Commerce Security Authority
LightNews LightNews
banner
commercesecurity.org
Commerce Security Authority
@commercesecurity.org
36 followers 39 following 39 posts
Authoritative resources on payment security, fraud prevention, and PCI DSS compliance.
Glossary, vendor directory and webinars at commercesecurity.org
Posts Replies Media Videos
Pinned
commercesecurity.org
Commerce Security Authority @commercesecurity.org · 21d
Commerce Security Authority: Authoritative resources on payment security, fraud prevention, and PCI DSS compliance.

Here we share terms from our glossary, plus our vendor directory and webinars.

commercesecurity.org

#PCIDSS #fraud
commercesecurity.org
Five Myths About AI-Ranked Stolen Data, Debunked

#PCIDSS #fraud
Five Myths About AI-Ranked Stolen Data, Debunked
AI-powered malware like VOLTA automates ranking of stolen data, enabling efficient attacks on all victim tiers and reducing defenders' response time.
commercesecurity.org
November 3, 2026 at 8:02 PM
commercesecurity.org
Term of the day: Tap-to-Pay

Tap-to-Pay is a contactless payment method that lets a customer pay by briefly tapping a credit or debit card, smartphone, or other digital wallet device near a compatible reader. Some...

Full definition: commercesecurity.org/glossary/tap-to-pay

#PCIDSS #fraud
Tap-to-Pay. Tap-to-Pay is a contactless payment method that lets a customer pay by briefly tapping a credit or debit card, smartphone, or other digital wallet device near a compatible reader. Some implementations also let a merchant accept these payments directly on a smartphone without additional hardware. It is designed for quick, in-person purchases such as groceries, tickets, or everyday retail.
November 3, 2026 at 4:02 PM
commercesecurity.org
AML Tech Questions Compliance Officers Keep Asking

#PCIDSS #fraud
AML Tech Questions Compliance Officers Keep Asking
Compliance officers face critical questions on integrating AI and automation into AML programs to enhance detection, reduce false positives, and meet regulatory standards.
commercesecurity.org
November 2, 2026 at 8:01 PM
commercesecurity.org
Term of the day: Tabletop Exercise

A tabletop exercise is a discussion-based activity in which the people responsible for handling an incident talk through how they would respond to a scenario presented by a...

Full definition: commercesecurity.org/glossary/tabletop-exercise

#PCIDSS #fraud
Tabletop Exercise. A tabletop exercise is a discussion-based activity in which the people responsible for handling an incident talk through how they would respond to a scenario presented by a facilitator. Rather than testing live systems, participants meet in a classroom or group setting to walk through their roles, decisions, and procedures. It is intended to help teams practice and improve their response before a real event occurs.
November 2, 2026 at 4:02 PM
commercesecurity.org
Higher-Order Attacks Aren't Always Stronger: Test HO-ASPA

#PCIDSS #fraud
Higher-Order Attacks Aren't Always Stronger: Test HO-ASPA
HO-ASPA reveals that increasing attack order isn't always beneficial, reshaping side-channel analysis strategies and optimizing evaluation budgets.
commercesecurity.org
November 1, 2026 at 8:02 PM
commercesecurity.org
Term of the day: TLS 1.3

TLS 1.3 is the 2018 version of Transport Layer Security, a widely used protocol that encrypts data as it travels between applications over the internet, such as between a browser and a website. It is...

Full definition: commercesecurity.org/glossary/tls-13

#PCIDSS #fraud
TLS 1.3. TLS 1.3 is the 2018 version of Transport Layer Security, a widely used protocol that encrypts data as it travels between applications over the internet, such as between a browser and a website. It is designed to be faster and to offer stronger security than the earlier TLS 1.2 version, in part through a streamlined connection setup and improved handling of encryption keys. Like any protocol, its real-world security also depends on how it is implemented and configured.
November 1, 2026 at 4:03 PM
commercesecurity.org
Rotated Keys, Same Map: Vendor Firewall Leaks Explained

#PCIDSS #fraud
Rotated Keys, Same Map: Vendor Firewall Leaks Explained
Firewall configuration leaks reveal network maps, not just secrets. Banks must reassess vendor risk management beyond credential rotation to secure payment connectivity.
commercesecurity.org
October 31, 2026 at 7:02 PM
commercesecurity.org
Term of the day: TLS 1.2

TLS 1.2 is a version of the Transport Layer Security protocol, a set of rules that secures information as it travels between two systems over a network such as the Internet. It helps protect data...

