Why PCI Has Not Reduced Fraud
Written by David TaylorJune 17th, 2009
One of the most persuasive ROI arguments used to justify spending thousands (even millions) of dollars on PCI compliance was that implementing all those PCI-mandated security controls would help reduce fraud, as well as security breaches. Merchants have been encouraged to balance their spending costs against the savings due to having fewer breaches and less fraud. In the end, PCI compliance would translate into profits for the merchant due to fewer chargebacks, less internal fraud and a lower risk of security breaches.
It's a great theory. But as PCI Columnist David Taylor reports, things haven't quite worked out that way.
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
2 Comments | Read Why PCI Has Not Reduced Fraud
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Ed
June 17th, 2009 at 10:26 pm
I’m having a problem getting my head around the concept that PCI reduces fraud for the merchant in compliance. Maybe in a remotely peripheral sense if a few of the hacked cards resulting from non-compliance are used against the merchant from whom they are stolen.
I don’t see any other ROI for an individual merchant unless they are breached and were not in compliance. Then, the ROI in the form of avoided fines can be significant.
I’m not against PCI compliance and I’d agree that overall it can certainly reduce fraud collectively for the merchant community. But to say that it will reduce fraud for the merchant in compliance is a stretch.
Tom Mahoney, Director
Merchant911.org
June 18th, 2009 at 11:06 am
I think this position is hard to quantify with respect to an actual security ROI – PCI s/b viewed within the context of a larger defense in depth strategy (and especially collectively for the community at large). as such and with any batch of stats one can argue both ways – I for one see value in PCI – if and when it is applied correctly, i.e., when driven by a risk based approach.