Evan Schuman's StorefrontBacktalk

Certainly if a retailer was hit by this deep a breach, Visa (NYSE:V) and MasterCard would assume that every card number passing through the system had been compromised. Retailers are now starting to take that worst-case position too: When regional grocery chain Schnuck’s was hit with a three-month breachthat involved malware sniffing the connection to its card processor, the retailer said as many as 2.4 million card numbers were compromised. They might not all have been stolen, but they were all at risk.

It’s not clear what action the card brands might take against EnStage. However, another Indian processor who was breached in December by the same defendants, ElectraCard Systems, suggested in statements over the weekend that its PCI certification had been revoked after a $5 million theft. The EnStage breach resulted in a $40 million theft.

Although the thefts don’t directly affect any retailers, the fact that it’s difficult to get clear answers about the processors—or even their names, if we have to depend on prosecutors—makes it much harder to gauge the breaches’ impact. For example, EnStage offers merchant acquirer services for prepaid debit cards. However, it apparently does this as an outsourcer for merchant acquirers that want to offload the handling of those cards to a third party. As a result, there’s no easy way to tell how many

retailers’ processing might be in EnStage’s hands.

Two things areclear from this breach scenario. One is that card processing is increasingly outside the control of merchants. You think you know who’s doing the work, but that may not be the case if your processor has outsourced it to someone else. (Customers, of course, will still blame the retailer who handled the card if anything goes wrong. That’s the only face a customer sees.)

That being the case—since you literally don’t know who’s in the processing chain—getting set up for the EMV liability shift as soon as possible seems like a reallygood idea. Without that shift, when there’s a breach you’ll be presumed guilty until you prove yourself innocent (and just because a processor’s outsourcer had a breach doesn’t mean you won’t get a hard time from the card brands).

But with the shift, you’ll start out with the presumption that it’s somebody else’s fault. As the processing business becomes increasingly a black box, where merchants have no idea whose systems card data may be passing through, shifting financial liability to someone else in the payments chain looks increasingly attractive.