What is Point-to-Point Encryption?

An Introduction to P2PE Credit and debit cards are becoming increasingly popular methods of payment in South Africa, with consumers of all income levels finding them easier and more convenient than carrying cash. According to Euromonitor there are currently over 47 million debit and credit cards in circulation in South Africa, with an expectation of 35% growth over the next five years[1]. Retailers are therefore accepting an increasing number of credit and debit cards as a primary payment method, as more consumers begin using cards for everyday payments. In order to enjoy the benefits of these cards however, consumers must trust that they are safe and secure from fraud. The banks that issue these cards therefore have a responsibility to protect their cardholders. In order to do so banks require that all retailers be accredited with the Payment Card Industry Data Security Standard (PCI-DSS). This accreditation makes it very difficult for thieves to steal cardholder data and hack into their accounts, but attaining this approval is an extremely arduous task for the retailer. A new solution called Point-to-Point encryption (P2PE) has been developed that considerably reduces the burden of PCI-DSS for the retailer. This technology ensures that the cardholder’s account data is protected from the point that the card is swiped or inserted at the checkout, until the bank processes the transaction and returns the response to the checkout. This makes it impossible for thieves to capture any cardholder data during the transaction. According to the PCI Security Standards Council, PCI-compatible P2PE solutions must include all of the following elements:

• Secure encryption of payment card data at the point-of-interaction (POI)
• P2PE-validated applications at the point-of-interaction
• Secure management of encryption and decryption devices
• Management of the decryption environment and all decrypted account data
• Use of secure encryption methodologies and cryptographic key operations, including key generation, distribution, loading/injection, administration and usage

P2PE solutions are applied to bank card information and includes secure devices, applications and processes that encrypt data from the point-of-sale (POS) to the card processing point, and is usually provided by a third party. P2PE is a relatively new technology and here in South Africa, Ecentric Payment Systems will be the first payments services provider to produce a solution that is fully compliant with the PCI Council.  Ecentric Payment Systems will be making P2PE available to all its customers over the next 12 months. Benefits of P2PE P2PE offers a number of benefits both to cardholders and to retailers. For the customer, P2PE considerably reduces the risk of fraud by immediately encrypting confidential cardholder data when the card is swiped. P2PE also offers the following benefits to retailers:

• Takes store almost completely out of scope for PCI compliance
• Valuable cardholder data is protected at all times
• Reduces PCI compliance costs significantly
• Helps maintain compliance with minimal effort
• No need for expensive VPN networks
• Account data is less valuable if stolen in a breach
• No costly scans, remediation and day-to-day management of the retail environment
• Allows retailer to focus on its core business

Ecentric’s P2PE Solution In order to embark on this journey Ecentric has partnered with a number of industry leaders to ensure that all the components are 100% certified, verified, safe and secure. Partners in its journey were:

• ACI, who provide the software to process transactions
• Futurex, who provide the security Module to decrypt the data
• Verifone, who provide the secure Pinpad used to encrypt the data at source
• Sysnet, the QSA who guided Ecentric in terms of all the compliance steps and requirements
• ABSA, the bank with whom it listed its first ever P2PE solution
• TFG, the first retailer who availed its POS and technical teams to participate in this initiative

“Working closely with our partners, Ecentric put the solution together, facilitated the various parties involved, implemented the solution, tested, verified and submitted to the council for accreditation. The journey was a complex and technically challenging one, and took us almost two years to achieve.” Said Ecentric Director, Hassen Sheik. Together with ABSA and TFG, Ecentric is the first South African payment solution provider to submit a solution that will be listed on the PCI Council website, with this listing due in the month of May. [1] Euromonitor International- FINANCIAL CARDS AND PAYMENTS IN SOUTH Africa – February 2015]]>