Dec. 14, 2018

Western Union, Equifax, Priceline, Spark Networks and Credit Sesame Inc. all reached settlements with the New York State Attorney General’s office regarding what the regulator said was a failure to secure sensitive personal and financial data on their mobile apps, according to a release from the regulator.

The NY AG alleged that the five companies had mobile apps with inadequate Transport Layer Security [TLS] thus making them vulnerable to man-in-the-middle attacks when used over public Wi-Fi networks.

The vulnerability left user data such as credit card numbers, bank account numbers, social security numbers and passwords subject to being intercepted using fairly well known techniques by hackers, according to the AG's release.

The AG says that the mobile apps used by these companies failed to properly authenticate SSL/TLS certificates, which left them vulnerable to an attacker impersonating the companies respective servers and intercepting sensitive data entered into the apps.

The companies all told the AG’s office that they employed sufficient protocols to protect information, regulators said they did not sufficiently test whether the mobile apps had these protocols, according to the release. The settlement requires that the companies take sufficient steps to secure these apps.

"Businesses that make security promises to their users — especially as it relates to personal information — have a duty to keep those promises," AG Barbara Underwood said in the announcement. "My office is committed to holding businesses accountable and ensure they protect users' personal information from hackers."

The announcement is part of an effort by the AG’s office to examine the security of various sites before consumers fall victim to cyber attacks and other breaches, the regulator said. The AG's office said it has tested dozens of apps and online sites as part of the effort.

"Equifax reached a settlement with the New York Attorney General’s Office about this matter in May of 2017," Meredith Griffanti, a spokesperson for the company said in an email. "The vulnerability mentioned was immediately remediated, and we have no evidence that consumer information was impacted as a result."

Officials at the remaining companies were not immediately available for comment. 

Topics: Mobile Apps, Mobile Payments, Money Transfer / P2P, Regulatory Issues, Security

Companies: Priceline Group, Credit Sesame, Equifax, Western Union

Related Content

Latest Content

Dec. 14, 2018

LaterPay, a technology firm that specializes in content or service-related payments, announced an agreement with Salon Media Group Inc. and Colorado-based publisher Pueblo Pulp to allow users to buy digital content on those particular sites.

LaterPay users can buy content on Salon.com using an ad-based, free content model or a user-supported model with no advertising. LaterPay users can buy content in increments of anywhere from one hour to a week, month or full year. The low friction model allows readers to delay payment until the reach a $5 threshold.

Salon CEO Jordan Hoffner said in the announcement that the model allowed them to bring in hundreds of new subscribers for the ad-free model without doing any promotion.

Pueblo Pulp, an independent publisher in the Southern Rockies and Western Plains, said LaterPay allows it to offer annual and monthly subscriptions as well as buy individual articles or sell weekly passes. Users can also make incremental payments of $3, $5, $10 and $25 to support quality journalism on The Pulp's website.

Topics: Mobile Marketing, Mobile Payments, Online Purchasing, Technology Providers

Related Content

Latest Content

Dec. 14, 2018

Instacart CEO Apoorva Mehta announced the end of the the delivery service’s relationship with Whole Foods, in a blog post.

He said that starting on February 10, there will be 243 positions impacted by the move out of a total of 1,415 in-store shoppers across 76 Whole Foods grocery locations. The company will wind down all the remaining shoppers from Whole Foods locations over the following months.

He noted that for 75 percent of Whole Foods shoppers impacted by the announcement, they will be placed in other positions as shoppers for other retailers.

The move will not impact Instacart's remaining shoppers as they work across multiple retailers, he said. The company will also help find positions for shoppers in other positions, both inside and outside of Instacart. The company has a total community of more than 70,000 mobile shoppers and delivery workers throughout North America. 

For shoppers where they cannot find new jobs, they will pay three-months severance based on maximum monthly pay from 2018, plus additional tenure-based compensation.

The move has been widely anticipated following the acquisition of Whole Foods by Amazon. 

Topics: Mobile Apps, Mobile Payments, Retail

Companies: Instacart, Amazon, Whole Foods

Related Content

Latest Content

COMMENTARY

Dec. 14, 2018

Steve Gilde, director of global product marketing, Paragon Application Systems

The world has sped up exponentially over the past decade. Thanks to the many advances made in our modern digital age, consumers can see more, be more and accomplish more than ever before. Take holiday shopping for instance, what used to take long and draining days at the mall can now be accomplished in a few hours on the couch.

Consumers expect convenience in all aspects of their daily life. They enjoy buying what they want, when they want it and have grown accustomed to the ease of having an Uber arrive at their doorstep or seeing groceries delivered to their house with just a few taps or swipes on their phones. They prioritize convenience and hold the same expectations for payment providers; they want to be able to pay for anything, anywhere. If a payment provider can’t support consumers’ desired ways to pay and provide them with a frictionless experience that will not crash or fail, there is no doubt that consumers will find another provider that does. One can have the most sophisticated payments systems available, but if they are not tested properly and fail once, they’ll see high levels of abandonment.

While on the surface it may seem that the payments industry has kept pace with these changes, this has not been easy. Digital payments options available today have increased rapidly and will only continue to multiply. Providers are supporting a seemingly never-ending list of payment apps, endpoints and consumer devices. As payment providers are forced to diversify their offerings to stay relevant and competitive, they need to ensure that every new payment type, every new connection and every new transaction works perfectly every time. To keep up with ever more sophisticated and demanding consumers, this will require additional investment in payments testing solutions that leverage automation and virtualization.  

Behind the times

While next-generation testing solutions are available, many organizations still rely on outdated, manually-driven testing tools and processes. While they may have worked okay in the past, these legacy forms of testing can no longer adequately support the current pace of change or wide variety of payments options that are available today. Simply put, manual testing is expensive, time-consuming and inefficient.  Manual processes also introduce the unwanted element of human error into the payments process.

Automation and virtualization offer significant opportunity to streamline payment testing operations. An automated testing process will help speed up the testing process, increase overall test coverage and reduce mistakes. Automation also allows for payment providers to reduce risk and better protect both the company’s brand and consumers.

Setting up an automated test framework comprised of software and re-usable data facilitates testing across multiple payment use cases and operational scenarios. Recorded test cases can be built into regression scripts and scheduled to run after hours with results delivered back to testers the next morning.

Payment providers that invest in these next generation testing methods will have a definite advantage over competitors that continue to rely on manual tools and processes and will allow them to maintain a more strategic focus on their overall objectives. Providers who take advantage of advanced testing options will also be able to ensure that they provide an optimal experience for consumers.

The pace of change and innovation will only continue to accelerate. The days of the cash-only society are long gone, and it is no longer acceptable for providers to only support the standard debit and credit options. The payments environment will continue to become more complex as consumer preferences evolve and new payments options such as contactless cards, wearables and the Internet of Things (IoT) become available.

As the modernization of payments systems occurs, testing methods must modernize as well. A payments infrastructure is only as strong as its weakest link; building sophisticated platforms and then not testing them properly actually introduces additional opportunity for failure and potential for brand damage. Payment providers must determine how to seamlessly support a wide variety of options if they want to be successful in the modern payments age. By investing in automated testing solutions, payment processors are investing in their future.

Cover photo: iStock

Topics: Mobile Payments, POS, Retail, Technology Providers

Companies: Paragon Application Systems

Related Content

Latest Content