Madrock

EFT devices and systems differ depending on hardware vendor, country and bank / payment aggregator.
Below is a list of things you may like to consider. This list is off the top of my head so it is probably not complete.

Looking at the products and relationships us usually a good start.

Things to consider:

• Card skimming methods
• Some EFT POS devices restrict the connection of a skimmer
• Review levels of associated fraud
• Review devices and EFT methods
• Review terminal identification (merchant and customer)
• Manual processing. (internal and external)
• eCommerce products
• PC based software
• Dedicated server services (Nobil, etc.)
• Web based engine (Custom objects, Web pop-ups, etc)
• Authorisation / identification methods (Merchant and customer)
• TCPIP session hijacking / session spoofing
• Direct Debit as well as Credit Cards.
• Swift (methods and controls)
• Telegraphic transfer (methods and controls)
• Payment aggregator relationships (eg. Payment Tech, manual processing, cheque scanning, etc.)
• Internet banking facilities (attack / penetration,  Certificate registration / management, ISP SLA’s, etc.)
• Implementation of Smart Card and / or alternative customer recognition devices.
• Outsourcing and associated risks / service level agreements
• Payment processing
• Payment clearance
• Payment switching
• Reporting (segregation of merchant / customers / aggregators / partners / local / international)
• Fraud detection and reporting
• 3rd party acquiring risks
• Single merchant ID many businesses
• Allows moneys to be laundered if the payment aggregator does not place appropriate controls on the merchant.
• Encryption used
• Internet / trusted partner / inter-bank / extranet
• Private and / or public certificates
• Single use certificates
• Client side certificates
• Remittance advice processes and controls.
• EFT disaster recovery and manual fall back procedures (associated security and reconciliation risks)
• Trusted partner relationships, SLA’s, liabilities and risks.
• EFT regulatory / legal requirements (inter-bank and government)
• Refund processing / authorisation. (policies, procedures, controls, etc.)
• CVV, CVV-2 / CVC-2 processing and management. (http://www.atlanticpayment.com/CVV.htm)
• Fraud detection mechanism (neural networks, inter-bank / department customer checks, etc)
• Supported card schemes (AMEX/Visa/Mastercard/Discover/etc )
• Review EFT floor limits (corporate and SME merchants)
• Review the ability to withhold merchant settlement until the presence of fraud has been determined.
• Review customer identification details. Such as (This varies around the world depending on local regulations / privacy laws)
• Review real-time and batched processing methods and controls (sequence numbers, access to raw data, etc.)
• Review processing with and without expiry dates. (exception controls and policies)
• Review exception / fraud reports.
• Review payment store and forward policies and procedures.
• Review Pre-Auth and Completion controls.
• Token based payment (eCash, etc)
• Merchant reconciliation, reporting methods and controls (paper, Internet, email, PDF, Fax, etc.) and associated security.
• Real time gross settlement policies, procedures and controls. (IT and amounts)
• Card issuing policies and procedures. (customer ID checks, etc)
• Banking infrastructure (ingress / egress) controls and security. (Web, partner, payment switches, outsourced infrastructure, monitoring / reporting.)
• Use of Internet technologies for inter-bank transfers and remote equipment.
• Physical security and controls of devices, ATM,s, line encryptors, etc.