News You Need to Succeed

What’s inside

M A R C H 2 0 1 7

SHAZAM’s 2017 Forum ..........................................................................................2

Support digital wallets this April .............................................................................3

ACH association updates publications list .............................................................5

ATM cash supplies can dwindle during tax refund season ......................................6

Core compliance news ...........................................................................................7

Removal of commercial card exclusion from Mastercard SecureCode merchant-

only liability shifts ................................................................................................8

Protect card data with resources from PCI SSC .....................................................9

Alice, a new ATM malware .....................................................................................10

Are you ready for Mastercard 2-series BINs? .......................................................11

SHAZAM training ..................................................................................................12

‘Ready, Set, Shop’ winners ....................................................................................13

Spotlight on Service — March 2017 2

SHAZAM’s 2017 Forum

Mike Burkerobbery and crisis management consultant

SHAZAM Crime Response Training: The Triple ThreatAs the violence of robbery continues to harm financial institutions across the nation, are you prepared? This action-packed session will unveil vital advice from each of Mike’s Crime Response Training courses: robbery, active shooter and threat assessment. He’ll also define the top three deterrence measures YOU SHOULD be taking to keep your organization, employees and customers safe.

Jackie Rolow executive vice president & chief talent officer

How “Smart” are Your Emotions?How many times have you been told to “check your emotions at the door”? Yet there’s currently a growing field of research on the value and importance of emotional intelligence. Emotional intelligence is the ability of individuals to use information to guide thinking and behavior in order to adapt to different environments or achieve one’s goals. Understanding and using emotions correctly can make you a better communicator and, ultimately, more effective in your job.

You’ll learn strategies to increase your emotional intelligence and translate that into knowledge for better decision making. With a greater understanding of your emotions, you’ll experience a positive impact on your professional and personal life.

The Forum blog is a great way to stay up to date on the latest announcements, learn about exclusive promotions and receive sneak peeks on SHAZAM Forum sessions! Plus, use our template letter with 7 reasons you should attend the 2017 SHAZAM Forum to convince your boss to send you and a co-worker to this great event. Check back often so you don’t miss an update!

Registration is $300 for the first attendee and only $200 for each additional attendee from the same financial institution. Hurry, register today to claim your spot!

Follow the Forum blog

Register today!

Featured speakers and sessionsDes Moines Marriott Downtown April 11 – 13

*From the same financial institution

$300 $200

pricing details

additional*

Regulatory & Compliance Panel

Panelists: A.J. Steiger Jr., CISA (FDIC); Mike Cavanaugh, lead CRSB examiner — CISA (FRB); and Brad Hart, bank analyst (IDOB)

Moderator: Kevin Christensen, SHAZAM’s senior vice president of market intelligence & data analytics

Join your SHAZAM Forum peers for a chance to get in front of industry regulators — who aren’t examining you! You’ll hear from a panel of experts from the Federal Deposit Insurance Corp. (FDIC), the Federal Reserve Board (FRB) and the Iowa Division of Banking (IDOB) on regulatory issues and hot topics. This session will provide guidance and takeaways for you to think about and implement in your own organization. Any remaining time will be open to the floor to ask any additional questions you may have.

NEW THIS

YEAR!

Attendee from Hardin County Savings BankEldora, Iowa

Spotlight on Service — March 2017 3

Products and Services

Support digital wallets this AprilMore digital wallets are hitting the market, and cardholders are exploring these new payment methods. With this in mind, we're excited to share that beginning this April, SHAZAM will support even more digital wallet options!

Supported walletsSHAZAM already supports Apple Pay® for Visa® issuers. For Mastercard® issuers, we’re pleased to share that Mastercard has resolved its issue to support the necessary bank identification number (BIN) configurations on Mastercard Connect™. If we haven’t already, we’ll work on your Apply Pay project soon.

In addition to SHAZAM’s Apple Pay support, SHAZAM will provide the following digital wallet options:

• Android Pay™

• Microsoft® Wallet

• Samsung Pay®

Why support?There are many benefits when you support digital wallets. A few include payment security and payment flexibility for cardholders.

