Risk Assessment & Management in Merchant Capture Systems: A Threat Analysis Perspective
Kevin Streff, Sarin Shrestha, Cody Delzer · 2013
Merchant Capture Systems (MCS) provide the ability to deposit checks remotely without visiting a brick-and-mortar bank. The adoption of this technology is increasing rapidly; however, security threats exist with merchant capture systems. This paper examined two prominent merchant capture architectures to determine and prioritize common security threats and mitigating controls. Threats were identified for three components of a typical merchant capture system: bank, merchant and technology service provider. The paper communicates common MCS threats and controls as gathered by a questionnaire, evaluated by security experts and verified by IT auditors and bank examiners. The study determined the likelihood and impact of each threat, calculated an asset threat score and an inherent risk score for a merchant capture system, and concluded data loss as the top security risks when checks are deposited remotely through a merchant capture system.