Evan Schuman's StorefrontBacktalk

Retailing’s most powerful lobby—the National Retail Federation (NRF)—is launching a campaign to change the way that credit cards and retailers interact.

Conceding that the Payment Card Industry (PCI) procedures have simply not been effective at stopping massive retail breaches, NRF CIO David Hogan has been pushing for a radical change in tactics, one that will require Visa, MasterCard and AmericanExpress to change procedures.

“It is unlikely PCI will ever be able to keep pace with the continually-evolving sophistication of the professional hacker, or anticipate every possible variation of future attacks,” Hogan said in a letter to Bob Russo, the head of the PCI Security Council. “We believe the time has come to rethink the assumptions behind PCI.”

Specifically, Hogan is trying to have the rule yanked that forces retailers to keep credit card numbers on file while awaiting potential returns or chargebacks. “A primary reason that PCI exists and retailers have been forced to jump through those (PCI certification) hoops is because credit card company rules require merchants to store the credit card data that criminals are so eager to steal,” Hogan wrote. “The bottom line is that it makes more sense for credit card companies to protect their data from thieves by keeping it in a relatively few secure locations than to expect millions of merchants scattered across the nation to lock up their data for them.”

Hogan’s proposed solution is straight-forward: “Rather than requiring that merchants keep reams of data—currently required under card company rules in order to satisfy card company retrieval requests—credit card companies and their banks should provide merchants with the option of keeping nothing more than the authorization code provided at the time of sale and a truncated receipt. The authorization code would provide proof that a valid transaction had taken place and been approved by the credit card company, and the sales receipt would provide validation for returns or proof of purchase. Neither would contain the full account number, and would therefore be of no value to a potential thief. Any inquiries about a credit transaction would be between the cardholder and the card-issuing bank.”

Hogan said he has discussed his proposal directly with Visa. Their response? “Kind of non-committal,” Hogan said.

Some retailers have used the credit card numbers as unique customers identifiers, given that they had to hold the data anyway. “If you’re required to store information, you’re going to figure out ways to use it,” Hogan said.

A member of the PCI Security Vendor Alliance—a PCI group that is distinct from the Security Standards Council—applauded the NRF proposal, but seriously questioned how practical it was in the near term.

“I think the NRF recommendation that retailers should not store credit card data is a great one. However, it is untenable in the short-medium term. It will take at least five years, given the reality of what it takes to change applications, test them, integrate and roll out into a production retail environment while keeping current operations intact,” said Prat Moghe, founder of data auditing vendor Tizor and a member of the PCI Security Vendor Alliance. “You also need to factor in the nightmare of transitioning old legacy applications where credit card data is stored. For example, there are black box applications where retailers have no idea how to make app changes because no one supports these apps anymore.”

If someone could figure out a way around those obstacles, Moghe said, it would be a great thing. “If they can influence and get all the POS systems and backend systems to change to get rid of the data, that will be fantastic. But in reality, it will take more than 5 years and cost more than all the PCI programs put together,” he said. “In the short-medium term, there is no choice but to secure the credit card data they are collecting, which brings us back to PCI. PCI is an inevitability for the next 5 years in the best case. Beyond that, NRF succeeds in getting rid of credit card data, PCI should go away.”

Even under that scenario, Moghe said, much of the data security problem would remain because credit card numbers and the associated codes represent a very tiny fraction of the data retailers collect and store. “PCI is telling them that you need to think about where critical data is and know what is happening to it. This is not just about credit card numbers. It’s about Social Security numbers, marketing data, etc. Look at what happened to Monster—seemingly benign data opened the door to much more serious data issues and possible ID theft. This can happen.”

Moghe argued that retailers have control of such a huge amount of customer data that focusing just on credit card numbers can obscure the bigger picture.

“If you take PCI very literally, it’s about credit card data, but merchants need to look at all of their critical data. They have a lot of marketing data on customers. Let’s say that PCI is 10-20 percent of the data they need to worry about and the PCI standard is crisply defined. If you can’t make data security work in that context, how are you going to solve the rest of your data security problem?”