Visa Revokes PCI Approval From Ingenico PIN Pads Following Breach
Written by Evan SchumanJuly 1st, 2010
In a move that seems to reflect a very different PCI approach coming from Visa, the world's largest card brand has ripped the PCI approval from two Ingenico PIN entry devices after a data breach.
What makes this move especially interesting is how it undercuts two strongly held Visa positions, both in terms of publishing the names of vendors whose products are engaged in PCI naughtiness and in its position that no PCI-compliant retailer has ever been breached.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
6 Comments | Read Visa Revokes PCI Approval From Ingenico PIN Pads Following Breach
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
July 1st, 2010 at 4:12 pm
VISA’s latest memo may finally have got it right, but all the previous memos from them and M/C starting in March (when this first came out more publicly) were quite vague and confusing. Yeah, they might have gotten this particular memo right, but you should see what came before it…
Yanking of the certification hasn’t taken into account the lack of availability of alternate compliant solutions. For example, in Canada there are over 200K Ingenico pinpads impacted by this decertification — and this decertification is occurring while many companies were working on having these previously certified pads injected to meet the VISA requirements to move to chip & pin by end of this year. So now everyone is scrambling to find replacements in time to meet chip & pin deadlines, and to meet the PCI requirements — yet the available stock of now compliant devices is probably less than 2% of the demand. Most of the new stock is only arriving from China in small shipments, and of those shipments were already ear-marked for customers before the Match announcements… many firms are now caught in PCI compliance limbo through no fault of their own.
July 1st, 2010 at 9:25 pm
When will the BS train surrounding PCI pull into the station?
July 5th, 2010 at 11:30 am
“…everyone is scrambling to find replacements in time to meet chip & pin deadlines…”
So by “scrambling”, you mean the 2-3 years that all merchants in Canada have known about chip and PIN requirements for the fall 2010 deadline?
July 5th, 2010 at 12:53 pm
@tim elliot
In a simplistic world, yeah, it probably could have all been done in about 30 seconds. However, in the real world, companies do not change major environments over night. Many firms were implementing over a longer term because of either budgets, alignment with other plans to expand or change POS environments, or the extent of the efforts required to inject, test, and deploy new pinpads over a geographical territory that spans 5 times zones and has many remote locations.
And the re-injected pads that have now been decertified all now have to be replaced — but there are not sufficient stocks available to do so…
Besides the move to chip & pin isn’t about (only/mainly) security — it is also about forcing acceptance of the card brand debit cards, card brand loyalty programs, and use of the card brands networks with a higher fee structure rather than INTERAC… go do some reading of the fine print and you’ll comprehend what some of the real drivers are…
July 7th, 2010 at 3:43 pm
I’m still amazed that retailers are left footing the bill to secure Visa and M/C’s insecure(able) product!
As a software developer, I have to ensure this so-called “protected” data is never stored, and teach my customers how to securely use their computers…
Meanwhile, the data we’re protecting is in plain sight, embossed on the card. Not to mention, easily copied by a cheap, concealable device. If and when Chip & Pin is mandated (hopefully not, as it’s already been hacked), why do the retailers pay for them? Visa and M/C should be required to reimburse retailers who spend money to shore up the security of their product.
The very idea that a company could be sued by Visa and/or MC because of a data breach is absurd. It’s THEIR design flaw – period.
July 7th, 2010 at 5:14 pm
Is there a re-certification date for PEDs as there is for Payment Applications? I’m wondering what happens when the retailer has to purchase 10,000 new POS devices because one of the devices compliance was revoked?