Is PCI Skimping On Skimming?

Written by Walter Conway
November 29th, 2011

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

PCI does not address skimming at your point-of-sale (POS) devices, especially those self-service areas that are not under constant control of a clerk or manager. I think it should and now may be the perfect time to make a change in your POS practices and PCI itself. Although this may be the season of sharing, that should not include sharing your POS devices with the bad guys.

The PCI Council recognizes the risk from card skimming. They have held information sessions highlighting the threat at the Community Meetings and they published in 2009 a document informing retailers of the risks of skimming. However, as of today, there is nothing in the PCI DSS directly addressing how retailers should protect their POS devices from being compromised by a bad guy installing a skimmer.

Self-service checkout areas in particular are not under constant observation and because of that they are that much more vulnerable to compromise. A retailer near me recently learned this lesson painfully. They discovered somebody had installed card skimmers at 20 of their stores and then they got to tell their customers (Note: I’m checking to see if this includes me) to monitor their credit and debit card accounts for unauthorized activity.

The timing for updating or clarifying PCI now is excellent. Each version of PCI DSS has a three-year lifecycle and we are now into the second year of PCI version 2.0. That means that as of November 1 we are in the formal period when Participating Organizations worldwide provide feedback on improving payment security and the PCI DSS itself.

I have written previously about changes I would like to see that would correct shortcomings in each of the Self-Assessment Questionnaires. This lack of clarity on POS devices is different, though, and it seems to justify an update to the standard itself. We need only a couple of changes to reduce the risk of POS skimming. Requiring daily inspection of devices by store managers or staff would go a long way to minimizing the threat. Such visual inspections do not seem onerous and, because PCI already requires daily log reviews, there is a precedent.


4 Comments | Read Is PCI Skimping On Skimming?

  1. Jonathan Rosenne Says:

    Please consider EMV. This is exactly what it was designed for.

  2. Walt Conway Says:

    Thanks for the comment, Jonathan. Unfortunately, EMV is not going to be a solution for several years at the soonest. And since ATMs still use the mag stripe almost everywhere, EMV does nothing for banks’ risks. (I focused on retailers’ risks, but banks face the same or larger risks at their ATMs!)

    What merchants (and banks) need to do is address the problem now based on the technology that is in use. That means at least visual inspection of POS devices and automated monitoring of them when they are moved, disconnected, or turned on/off. And then, once EMV (or at least some form of chip) is implemented across the planet, all we need to do is make sure the chips never, ever fail so retailers don’t need to read the mag stripe. Unfortunately, that is not likely to happen soon, either.

    I’m putting my money on changes to smart retailers’ security practices coupled with enforcement from a change to PCI to encourage everybody else.

  3. ed Says:


    EMV payment processing machines were implemented throughout the USA and in ATMs but have not been enabled at this time. For example, all of Wal-Mart payment devices are EMV-equipped to handle chip and pin.

  4. Walt Conway Says:

    Good comment, Ed, but terminals are not the issue. The cards are the issue.

    That is until retailers no longer use or need the mag stripe, skimming is going to happen. And it is going to happen to the least prepared, least vigilant, and least aware retailers. This is less a technology issue (although monitoring your devices is a great idea) but a result of living with a 50-year old technology (i.e., mag stripe), and until that is changed all the EMV-equipped terminals in the world won’t help too much.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.