Mobile Payments May Make PCI Obsolete
Written by David TaylorAugust 6th, 2009
As more people start paying for goods and services using their phone, rather than a credit card, they are venturing into that ethereal netherworld that is “beyond PCI” – in this case, literally, as their daring actions challenge the Payment Card Industry to drop “card” from their name.
But there’s more to the challenge than semantics, argues PCI Columnist David Taylor. A lot more.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
4 Comments | Read Mobile Payments May Make PCI Obsolete
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Ed
August 6th, 2009 at 2:47 pm
Mobile Payment to become universal must leverage from existing payment infrastructure as much as possible. Mobile Payment and NFC will therefore never be universal and as convenient as today’s credit/debit cards until it becomes PCI DSS Compliant or FSTC compliant.
August 7th, 2009 at 6:52 am
Mobiles can leverage the global credit/debit cards infrastucture and solve many PCI DSS compliance issues; To start mobiles (or POS) should never have to store a credit/debit card number. Mobiles can be enabled to compute one-time-use credit/debit cards – a token for a single purchase. One-time-use is the best form of security (it cannot be re-used). No personal data or (plastic) credit/debit card details need to be stored in a phone, or at a TSM. Your sensitive data should remain with your Financial Institution at all times and not be shared with anyone. FI should worry about PCI DSS, no one else!
August 7th, 2009 at 9:14 am
Eric, i agree about the value of OTU passwords, but i also believe tokens are another option. Either way, the centralization of card data is critical from an architecture perspective, as well as simplifying compliance and minimizing data breach risk. Good point!
August 10th, 2009 at 11:19 am
I believe that the move to an infrastructure will make requirements like PCI more important. As we move further away from physical instruments like cards, which at least have physical security features (for what they are worth, I know most merchants don’t give them a second look). But if data from one of my transactions was compromised and put onto someone else’s mobile their is no real way for a merchant to identify one mobile from another as being the genuine payment token
The fact that the device could support features like (more) advanced encryption of the transaction data is just a bonus.
Nealle