Merchants need to be aware of a new mobile payment solution – Square from Square Inc. A colleague pointed me to the Square site with the question, “Is this PCI compliant?”
Square appears to be a hardware/software solution for iPhones, iPads and Android devices. It has a cute, square magnetic stripe reader for swiping cards, but also appears to provide the capability to manually enter cardholder data through these devices’ virtual keyboards. This all appears to be similar to the iPhone that used to appear in the first Apple iPhone commercials that, for reasons that will become obvious, magically disappeared from their commercials very quickly and quietly. It is also why Apple no longer uses iPhones or iPod Touches in their stores to process payments.
In referencing the PCI SSC’s PTS certification database, I could not find Square’s certification for the PTS standard. Although, given the pictures on Square’s Web site, I really did not expect to find it certified to the PTS standard as there is no way it could meet the PTS standard. Has Square submitted their solution for PTS certification? It may have, but since the PCI SSC PTS certification database only lists those devices that have completed the certification process, there is no way for anyone to know if it has submitted Square until it is certified. However, since the use of PTS certified devices is a requirement of all of the card brands, until Square is PTS certified, use of a Square device for processing of credit cards violates a merchant’s merchant agreement. Game over.
While not complying with the PTS standard is a deal breaker in my opinion that is not the only PCI compliance issue. In referencing the PCI SSC’s PA-DSS certification database, I could also not find the Square software application listed. That situation was also not unexpected as the PCI SSC announced in a press release on June 24, 2011 that it was suspending the PA-DSS certification review of all mobile payment applications indefinitely. As a result, there is no way Square’s software will be PA-DSS certified for the foreseeable future whether they submitted it for PA-DSS certification or not. Not that the PA-DSS certification is a deal breaker for merchants to use the Square software, but it means that merchants using the Square software to process payments will have to have the Square software assessed to ensure it meets all of the PCI DSS requirements regarding payment applications.
And knowing what I know about all of these devices, I can guarantee that the Square software will not be PCI DSS compliant because all of these devices will store the cardholder data unencrypted for an untold amount of time until it is written over. Even if Square’s software encrypts the data, the underlying OS will also collect the data in cleartext. Forensic examinations of these devices have shown time and again that regardless of what the software vendor did, the data still existed in memory unencrypted. And that unencrypted data in memory can exist in these devices for days, weeks to even months depending on transaction volume and other applications loaded on the device. It is this surreptitious OS data collection activity, the security issues with other applications as well as other security concerns that caused the PCI SSC to suspend their PA-DSS certification activities of these applications.
There is only one solution that uses an iPhone or iPod Touch that is PTS and PA-DSS certified at this time and it is from Verifone. The reason that Verifone’s PAYware solution is certified is that: (1) Verifone submitted it for the PCI certifications prior to the June 24 suspension and, the bigger reason in my book; (2) it relies on a digital back separate from the iPhone/iPod that performs the card swipe and all of the card data processing/transmission in a secure manner. The iPhone or iPod Touch are used only as a display and cellular/Wi-Fi conduit for network connectivity.
The only other mobile payment solutions I am aware that are PTS compliant are purpose built credit card terminal using Wi-Fi or cellular communications. These are considered terminals by the PCI SSC, so their underlying software is not required to be PA-DSS certified at this time, but they are required to be PTS certified. In addition, these terminals have been in use in Europe for quite some time, so they are a proven secure solution.
The bottom line is that it is the merchant’s responsibility to ask vendors the right questions and weed out non-PCI compliant solutions. The card brands and the PCI SSC are not in the business of regulating vendors, they leave that to the marketplace.
If you are looking for a PCI compliant mobile payment solution, talk to Verifone, Equinox, Ingenico or other recognized card terminal manufacturers as those are going to be your only PCI certified mobile payment processing options at this time.
PCI Guru 
See this article: http://www.merchant911.org/blog/index.php/2013/03/05/the-square-is-pci-compliant-with-a-question-mark/
Newer Square devices encrypt at point-of-swipe.
See the comment to that article by Dirk Anderson (apparently from Coalfire, Square’s PCI assessor) that we don’t need to attest compliance vis-a-vis our use of the Square device + mobile app (their back end is level-1 compliant) because Square, not we, are the merchant, and it is their responsibility to attest compliance.
Your thoughts?
I knew that Square had changed but have never gotten confirmation from Square. They have never publicly swapped out earlier units, so you have to wonder what their deal is. As far as the comment about who is the actual merchant, that is up for debate and will be decided by the first breach lawsuit. Square is operating in a gray area of the rules and the card brands are allowing it.
Does anyone konw if the Mobuyle system by Heartland Payment Systems is PCI compliant? Heartlnad says it is. Is there a PCI document I should ask for?
The PCI SSC Web site only shows two applications from Heartland Payment Systems that are PCI compliant: Campus OneCard System and SpiDr. I looked up the applications by name and there is nothing named ‘Mobuyle’ in the PCI SSC’s approved PA-DSS certified application database.
If you want to look up any PA-DSS application, click on ‘Approved Companies & Providers’ on the top control bar and then click on ‘Validated Payment Applications’ on the left hand side menu. You must acknowledge you understand the information provided is “as is” but then you can look up applications by company or name.