CRUSH Alerts 2.0 - New Fortune 1000 Security Breach Announcements

HSBC data theft affected 24,000 Swiss accounts

Thursday March 11th 2010 07:23:00 AM

A former information-technology staffer at HSBC Holdings stole data on 24,000 clients of the group?s Swiss private-banking arm, including 15,000 current clients, the bank says.

BitDefender Offers Tips to Protect Your Company and Customers From Data Breaches

Thursday March 11th 2010 05:59:00 AM

Fraud, Identity Theft, Impersonation and Sabotage Are Only a Few of the Actions Cybercriminals Can Take to Damage Your Business and Finances

HSBC says Swiss data theft affects 24,000 accounts

Thursday March 11th 2010 05:27:00 AM

Reuters - LONDON/GENEVA (Reuters) - HSBC , Europe's biggest bank, said a theft of data by a former employee affected up to 24,000 Swiss client accounts, dealing a hefty blow to the reputation of its private bank.

Some 24,000 hit by stolen HSBC Swiss bank data

Thursday March 11th 2010 05:03:00 AM

AFP - GENEVA (AFP) - Some 24,000 customers may have been affected by the theft of data from a Swiss branch of banking giant HSBC three years ago, Alexandre Zeller, chief executive of HSBC Private Bank, said on Thursday.

HSBC admits huge scale of Swiss data theft

Thursday March 11th 2010 03:54:07 AM

An estimated 24,000 clients of HSBC Private Bank in Switzerland had personal details stolen in a data theft three years ago, a far higher number than originally thought and "highly likely" to include British customers, the bank acknowledged today.

HSBC says Swiss data theft affects 15,000 clients

Thursday March 11th 2010 12:58:00 AM

Reuters - LONDON (Reuters) - HSBC Holdings said the theft of data by a former employee affected about 15,000 Swiss client accounts, after previously saying it affected "less than 10 clients."

Data Tap: Tech's Lost Decade

Wednesday March 10th 2010 03:00:00 PM

Read full story for details.

Verizon Incident-Sharing Framework Brings Sanity to Security Checks

Wednesday March 10th 2010 02:17:16 PM

The 2009 Verizon Data Breach Investigations Report offers insider knowledge based on forensic investigations of 90 confirmed breaches in 2008. Now anyone with an hour to spare can look over a beta version of the framework used to collect the data. IT managers and business executives alike can use the newly released Verizon Incident Sharing Framework to begin a security review with the goal of avoiding being one of the statistics in 2010.
- A document was just released that could help IT managers avoid being a security statistic in 2010. This week (March 9), Verizon Business released a beta version of the Verizon Incident Sharing Framework (VerIS), a version of the assessment document used by Verizon forensic investigators to sys...

What will it take to make mobile payments mainstream in the US?

Wednesday March 10th 2010 01:18:51 PM

Steven Klebe is senior VP of business development at on-demand billing company Vindicia and writes regularly about mobile payments on his Payment Talk blog.

The tech industry’s been talking about mobile payments for years, and I find the whole discussion fascinating. Not just the potential and the rhetoric, but the gap that exists between the two. I even spent a year working at a yet-to-launch mobile payments company, BillToMobile. But to be honest, we’re still at least about five years away from seeing mobile payments go mainstream. We’re at ?the wind at your back stage,? where the possibilities seem endless, and will soon enter ?the wind in your face stage,? where reality kicks in. And on the way from one stage to the other, we’ll see a number of companies fall by the wayside and a few legitimate contenders survive. There is already a long history of road kill in the alternative payment space (PayByTouch, Revolution Money, DigiCash, and PepperCoin to name a few).

So what system for mobile payments will eventually take hold? I’ll get to that in a minute. First, what exactly is a mobile payment?

This is a more complicated question than you think. There are at least half a dozen different definitions. A lot of existing alternative payment companies, entrepreneurs, and VCs are attempting to associate whatever it is they’re doing with the buzz around mobile payments. In my opinion, a real mobile payment is one where the obligation to pay ends up as a line item on your mobile phone bill regardless of the access device or location. However, many would argue that the use of your mobile phone as a proxy for one of your regular credit/debit card accounts or perhaps your prepaid card also qualifies.

