What is happening is that small businesses, like the ones I mentioned above, are helping fund hundreds of new PCI compliance businesses with plenty of cash from unnecessary quarterly network scans. It simply results in wasted time from paperwork and trying to understand an industry that is not their core business. PCI DSS at this level, as currently implemented, does little to nothing to provide any more security to the card industry in general.

I am not bemoaning security standards or best-practices for keeping customer card data safe. I am just pointing out that it is the small businesses that are the absolute least contributors to the overall card industry losses that are paying the biggest price when tallied up. When I approach a new customer interested in accepting credit card payment and mention they will need to tag another $100 – $200 a year for quarterly network scans of their PC that they process credit cards on, in addition to any costs in time and software to GET compliant, they will likely tell me to go jump in a lake.

In the old days, the hard sell for a merchant account was always an argument of “will you waive the $50 set-up fee, we really can’t afford that as a small business.” Now I have to add these fees into the sales process. All these additional costs for small businesses via PCI DSS are an absolute death knell for anyone trying to sell these services to small businesses or for small businesses themselves.

If the PCI DSS committee members had focused their energies more on the card processors, gateway providers, and the myriad other middle to top tier providers, developed new standards for secure data transmissions, network compliance, etc., I would venture that some 25% – 75% improvement on losses could be seen by the industry in the next 5 years. Then, they could focus on education services for the small business owners and offer free (yes free) network scans and advice on making a merchant’s data safer for their own peace-of-mind and for the entire industry.

Let us not forgot the forest for the trees. The small mom-and-pop merchant is not the one making money to accepting credit cards. Indeed the merchant gives away between 2% and 5% of every transaction to Visa/MC/AMEX, etc. on each transaction. Yet it is the merchant having to pay even more to assure that those profits keep flowing to the big providers and their middle-man partners.