Should Chains Still Use Payment Card Data For CRM?
Written by Evan SchumanSeptember 16th, 2009
For decades, major retail chains have always used payment card data for various purposes beyond processing transactions, often as a practical customer identification means, typically for CRM and purchase history purposes. Although it has never been considered ideal, retailers did it as a matter of pragmatism, in the same way that universities and many businesses have historically used Social Security numbers to identify customers, even though they were never supposed to.
But in recent years, PCI advocates—especially the card brand executives—have discouraged the practice, arguing that the safest process is to use payment card numbers to process a payment and to then delete it as quickly as possible. Having those numbers lying around—especially spread into marketing and sales departments—was simply increasing the chance that someone unauthorized could access the data. But the guidance is vague and subject to economic considerations.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
One Comment | Read Should Chains Still Use Payment Card Data For CRM?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
September 17th, 2009 at 11:04 am
All the more reason for businesses to strongly consider format-preserving tokenization of confidential data at time of capture. The token representation of the value is no longer considered confidential data and maintains a one-to-one relationship with the original value. Business units are then free to perform any analysis they wish on the data without the having the need to protect it. Protection and controls can be focused on the resulting “vault” environment where the encrypted original values are stored, referenced by the token, of course.