Fortnum & Mason’s PCI Weakness: Customer Service
Written by Evan SchumanJanuary 25th, 2012
Historic British retailer Fortnum & Mason—with roots dating back to 1704—is finding that PCI compliance doesn't end with IT. The chain had to confess last week that a customer service rep was asking customers to E-mail their full credit-card data—including CVV—to process routine refunds.
Clearly, one errant employee is something every chain has. But this example brings up a too-often overlooked PCI fact: Compliance is an issue for every employee. Mobile payment, being a disruptive factor, will only make things worse, because it creates many more opportunities for payment-card data to be captured/retained against the rules.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
One Comment | Read Fortnum & Mason’s PCI Weakness: Customer Service
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
January 25th, 2012 at 10:04 pm
This is a great example of “customer service” trumping security. I disagree with one conclusion, however. Based on my experience, this is most definitely not an “isolated problem” as you state. Rather it is something I and QSAs like me run into regularly.
Part of the cause is a lack of training. As you point out, PCI compliance requires employees be trained not to do things like asking for payment cards over email. That the customer service rep did that is bad enough. Worse is the Fortnum & Mason spokesperson foolishly stating both how important their customers’ security is AND that the company is PCI compliant.
This situation also has me wondering if they also have a call recording system that captures and stores card data, too. Just for quality purposes, of course…
It is disappointing that a leading retailer like Fortnum’s would be so casually dismissive of their customers’ security.