NEW YORK — Credit cards: What would today’s retailer do without them? If you’re like most merchants, you’ve found that the ubiquitous plastic card has become the default transaction tool for purchases large and small.
There’s hidden danger, though, in being too cavalier about just how your staff handles card transactions. The recent data breach at Target—affecting some 70 million to 110 million people—drives home the need for every retailer to be vigilant in protecting customer data.
You can be hit with costly fines and penalties if you ignore increasingly tight regulations governing the protection of credit card data—especially if your violation leads to an actual release of customer information into criminal hands.
“Merchants who store, process or transmit credit card data need to understand they have a responsibility to protect that data,” says Mark Burnette, a partner with LBMC Security & Risk Services, a Nashville-based consulting firm.
COSTLY FINES
So who makes the rules when it comes to protecting customer data? The big boss here is the Payment Card Industry (PCI) Security Standards Council, Wakefield, Mass. This assemblage of credit card associations has been steadily tightening the reins on runaway data by releasing regulations in the form of official standards. The latest iteration, dubbed PCI Data Security Standard (PCI DSS), further strengthens the procedures that must be instituted by merchants by the end of 2014.
Fail to follow the PCI compliance rules and you may well be targeted for damages by your “acquirer”—the bank which provided you with your merchant account. Read your contract closely and you’ll find that the bank has the power of the purse: “If the acquirer finds that you have been consistently noncompliant, fines can be assessed,” says Burnette. “And an actual breach of data can lead to even higher penalties.”
The extent of monetary damages depends on the size of the merchant, the size of the breach and the number of cards involved. Penalties have ranged from $10,000 into the six figures and more.
Not to be underestimated, either, is the costly hit a publicized breach can have on a merchant’s reputation. Many consumers will be reluctant to shop at an establishment where a breach has occurred.
But perhaps the greatest motivation for towing the line is the threat of losing the merchant account itself. “The card association may take away your ability to accept credit cards at all,” says Burnette. “That can be extremely costly to any merchant.”
PROTECT YOURSELF
While failure to follow mandated data-protection guidelines is foolish, the good news in all this is that you can take positive steps to minimize risk.
Start by drawing up a statement of standard operating procedures (SOP) for everyone in your organization. “Make sure you have a clear written policy about how to handle credit cards,” says Burnette. “And make sure your employees have been educated on the policy. Bring up the topic regularly in your staff meetings.”
Your SOP must address the critical need of keeping sensitive customer numbers under wraps. “Where the merchant is most vulnerable is in the accidental mishandling of card information,” says Burnette. “Suppose, for example, an employee takes an order over the phone, jots down the card number on a piece of paper, and then later drops the paper into the trash instead of a shredder. That violates the PCI and is bad business practice.”
Another good rule is to keep the credit card in the hands of the customer as long as possible. “Employees should quickly process the card and return it,” says Burnette. “This will keep the card from being accidentally grabbed (or from having its number written down) by someone else.”
The right hardware can be as important as the right procedures. Have you been using the same POS equipment for many years? It may be time to replace it. “Some retailers still have legacy equipment that they don’t even realize is capturing cardholder information that can be compromised,” says Paul Rianda, an attorney in Irvine, Calif. “In contrast, if merchants use newer equipment, and use it correctly, there should be no way to lose cardholder information.”
Computer systems face special challenges: “You need to establish rules about passwords and about access to the computer system,” says Burnette. “Each employee should have a unique security code which they are forbidden to share with other employees or even with managers. The passwords should allow access only to those sections of the database required to do an individual’s job.”
You should use only hardware and software that has been approved by the PCI Security Standards Council (approved vendor lists are available at www.pcisecuritystandards.org). Make sure you are using a firewall, and that your wireless router is password-protected and uses encryption. And change the default hardware passwords to complex ones.
Check back Wednesday for the conclusion!
Have a question or comment? E-mail our editor Dave Davis at [email protected].