Payment security Digital wallet tokenization provides extra security for cardholders. Tokenization is the process of substituting a sensitive data element with a non-sensitive equivalent, referred to as a token, which has no exploitable meaning or value.

• Apple Pay uses secure element (SE) for tokenizationstorage. SE is a chip embedded directly into thephone’s hardware.

Android Pay, Microsoft Wallet and Samsung Pay use host card emulation (HCE) for tokenization storage. HCE is the software architecture that provides exact virtual representation of various electronic identity cards using only software.

– Continued on next page

Deb Conley, SHAZAM’s senior product manager, plays a key role for SHAZAM and financial institutions to support digital wallet payments. Conley also has firsthand experience as an avid digital wallet user. Here’s what she has to say:

Using a digital wallet is a lot of fun, and it’s a very convenient payment method. Even after all of the times I’ve used a digital wallet, I love to see the shock on a clerk’s face when I make payments by the simple swipe of my finger on my cellphone!

For financial institutions with skepticism about digital wallets, I encourage you to have an open mind for your cardholders’ payment options. The payment methods SHAZAM will soon support are safer than your traditional magnetic stripe transaction — the PAN is tokenized and the “digital card” requires a PIN or fingerprint match before it can be used for payment.

It’s important for SHAZAM and our financial institutions to remain relevant in as many payment transactions as possible. If cardholders are interested in using a digital wallet as a payment option, and their favorite financial institution isn’t offering any digital payment options, these cardholders will likely find a new place to do business. With that in mind, I highly encourage financial institutions to make digital wallets available to all cardholders.

C a r d h o l d e r e x p e r i e n c e

Deb Conley

Spotlight on Service — March 2017 4

Along with security benefits, these emerging mobile wallet trends feature what cardholders are demanding — flexibility and ease.

Get started today!Support is easy. Simply contact your SHAZAM client executive to get the project process started. A SHAZAM customer operations professional will then contact you to discuss the necessary paperwork.

For more informationWe invite you to ask SHAZAM any questions you may have about digital payment support, including SHAZAM and card brand fees. Please contact your client executive with questions.

Products and Services

Digital – Continued from previous page

We’re diligently working with Visa and Mastercard for card on file, Visa Checkout® and Masterpass support. While tokenization support may not begin in April 2017, due to circumstances outside of SHAZAM’s control, we’ll be ready to support these features:

• Card on file (COF) — Visa and Mastercard are working with merchants that store cardholder information in their system for billing or purchases, such as cardholders with recurring payments through merchants. SHAZAM is prepared to support this form of tokenization. As more information becomes available about which merchants will implement COF tokenization, SHAZAM will promptly notify you.

• Masterpass — Your cardholders can enroll directly through the Masterpass website today. When a cardholder enrolls his or her primary account number (PAN) it isn’t automatically tokenized, yet. However, once your institution enrolls in the Mastercard Digital Enablement Service (MDES) and selects Masterpass, you’ll have the opportunity to tokenize real PANs. Mastercard is determining the timing of when registered PANs will be tokenized.

• Visa Checkout — Your cardholders can enroll directly through the Visa Checkout website today. Provisioning of new subscribers for Visa Checkout tokenization began in January. No action is required by issuers.

O t h e r t o k e n i z a t i o n e f f o r t s

Spotlight on Service — March 2017 5

The SHAZAM, Inc. ACH Association recently updated its ACH Publications List and Order Form for 2017.

All SHAZAM financial institutions can use this form, located in SHAZAM Resource > Forms, to order or learn more about a variety of automated clearing house (ACH) reference materials.

New and updated publications The following publications are new or have been updated for 2017:

• AAP Flashcards

• A Banks’ Quick Reference Guide to ACH Origination

• ACH Audit Workbook (CD)

• ACH Quick Reference Guide

• ACH Risk Assessment Workbook (CD)

• ODFI Audit Checklists for Originators and Third-PartySenders (CD)

• Remote Deposit Capture Risk Assessment Workbook(CD)

Additional publications not sold by SHAZAM are available through the NACHA — The Electronic Payments Association® eStore.

