Chuck Herrin, CISSP, CCSP, NACD.DC’s Post

[WHAT'S THE TEA] Dear Father Christmas 🎅 , here is my wishlist for my PayFac project… Hope you can do something for me... ✅ Gateway to accept transaction  ✅ Onboarding management system to perform AML due diligence ✅ Credit risk management system to check merchants' credit deliquency ✅ Scheme fit and proper solution to check merchant is not black listed ✅ Pre Authorisation Fraud solution to accept only legitimate transaction ✅ Monitoring manager for merchants’ daily activity to report schemes ✅ Merchant account management system to open account and assign funds ✅ Chargeback management system to fight any chargeback coming ✅ Automated Ledger to reconcile all cost (+ a good invoicing system ) ✅ Settlement provider to pay out my merchants  ✅ Reporting factory to create any documents needed for merchants ✅ Good acquirer to get my funds from scheme ✅ Bank to open a bank account  ✅ License provider if needed to escrow, or settle or both.   ✅ Back office interface for merchants' self service ✅ Customer service interface for my employees ✅ Compliance department  ✅ Risk policy for acquirer and scheme ✅ AML and KYC policy for regulators  ✅ Contract management system for all contracts applicable ✅ Pricing system to sell payment services to merchants You can’t make a Christmas Miracle? 🎄 I am not surprised, it looks way more complicated than some try to sell me :) ——————————— Follow me to share more nice 🍵 of tea  Like this content, share it, it is free of charge darling 💖 I am JORDAN GRAISON, you can find me here :  https://lnkd.in/enMP6dUy

Using UPI is a 3-click job, thanks to the processes running in the background. Let me break down the process in the simplest way possible. There are generally two types of transactions: PUSH and PULL. Below, we will focus on the PUSH method, which is widely used in the market. Phase I • The customer initiates the transaction using the payee's mobile number, VPA, or QR code. • The payer's Payment Service Provider (PSP) forwards the request to NPCI. • The NPCI UPI server then forwards the request to the payee's PSP for address resolution and authorisation. • The payee's PSP resolves the address and provides the account details in coordination with the remitter bank. Phase II • The payee's PSP provides the bank details to UPI, which then forwards them to NPCI. • NPCI checks with the remitter bank to debit funds from the payer’s account. • Once the funds are debited, a credit request is sent to the beneficiary's bank. • The beneficiary's bank credits the payee’s account and responds to NPCI UPI. • NPCI UPI server updates the transaction status and communicates it back to the customer via the payer's PSP. Next time you transfer money to a buddy, take a moment to thank the network of nodes behind the scenes. ;)

Using UPI is a 3-click job, thanks to the processes running in the background. Let me break down the process in the simplest way possible. There are generally two types of transactions: PUSH and PULL. Below, we will focus on the PUSH method, which is widely used in the market. Phase I • The customer initiates the transaction using the payee's mobile number, VPA, or QR code. • The payer's Payment Service Provider (PSP) forwards the request to NPCI. • The NPCI UPI server then forwards the request to the payee's PSP for address resolution and authorisation. • The payee's PSP resolves the address and provides the account details in coordination with the remitter bank. Phase II • The payee's PSP provides the bank details to UPI, which then forwards them to NPCI. • NPCI checks with the remitter bank to debit funds from the payer’s account. • Once the funds are debited, a credit request is sent to the beneficiary's bank. • The beneficiary's bank credits the payee’s account and responds to NPCI UPI. • NPCI UPI server updates the transaction status and communicates it back to the customer via the payer's PSP. Next time you transfer money to a buddy, take a moment to thank the network of nodes behind the scenes. ;)