Full definition: commercesecurity.org/glossary/tls-12

#PCIDSS #fraud
TLS 1.2. TLS 1.2 is a version of the Transport Layer Security protocol, a set of rules that secures information as it travels between two systems over a network such as the Internet. It helps protect data exchanged between a client, such as a web browser, and a server so that it is harder for third parties to read or tamper with that data. It is an updated version of earlier protocols, intended to improve the security of communications.
October 31, 2026 at 3:02 PM
commercesecurity.org
92,000 Records Lost Over Three Years

#PCIDSS #fraud
92,000 Records Lost Over Three Years
Japan Airlines faced a 3-year data breach exposing 92,000 customers due to vendor system vulnerabilities, underscoring the need for robust third-party risk controls.
commercesecurity.org
October 30, 2026 at 7:02 PM
commercesecurity.org
Term of the day: TC40 Fraud Report

A TC40 is a fraud report created by a card issuer in the Visa network when a cardholder claims that a charge was made without their permission. Issuers use it to report those...

Full definition: commercesecurity.org/glossary/tc40-fraud-report

#PCIDSS #fraud
TC40 Fraud Report. A TC40 is a fraud report created by a card issuer in the Visa network when a cardholder claims that a charge was made without their permission. Issuers use it to report those fraud claims to Visa and to share the information with acquiring banks so merchants and processors can monitor fraud activity. It is one of the data sources payment teams use to track fraud and manage chargeback risk.
October 30, 2026 at 3:03 PM
commercesecurity.org
Should You Treat IT Contractors as AML Risks?

#PCIDSS #fraud
Should You Treat IT Contractors as AML Risks?
North Korean IT operatives use stolen identities to launder millions and steal data. Evaluate AML/KYC controls for IT contractors to mitigate sanctions and fraud risks.
commercesecurity.org
October 29, 2026 at 7:02 PM
commercesecurity.org
Term of the day: TC15 Dispute

A TC15 is a Visa transaction code used to record disputes, commonly known as chargebacks, when a cardholder or their issuing bank challenges a transaction. It can cover many kinds of...

Full definition: commercesecurity.org/glossary/tc15-dispute

#PCIDSS #fraud
TC15 Dispute. A TC15 is a Visa transaction code used to record disputes, commonly known as chargebacks, when a cardholder or their issuing bank challenges a transaction. It can cover many kinds of disputes, including problems with a product, authorization issues, and processing errors. Merchants and acquirers track TC15 activity because it can affect their standing under Visa's dispute-monitoring rules.
October 29, 2026 at 3:04 PM
commercesecurity.org
Convertr Breach: Your Patch Checklist for Third-Party Analytics

#PCIDSS #fraud
Convertr Breach: Your Patch Checklist for Third-Party Analytics
The Convertr breach exposed payment data via unpatched third-party analytics scripts. This checklist guides payment security engineers to prioritize and apply patches effectively.
commercesecurity.org
October 28, 2026 at 7:02 PM
commercesecurity.org
Term of the day: System Components

System components are the individual technology building blocks that make up a computer system, such as hardware, software, and firmware. In a payment security context, this term...

Full definition: commercesecurity.org/glossary/system-components

#PCIDSS #fraud
System Components. System components are the individual technology building blocks that make up a computer system, such as hardware, software, and firmware. In a payment security context, this term is used to describe the pieces of an environment that may need to be assessed for compliance. Which specific components are considered part of a payment environment depends on how the environment is designed and connected.
October 28, 2026 at 3:02 PM
commercesecurity.org
Interchange Fee Recalculations: 5 Costly Errors

#PCIDSS #fraud
Interchange Fee Recalculations: 5 Costly Errors
Interchange fee recalculations often cause costly errors in compliance and pricing. Addressing fraud budgets, asset thresholds, and contracts is vital for regulatory fairness.
commercesecurity.org
October 27, 2026 at 7:02 PM
commercesecurity.org
Term of the day: Synthetic Identity Fraud

Synthetic identity fraud is a type of financial fraud in which a criminal creates a fake identity by combining real personal information, such as a Social Security...

