This is page 2 of:
It May be Time to Switch Card Processors
April 1st, 2009
Many merchants continue to object to having anyone keep their card data other than themselves. Often, these are leading merchants that have made significant investments in data security and they simply do not believe that any other company has more motivation (or better technology) than they do to protect their data. For these companies, they should look to processors who can support end-to-end encryption, which some processors see as their next generation card data security offering.
In this case, the service includes both consistent encryption access control and management, as well as a key management service. It is key management, of course, that is the hard part of all this, and such services amount to having a central key repository, managed by the processor.
But even in such scenarios, data should still be centralized whenever possible, mainly because key rotation, which must be done annually to meet PCI standards, can still bring down enterprise applications for 48 hours while all the data is being re-encrypted with the new keys. Nonetheless, this type of system is an important option for those merchants who want to retain more control of their card data.
Last week, Storefront Backtalk published an article on pilot tests of new security technologies and procedures by banks, processors and Visa that go beyond the current PCI standards to secure card data. I expect to see lots of similar efforts designed to leverage merchant concerns about card data security and the desire to minimize the retention of card data. Processors talk about several “secret sauce” tactics that have yet to make it to the pilot stage, but which will find their way into the market during 2009. In each case, the technologies are an effort to re-introduce some of the technical competitive advantage that the PCI standards have taken away.
Switching card processors is much easier than some merchants think, but you shouldn’t switch just to get a lower transaction processing costs. Considering what is at stake, it is well worth time to discuss card data security technologies and procedures with your current and prospective card processors. PCI project managers and IT security managers should be part of any discussion related to switching card processors, which is often not the case today. For more information on this, visit the
PCI Knowledge Base and if you’d like to discuss trends in the industry or your own experiences, please send me an E-mail at David.Taylor@KnowPCI.com.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