ACH association updates publications list

Products and Services

Members of the SHAZAM, Inc. ACH Association recently received a complimentary copy of the 2017 NACHA Operating Rules and Guidelines Book and the Corporate Edition 2017 Operating Rules and Guidelines CD by mail.

If your institution is a member of the ACH association but didn’t receive the free reference materials, please call SHAZAM client support at 800-537-5427 (option 4).

F r e e c o p i e s

Spotlight on Service — March 2017 6

Many of your customers may be receiving their tax refunds or loan proceeds on a debit card from their tax preparer. Are your ATMs ready for the additional withdrawals?

As customers withdraw funds using debit cards, your ATMs may run out of cash more frequently. You may need to replenish your ATM cash supplies more often to avoid inconveniencing your customers.

SHAZAM Monitor can assist you in providing quality customer service without a hiccup in your ATM system.

SHAZAM MonitorSHAZAM Monitor can help ensure your ATM cash supplies are sufficient. The service can detect when there’s a low number of bills in your ATM cassettes and when your cassettes are jammed, empty or installed incorrectly.

You can learn more by reviewing the SHAZAM Monitor Reference Guide in SHAZAM Resource.

More benefits paid on debit cardsTake note that more benefits are being paid on government-issued debit cards. It’s a good idea to keep track of how often your ATMs run low on cash and consider using currency of a greater denomination in your ATM cassettes (for example: $20s and $50s instead of $10s and $20s).

Please Note: Never change currency denominations in your ATMs before discussing your options with SHAZAM client support at 800-537-5427 (options 5, 2). SHAZAM requires a 14-day lead time to process your request.

Bill dispensing optionFor certain ATMs, SHAZAM can define the maximum number of bills dispensed per withdrawal or the maximum number of bills dispensed per cassette.

This option is available for Diebold® ATMs, NCR® ATMs that run APTRA™ Advance, and GRG and Nautilus Hyosung ATMs that emulate NCR NDC+.

These values are currently set at the manufacturer’s recommended level. SHAZAM can reduce these values but can’t exceed the manufacturer’s recommendation. Changing these values is another way to reduce the maximum amount dispensed per withdrawal transaction.

ATM cash supplies can dwindle during tax refund season

Terminals

If you’d like to redefine the values in your ATM cassettes, please fax a request on your financial institution’s letterhead to SHAZAM EFT implementations at 800-267-0549 or email customerimplementation@shazam.net.

On the request, please include specific terminal ID numbers, along with your financial institution name, old and new cassette values, routing number, contact name and contact email address.

R e d e f i n i n g v a l u e s

Spotlight on Service — March 2017 7

State regulators release BSA / AML self-assessment toolThe Conference of State Bank Supervisors (CSBS) and a group of state bank secrecy act / anti-money laundering (BSA /AML) subject-matter experts have developed a BSA / AML self-assessment tool that can be used at the discretion of each financial institution with their BSA /AML risk assessment process.

The tool can help you assess and manage BSA / AML risks, which will reduce some of the regulatory burden associated with BSA / AML risk management and lead to a more informed board and staff, improving your institution’s risk posture.

The tool is flexible and intended to be adapted to each institution’s circumstances and risk profile.

The tool isn’t a replacement for other aspects of an institution’s BSA / AML risk management program, but is an optional supplement to that program. The assessment tool is available for use by any institution and is strictly optional.

Instructions and a narrated tutorial are available to help you use the tool.

Guide for Cybersecurity Event Recovery releasedThe National Institute of Standards and Technology (NIST) has published the Guide for Cybersecurity Event Recovery to provide organizations with tactical and strategic guidance for developing, testing and improving recovery plans.

The guide calls for organizations to create a specific “playbook” for each possible cybersecurity incident. The guide provides examples of playbooks for handling data breaches and ransomware, as well as a checklist of elements to include in a playbook.

This guide helps support organizations in a technology-neutral way in improving their cyber event recovery plans, processes and procedures to resume normal operations more quickly.

