Is PCI Skimping On Skimming?
Written by Walter ConwayNovember 29th, 2011
PCI does not address skimming at your point-of-sale (POS) devices, especially those self-service areas that are not under constant control of a clerk or manager. PCI Columnist Walter Conway thinks it should and that now may be the perfect time to make a change in your POS practices and PCI itself. Although this may be the season of sharing, that should not include sharing your POS devices with the bad guys. The PCI Council recognizes the risk from card skimming. They have held information sessions highlighting the threat at the Community Meetings and they published in 2009 a document informing retailers of the risks of skimming.
However, as of today, there is nothing in the PCI DSS directly addressing how retailers should protect their POS devices from being compromised by a bad guy installing a skimmer. The timing for updating or clarifying PCI now is excellent. Each version of PCI DSS has a three-year lifecycle and we are now into the second year of PCI version 2.0. That means that as of November 1 we are in the formal period when Participating Organizations worldwide provide feedback on improving payment security and the PCI DSS itself.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
4 Comments | Read Is PCI Skimping On Skimming?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
November 30th, 2011 at 11:51 am
Please consider EMV. This is exactly what it was designed for.
November 30th, 2011 at 10:01 pm
Thanks for the comment, Jonathan. Unfortunately, EMV is not going to be a solution for several years at the soonest. And since ATMs still use the mag stripe almost everywhere, EMV does nothing for banks’ risks. (I focused on retailers’ risks, but banks face the same or larger risks at their ATMs!)
What merchants (and banks) need to do is address the problem now based on the technology that is in use. That means at least visual inspection of POS devices and automated monitoring of them when they are moved, disconnected, or turned on/off. And then, once EMV (or at least some form of chip) is implemented across the planet, all we need to do is make sure the chips never, ever fail so retailers don’t need to read the mag stripe. Unfortunately, that is not likely to happen soon, either.
I’m putting my money on changes to smart retailers’ security practices coupled with enforcement from a change to PCI to encourage everybody else.
December 1st, 2011 at 2:52 pm
Walt,
EMV payment processing machines were implemented throughout the USA and in ATMs but have not been enabled at this time. For example, all of Wal-Mart payment devices are EMV-equipped to handle chip and pin.
December 2nd, 2011 at 11:37 am
Good comment, Ed, but terminals are not the issue. The cards are the issue.
That is until retailers no longer use or need the mag stripe, skimming is going to happen. And it is going to happen to the least prepared, least vigilant, and least aware retailers. This is less a technology issue (although monitoring your devices is a great idea) but a result of living with a 50-year old technology (i.e., mag stripe), and until that is changed all the EMV-equipped terminals in the world won’t help too much.