I’m a regular enough patron at Starbucks that I carry one of their proprietary prepaid cards. I heard about their pilot that lets you pay directly from your iPhone, so I loaded the app onto my phone and associated it with my existing card. I tried it out in Sunnyvale two weeks ago at one of the few stores outfitted for the service, and the experience was amazing. After performing an activation step for first-time users, I was able to pay for my coffee by simply passing my iPhone screen in front of the bar code reader on the counter. So, was that a mobile payment? No. My iPhone was just a way to link me to the account that exists on some server back at Starbucks. They could have just as easily captured a retina scan and associated that with the stored value account and we’d be talking about biometric payments, which were all the rage a decade ago.

The Starbucks app is very well done and cool, sure, but it’s just using my phone instead of a card to access my prepaid account. There is no guarantee that having this will open up a new revenue stream for Starbucks. And to run the program, the company has to outfit its stores with new technology. So where’s the payoff?

The valuable lesson here is that the Starbucks card and all the infrastructure to support it already existed and adding this feature is a benefit that some customers will really appreciate. In general, experience has taught me that the best chances for success are when you combine two things that already exist rather than creating something completely new. This is especially true in payments, because there are a lot of details involved that are difficult to change but readily available to leverage. (There would be no PayPal today if there didn’t already exist an entire credit card system, automated clearinghouse for echecks, and a whole community of eBay users needing a payment option.) So, any new offering that requires users to download an application, get a new device, or open a new account is probably doomed to fail. This applies not just to the end user side of the equation but also to the merchant side. In the case of Revolution Money, users had to open a new account and then find a place to use it. The company made a lot of noise about having lots of merchants, but in reality they had just signed (and paid) processors to link to their card. The merchants still had to opt in, and most did not because there were not enough consumers to bother. So what does Revolution Money have to do with mobile payments? Numerous mobile payment companies require users to establish a new account or carry a specific device. Unless you can build up a significant number of users and places to use the service within a very short period of time, you’re toast.

Take NFC (near field communications), for example. You may have received a card from Visa (payWave), MasterCard (PayPass) or Amex (ExpressPay) that has an embedded NFC chip that can communicate with properly outfitted POS systems. It was the rage about five years ago. And with the big credit card companies behind it, it had a fantastic chance to get into the hands of lots of users. But the business case was weak both for merchants and for the card issuers themselves, and so it hasn’t lived up to its expectations. Changes to the rules for $25-and-under payments, where no signature is required, have further diminished the case. The idea is to put the NFC chip on the back via a decal or inside of mobile phones. The decal is certainly a step up from the embedded model, because it eliminates all the contentiousness with trying to bring the mobile carriers and the payment brands to the table together (there’s been much written about this chasm, so I won’t dwell on that here). But, there is still this nasty issue about the business case for the expense associated with outfitting the POS and distributing the decals in lieu of the fully deployed mag stripe terminals and extremely inexpensive mag stripe card. Unlike in France, where chip cards were successful thanks to government mandates and subsidies, I don’t see the government having any particular motivation to subsidize the deployment of NFC. Anyone for a ?Cash for Clunky Mag Stripe Cards? program??

So what about all the players on the e-commerce side of mobile payments — providers like Zong or Boku that have been drawing a lot of attention lately. These services enable SMS payments for digital goods and services. Want to buy a $1.00 virtual flower to send to your friend?s Facebook account? These services will let you charge that to your mobile phone account. But, again, there’s no strong incentive here for merchants. It costs them 50% off the top to enable such a transaction, most of which goes to the mobile carrier. As a side note, even if you paid with PayPal, it would cost most merchants around 33%. So, until the time comes when the cost of having a payment pushed to your mobile phone bill drops (like it has in S. Korea, to the 5-7% range), the only people likely to use these SMS payment services are the under/un-banked and purchasers of digital goods and services, where the merchants marginal costs are near zero. If the merchant fee does come down for direct-to-mobile billing, we would be looking at a seismic shift in the payments landscape. The other side of e-commerce such as the Amazon app on my iPhone, in my opinion, does not count as a mobile payment, but that’s certainly open for debate.