CFPB outlines fair lending priorities for 2017 In a Consumer Financial Protection Bureau (CFPB) blog post, the CFPB stated that it will increase its efforts to prevent credit discrimination and improve credit access in 2017. Specifically, the CFPB will investigate “redlining” issues to determine whether lenders have intentionally avoided lending in minority neighborhoods. It will also evaluate whether women and minorities experience discrimination when applying for credit, or experience greater difficulty when attempting to make payment arrangements with servicers for student loans or home mortgages.

Core compliance news

Core

Tools, guides and fair lending priorities announced by third parties

Spotlight on Service — March 2017 8

Fraud and Risk Management

Effective for transactions occurring on or after April 21, 2017, Mastercard® is removing the exclusion of Mastercard commercial cards from the merchant-only Mastercard SecureCode® liability shifts for domestic e-commerce transactions in the Canada and U.S. regions. An eligible e-commerce transaction may be subject to the merchant-only Mastercard SecureCode liability shift when the merchant has attempted cardholder authentication and the issuer hasn’t provided an authentication response.

Invalid reason codesThis change relates to chargeback message Reason Codes 4837 (No Cardholder Authorization) and 4863 (Cardholder Does Not Recognize). Issuers will no longer be able to use these message reason codes to chargeback commercial card transactions if the merchant has made an authentication attempt. An acquirer receiving a commercial card chargeback will be able to submit a second presentment on the basis that the chargeback was invalid.

Liability for transactionsLiability will shift from the acquirer to the issuer for chargebacks under reason codes 4837 and 4863 when all of the following conditions are met:

• Required e-commerce indicators were provided in the Authorization Request (0100) message.

• Authorization Request Response (0110) message reflects the issuer’s approval of the transaction.

• The Universal Cardholder Authentication Field (UCAF™) indicator = 1.

• The UCAF field is located at the bottom of the Transaction Detail screen under the Mastercard Specific Indicators section. All codes can be found in SHAZAM Access > Transaction Detail > Mastercard Specific Indicators.

For more information If you have any questions, please call SHAZAM client support at 800-537-5427 (options 2, 1) or submit a service request online using SHAZAM

® Web Rep.

Removal of commercial card exclusion from Mastercard SecureCode merchant-only liability shifts

Spotlight on Service — March 2017 9

A 2016 Gallup poll found that stolen credit or debit card data was the second most-worried about crime, with 69 percent of respondents saying they worry about it frequently or occasionally. Similarly, 70 percent said they worry about being victim to identity theft.

Data security is at the top of consumers’ minds, and it’s also of huge importance for small businesses. According to the National Association of Small Businesses, a single cyberattack costs small businesses an average of $20,752.

As payment systems become more complex, the data that needs to be secured also becomes more complex. To help small merchants protect themselves and their customers, the Payments Card Industry Security Standards Council (PCI SSC) recently published a set of resources that provide easy-to-use tips to practice safe payments.

Ways to be more secure PCI SSC’s resources include many ways to protect cardholder data and payments. Here are a few cost-effective and strong steps that can help mitigate risk:

• Use strong passwords: Many pieces of equipment and out-of-the-box software come with pre-loaded passwords, such as “password” or “admin.” These should be changed immediately to a phrase that includes a combination of upper and lowercase letters, numbers and symbols — PCI SSC uses “B1gMac&frieS” as an example of a strong password phrase. Each employee should have their own unique password, and the passwords should be changed every three months.

• Only store card data you need: Limit risk by accepting payment details over the phone, via fax or through the mail rather than allowing customers to include it in emails. If you need to keep a paper that includes card data, mark through the data with a thick black marker and store it in a locked drawer or safe. Above all, the best way to protect against data breaches is to not store card data at all — consider what data is truly necessary for your business to keep.

• Inspect payment terminals: Keep a list of all your terminals, and include photos of all sides and connections that employees can refer to when checking for skimming devices. Keep all terminals out of customers’ reach when not being used. You should check these devices every day against the photos before accepting any transactions on them.

