Electronic payments are protected using. Information protection in electronic payment systems. Security of electronic payment systems

For some time, the development of the WWW was constrained by the fact that the html pages that are the basis of the WWW are static text, i.e. with their help it is difficult to organize an interactive exchange of information between the user and the server. Developers have proposed many ways to extend HTML in this direction, many of which have never been widely adopted. One of the most powerful solutions in a new stage in the development of the Internet was Sun's proposal to use Java applets as interactive components that connect to HTML pages.

Java applets are programs written in the Java programming language and compiled into special bytecodes, which are the codes of some virtual computer - Java machine - and are different from the codes of Intel processors. Applets are hosted on a server on the Internet and downloaded to the user's computer whenever an HTML page is accessed, which contains a call to this applet.

To execute applet codes, a standard browser includes a Java machine implementation that interprets bytecodes into machine instructions for Intel processors (or another family). The capabilities embedded in the technology of Java applets, on the one hand, make it possible to develop powerful user interfaces, organize access to any network resources by URL, easily use TCP / IP, FTP, etc. protocols, and, on the other hand, make it impossible to implement access directly to computer resources. For example, applets do not have access to the computer's file system and attached devices.

A similar solution to expand the capabilities of the WWW is Microsoft's technology - Active X. The most significant differences of this technology from Java is that the components (analogs of applets) are programs in Intel processor codes and the fact that these components have access to all computer resources , as well as Windows interfaces and services.

Another less common approach to expanding the capabilities of the WWW is Netscape's Plug-in for Netscape Navigator technology. It is this technology that seems to be the most optimal basis for building information security systems for electronic payments over the Internet. For further presentation, we will consider how this technology is used to solve the problem of protecting information on a Web server.

Suppose that there is a certain Web server and the administrator of this server needs to restrict access to a certain part of the server's information array, i.e. organize so that some users have access to some information, while others do not.

Currently, a number of approaches to solving this problem are proposed, in particular, many operating systems that run Internet servers require a password to access some of their areas, i.e. require authentication. This approach has two significant drawbacks: firstly, the data is stored on the server itself in clear text, and secondly, the data is also transmitted over the network in clear text. Thus, an attacker has the opportunity to organize two attacks: on the server itself (password guessing, password bypass, etc.) and traffic attacks. The facts of such attacks are widely known to the Internet community.

Another well-known approach to solving the problem of information security is an approach based on SSL (Secure Sockets Layer) technology. When using SSL, a secure communication channel is established between the client and the server, through which data is transmitted, i.e. the problem of transmitting data in clear text over the network can be considered relatively solved. The main problem with SSL is to build and control the core system. As for the problem of storing data on the server in an open form, it remains unresolved.

Another important disadvantage of the approaches described above is the need for their support from the software of both the server and the network client, which is not always possible and convenient. Especially in systems focused on the mass and unorganized client.

The approach proposed by the author is based on the protection of directly html-pages, which are the main carrier of information on the Internet. The essence of the protection lies in the fact that files containing HTML pages are stored on the server in an encrypted form. At the same time, the key on which they are encrypted is known only to the encrypted administrator (administrator) and to the clients (in general, the problem of building a key system is solved in the same way as in the case of transparent file encryption).

Customers access protected information using Netscape's Plug-in for Netscape technology. These modules are programs, or rather software components, that are associated with certain types of files in the MIME standard. MIME is an international standard that defines file formats on the Internet. For example, the following file types exist: text / html, text / plane, image / jpg, image / bmp, etc. In addition, the standard defines a mechanism for specifying custom file types that can be defined and used by independent developers.

So, plug-ins are used, which are associated with certain MIME file types. The connection consists in the fact that when the user accesses files of the corresponding type, the browser launches the associated Plug-in and this module performs all the actions to render the file data and process user actions with this files.

The most famous Plug-in modules include modules that play videos in avi format. Viewing these files is not included in the standard capabilities of browsers, but by installing the appropriate Plug-in, you can easily view these files in a browser.

Further, all encrypted files in accordance with the established international standard order are defined as MIME type files. "application / x-shp". Then, in accordance with Netscape technology and protocols, a Plug-in is developed that binds to this file type. This module performs two functions: first, it asks for a password and user ID, and secondly, it does the work of decrypting and outputting the file to the browser window. This module is installed in accordance with the standard procedure established by Netscape on the browsers of all client computers.

At this preparatory stage of work is completed, the system is ready for operation. When working, clients refer to encrypted html pages at their standard address (URL). The browser determines the type of these pages and automatically launches the module developed by us, passing it the contents of the encrypted file. The module authenticates the client and, upon successful completion, decrypts and displays the page content.

When performing this entire procedure, the client has a feeling of “transparent” encryption of pages, since all the work of the system described above is hidden from his eyes. At the same time, all the standard features embedded in html pages, such as the use of pictures, Java applets, CGI scripts, are preserved.

It is easy to see that this approach solves many information security problems, since in clear form, it is only on clients' computers; data is transmitted over the network in encrypted form. An attacker, in pursuit of the goal of obtaining information, can only carry out an attack on a specific user, and none of the server's information protection systems can protect against this attack.

Currently, the author has developed two information security systems based on the proposed approach for the Netscape Navigator (3.x) and Netscape Communicator 4.x browser. During preliminary testing, it was found that the developed systems can function normally under MExplorer control, but not in all cases.

It is important to note that these versions of the systems do not encrypt objects associated with the HTML page: pictures, script applets, etc.

System 1 offers protection (encryption) of the actual html pages as a single object. You create a page and then encrypt it and copy it to the server. When accessing an encrypted page, it is automatically decrypted and displayed in a special window. No security support is required from the server software. All encryption and decryption work is done at the client's workstation. This system is universal, i.e. does not depend on the structure and purpose of the page.