So if the objective in this industry is to effect a paradigm shift, then mobile carriers have to appreciate the fact that they have the opportunity to become the ?everyday? payment processors of the future, especially for the under $10 payment market. This is a huge opportunity for them to generate incremental revenue and become more relevant than just a ?browser on the hip?. They also have to be willing to perform this incremental service for a competitive fee. Every consumer that matters has a mobile phone with them everywhere they go, they have been credit checked, and the device can be leveraged to dramatically reduce risk. With the addition of additional authentication, fraud risk can almost completely be eliminated. They don’t have to be in the credit granting business, since debit is the preferred way to pay today anyway, especially for small value transactions.

Carriers already have billing relationships with the roughly 90% of us that choose post-pay accounts, and by adding payment processing services, they’d increase the utility for their customers, rather than asking them to establish, manage and carry something new. While it was neat to use my iPhone with the Starbuck?s Card app on it, if this concept is going to revolutionize the way I pay, it has to become ubiquitous ? one to many. There need to be as few mouths to feed between the consumer and the merchant as possible, and if the carriers don’t step in and fill the gap, then PayPal has the best chance of adding mobile as an incremental piece of its ever expanding puzzle, since the hard part — the existence of the account and the primary utility — has already been established.

THE COMMUNITY RESPONDS:

–Hill Ferguson, VP, Product & Marketing, ZONG

Steve makes a lot of good points here, and there are very few people in the industry more qualified to speak on this topic. We at Zong agree that building a payment network hinges on creating ubiquity. Consumers and merchants alike must have easy access to the payment method. The salient question here is, how do you define “mainstream”? Zong has carrier connections that allow over 1.5 billion consumers instant access to use Zong to pay online and have the charge appear on their mobile bill. This is no small feat. We’ve spent the better part of the last 10 years building out direct carrier connections with mobile operators around the world. We also have a merchant network which provides our payment option to over 500 million online consumers worldwide. We are also making great strides on the merchant side, powering mobile payments for some of the leaders in social networking and online gaming, including Facebook. Our merchants often serve tens of millions of customers each month. Facebook alone reports over 400 million monthly active monthly users! Today, almost all of these users can use their mobile phone to buy virtual goods with Zong via Facebook Credits, the company’s latest platform payments initiative. Is Zong’s mobile payment network considered mainstream? We think so, but we’re not remotely satisfied yet. Our mobile payment platform processed mobile payments for well over 10 million unique users in 2009, and we’re ramping even faster in 2010. So, while we’re not yet 100% ubiquitous, it’s certainly our goal, and we’re clearly on the right path.

–Redg Snodgrass, Director of Digital Distribution, Alcatel-Lucent

While I respect Steve?s experience, it is time we all stop thinking of payments as a problem and start looking at payments as an opportunity. The smart companies are. The companies I talk to know all too well the challenges they face. What I?m seeing more and more, though, are service providers who no longer look at half-empty glasses. In fact, they see glasses that are increasingly half-full. Take mobile payments. Service providers see it. They want it. But they know it also comes with a cost. That cost, at least to those I?ve spoken to, comes in the form of the high costs associated with customer service calls (at an average of roughly $35 per call from what I can tell). To many, the idea of opening this to exponentially higher numbers of mobile users is, well, a wee bit frightening. But what if they could turn this cost into revenue (or at least offset the cost)? And this is where I fundamentally agree with where Steve is coming from. We?ve been working hard (really hard) at Alcatel-Lucent to deliver a program to bring relevance to those programming to the pipes (stay tuned later this week for more details?for a sneak peak, take a look at what we announced a few weeks back in Barcelona at Mobile World Congress?or look at the work going on at TouchaTag). Relevance is important. If everything a service provider makes money on becomes commoditized ? things like location based services, SMS, payment, presence and, potentially, data ? we all lose. If data becomes commoditized, suddenly there is no more money to spend on infrastructure. If there is no money to spend on infrastructure, we all suffer (or get powned by our new Google overlord). We want to make it easy for our customers to take advantage of payments as a revenue stream (hint: it has to do with commercially bundling APIs). So while many look at mobile payments as something to fear, we think we?re cutting a path for the industry to see revenue rather than cost.