• Install patches from your vendors promptly: Hackers commonly exploit bugs or vulnerabilities in software, which is why it’s important to always install new patches as soon as vendors let you know about them. When working with new vendors, ask them how often they’ll notify you about patches and how you can receive the instructions to install them.

These are just a few of the tips outlined in the resources. Visit PCI's website to view the full guides.

Protect card data with resources from PCI SSC

Fraud and Risk Management

• Guide to safe payments: Simple guidance for understanding the risk to small businesses, security basics to protect against payment data theft, and where to go for help.

• Common payment systems: Real-life visuals to help identify what type of payment system small businesses use, the kinds of risks associated with their system, and actions they can take to protect it.

• Questions to ask your vendors: A list of the common vendors small businesses rely on and specific questions to ask them to make sure they’re protecting customer payment data.

• Glossary of payment and information security terms: Easy-to-understand explanations of technical terms used in payment security.

A v a i l a b l e P C I S S C g u i d e s

Spotlight on Service — March 2017 1 0

SHAZAM wants to make you aware of a new family of ATM malware called Alice, which empties the safe of ATMs. Rather than a criminal stealing information, Alice enables users of the malware to physically access the machine to steal the money available in the ATM.

About AliceResearchers at Trend Micro™ say it connects to the currency dispenser of the ATM. Criminals open the ATM and infect the machine with either a CD-ROM or USB. Once it’s infected, they enter a four digit PIN. Once the correct PIN is entered, the malware lists cassettes, including money in the machine.

Unlike other ATM malware, Trend Micro researchers say Alice only includes the basic functionality to extract money from the ATM safe. “It only connects to the dispenser peripheral and it never attempts to use the machine’s PIN pad. The logical conclusion is that the criminals behind Alice need to physically open the ATM and infect the machine via USB or CD-ROM, then connect a keyboard to the machine’s mainboard and operate the malware through it.”

The malware was first discovered by Trend Micro in November 2016. Criminals have avoided detection by hiding these creations from the security industry. “Off-the-shelf” packers are currently used, but researchers warn that hackers will eventually start to use custom packers and obfuscation techniques.

Alice, a new ATM malware

Fraud and Risk Management

Spotlight on Service — March 2017 1 1

Mastercard® is currently implementing 2-series bank identification numbers (BINs). SHAZAM is prepared to issue and process 2-series BINs, and we want to remind you about this required Mastercard project.

What’s 2-series?Simply put, there are now Mastercard debit and credit cards beginning with the number two. MasterCard started assigning 2-series BINs (222100 – 272099) to issuers on Jan. 1.

These are in addition to the 5-series BIN range (510000 – 559999) in use today.

Mastercard issuersTransactions on primary account numbers (PANs) within the 2-series BINs must operate seamlessly and follow the same logic and handling as PANs within the 5-series BIN range.

Ensure your processor and software vendors are ready to support 2-series BINs. Evaluate the impact of issuing and processing 2-series BINs on online banking, cardholder statements, card order processing, back-end database support and other back-end processes that may apply. If you are your own processor, please ensure you’re ready to meet these requirements.

Merchant sponsoring financial institutionsBeginning June 2017, merchants will be required to accept 2-series BIN transactions. On Jan. 17, SHAZAM sent a memo to merchant sponsoring financial institutions with a list of merchants that need to complete a terminal download to process 2-series BINs. This terminal download is required for merchants to stay compliant with this Mastercard effort.

For more informationMastercard provides additional information about the expansion to 2-series BINs on its website.

SHAZAM client support also welcomes any questions you may have about the Mastercard project. Mastercard issuers may call 800-537-5427 (options 2, 5). Merchant sponsoring financial institutions may call 800-537-5427 (options 5, 3).

Questions can also be sent to SHAZAM by submitting a service request online using SHAZAM

® Web Rep.

Are you ready for Mastercard 2-series BINs?

Cards

Training

Spotlight on Service — March 2017 1 2

For more details on training events, visit our Training Services page.

