PCI Talk is Cheap: Even Small Merchants Can Afford It
Written by David TaylorAugust 13th, 2009
When the National Retail Federation published a report this week about a survey of Level 4 merchants and PCI concerns, it presented an optimistic—but potentially misleading—picture, points out PCI Columnist David Taylor, who had been actively involved in the report's research. "One of the problems with multiple choice surveys is that it’s hard to present realistic tradeoffs to the respondents. You rarely see a question: 'Which is more important? Spending $500 on a new network firewall or spending $500 to fix the delivery van?' But that’s the real issue."
That's because data security may be a high priority in the abstract, but compared to “keeping the business running” types of concerns, it typically drops off the bottom of the list of things to spend money on. Why? Because small businesses do not believe they are going to have a data breach.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
4 Comments | Read PCI Talk is Cheap: Even Small Merchants Can Afford It
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
August 13th, 2009 at 4:27 pm
I agree with you David. Opinion does not always translate into action when it comes to merchants taking the necessary steps to achieve compliance and secure credit card data. At the same time, I think that service providers in the payment processing industry are getting much better at developing solutions that lessen PCI Compliance scope and secure sensitive data for merchants – which will help move things along faster.
August 13th, 2009 at 5:31 pm
Hi, Bryan,
Good point. I really ought to write more about the use of service providers & outsourcing. It keeps coming up in our interviews with merchants. If you or anyone else reading this has suggestions for an “angle” for the piece, let me know. Remember, Evan always wants the topic to have a fresh approach. So, suggestions anyone?
thx, Dave T.
August 18th, 2009 at 8:19 pm
David you bring up some great points. Small businesses are targets for credit card hackers. In fact, a recent Visa review of fraud cases found that small businesses account for the vast majority of credit and debit card data breaches.
October 12th, 2009 at 12:55 pm
Rubbish,
The entire drive to PCI compliance is more driven by PCI committee members greed (many of which are involved in the network scanning and on-site consulting review business) than it has anything to do with any real steps toward reforming the overall card processing industry. Small businesses, like a martial arts school or a bicycle repair shop that just happen to process credit card transactions over an Internet connection are the least of the Industry’s problems. Hackers simply are not interested in spending a few days setting up to crack into a small merchant’s computer on the hopes of intercepting 50 – 100 credit card transactions a month. It just is NOT going to happen. They want the middle to large tier processors where they can be assured of a quantity of data to either resell or use directly.
What is happening is that small businesses, like the ones I mentioned above, are helping fund hundreds of new PCI compliance businesses with plenty of cash from unnecessary quarterly network scans. It simply results in wasted time from paperwork and trying to understand an industry that is not their core business. PCI DSS at this level, as currently implemented, does little to nothing to provide any more security to the card industry in general.
I am not bemoaning security standards or best-practices for keeping customer card data safe. I am just pointing out that it is the small businesses that are the absolute least contributors to the overall card industry losses that are paying the biggest price when tallied up. When I approach a new customer interested in accepting credit card payment and mention they will need to tag another $100 – $200 a year for quarterly network scans of their PC that they process credit cards on, in addition to any costs in time and software to GET compliant, they will likely tell me to go jump in a lake.
In the old days, the hard sell for a merchant account was always an argument of “will you waive the $50 set-up fee, we really can’t afford that as a small business.” Now I have to add these fees into the sales process. All these additional costs for small businesses via PCI DSS are an absolute death knell for anyone trying to sell these services to small businesses or for small businesses themselves.
If the PCI DSS committee members had focused their energies more on the card processors, gateway providers, and the myriad other middle to top tier providers, developed new standards for secure data transmissions, network compliance, etc., I would venture that some 25% – 75% improvement on losses could be seen by the industry in the next 5 years. Then, they could focus on education services for the small business owners and offer free (yes free) network scans and advice on making a merchant’s data safer for their own peace-of-mind and for the entire industry.
Let us not forgot the forest for the trees. The small mom-and-pop merchant is not the one making money to accepting credit cards. Indeed the merchant gives away between 2% and 5% of every transaction to Visa/MC/AMEX, etc. on each transaction. Yet it is the merchant having to pay even more to assure that those profits keep flowing to the big providers and their middle-man partners.