What do you say? Who will drive mobile payments in the US?online surveys

Steve Klebe has over 25 years of experience in electronic payments, fraud prevention and authentication. He is a former member of the board of directors of the Electronic Transactions Association and advisory boards of the Direct Response Forum and the Electronic Funds Transfer Assoc. He has held a variety of senior management roles at VeriFone, CyberCash, CyberSource and PassMark Security (now part of EMC/RSA). He’s currently a member of two private company advisory boards and works as SVP, Business Development for Vindicia, a leading provider of a SaaS based recurring subscription billing solution.

Steven Klebe is senior VP of business development at on-demand billing company Vindicia and writes regularly about mobile payments on his Payment Talk blog.

The tech industry’s been talking about mobile payments for years, and I find the whole discussion fascinating. Not just the potential and the rhetoric, but the gap that exists between the two. I even spent a year working at a yet-to-launch mobile payments company, BillToMobile. But to be honest, we’re still at least about five years away from seeing mobile payments go mainstream. We’re at ?the wind at your back stage,? where the possibilities seem endless, and will soon enter ?the wind in your face stage,? where reality kicks in. And on the way from one stage to the other, we’ll see a number of companies fall by the wayside and a few legitimate contenders survive. There is already a long history of road kill in the alternative payment space (PayByTouch, Revolution Money, DigiCash, and PepperCoin to name a few).

So what system for mobile payments will eventually take hold? I’ll get to that in a minute. First, what exactly is a mobile payment?

This is a more complicated question than you think. There are at least half a dozen different definitions. A lot of existing alternative payment companies, entrepreneurs, and VCs are attempting to associate whatever it is they’re doing with the buzz around mobile payments. In my opinion, a real mobile payment is one where the obligation to pay ends up as a line item on your mobile phone bill regardless of the access device or location. However, many would argue that the use of your mobile phone as a proxy for one of your regular credit/debit card accounts or perhaps your prepaid card also qualifies.

I’m a regular enough patron at Starbucks that I carry one of their proprietary prepaid cards. I heard about their pilot that lets you pay directly from your iPhone, so I loaded the app onto my phone and associated it with my existing card. I tried it out in Sunnyvale two weeks ago at one of the few stores outfitted for the service, and the experience was amazing. After performing an activation step for first-time users, I was able to pay for my coffee by simply passing my iPhone screen in front of the bar code reader on the counter. So, was that a mobile payment? No. My iPhone was just a way to link me to the account that exists on some server back at Starbucks. They could have just as easily captured a retina scan and associated that with the stored value account and we’d be talking about biometric payments, which were all the rage a decade ago.

The Starbucks app is very well done and cool, sure, but it’s just using my phone instead of a card to access my prepaid account. There is no guarantee that having this will open up a new revenue stream for Starbucks. And to run the program, the company has to outfit its stores with new technology. So where’s the payoff?

The valuable lesson here is that the Starbucks card and all the infrastructure to support it already existed and adding this feature is a benefit that some customers will really appreciate. In general, experience has taught me that the best chances for success are when you combine two things that already exist rather than creating something completely new. This is especially true in payments, because there are a lot of details involved that are difficult to change but readily available to leverage. (There would be no PayPal today if there didn’t already exist an entire credit card system, automated clearinghouse for echecks, and a whole community of eBay users needing a payment option.) So, any new offering that requires users to download an application, get a new device, or open a new account is probably doomed to fail. This applies not just to the end user side of the equation but also to the merchant side. In the case of Revolution Money, users had to open a new account and then find a place to use it. The company made a lot of noise about having lots of merchants, but in reality they had just signed (and paid) processors to link to their card. The merchants still had to opt in, and most did not because there were not enough consumers to bother. So what does Revolution Money have to do with mobile payments? Numerous mobile payment companies require users to establish a new account or carry a specific device. Unless you can build up a significant number of users and places to use the service within a very short period of time, you’re toast.