System 2 offers a different approach to security. This system provides display of protected information in a certain area of \u200b\u200byour page. The information is stored in an encrypted file (not necessarily in html format) on the server. When you go to your page, the protection system automatically accesses this file, reads data from it and displays it in a specific area of \u200b\u200bthe page. This approach allows for maximum efficiency and aesthetic beauty, with minimum versatility. Those. the system turns out to be focused on a specific purpose.

This approach can be applied to the construction of electronic payment systems via the Internet. In this case, when a page of the Web server is accessed, the Plug-in module is launched, which displays the payment order form to the user. After the client fills it in, the module encrypts the payment data and sends it to the server. At the same time, he can request an electronic signature from the user. Moreover, encryption and signature keys can be read from any medium: floppy disks, electronic tablets, smart cards, etc.

Basic rules that the buyer should follow

Never share your password with anyone, including payment system employees.
Check that the connection is indeed in SSL secured mode - the closed padlock icon should be visible in the lower right corner of your browser;
Check that the connection is established exactly with the address of the payment system or Internet bank;
Never save your password information on any media, including a computer. If you have any suspicions that someone has gained access to your personal account, change your password or block your account / account;
After finishing work, be sure to press the Exit button;
Make sure your computer is not infected with any viruses. Install and activate antivirus software. Try to keep them up to date, as the action of viruses can be aimed at transferring information about your password to third parties;
Use software from trusted and trusted sources and update regularly.

Statistics
According to statistics, the following systems are most often attacked: terminals (32%), database servers (30%), application servers (12%), web servers (10%). Workstations, authentication servers, backup servers, file storages and so on account for only 10%. From these statistics, the relevance of security is clearly visible. sites and applications, since through their vulnerabilities it often becomes possible to gain access to data.

What ensures the security of payment systems

Secure / encrypted internet connections

Currently, the presence of an SSL certificate on the site is not a sufficient condition for the secure online payments. Only an integrated approach certified in accordance with modern international standards allows us to say that the security of processing Internet payments is ensured at the highest level.

Client protection

Login / password for accessing the system, which is tested for complexity;
A combination of bank card number, expiration date, cardholder name, CVV / CVC codes;
The ability to create a virtual card that duplicates the main one for making online payments;

Technical protection

Binding of the payment service to a fixed IP address and customer phone number;
Implementation of client access to the system via the encrypted HTTPS / SSL protocol;
The ability to use a virtual keyboard for typing identification data (countering the interception of personal data);
Separation of the channels for generating transactions and the channel for authorizing transactions:

authorization of transactions is carried out through a special code, which, when making a payment, the client receives from the system to his mobile phone via SMS (a random combination of letters and numbers, valid only for several minutes).

Protection of plastic cards
Attackers most often try to gain access to card data. The research reports of experts in the field of payment security - Verizon and Trustwave companies indicate statistics: in 85 and 98 cases out of 100, respectively, the target of the attack was card data.

Payment systems certification
Certification of service providers and business owners (merchants) with more than 6 million transactions per year is subject to Qualified Security Assessor (QSA) certification, which are issued in Russia by IBM, NVision Group, Deiteriy, Digital Security, TrustWave, EVRAAS IT, Informzashita, Jet Infosystems, Croc Incorporated.

Certificate of Compliance Payment Card Industry Data Security Standard (PCI DSS);
Security certificate for compliance with international requirements for information security management in the development, implementation and maintenance of software ISO / IEC 27001: 2005;
Use of electronic digital signature (EDS);
Licenses for the right to carry out activities for the provision, maintenance, distribution of encryption (cryptographic) means.

Effective July 1, 2012, the use of non-certified applications by companies subject to PCI DSS will be prohibited.
PCI DSS information security standard in the payment card industry was developed by the international payment systems Visa and MasterCard and is a set of 12 detailed requirements for ensuring the security of data about payment card holders that are transmitted, stored and processed in the information infrastructures of organizations. Taking appropriate measures to ensure compliance with the requirements of the standard implies an integrated approach to ensuring information security of payment card data.

Vulnerabilities and remedies
From the point of view of information security, the following vulnerabilities exist in electronic payment systems:

Transfer of payment and other messages between the bank and the client and between banks;
Information processing within the organizations of the sender and recipient of messages;
Client access to funds accumulated on accounts.
One of the most vulnerable places in the electronic payment system is the transfer of payment and other messages between banks, between a bank and an ATM, between a bank and a client.

Protection while forwarding payment messages:

The internal systems of the sender and recipient organizations must be adapted to send and receive electronic documents and provide the necessary protection during their processing within the organization (protection of end systems);
The interaction between the sender and the recipient of an electronic document is carried out indirectly - through a communication channel.

Problems solved when organizing payment protection:

mutual identification of subscribers (the problem of establishing mutual authenticity when establishing a connection);
protection of electronic documents transmitted through communication channels (problems of ensuring the confidentiality and integrity of documents);
ensuring the execution of the document (the problem of mutual distrust between the sender and the recipient due to their belonging to different organizations and mutual independence).

Ensuring the security of payment systems

guarantees of message delivery;
impossibility of refusal to take action on the message;

The quality of the solution to the above problems is largely determined by the rational choice of cryptographic means when implementing protection mechanisms.

Payment system is a system of interaction between participants
From an organizational point of view, the core of the payment system is an association of banks, united by contractual obligations. In addition, the electronic payment system includes trade and service enterprises that form a network of service points. For the successful functioning of the payment system, specialized organizations are also needed that provide technical support for servicing cards: processing and communication centers, technical service centers, etc.

Security of electronic payment systems

It is impossible to imagine the modern practice of banking operations, commercial transactions and mutual payments without settlements using plastic cards.

