Further to the information provided in Global Security Bulletin No. 4, 15 April 2010, which reported that the Ingenico i3070MP01 and i3070EP01 had been de-listed from the PCI PTS Approved Product List, MasterCard provides the following additional information for acquirers and merchants.
MasterCard strongly recommends that acquirers and merchants replace all existing Ingenico i3070MP01 and i3070EP01 terminals as soon as possible.
Web site https://www.pcisecuritystandards.org/security_standards/ped/pedapprovallist.html?mn=I
MasterCard requires acquirers and merchants to place all new orders for only the i3070 variants listed on the PCI Security Standards Council (SSC) Web site of approved terminals Further to the information provided in Global Security Bulletin No. 4, 15 April 2010, which reported that the Ingenico i3070MP01 and i3070EP01 had been de-listed from the PCI PTS Approved Product List, MasterCard provides the following additional information for acquirers and merchants.in accordance with section 4.10 of the Security Rules and Procedures manual
In particular, acquirers and merchants that have placed orders for either the i3070MP01 or i3070EP01 terminals on or before 23 March 2010, and are awaiting delivery should be aware of the described de-listing and of the MasterCard PIN Entry Device (PED) Standards, but may deploy those terminals at their own risk.
Acquirers and merchants that elect to use or continue to use the Ingenico i3070MP01 or i3070EP01 terminals should be aware of the associated risk, including potential responsibility for account data compromise events attributable to such use. However, the de-listed terminals satisfy the EMV1 requirements for MasterCard Chip/PIN liability shifts.
All acquirers and merchants are urged to adopt and follow the guidance provided by the PCI SSC Skimming Prevention—Best Practices for Merchants.
Web Site: www.pcisecuritystandards.org/education/info_sup.shtml
MasterCard encourages the regular checking and monitoring of all terminal assets. A common mode of operation of the criminal is to steal, compromise, and then return the terminal. Therefore, merchants must pay close attention to terminal inventory, identification, security, and monitoring.
As stated in the above best practices, MasterCard recommends that acquirers and merchants record the location, make, model, serial number, and variant of all terminals that are stolen, noting where possible the following:
• Approximate time and date when the terminal was stolen
• Model
• Variant
• Serial number (if known)
If any stolen terminal re-appears, then the merchant or acquirer should immediately inform the relevant authorities as any returned terminals may be compromised. Any terminal found to have been stolen and returned must be replaced immediately.
MasterCard also recommends that on at least a monthly basis acquirers should notify MasterCard of any terminals stolen or compromised, including the number, variant, and model of terminals stolen. MasterCard strongly recommends that acquirers and merchants with existing i3070MP01 or i3070EP01 terminals that fail in the field upgrade these terminals to terminals or variants listed on the PCI PTS Approved Product List. If this is not possible or practical, then the existing terminal may be repaired or replaced on a like-for-like basis, if this does not increase the overall terminal inventory.
Email : pos_compromise@mastercard.com
MasterCard rules and other standards that address rights and obligations remain in effect. MasterCard reserves the right to change this information at any time should it become necessary; however, MasterCard will endeavor to work closely with acquirers to ensure that they are kept informed of any change in the situation that may impact the i3070MP01 or i3070EP01.
Email: pos_compromise@mastercard.com
