Credit cards: What would today's businesses do without them? If you're like many companies, you've found that the ubiquitous plastic card has become the default transaction tool for purchases large and small.
There's hidden danger, though, in being too cavalier about just how your staff handles card transactions. The recent data breach at Target-affecting some 70 million to 110 million people-drives home the need for every retailer to be vigilant in protecting customer data. There's danger in being too cavalier about how you and your staff handle card transactions. You can be hit with costly fines and penalties if you ignore increasingly tight regulations governing the protection of customer data-especially if your violation leads to an actual release of customer information into criminal hands.
"Merchants who store, process or transmit credit card data need to understand they have a responsibility to protect that data," says Mark Burnette, a partner with LBMC Security & Risk Services, a Nashville-based consulting firm.
Costly Fines
So who makes the rules when it comes to protecting customer data? The big boss here is the Payment Card Industry (PCI) Security Standards Council in Wakefield, Mass. This assemblage of credit card associations has been steadily tightening the reins on runaway data by releasing regulations in the form of official standards. The latest iteration, dubbed PCI Data Security Standard (PCI DSS), further strengthens the procedures that must be instituted by companies by the end of 2014. (For details, see the adjacent sidebar "Get More Help.")
Fail to follow the PCI compliance rules and you may be targeted for damages by your "acquirer"-the bank that provided you with your merchant account. Read your contract closely and you'll find that the bank has the power of the purse: "If the acquirer finds that you have been consistently noncompliant, fines can be assessed," Burnette says. "And an actual breach of data can lead to even higher penalties."
The extent of monetary damages depends on the size of the company, the size of the breach and the number of cards involved. Penalties have ranged from $10,000 into six figures and more.
Not to be underestimated, either, is the hit a publicized breach can have on a company's reputation. Many customers will be reluctant to shop at an establishment where a breach has occurred.
But perhaps the greatest motivation for toeing the line is the threat of losing the account itself. "The card association may take away your ability to accept credit cards at all," Burnette says. "That can be extremely costly to any merchant."
Protect Yourself
While failure to follow mandated data protection guidelines is foolish, the good news is that you can take steps to minimize risk.
Start by drawing up a statement of standard operating procedures (SOP) for everyone in your organization. "Make sure you have a clear written policy about how to handle credit cards," Burnette says. "And make sure your employees have been educated on the policy. Bring up the topic regularly in your staff meetings."
Your SOP must address the critical need of keeping sensitive customer numbers under wraps. "Where the merchant is most vulnerable is in the accidental mishandling of card information," Burnette says. "Suppose, for example, an employee takes an order over the phone, jots down the card number on a piece of paper, and then later drops the paper into the trash instead of a shredder. That violates the PCI and is bad business practice."
Another good rule is to keep the credit card in the hands of the customer as long as possible. "Employees should quickly process the card and return it," Burnette says. "This will keep the card from being accidentally grabbed (or from having its number written down) by someone else."
The right hardware can be as important as the right procedures. Have you been using the same POS equipment for many years? It may be time to replace it. "Some retailers still have legacy equipment that they don't even realize is capturing cardholder information that can be compromised," says Paul Rianda, an attorney in Irvine, Calif. "In contrast, if merchants use newer equipment, and use it correctly, there should be no way to lose cardholder information."
Computer systems face special challenges: "You need to establish rules about passwords and about access to the computer system," Burnette says. "Each employee should have a unique security code they are forbidden to share with other employees or even with managers. The passwords should allow access only to those sections of the database required to do an individual's job."
You should use only hardware and software that has been approved by the PCI Security Standards Council (approved vendor lists are available at pcisecuritystandards.org). Make sure you are using a firewall, and that your wireless router is password-protected and uses encryption. And change the default hardware passwords to complex ones.
The Third-Party Option
As the world of electronic commerce has become more complicated, regulations become more demanding. "There are over 255 individual requirements for PCI compliance," Burnette says. "All of them have to be met. There is no wiggle room." Little wonder that business owners are sidestepping the requisite procedures by farming everything out to Independent Sales Organizations (ISOs), which are in the business of pairing merchants with vendors of credit card transaction processing equipment. "Offloading responsibility to a third party is a good solution," says Don Hartley, a consultant with Savannah, Georgia-based Tata Consultancy Services.
Don't get trapped, though, by a false sense of security. You can outsource the operational duties for carrying out PCI compliance, but you cannot outsource your responsibility for protecting customer information. If something goes wrong, you will be assumed guilty.
To protect yourself from fines and penalties, make sure your contract specifies the third party's responsibilities for setting up and maintaining computer systems that comply with PCI standards. You should also ask the third party to provide an annual "PCI report on Compliance" signed off by a qualified security assessor (QSA). This should be done once a year. Both these steps will help protect you if the third party violates regulations.
A Need-to-Know Basis
Many of the protective steps suggested in this article derive from a broader maxim near and dear to the hearts of security people everywhere: Retain only the information you need. "Follow the rule that says, 'If you do not need customer information, you should not keep it,'" Burnette says.
Education is the first step to safety. Many smaller businesses are not aware of the duty to protect customer data, nor of the continually morphing rules. Ignorance of the law, as always, is no excuse. Taking the basic steps in this article will reduce your risk considerably.
Get More Help