The system of cashless payments using plastic cards is called electronic payment system .

To ensure normal operation, an electronic payment system must be reliably protected.

From the point of view of information security, the following vulnerabilities exist in electronic payment systems:

transfer of payment and other messages between banks, between a bank and an ATM, between a bank and a client;
information processing within the organizations of the sender and recipient of messages;
clients' access to funds accumulated in their accounts.

The forwarding of payment and other messages is associated with the following features:

internal systems of the sender and recipient organizations must provide the necessary protection when processing electronic documents (protection of end systems);
the interaction between the sender and the recipient of an electronic document is carried out indirectly - through a communication channel.

These features give rise to the following problems:

mutual identification of subscribers (the problem of establishing mutual authenticity when establishing a connection);
protection of electronic documents transmitted through communication channels (the problem of ensuring the confidentiality and integrity of documents);
protection of the process of exchange of electronic documents (the problem of proof of departure and delivery of a document);
ensuring the execution of the document (the problem of mutual distrust between the sender and the recipient due to their belonging to different organizations and mutual independence).

To ensure the functions of protecting information on individual nodes of the electronic payment system, the following protection mechanisms must be implemented:

endpoint access control;
control of message integrity;
ensuring the confidentiality of the message;
mutual authentication of subscribers;
the impossibility of rejecting the authorship of the message;
guarantees of message delivery;
impossibility of refusal to take action on the message;
registration of a sequence of messages;
monitoring the integrity of the message sequence.

So, electronic plastic cards are used as a means of payment in the electronic payment system.

Electronic plastic card is a storage medium that identifies the owner and stores certain credentials.

There are credit and debit cards.

Credit cards are the most common type of plastic cards. These include cards of the national systems of the United States Visa and MasterCard, American Express and a number of others. These cards are presented to pay for goods and services. When paying with a credit card, the buyer's bank opens a loan for the purchase amount, and then after a while (usually 25 days) sends the invoice by mail. The buyer must return the paid check (invoice) back to the bank. Naturally, a bank can offer such a scheme only to the most wealthy and proven of its clients, who have a good credit history with the bank or solid investments in the bank in the form of deposits, valuables or real estate.

Owner debit card must deposit a certain amount into his account with the issuing bank. The amount of this amount determines the limit of available funds. When making settlements using this card, the limit is reduced accordingly. To renew or increase the limit, the owner must re-deposit money into his account. To insure a temporary gap between the moment the payment is made and the moment the bank receives the relevant information, a minimum balance must be maintained on the client's account.

Both credit and debit cards can be personal as well as corporate. Corporate cards provided by the company to its employees for travel or other office expenses. The company's corporate cards are linked to one of its accounts. These cards can have split or non-split limit. In the first case, an individual limit is set for each of the corporate cardholders. The second option is more suitable for small companies and does not imply a delineation of the limit.

A plastic card is a plate made of special plastic that is resistant to mechanical and thermal influences. Standard ISO 9001 all plastic cards are 85.6 x 53.9 x 0.76 mm.

To identify the owner, the following are applied to the plastic card:

the logo of the issuing bank;
the logo of the payment system serving this card;
cardholder Name;
cardholder's account number;
card expiration date, etc.

In addition, the card may contain a photograph of the owner and his signature.

Alphanumeric data (name, account number, etc.) can be embossed, i.e. applied in embossed type. This makes it possible to quickly transfer the data to a check during manual processing of cards accepted for payment using a special device - an imprinter that "rolls" the card.

By the principle of action, there are passive and active plastic cards... Passive plastic cards only store information. These include plastic cards with a magnetic stripe.

Magnetic stripe cards are still the most common - there are over two billion cards of this type in circulation. The magnetic stripe is located on the back of the card and, in accordance with the ISO 7811 standard, consists of three tracks. Of these, the first two are for storing identification data, and the third track can be used to write information (for example, the current value of the debit card limit). However, due to the low reliability of a repetitively repeated write / read process, writing to a magnetic stripe is usually not practiced.

Magnetic stripe cards are relatively vulnerable to fraud. To increase the security of their cards, the Visa and MasterCard / Europay systems use additional graphic security tools: holograms and non-standard fonts for embossing. Embossers (devices for embossing relief on the map) are produced by a limited number of manufacturers. In a number of Western countries, the free sale of embossers is prohibited by law. Special symbols confirming that the card belongs to one or another payment system are supplied to the owner of the embosser only with the permission of the governing body of the payment system.

Payment systems with such cards require on-line authorization in retail outlets and, as a result, the presence of branched, high-quality communication means (telephone lines).

A distinctive feature of an active plastic card is the presence of an electronic microcircuit built into it. The principle of a plastic card with an electronic microcircuit was patented in 1974 by the Frenchman Roland Moreno. Standard ISO 7816 defines the basic requirements for integrated circuit cards or chip cards.

Chip cards can be classified in two ways.

The first sign is the principle of interaction with the reader. Basic types:

cards with contact reading;
cards with contactless (induction) reading.

Contact reader card has 8 to 10 contact plates on its surface. The location of the contact plates, their number and pin assignment are different for different manufacturers and it is natural that readers for cards of this type differ from each other.

Data exchange between contactless card and a reading device is produced by induction. It is obvious that such cards are more reliable and more durable.

The second feature is the functionality of the card. Basic types:

counter cards;
memory cards;
microprocessor cards.

Counter cards apply, as a rule, in cases where a particular payment transaction requires a decrease in the balance on the cardholder's account by a certain fixed amount. Such cards are used in specialized prepaid applications (pay for using a pay phone, paying for a parking lot, etc.). Obviously, the use of cards with a counter is limited and not very promising.