🤝 Events and engagement On Monday, our Managing Director, David Geale, delivered a speech at a payment systems conference, co-hosted by the LSE Systemic Risk Centre and Oxera. His speech focused on how effective regulation can create the right conditions to enhance competition in markets, while making sure there is financial stability, consistency and transparency. Dan Moore, our Head of Strategy, Analysis and Engagement, also joined a panel session to talk about how regulators can contribute to growth and innovation. David also joined the Financial Conduct Authority’s Matthew Long at the Open Banking Expo UK & Europe. They appeared at a fireside chat to discuss Joint Regulatory Oversight Committee recommendations on the vision and design of the open banking entity. While Kate Fitzgerald, our Head of Policy, and Andrew Self, our Senior Policy Manager, joined separate panel sessions on VRP and open banking. On Wednesday, Dan and Oliver Hanmer, our Head of Supervision and Compliance Monitoring, were at the Payments Leaders' Summit. Dan took part in a fireside chat about the National Payments Vision and Strategy: The future of UK payments. Then later in the day, Dan and Oliver held a regulatory lunch & learn – a great opportunity to engage with stakeholders. 👀 Take a look... Last week, Monday 7 October, marked a really important milestone in the fight against fraud – our groundbreaking authorised push payment (APP) fraud protections came into force. By introducing these measures, we’re ensuring all payment firms – including for the first time, those that bank the fraudsters, face strong incentives to stop fraud from happening in the first place. And if people do fall victim, our rules provide a consistent minimum standard of protection across the board. You can read our full announcement here: https://lnkd.in/eE8WnQba   📢 Open consultations - get in touch! We've published our consultation on the draft statement of policy for our cost benefit analysis (CBA) framework. CBA is an important tool helping us assess the potential impacts of our proposed policies and ensure we deliver positive outcomes. Get in touch with your feedback by 3 November 2024. https://lnkd.in/dhyrWNeH 🚨 Exciting job opportunities at the PSR! #hiring We’re currently looking for someone to join our Communications and Engagement Team to take the lead on our events and regional visits programme of work. https://lnkd.in/eERpzH8D We’re also looking for a regulatory finance specialist to help deliver our card fees work, with an initial focus on profitability analysis. https://lnkd.in/ec4ttNga #engagement #publications #jobs #payments

As an Asset Channel Manager in a banking support function role, managing requests that fall outside your scope can be challenging. Here are some tips to help you navigate such situations: 1. *Clearly define your role and responsibilities*: Ensure you have a well-defined job description and understand your key performance indicators (KPIs). 2. *Communicate your scope effectively*: Politely inform requesters about your role's limitations and the reasons behind them. 3. *Offer alternative solutions or referrals*: If possible, redirect requests to the appropriate department or person who can assist. 4. *Set boundaries and prioritize*: Focus on your core responsibilities and prioritize tasks accordingly. 5. *Document requests and responses*: Keep a record of requests and your responses to maintain transparency and accountability. 6. *Escalate if necessary*: If requests are persistent and unreasonable, escalate the matter to your supervisor or relevant authority. 7. *Maintain a positive and helpful attitude*: Be courteous and helpful while remaining firm in your boundaries. 8. *Provide education and training*: Offer guidance and training to help others understand your role and responsibilities. 9. *Continuously review and refine your processes*: Identify areas for improvement and optimize your workflows to minimize distractions. 10. *Seek support from your team and supervisor*: Don't hesitate to ask for help or guidance when needed. By following these tips, you can effectively manage requests that fall outside your scope and maintain focus on your core responsibilities as an Asset Channel Manager in banking.