Full definition: commercesecurity.org/glossary/synthetic-identity-fraud

#PCIDSS #fraud
Synthetic Identity Fraud. Synthetic identity fraud is a type of financial fraud in which a criminal creates a fake identity by combining real personal information, such as a Social Security number or date of birth, with fabricated or fictitious details. Because the resulting identity does not fully correspond to any single real person, it can be harder to detect than fraud involving a wholly stolen identity. Reports indicate the threat has been growing, with generative AI cited as a factor that may make fabricated identities easier to produce.
October 27, 2026 at 3:03 PM
commercesecurity.org
5 Incident Response Myths Exposed by Capcom's 11.7M Record Breach

#PCIDSS #fraud
5 Incident Response Myths Exposed by Capcom's 11.7M Record Breach
Capcom's breach of 11.7 million accounts exposes common incident response myths and stresses the importance of strong response and communication in gaming.
commercesecurity.org
October 26, 2026 at 7:02 PM
commercesecurity.org
Term of the day: Symmetric Key

A symmetric key is a single secret value used both to lock (encrypt) data and to unlock (decrypt) it. Because the same key performs both operations, everyone who needs to read the...

Full definition: commercesecurity.org/glossary/symmetric-key

#PCIDSS #fraud
Symmetric Key. A symmetric key is a single secret value used both to lock (encrypt) data and to unlock (decrypt) it. Because the same key performs both operations, everyone who needs to read the protected data must have a copy of that key, which means it has to be shared and protected carefully. In payment environments, symmetric keys are commonly used to encrypt cardholder data at rest and in transit.
October 26, 2026 at 3:02 PM
commercesecurity.org
Can Your S-Boxes Hide a Trapdoor?

#PCIDSS #fraud
Can Your S-Boxes Hide a Trapdoor?
Standard S-box tests miss design-level backdoors that compromise payment security. Advanced detection algorithms are essential to uncover hidden trapdoors.
commercesecurity.org
October 25, 2026 at 7:02 PM
commercesecurity.org
Term of the day: Suspicious Activity Report

A Suspicious Activity Report (SAR) is a document that a financial institution files when it detects activity that may involve money laundering, fraud, or other...

Full definition: commercesecurity.org/glossary/suspicious-activity-report

#PCIDSS #fraud
Suspicious Activity Report. A Suspicious Activity Report (SAR) is a document that a financial institution files when it detects activity that may involve money laundering, fraud, or other suspicious financial behavior. It describes the individual or entity involved and the activities observed, and is submitted to the appropriate authorities so that potential violations of law can be reviewed for possible investigation.
October 25, 2026 at 3:02 PM
commercesecurity.org
Should You Bet on AI or Human Analysts for AML?

#PCIDSS #fraud
Should You Bet on AI or Human Analysts for AML?
The $658 billion lost to money laundering in 2025 highlights the need for AML programs that combine AI scalability with human expertise to detect and report suspicious activity.
commercesecurity.org
October 24, 2026 at 7:02 PM
commercesecurity.org
Term of the day: Supply Chain Attack

A supply chain attack happens when an attacker compromises a trusted outside vendor, supplier, or software provider in order to reach the organizations that rely on them...

Full definition: commercesecurity.org/glossary/supply-chain-attack

#PCIDSS #fraud
Supply Chain Attack. A supply chain attack happens when an attacker compromises a trusted outside vendor, supplier, or software provider in order to reach the organizations that rely on them. Instead of attacking a target directly, the attacker exploits the access, code, or trust that a third party already has. This lets a single compromise potentially affect many downstream customers.
October 24, 2026 at 3:03 PM
commercesecurity.org
196 Passwords Changed Without Authorization

#PCIDSS #fraud
196 Passwords Changed Without Authorization
The Capcom breach involved 196 unauthorized password changes, highlighting critical steps for incident response and customer protection after data breaches.
commercesecurity.org
October 23, 2026 at 7:02 PM
commercesecurity.org
Luis Licea, with 345 earlier cases in the archive, was among the month's plaintiffs, the highest repeat count.

#PCIDSS #fraud
September 2026 website accessibility lawsuit report
148 federal website accessibility lawsuits were filed in September 2026 across 8 states. What the complaints alleged, who was sued, where, and by whom.
www.accessibility.com
October 23, 2026 at 5:30 PM
commercesecurity.org
Term of the day: Structuring (Smurfing)

Structuring is the practice of breaking up a large sum of money into multiple smaller transactions so that each falls below reporting or scrutiny thresholds and appears...

Full definition: commercesecurity.org/glossary/structuring-smurfing

#PCIDSS #fraud
Structuring (Smurfing). Structuring is the practice of breaking up a large sum of money into multiple smaller transactions so that each falls below reporting or scrutiny thresholds and appears less suspicious. Smurfing is a form of structuring that typically involves illegally obtained funds and multiple people, often low-level operatives known as 'smurfs,' who carry out the smaller transactions. Both practices are illegal, though structuring can sometimes involve legitimate funds while smurfing generally involves illicit funds.
October 23, 2026 at 3:02 PM