Memory Cards are transitional between counter cards and microprocessor cards. A memory card is a rewritable counter card that has been designed to make it more secure against malicious attacks. The simplest memory cards have a memory size of 32 bytes to 16 KB. This memory can be organized as:

programmable read-only memory (EPROM), which can be written once and read many times;
an electrically erasable programmable read-only memory (EEPROM) that can be written once and read many times.

Memory cards can be classified into two types:

with unprotected (fully accessible) memory;
with protected memory.

In cards of the first type, there are no restrictions on reading and writing data. These cards cannot be used as payment cards, as they can be easily hacked.

The second type of cards have an identity area and one or more application areas. The identification area can only be written once during personalization and is further read-only. Access to application areas is regulated and is carried out only when performing certain operations, in particular, when entering a secret PIN.

The security level of memory cards is higher than that of magnetic cards. As a means of payment, memory cards are used to pay for public payphones, travel in public transport, in local payment systems (club cards). Memory cards are also used in systems for access to premises and access to resources of computer networks (identification cards).

Microprocessor cards also called smart cards or smart cards. These are essentially microcomputers that contain all the major hardware components:

microprocessor with a clock frequency of 5 MHz;
operational memory with a capacity of up to 256 bytes;
permanent memory up to 10 Kbytes;
non-volatile memory with a capacity of up to 8 Kbytes.

The smart card provides a wide range of functions:

delimitation of access rights to internal resources;
data encryption using various algorithms;
formation of an electronic digital signature;
maintaining a key system;
execution of all operations of interaction between the cardholder, the bank and the merchant.

Some smart cards provide a "self-locking" mode when attempting unauthorized access.

All this makes the smart card a highly secure payment tool that can be used in financial applications that have increased requirements for information security. That is why smart cards are the most promising type of plastic cards.

Important stages in the preparation and use of a plastic card are personalization and authorization.

Personalization carried out when the card is issued to the client. At the same time, data is entered on the card, which allows identifying the card and its owner, as well as checking the card's solvency when accepting it for payment or issuing cash. The original way of personalization was embossing.

Personalization also includes magnetic stripe coding and chip programming.

Magnetic stripe encoding is performed, as a rule, on the same equipment as embossing. With this, part of the information about the card, containing the card number and the period of its validity, is the same both on the magnetic stripe and on the relief. However, there are situations when, after the primary encoding, it is required to additionally enter information on the magnetic stripe. In this case, special devices with the "read-write" function are used. This is possible, in particular, when the PIN code for using the card is not generated by a special program, but is chosen by the client at his own discretion.

Chip programming does not require special technological methods, but it has some organizational features. So the programming operations of individual areas of the microcircuit are spaced geographically and delimited by the rights of various employees. This procedure is usually broken down into three stages:

at the first workplace, the card is activated (put into operation);
in the second workplace, operations related to security are performed;
in the third workplace, the actual personalization is performed.

Such measures increase safety and eliminate possible abuse.

Authorization is the process of approving a sale or cash withdrawal by card. For authorization, the service point makes a request to the payment system to confirm the powers of the card bearer and his financial capabilities. Authorization technology depends on the type of card, payment system scheme and technical equipment of the service point.

Authorization is carried out either "manually" or automatically. In the first case, voice authorization is carried out, when the seller or the cashier sends the request to the operator by phone. In the second case, the card is placed in an automated trading POS terminal (Point-Of-Sale - payment at the point of sale), the data is read from the card, the cashier enters the payment amount, and the cardholder enters the PIN (Personal Identication Number). After that, the terminal performs authorization, establishing a connection with the payment system database (on-line mode), or implementing additional data exchange with the card itself (off-line mode). When issuing cash, the process is similar, with the only peculiarity that money is automatically issued by an ATM, which performs authorization.

A proven method of identifying the owner of a plastic card is the use of a secret personal identification number PIN ... Only the cardholder should know the PIN value. On the one hand, the PIN must be long enough so that the brute-force guessing probability is reasonably low. On the other hand, the PIN must be short enough for the owner to remember. Usually the PIN length ranges from 4 to 8 decimal digits, but can be up to 12.

The PIN value is unambiguously associated with the corresponding attributes of the plastic card, so the PIN can be interpreted as the cardholder's signature.

Protection of the personal identification number PIN for a plastic card is critical to the security of the entire payment system. Plastic cards can be lost, stolen or tampered with. In such cases, the only countermeasure against unauthorized access remains the secret PIN value. Therefore, the open PIN form should only be known to the legal cardholder. It is never stored or transmitted as part of an electronic payment system.

The method for generating the PIN value has a significant impact on the security of an electronic payment system. In general, personal identification numbers can be generated either by the bank or by the cardholders.

If the PIN is assigned by the bank, then one of two options is usually used.

In the first option, the PIN is generated cryptographically from the cardholder's account number. Encryption is carried out according to the DES algorithm using a secret key. Advantage: the PIN value does not need to be stored inside the electronic payment system. Disadvantage: if it is necessary to change the PIN, either the client's account number or the cryptographic key must be changed. But banks prefer to keep the customer's account number fixed. On the other hand, since all PINs are calculated using a single key, changing one PIN while maintaining a customer account entails changing all personal identification numbers.

In the second option, the bank selects the PIN at random, storing this value in the form of a cryptogram. The selected PIN values \u200b\u200bare transmitted to cardholders via a secure channel.

The use of the PIN assigned by the bank is inconvenient for customers even if it is short. Such a PIN is difficult to retain in memory, and therefore the cardholder can write it down somewhere. The main thing is not to write the PIN directly onto the card or other prominent place. Otherwise, the attackers' task will be greatly facilitated.

For the convenience of the client, use the PIN value chosen by the client himself. This way of determining the PIN allows the client to:

use the same PIN for different purposes;
set in PIN not only numbers, but also letters (for easy memorization).