Here’s how private investigators used to trick banks into giving up private account information. I learned it directly from a former practitioner of this dark art, and it was not exactly as I expected.     I was chatting with her on another matter, but she mentioned she used to do “pretext” bank searches in the olden days, when PIs would call up banks and fake their identities to get peoples’ bank balances.   Since I had her on the phone, I asked to her to walk me through how it went.   Working off a script, the first step was to call the target debtor directly under the guise of confirming some credit card or other financial information.    The objective was to learn where they banked.   With that information in hand, she would call a remote branch of that bank -- ideally in a low-income or rural area where she expected the employees would be less sophisticated -- and pretend to be a colleague.    The objective was to obtain the “code of the day” that branches would use to confirm identities when communicating with each other.   Only then would she call the branch where the subject banked, and, acting as a bank employee with the appropriate code, would ask after the balance and the specific name on the signature card.    The latter was critical because the end game here was to issue a subpoena, but the name on the account had to match perfectly.   Amazingly, this was all considered to be perfectly legal in the old days.   (There are still bank account search companies out there, but that’s a post for a different day.)    I had always imagined that pretexters just called the bank directly and imitated the consumer, which must have been how some people did it, but I hadn’t conceived of this more complicated process.

#BankingAndFinanceNews Please Repost

#Gotobedsmarter To submit a Suspicious Transaction Report (STR) to a Financial Intelligence Unit (FIU), ensure you include the following key documents: 🔻 Account Onboarding Documents: Identification documents like ID cards, passports, driver’s licenses, salary certificates, and proof of business ownership. 🔻KYC and Enhanced Due Diligence: All relevant Know Your Customer documents. 🔻Entity Documentation: Trade licenses, commercial registrations, Memorandum and Articles of Association, trust or partnership deeds, and ID documents for beneficial owners, partners, directors, signatories, and management. 🔻Account Statements: Detailed statements for all accounts. 🔻Transaction Synopsis: Summary of total debit and credit transactions. 🔻Transaction Analysis: Detailed analysis of each transaction type. 🔻Link Analysis: Analysis showing connections between transactions and entities. 🔻Supporting Documents: Proof of suspicious activities, such as invoices, SWIFT documents, checks, cash deposit receipts, and Letters of Credit. 🔻Completed STR Form: Detailed description of the customer profile, suspicious transactions, and reasons for suspicion. This concise set of documents ensures a thorough and effective STR submission. Source : https://lnkd.in/dMmSh69f

Why oh why do account management processes keep sucking? For a reason I can't figure out, the more valuable the account is (e.g. banking, finances), the more likely it is to intentionally sabotage your attempts at keeping yourself secure. Today, I had the pleasure to figure one out. Your account gets locked if you enter the wrong PIN a few times, e.g. when their MFA is broken and sends codes out of order to you. Bonus points, you can intentionally block another person's account, making it impossible for them to use the services. Account can only be unlocked by calling support. Support is only open during business hours. There is no 24/7 phone support and 24/7 chat requires that, surprise, your account works. They also can't help you even if you get there. This is neat if you combine it with previous tip and lock another person's account on Friday evening. Or just repeatedly do it, it takes a second to lock and easily 30 minutes to unlock. I still can't fathom what the password requirements are. It says 8-255 letters and says that "spaces may be used" in broken Finnish that is worse than most scam e-mails today. After 10 minutes of testing passwords and failing to select one that was acceptable, ultimately the magic trick was to include a handful of capital letters and not to have too long of a password. I now have yet another financial service with a horrible password so I can at least set it.

Hierarchy inside the Banks: -In banking terms, the levels of "PIN officer" can vary depending on the hierarchy and specific security policies of each financial institution. However, generally, "PIN officer" levels can be organized as follows: 1. **Basic Level:** Entry-level employees may have limited access to information and systems protected by PINs to perform routine tasks such as computer or payment terminal access. 2. **Intermediate Level:** Mid-level employees may have access to more sensitive information and systems, such as customer data or financial transactions. They may be responsible for more complex operations and require higher levels of authentication. 3. **Advanced Level:** Advanced-level employees have access to highly sensitive information and systems, such as high-value customer accounts or risk management systems. They typically have additional security privileges and may be responsible for authorizing significant transactions. 4. **Executive Level:** Senior executives, such as directors or vice presidents, may have access to the highest levels of information and systems protected by PINs. They generally have ultimate authority to approve critical transactions or conduct strategic operations. These are just general examples, and specific levels may vary according to the security policies and procedures of each banking institution.