SHAZAM trainingMarch 2017

Sun Mon Tue Wed Thu Fri Sat

1 2 3 4

5 6 7 8 9 10 11

12 13 14 15 16 17 18

19 20 21 22 23 24 25

26 27 28 29 30 31

April 2017

Sun Mon Tue Wed Thu Fri Sat

1

2 3 4 5 6 7 8

9 10 11 12 13 14 15

16 17 18 19 20 21 22

23 24 25 26 27 28 29

30

SHAZAM Debit Card and ATM Operations regional seminarMarch 15: Wisconsin Dells, Wisconsin April 5: Memphis, Tennessee April 19: East Peoria, Illinois

Description: Learn everything you need to know about your ATM card, debit card and ATM programs. Topics include settlement and related reports, prefunding, the authorization process, PIN-based adjustments and disputes, lost and stolen cards, captured card rules, monthly reporting and billing, SHAZAM Access and recent product developments.

SHAZAM Debit Card Fraud webinarMarch 9: 9:30 – 11:30 a.m. CT March 28: 1:30 – 3:30 p.m. CT

Description: The more you know about debit card fraud, the better equipped you’ll be to identify and prevent fraud as well as mitigate your fraud risk. Join us to learn about fraud categories, fraud statistics, fraud reporting requirements and many of the fraud prevention and detection services available from SHAZAM.

SHAZAM Chargebacks webinarApril 18: 9:30–11 a.m. CT April 27: 1:30 – 3 p.m. CT

Description: If you issue Mastercard® or Visa® debit cards, you need to understand the dispute and chargeback process for signature-based transactions. Unravel the mystery surrounding the chargeback process with this 90-minute webinar. Topics include:

• The complete chargeback cycle

• Common types of chargebacks

• Your financial institution’s responsibilities

• Documentation needed to process a chargeback

Spotlight on Service — March 2017 1 3

‘Ready, Set, Shop’ winners

• Michelle B. of Springdale, Arkansas (United Bank; Springdale, Arkansas)

• Benjamin G. of Overland Park, Kansas (Citizens State Bank and Trust Co. Ellsworth; Ellsworth, Kansas)

• Jeanne H. of Dubuque, Iowa (Dupaco Community Credit Union; Asbury, Iowa)

• Judy B. of Newark, Arkansas (Merchants & Planters Bank; Newport, Arkansas)

• Martha H. of Westfield, Indiana (The Peoples Bank; Brownstown, Indiana)

• Paul S. of Mount Vernon, Ohio (The Peoples Bank; Gambier, Ohio)

• Mark L. of Peosta, Iowa (Alliant Credit Union; Dubuque, Iowa)

• Bonnie H. of Spirit Lake, Iowa (Northwest Bank; Spencer, Iowa)

J a n u a r y w i n n e r s

Spotlight on Service, winner of 15 awards of publication excellence, provides you with information on the financial services industry. It’s not a definitive analysis of the subjects discussed and is not an alternative to the requirements of any regulatory agency.

To join the Spotlight on Service subscription list, send us your name, account number and email address. We also welcome your questions or comments about the newsletter.

SHAZAM, Inc. 6700 Pioneer ParkwayJohnston, IA 50131 shazam.net | @SHAZAMNetwork

Contacts

Fax numbers Chargebacks 515-558-7614Client support 515-558-7610EFT implementations 800-267-0549Fraud operations 515-558-7616

Client support Call 800-537-5427 or submit a service request in SHAZAM® Web Rep.

About the newsletter

Debit Rewards Winners

Congratulations to the January monthly winners for SHAZAM’s “Ready, Set, Shop” Debit Rewards campaign, which runs January – March 2017. Each of the monthly winners will receive a $50 Amazon® gift card.

Do you want one of your customers to be a lucky winner? To learn how, please call SHAZAM marketing at 800-537-5427, ext. 4394, or email SHAZAM Debit Rewards.JEWELRY

BOOKS CLOTHING

SPORTS

$

Ready, Set, Shop

Enroll in todayEnroll in SHAZAM Debit Rewards today!