The PIN chosen by the client can be sent to the bank by registered mail or sent through the secure terminal of the bank office, which immediately encrypts it. If the bank needs to use the PIN chosen by the client, then proceed as follows. Each digit of the PIN chosen by the client is added modulo 10 (excluding transfers) with the corresponding digit of the PIN, withdrawn by the bank from the client's account. The resulting decimal number is called the "offset". This offset is stored on the customer card. Since the withdrawn PIN is random, the PIN chosen by the client cannot be determined from its offset.

The main security requirement is that the PIN value should be remembered by the cardholder and should never be stored in any readable form. But people are imperfect and very often forget their PIN. Therefore, for such cases, special procedures are designed: restoring a forgotten PIN or generating a new one.

When identifying a client by the PIN value and the presented card, two main ways of checking PIN are used: non-algorithmic and algorithmic.

The non-algorithmic method is carried out by directly comparing the PIN entered by the client with the values \u200b\u200bstored in the database. Typically, the client PIN database is encrypted using transparent encryption to increase its security without complicating the comparison process.

An algorithmic method for verifying a PIN is that the PIN entered by the client is converted according to a certain algorithm using a secret key and then compared with the PIN value stored in a certain form on the card. Advantages of this verification method:

absence of a PIN copy on the main computer excludes its disclosure by the bank personnel;
the absence of PIN transfer between the ATM or POS-terminal and the main computer of the bank excludes its interception or imposition of comparison results;
Simplification of the work on the creation of system software, since there is no longer the need for action in real time.

It is difficult to surprise someone with the presence of electronic savings, because they have long entered the everyday life of every person and are used to make purchases on the Web, carry out transfers and convert funds. The popularity of such a currency is explained by the convenience of its use, as well as the minimum commission. The issue of money safety deserves special attention. Ensuring the proper functioning of standards and mechanisms for storing virtual assets, as a rule, is provided by payment services, but users are also required to observe elementary precautions when manipulating the latter.

With the advent of internet banking, there are even more opportunities. People gained access to make purchases or conduct other transactions without leaving their homes. To carry out any operation, a computer, smartphone or other device is enough, as well as a stable connection to the Network.

Despite a number of advantages, electronic money needs additional protection on the part of the user. This is due to the emergence of a large number of scammers who know how to hack personal accounts and obtain the necessary passwords. This is why it is important to take some steps to ensure the security of any transaction on the Web. After all, schemes of unauthorized access to other people's virtual savings are progressing, and very often online scammers are one step ahead of the developers of protective mechanisms.

Existing risks and main methods of protection

There are many types of fraud on the Internet that allow attackers to deftly deceive people, steal personal data, and subsequently money. The most popular varieties include:

Phishing is a sophisticated method of fraud that involves theft of personal data, namely passwords, bank accounts, logins, and plastic card numbers. The essence of the method consists in sending a letter by e-mail on behalf of any reputable organization, for example, a banking institution. In the text, employees of the pseudo-organization recommend updating or transmitting any information under various pretexts.The peculiarity of phishing lies in the detailed elaboration of a fraudulent scheme. For greater reliability, attackers create websites that exactly copy the Internet resource of the front organization. Consequently, a person is unaware of the deception, gets hooked and loses money. To avoid this kind of trouble, it is important to exercise the utmost vigilance and learn how to detect fake sites.

Skimming is a direction that implies the use of special devices that allow reading the necessary information from the magnetic tape of a plastic card. The algorithm of actions is as follows. First, the attacker fixes the skimmer on the ATM receiver. The peculiarity of this device is that it hardly differs from the factory connector. The device is based on a special circuit that provides data reading. At the same time, a video camera is attached to the ATM, the purpose of which is to fix the PIN code. At the last stage, the fraudster makes a copy of the card and withdraws all funds using the stolen code.

One of the advantages of electronic money is the impossibility of counterfeiting (in the classical sense). They cannot be printed, and then purchased with counterfeit banknotes. Virtual currency is in digital form and is used only on the Web, but even this guarantees one hundred percent protection. As noted above, many fraud options have been developed to deceive gullible people.

But there are several main ways to protect money to protect electronic savings from intruders:

Passwords. Almost every user of the global network is faced with the need to enter special codes to enter the personal account of a site every day. A similar system is implemented in electronic payment services, many of which use this method as the main method of ensuring security. In practice, not one, but several passwords can be used at once, which can be stationary or changing. In the latter case, the code is updated every time you visit the resource. The new combination is sent by e-mail or mobile phone.The control password is usually entered during any financial transaction on the Internet. This measure allows you to additionally protect the user who made the transaction and temporarily left the computer. Another person will not be able to carry out any financial manipulation and use other people's money without specifying the control code. The considered system is in great demand in many payment systems, including Yandex.Money, Qiwi and others (called "Payment Password"). The issue of money security is well thought out in another service - WebMoney. Here, one password to enter the wallet is not enough - you need a key file. The use of a PIN code as protection is also typical for bank cards, which were mentioned at the beginning of the article. It usually consists of four digits that each user sets individually. As practice has shown, this method of protecting electronic money is not very reliable, and the security system itself is susceptible to hacking. If the attacker stole the card and tries to guess the password, the "plastic" is blocked after three consecutive mistakes. From the above, we can conclude that the password is a popular way to ensure the security of electronic currency, and it is present in almost all modern payment systems. The only drawback is the insufficient level of reliability, so it is recommended to combine it with other protection methods.

