The PayPal Problem: Will It Impact Retailers’ PCI Scope?
Written by Walter ConwayJanuary 23rd, 2012
Given that PCI only applies to payment transactions for the five major card brands, PayPal transactions would not normally be in scope. But recent pilot programs by at least one major retailer and an announcement by a POS device vendor has PCI Columnist Walter Conway questioning the conclusion that PayPal transactions will remain out of PCI scope.
If a PayPal card triggers a transaction on an underlying Visa or MasterCard, might that PayPal account be considered a "high-value token" and, therefore, be in scope for PCI? And if the PayPal account is in scope, is it a big deal?
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
7 Comments | Read The PayPal Problem: Will It Impact Retailers’ PCI Scope?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
January 24th, 2012 at 5:42 am
Walt, I think your closing paras are the most relevant – for the foreseeable future, retailers are not going to be transacting exclusively against PayPal accounts. Therefore, with the assumption that the payments are stored, transmitted and processed through the same systems as “regular” CHD, there will be no change in scope.
Merchants will have to protect the PayPal payment information with the same rigour as PANs/CV2s/tokens, but this isn’t arduous because they are doing it right now. (Or should be.)
Emma.
January 24th, 2012 at 2:29 pm
This is the problem with the notion of the high value token wording in September’s guidelines. As you rightly point out an email address, mobile no. or even a name can be considered a high value token. Yet by their very nature these are all readily available in the public domain, so I find it hard for them to be considered as a high value token.
Which leaves the PIN. It’s fair to consider this a high value token and therefore PayPal would be in scope. So methods like end to end encryption, tokenisation will be inevitable everywhere if Merchants want to minimise the impact of PCI compliance as solutions like PayPal are unlikely to.
January 24th, 2012 at 7:50 pm
Being an extremely vocal critic of the “clunky” PayPal I will simply observe that, with respect to online transactions, PayPal effectively does no more than Visa is offering to do with its announced new online gateway, V.me. The real question is which of these two (or any others) would you happily trust to hold your personal banking and credit card details (including PIN), bearing in mind that Visa/MasterCard already have access to these details for their POS operations? Which then begs the question that I have not yet heard answered. Will Visa be including in their V.me system the additional ability for online payers to source funds via a “debit” transaction from their banking account, rather than only by a credit card transaction as has been the case in the past because of the PIN requirement for such a “debit” transaction? After all, what’s the difference between a PIN, that Visa/MasterCard already hold, and a password required to access a secure online payments gateway?
January 25th, 2012 at 2:36 pm
The PayPal user information is much more “high value” because it can be used across merchants to initiate transactions. If I have it or gain access to it via a merchant compromise, there is nothing to stop me from using it at another merchant.
A properly designed tokenization system should have rules that prohibit tokens obtained from one merchant to be used at another merchant and/or prohibit initiating transactions unless the PAN and authentication data has been previously received by that merchant.
Implemented properly, tokens retain their “high value” to the merchant but not to a fraudulent actor.
January 25th, 2012 at 9:52 pm
Thanks to all for the great comments!
Emma, we both agree that merchants should protect PayPal data with the same rigor that they protect cardholder data for PCI. Let’s hope everyone does. Especially given the later comments.
Steve and Rob, your insights into the parallels with tokenization should have every merchant thinking. In particular, Rob’s points out that a PayPal “token” can be used at multiple merchants where a “regular” token could be used only at one merchant. That aspect/risk had escaped me. Thanks for the insight, and for reinforcing that whether or not PayPal is officially in PCI scope, merchants should be advised to protect the PayPal account, PIN, and other data as though they were subject to PCI.
And that advice goes for whether your QSA tells you to do it or not.
February 1st, 2012 at 6:50 pm
@pcohen, I am not sure I have understood statement regarding PINs correctly, but in general, Visa and MasterCard do not “have your pin”, the issuing entity(Bank) does. Also a big difference with PINs(at least in the debit world) is that they should only be entered into an encrypting PIN Pad. The feeling goes that if I steal a card with a valid PIN I can go to an unattended device(ATM) and pull out money w/o having to present a legitimate card to a person. I suppose you could make the same case(which you did) regarding an online transaction w/ a password.
February 15th, 2012 at 7:25 pm
PayPal’s plan of POS attack is to entice merchants with below-cost credit and debit card processing, which is an offer no retailer will refuse. The company will subsidize its losses from the card transactions with the very high-margin profits it enjoys when its users fund the sales amount from their bank accounts.
On the other hand, whether the consumers will be won over is another question altogether. If it is to stand a chance, PayPal will need to make the checkout process as uneventful as possible. As it is, the customer is asked to enter his or her cell phone number, in addition to a PIN, before the transaction can be completed. That’s unnecessary and excessive. I would never give my cell phone number to a merchant (or PayPal) to protect myself against spam, whatever assurances to the contrary they may give me. And I’m far from alone.
Still, given the amazing deal that retailers get out of it, I like PayPal’s chances.