Take NFC (near field communications), for example. You may have received a card from Visa (payWave), MasterCard (PayPass) or Amex (ExpressPay) that has an embedded NFC chip that can communicate with properly outfitted POS systems. It was the rage about five years ago. And with the big credit card companies behind it, it had a fantastic chance to get into the hands of lots of users. But the business case was weak both for merchants and for the card issuers themselves, and so it hasn’t lived up to its expectations. Changes to the rules for $25-and-under payments, where no signature is required, have further diminished the case. The idea is to put the NFC chip on the back via a decal or inside of mobile phones. The decal is certainly a step up from the embedded model, because it eliminates all the contentiousness with trying to bring the mobile carriers and the payment brands to the table together (there’s been much written about this chasm, so I won’t dwell on that here). But, there is still this nasty issue about the business case for the expense associated with outfitting the POS and distributing the decals in lieu of the fully deployed mag stripe terminals and extremely inexpensive mag stripe card. Unlike in France, where chip cards were successful thanks to government mandates and subsidies, I don’t see the government having any particular motivation to subsidize the deployment of NFC. Anyone for a ?Cash for Clunky Mag Stripe Cards? program??

So what about all the players on the e-commerce side of mobile payments — providers like Zong or Boku that have been drawing a lot of attention lately. These services enable SMS payments for digital goods and services. Want to buy a $1.00 virtual flower to send to your friend?s Facebook account? These services will let you charge that to your mobile phone account. But, again, there’s no strong incentive here for merchants. It costs them 50% off the top to enable such a transaction, most of which goes to the mobile carrier. As a side note, even if you paid with PayPal, it would cost most merchants around 33%. So, until the time comes when the cost of having a payment pushed to your mobile phone bill drops (like it has in S. Korea, to the 5-7% range), the only people likely to use these SMS payment services are the under/un-banked and purchasers of digital goods and services, where the merchants marginal costs are near zero. If the merchant fee does come down for direct-to-mobile billing, we would be looking at a seismic shift in the payments landscape. The other side of e-commerce such as the Amazon app on my iPhone, in my opinion, does not count as a mobile payment, but that’s certainly open for debate.

So if the objective in this industry is to effect a paradigm shift, then mobile carriers have to appreciate the fact that they have the opportunity to become the ?everyday? payment processors of the future, especially for the under $10 payment market. This is a huge opportunity for them to generate incremental revenue and become more relevant than just a ?browser on the hip?. They also have to be willing to perform this incremental service for a competitive fee. Every consumer that matters has a mobile phone with them everywhere they go, they have been credit checked, and the device can be leveraged to dramatically reduce risk. With the addition of additional authentication, fraud risk can almost completely be eliminated. They don’t have to be in the credit granting business, since debit is the preferred way to pay today anyway, especially for small value transactions.

Carriers already have billing relationships with the roughly 90% of us that choose post-pay accounts, and by adding payment processing services, they’d increase the utility for their customers, rather than asking them to establish, manage and carry something new. While it was neat to use my iPhone with the Starbuck?s Card app on it, if this concept is going to revolutionize the way I pay, it has to become ubiquitous ? one to many. There need to be as few mouths to feed between the consumer and the merchant as possible, and if the carriers don’t step in and fill the gap, then PayPal has the best chance of adding mobile as an incremental piece of its ever expanding puzzle, since the hard part — the existence of the account and the primary utility — has already been established.

THE COMMUNITY RESPONDS:

–Hill Ferguson, VP, Product & Marketing, ZONG

Steve makes a lot of good points here, and there are very few people in the industry more qualified to speak on this topic. We at Zong agree that building a payment network hinges on creating ubiquity. Consumers and merchants alike must have easy access to the payment method. The salient question here is, how do you define “mainstream”? Zong has carrier connections that allow over 1.5 billion consumers instant access to use Zong to pay online and have the charge appear on their mobile bill. This is no small feat. We’ve spent the better part of the last 10 years building out direct carrier connections with mobile operators around the world. We also have a merchant network which provides our payment option to over 500 million online consumers worldwide. We are also making great strides on the merchant side, powering mobile payments for some of the leaders in social networking and online gaming, including Facebook. Our merchants often serve tens of millions of customers each month. Facebook alone reports over 400 million monthly active monthly users! Today, almost all of these users can use their mobile phone to buy virtual goods with Zong via Facebook Credits, the company’s latest platform payments initiative. Is Zong’s mobile payment network considered mainstream? We think so, but we’re not remotely satisfied yet. Our mobile payment platform processed mobile payments for well over 10 million unique users in 2009, and we’re ramping even faster in 2010. So, while we’re not yet 100% ubiquitous, it’s certainly our goal, and we’re clearly on the right path.