Key files. The considered method is used in WebMoney and provides additional reliability. Its essence is that after registration, the client is issued a special file containing the keys to the storage. To gain access to the savings, the user must have a password at hand, as well as the document mentioned above. In addition, the wallet file has its own protection to ensure the safety of money. Here you also need to enter a specific combination of letters, numbers and symbols. For additional protection of personal savings, the above file is recommended to be stored outside the computer's hard drive, for example, on a USB flash drive. Otherwise, after penetrating a PC, an attacker obtains all the necessary data to hack a wallet. In case of loss of this file, it is advisable to make a copy of it and save it on a removable medium.
The set of symbols on the display. One of the ways to protect yourself from various worms, trojans and viruses is the on-screen keyboard. This technique is used in one of the most popular EasyPay systems. Unlike other EPS, the required characters are entered not from a regular keyboard, but through a special image on the monitor screen. This protection technique has two sides. In the case of typing a password, another person can spy on the information, and then use it to hack. If you carefully approach this moment and make a set when there are no strangers, you can protect almost all types of electronic money from keyloggers. The latter are programs that penetrate the user's computer and read a special log file (it is in it that information about the characters entered through the keyboard is stored).But there are other programs that record and subsequently reproduce any user actions, including moving with the mouse. Therefore, it is necessary to make a decision on the relevance of using a conventional or display keyboard individually, taking into account the current situation.

Special phrase. To increase the level of protection of their funds, each user must come up with one or more words. The use of this technique allows you to protect yourself from phishing, which was mentioned at the beginning of our story. After opening the operating page of the service, the person should see the set passphrase. If it does not match the original, or it does not exist at all, we can confidently speak of an attempted fraud.
Account blocking. You have to resort to this step in a situation when the methods discussed above did not work or cannot provide the required level of protection. This is possible when a person accidentally lost his password, became a victim of data theft from a PC, or cannot find a plastic card. So, if the main protection methods did not work, the user sends an SMS to a specific number or makes a call with the command to block the electronic account. This measure is suitable for extreme cases, but it provides the best protection for electronic money in an emergency.

The above methods individually do not guarantee complete safety and should be used exclusively in combination. The “weakest link” in this matter is the presence of the human factor, which makes even a reliable system vulnerable.

Simple defenses are a powerful addition to basic methods

Every person should understand that the safety of electronic money directly depends on his attention and following some recommendations:

Never share passwords with other people, regardless of the explanation. The PIN-code of the card or the set of characters for entering the wallet of the electronic payment system is personal information that cannot be trusted by anyone. Any attempt to find out these facts should be alarming, even if a customer service representative asks for personal information. Ignoring this recommendation, you level out the main methods of protection, which become simply ineffective. Efforts to defraud personal data via e-mail should be particularly suspicious. In this case, it is highly probable that we can talk about Internet fraud.
If online purchases are commonplace, it is advisable to issue a separate bank card and use it as a payment instrument to pay for services or goods on the Internet. You should not pay with various cards, because in this case their degree of confidentiality is reduced. In addition, it is advisable to set a limit in order to avoid losing a large amount in case of hacking "plastic" by an attacker.
Before withdrawing money from an ATM, it is advisable to carefully examine the device for the fact that there are no special devices for skimming. If you notice poorly attached elements, you should report the problem to the representatives of the bank, and look for another device for cashing out funds yourself.
Do not use electronic payment system wallets through public computers in Internet cafes or other similar establishments. In this case, attackers can easily intercept confidential information, after which the main methods of protecting money are useless. The administrator of such an establishment can easily check the history of each user and remove the information he needs.
Do not follow the links that come to your e-mail if you are not sure of the accuracy of the data and you are not familiar with the sender. If you ignore the recommendations, you can "pick up" a virus or Trojan that will collect confidential information and send it to the creator. In addition, you should not 100% trust the users you know, because the mailbox could be hacked. If the link is suspicious, it is better to separately find out its relevance.
When paying with a bank card in any institution, always keep the "plastic" in sight. If the waiter passes the magnetic tape through a separate reader, all the necessary data will be transferred to him.
Never use the same password on different services, because in the event of a hack, an attacker gains access to all the money. In addition, it is advisable to use a complex combination of symbols to make matching impossible.
When purchasing goods using EPS or a card on the Web, it is advisable to work only with reputable online stores. You should not transfer money to dubious persons, regardless of the benefits offered.
Periodically check the account of the card or payment system in order to quickly detect the loss and use the lock.
Install a reliable antivirus on your PC and update it regularly. Also, enable a firewall, which will provide additional protection against intruders.

Any type of electronic money requires attention. It depends only on the user whether he will be able to save the money he earned, or whether it will go to scammers.

Today it is difficult to imagine a serious - and not necessarily large - business without Internet support in the form of its own resource, selling page or online store. It allows you to turn an ordinary electronic catalog into a functioning virtual store with the ability to select a product on the seller's website and pay for it. It is not surprising that the issue of effective organization of the security of electronic payments is important for the owner of any Internet service specializing in financial settlements.

Information protection in electronic payment systems assumes the fulfillment of the following conditions:

confidentiality - in the process of online settlements, the buyer's data (number of a plastic credit card or other payment means) should remain known only to institutions and structures that have the legal right to do so;
authentication - most often a PIN code or a message, thanks to which the client (or the seller) can make sure that the second party to the transaction is exactly who he claims to be;
authorization - makes it possible, before the start of the transfer of money, to determine whether the buyer has a sufficient amount in order to pay for the order.

All of this is aimed at providing a secure payment algorithm that can minimize the risks of electronic financial settlements for both the buyer and the seller.

Modern methods of protecting information of electronic payment systems

Today, the protection of information of electronic payment systems is carried out mainly with the help of:

instant authorization of the payer;
encryption of financial information on the Internet;
special certificates.

Providing for simultaneous interaction with thousands of users, modern applications of a purely commercial nature cannot work with classic "unambiguous" systems - both operating exclusively on public keys, and with functioning only on private keys. Interception by malefactors of at least one key of a completely "closed" system automatically leads to a complete opening of its entire protection chain. In turn, encryption with only public keys requires significant computational resources.

