration ecosystems. Switch SUPERNAP represents innovation, security, and reliability for more than 1,000 global clients, from sophisticated startups to Fortune 100 powerhouses.” Essentially, Switch SUPERNAP is a sophisticated, climate-controlled, protected-like-it’s-the-President, housing facility, specifically designed for extremely important computer servers.
The facility employs 24/7 armed guards, requires two-factor authentication to get inside, and provides additional access controls even after you’re in the building to ensure that you only have access to the machines you own. It’s even built under two separate roofs, so that they can replace or repair one roof without ever exposing the data center to the elements! Perhaps most impressive of all is that thanks to some of the companies/agencies/organizations that also call Switch home, the government has deemed Switch SUPERNAP a critical infrastructure component, which means in the event of an emergency or disaster, the facility receives top priority for restoration of power and/or fuel to run their onsite generators.
What Does All of This Mean to Our Merchant Customers? 
In simple terms, it means that DOLLARS ON THE NET is now hosted in one of the world’s most reliable environments, a facility that has become the gold standard for secure data center construction. (There have been magazine articles and white papers written about Switch SUPERNAP, and it holds certifications that no other data center on earth has ever obtained – it really is that good.)
It also means that we can simultaneously perform maintenance on up to half our servers without impacting any of our merchant customers’ ability to process transactions.
Oh, and the best part of this whole experience for Shift4 is that when the Switch team came to review what we had built, they complimented our team for going above and beyond their stringent standards. Maybe we should have warned them that “good enough” is not in the Shift4 vocabulary; we do things bigger, better, stronger, and faster because our merchant customers expect the very best – and that’s what we deliver.