60 Minutes Report On TJX Raises New Charge
Written by Evan SchumanA fascinating report aired on the 60 Minutes site tonight. Not a tremendous amount of new ground was covered, but the comments from NRF CIO Dave Hogan—where he said that Visa and company are pressuring retailers to retain credit card data specifically so that they can bring in money—was a new angle.
“If you do the math on it, this could be a windfall of $200 million annually for the credit card companies as far as a revenue stream,” Hogan was shown saying on the video. Even at my most cynical, I’m not so sure I’d buy into that rationale. Clearly, the credit card companies don’t want to take on the burden and most larger retailers would truly like to avoid the hassle. But deliberately faciliating PCI violations so they can pocket the fine money? That’s pretty Machiavellian, even for Visa. (But 60 Minutes also linked to only one media source—StorefrontBacktalk—for further information about the TJX data breach, so they certainly got that part right.) ;-)
-Marc
November 27th, 2007 at 12:21 am
Evan,
I agree with you completely.
In my blog on this topic, I mention that I was “taken aback” by the statement from Dave Hogan. While I understand his organizations role in the ongoing battle between retailer and card association. . .it was very surprising to hear that he felt Visa, etc. were hoping solely to monetize data breach.
With that said, I’m glad that the story of security at the physical retail location is being to be widely reported. PA-DSS as an extension to PCI further underscores the importance this topic will continue to have in the future.
http://tylerhannan.blogspot.com/2007/11/60-minutes-heist-analysis.html
November 30th, 2007 at 3:41 pm
As an IT compliance auditor, and hearing the remarks made about VISA, and seeing the type of information that 60 Minutes had gathered, I have to agree with Mr. Hogan, that type of information would not be privy to a merchant, that information is kept at the bank. Also, my opinion on PCI is very low to begin with, although it is a start, I think that Congress should take PCI and make it an amendment to the GLBA, because it is true that VISA is making money if a merchant is non-compliant with PCI. As for PCI, the objectives and control objectives are so vague that it’s open to interpretation by only the VISA certified auditors that also must pay VISA to certify them to do PCI audits, yeap I’d say this is a huge money maker for VISA.
December 5th, 2007 at 9:50 pm
Utter poppycock ! The notion that VISA wants merchants to retain cardholder data is the most uninformed statement I have ever seen in payments circles. The damage to the reputation of the networks, merchants and casrd issuers is in the hundreds of millions. The few measly dollars taken in fines pales in comparison.. I can not disagree more – anyone who works closely with PCI or the card networks will take issue with this drivel !