In this regard, today the security of payment systems in e-commerce provides the simultaneous use of protocols with private and public keys. Information that travels over networks is encrypted using a private key. In this case, its generation is carried out dynamically, and it is transmitted to the second party to the transaction with a cipher based on the public key. As a rule, encryption is carried out using the Secure Sockets Layer (SSL) protocol, as well as Secure Electronic Transaction (SET) - it was developed by the financial giants MasterCard, VISA. The first protocol performs encryption at the channel level, and the second one encrypts financial data directly. In the process of using applications with the SET protocol, a double electronic signature algorithm is used.

One part of it is sent to the seller, and the other to the bank. Thanks to this scheme, the buyer has access to all data on orders, but he does not have access to the settlement details of the selling party, and the bank, in turn, has all the financial data of both parties to the transaction in the absence of information about the composition of the order. To improve the protection of virtual transactions, virtual certification authorities are also called upon to issue e-commerce representatives unique “certificates” in electronic format with a signed personal public key. An electronic certificate is issued by the center based on the identification documents of the parties to the transaction and is valid for a certain period of time. With such a certificate, a participant in a commercial transaction can perform financial transactions, checking the validity of the public keys of other participants.

Banking transactions, trade transactions and mutual payments cannot be imagined without settlements using plastic cards. The system of cashless payments using plastic cards is called an electronic payment system. To ensure the normal operation of the electronic payment system, it must be reliably protected.

It is believed that there are vulnerabilities in information security in electronic payment systems:

Transfer of payment and other messages between banks, between a bank and an ATM, between a bank and a client;

Information processing by the organization of the sender and recipient;

Buyers' access to funds spent on accounts.

Forwarding payment and other messages is connected with the following features:

The internal systems of the sender and recipient organizations are obliged to provide suitable protection for the processing of electronic documents (protection of end systems);

The interaction between the sender and the recipient of an electronic document is performed directly through the communication channel.

These features cause difficulties:

Mutual identification of subscribers (the problem of establishing mutual authenticity when establishing a connection);

Protection of electronic documents transmitted through communication channels (the problem of ensuring confidentiality and integrity);

Protection of the process of exchange of electronic documents (the problem of proof of departure and delivery of a document);

ensuring the execution of the act (the problem of mutual distrust between the sender and the recipient due to their belonging to different organizations and mutual independence).

To ensure information security functions in some nodes of the electronic payment system, protection mechanisms must be implemented:

Access control on initial systems;

Monitoring the integrity of the message;

Ensuring the confidentiality of the message;

Mutual client authentication;

Guaranteed message delivery;

Impossible refusal to take action on the message;

Registration of a sequence of messages;

Monitoring the integrity of the message sequence.

Electronic plastic cards are used as means of payment in electronic payment systems.

An electronic plastic card is a carrier of certain information that identifies a user and stores certain data.

Distinguishing between credit and debit cards.

Electronic cards are the more common type of plastic cards. Electronic cards are used to pay for various goods and services. When paying with a credit card, the client's bank opens a loan for the purchase amount, and then after a while sends an invoice by mail for the amount of the purchase made. The buyer must return the paid check back to the bank. Of course, the bank can recommend a similar scheme only to the wealthier and more proven of its own clients who have a good credit history with the bank or significant deposits in the bank in the form of deposits, valuables or real estate.

A plastic card is a plate made of special plastic that is resistant to mechanical and thermal effects. According to the ISO 9001 standard, all plastic cards have dimensions of 85.6 x 53.9 x 0.76 mm.

To identify the owner, the following are applied to the plastic card:

the logo of the issuing bank;

the logo of the payment system serving this card;

cardholder Name;

cardholder's account number;

card expiration date, etc.

In addition, the card may contain a photo of the owner and his signature.

Alphanumeric data (name, account number, etc.) can be embossed, i.e. applied in embossed type. This makes it possible to quickly transfer the data to a check during manual processing of cards accepted for payment using a special device - an imprinter that "rolls" the card.

According to the principle of operation, passive and active plastic cards are distinguished. Passive plastic cards only store information. These include plastic cards with a magnetic stripe.

Magnetic stripe cards are still more common - there are over two billion analog cards in circulation. The magnetic stripe is located on the back of the card and, in accordance with the ISO 7811 standard, consists of 3 tracks. Of these, the first two are provided for storing identification data, and it is allowed to enter information on the third track (for example: the current value of the debit card limit). However, due to the low reliability of the repeatedly repeated write / read process, writing to a magnetic stripe is usually not practiced.

Payment systems with such cards require on-line authorization in retail outlets and, as a result, the presence of branched, high-quality communication means (telephone lines).

A distinctive feature of an active plastic card is the presence of an electronic microcircuit built into it. The ISO 7816 standard defines the basic requirements for cards based on integrated circuits or chip cards.

Chip cards can be classified in two ways.

The first sign is the principle of interaction with the reader. Basic types:

cards with contact reading;

cards with contactless (induction) reading.

A card with contact reading has 8 to 10 contact plates on its surface. The location of the contact plates, their number and pin assignment are different for different manufacturers and it is natural that readers for cards of this type differ from each other.

Data exchange between the contactless card and the reader is carried out inductively. It is obvious that such cards are more reliable and more durable.

The second feature is the functionality of the card. Basic types:

counter cards;

memory cards;

microprocessor cards.

Counter cards are used, as a rule, in cases where a particular payment operation requires a decrease in the balance on the cardholder's account by a certain fixed amount. Such cards are used in specialized prepaid applications (pay for using a pay phone, pay for parking, etc.). Obviously, the use of cards with a counter is limited and not very promising.