–Redg Snodgrass, Director of Digital Distribution, Alcatel-Lucent

While I respect Steve?s experience, it is time we all stop thinking of payments as a problem and start looking at payments as an opportunity. The smart companies are. The companies I talk to know all too well the challenges they face. What I?m seeing more and more, though, are service providers who no longer look at half-empty glasses. In fact, they see glasses that are increasingly half-full. Take mobile payments. Service providers see it. They want it. But they know it also comes with a cost. That cost, at least to those I?ve spoken to, comes in the form of the high costs associated with customer service calls (at an average of roughly $35 per call from what I can tell). To many, the idea of opening this to exponentially higher numbers of mobile users is, well, a wee bit frightening. But what if they could turn this cost into revenue (or at least offset the cost)? And this is where I fundamentally agree with where Steve is coming from. We?ve been working hard (really hard) at Alcatel-Lucent to deliver a program to bring relevance to those programming to the pipes (stay tuned later this week for more details?for a sneak peak, take a look at what we announced a few weeks back in Barcelona at Mobile World Congress?or look at the work going on at TouchaTag). Relevance is important. If everything a service provider makes money on becomes commoditized ? things like location based services, SMS, payment, presence and, potentially, data ? we all lose. If data becomes commoditized, suddenly there is no more money to spend on infrastructure. If there is no money to spend on infrastructure, we all suffer (or get powned by our new Google overlord). We want to make it easy for our customers to take advantage of payments as a revenue stream (hint: it has to do with commercially bundling APIs). So while many look at mobile payments as something to fear, we think we?re cutting a path for the industry to see revenue rather than cost.

What do you say? Who will drive mobile payments in the US?online surveys

Steve Klebe has over 25 years of experience in electronic payments, fraud prevention and authentication. He is a former member of the board of directors of the Electronic Transactions Association and advisory boards of the Direct Response Forum and the Electronic Funds Transfer Assoc. He has held a variety of senior management roles at VeriFone, CyberCash, CyberSource and PassMark Security (now part of EMC/RSA). He’s currently a member of two private company advisory boards and works as SVP, Business Development for Vindicia, a leading provider of a SaaS based recurring subscription billing solution.

LifeLock fined $12 million over lack of life-locking ability

Wednesday March 10th 2010 11:37:00 AM

Identity theft prevention service LifeLock is not as pristine as its reputation claims after all. The company agreed to pay out $12 million to settle charges with the Federal Trade Commission and 35 states, which had said that LifeLock's identity-theft-prevention claims were false and that the company actually made its own customer data available and unsecured from theft. As it turns out, there is no way to fully guarantee that identity theft won't happen, no matter what someone puts on the side of a truck.

LifeLock has made a name for itself as the go-to service if you never want to have any part of your identity stolen, ever. The company claims to proactively protect your information against fraud, alert you to any kind of shady activity, and reduce credit card offers for $10-15 per month. Those who have seen LifeLock's trucks driving around their cities know that the company used to slap its CEO Todd Davis' social security number on the side of the vehicle along with a number of claims guaranteeing that its customers won't fall victim. (As an aside, Davis' identity allegedly ended up getting stolen in 2007.)

Read the comments on this post

Microsoft gains, Google loses search share: report

Wednesday March 10th 2010 10:57:33 AM

SAN FRANCISCO (MarketWatch) -- Microsoft Corp. gained a larger portion of the U.S. Internet search market in February, while rival Yahoo Inc.'s share remained flat and market leader Google Inc. lost a marginal amount of market share, according to data published Wednesday by Experian Hitwise. Microsoft, which unveiled a new search engine last year, gained 4% from the prior month to reach a 9.7% share, according to the data. Meanwhile Yahoo's share remained at 14.57%, and Google's share dipped 1% to 70.95%. Microsoft and Yahoo have a partnership in place that will have Microsoft handling the technology behind Yahoo's search service, in a revenue-sharing arrangement.

Market Pulse Stories are Rapid-fire, short news bursts on stocks and markets as they move. Visit MarketWatch.com for more information on this news.