Memory cards are transitional between counter cards and microprocessor cards. A memory card is a rewritable counter card that has been designed to make it more secure against malicious attacks. The simplest memory cards have a memory size of 32 bytes to 16 KB. This memory can be organized as:

programmable read-only memory (EPROM), which can be written once and read many times;

an electrically erasable programmable read-only memory (EEPROM) that allows multiple writes and multiple reads.

Memory cards can be classified into two types:

with unprotected (fully accessible) memory;

with protected memory.

In cards of the first type, there are no restrictions on reading and writing data. These cards cannot be used as payment cards, as they can be easily hacked.

The security level of memory cards is higher than that of magnetic cards. As a means of payment, memory cards are used to pay for public payphones, travel in public transport, in local payment systems (club cards). Memory cards are also used in the systems of access to premises and access to the resources of computer networks (identification cards).

The smart card provides a wide range of functions:

delimitation of access rights to internal resources;

data encryption using various algorithms;

formation of an electronic digital signature;

maintaining a key system;

execution of all operations of interaction between the cardholder, the bank and the merchant.

Some smart cards have a "self-locking" mode when unauthorized access attempts are made.

Personalization and authorization are important stages in the preparation and use of a plastic card.

Personalization occurs when the card is issued to the buyer. The card contains data that allows identifying the card and its owner, as well as checking the card's solvency when paying or issuing cash. The original way of personalization was embossing.

Personalization includes magnetic stripe coding and chip programming.

As a rule, magnetic stripe coding is made using the same equipment as embossing. At the same time, part of the information about the card, storing the card number and the time of its validity, is the same both on the magnetic stripe and on the relief. But there are situations when, after the primary encoding, it is required to additionally enter information on the magnetic stripe. In this case, special devices with the "read-write" function are used. This is possible, in particular, when the PIN code for using the card is not generated by a special program, but is chosen by the client at his own discretion.

Microcircuit programming does not require any special technological methods, but it has some organizational features. So the programming operations of individual areas of the microcircuit are spaced geographically and delimited by the rights of various employees. This procedure is usually broken down into three stages:

at the first workplace, the card is activated (put into operation);

in the second workplace, operations related to security are performed;

in the third workplace, the actual personalization is performed.

Such measures increase safety and eliminate possible abuse.

Authorization is carried out either "manually" or automatically. In the first case, voice authorization is carried out, when the seller or cashier sends a request to the operator by phone. In the second case, the card is placed in an automated POS terminal (Point-Of-Sale - payment at the point of sale), the data is read from the card, the cashier enters the payment amount, and the cardholder enters the PIN (Personal Identication Number) ... After that, the terminal performs authorization, establishing a connection with the payment system database (on-line mode), or implementing additional data exchange with the card itself (off-line mode). When issuing cash, the process is similar, with the only peculiarity that money is automatically issued by an ATM, which performs authorization.

A proven method of identifying the owner of a plastic card is the use of a secret personal identification number PIN. Only the cardholder should know the PIN value. On the one hand, the PIN must be long enough so that the brute-force guessing probability is reasonably low. On the other hand, the PIN must be short enough for the owner to remember. Usually the PIN length ranges from 4 to 8 decimal digits, but can be up to 12.

The PIN value is unambiguously associated with the corresponding attributes of the plastic card, so the PIN can be interpreted as the cardholder's signature.

If the PIN is assigned by the bank, then one of two options is usually used.

In the second option, the bank selects the PIN at random, storing this value in the form of a cryptogram. The selected PIN values \u200b\u200bare transmitted to cardholders via a secure channel.

The use of the PIN assigned by the bank is inconvenient for customers even if it is short. Such a PIN is difficult to retain in memory, and therefore the cardholder can write it down somewhere. The main thing is not to write the PIN directly onto the card or other prominent place. Otherwise, the attackers' task will be greatly facilitated.

For the convenience of the client, use the PIN value chosen by the client himself. This way of determining the PIN allows the client to:

use the same PIN for different purposes;

set in PIN not only numbers, but also letters (for easy memorization).

The main security requirement is that the PIN value should be remembered by the cardholder and should never be stored in any readable form. But people are imperfect and very often forget their PIN. But for such cases, special procedures are intended: restoring a forgotten PIN or generating a new one.

When identifying a client by the PIN value and the presented card, two main ways of checking PIN are used: non-algorithmic and algorithmic.

absence of a PIN copy on the main computer excludes its disclosure by the bank personnel;

the absence of PIN transfer between the ATM or POS-terminal and the main computer of the bank excludes its interception or imposition of comparison results;

Simplification of the work on the creation of system software, since there is no longer the need for action in real time.

Promising solutions. Mobile banking

The main field of application of the Mobil-ID SIM card + EDS is the use of a mobile phone to confirm transactions that require strict procedures for verifying the authenticity of data and subjects of information interaction. WirelessPKI services for a cellular operator must be provided by a special service provider called the Mobile Signature Service Provider (MSSP).

In practice, two-channel multifactor mobile authentication based on the Mobil-ID + EDS SIM card will allow not only identifying the owner in the system for providing electronic services, but also using electronic signatures during the entire communication session or even after the end of a phone call. The owner no longer has to remember all their passwords and usernames. He will be able to completely abandon code bank cards and PIN calculators. If for various services now the user is forced to use different identification data (passwords and usernames), then such a SIM card will allow authorization in all services and services with a single personal code. Functionally, the owner of the new SIM card will be able to do the same electronic operations as the owners of ordinary smart cards - go to the Internet bank, service portals, sign various contracts, etc. At the same time, the MSSP provides two-channel support for strong authentication by combinations of many factors , including GOST R. 34.10-2001, GOST R. 34.11-94 (public key cryptography), GOST 28147-89.