Evan Schuman's StorefrontBacktalk

MasterCard’s guidance leaves merchants on their own to ensure they implement a secure solution. It seems a bit unfair to ask a plumber, farmstand vendor, food truck operator or taxi driver to assess the security of a complicated mobile payment application. All they want to do is sell stuff. And I have no idea how they are to “consult their MPOS solution provider,” especially if they bought the dongle online or from their local office supply store or megamart.

As far as I can tell, the only path to a PCI-compliant MPOS solution is the PCI Council’s P2PE approach where the smartphone or tablet never sees or stores clear-text cardholder data. The Council described it in its MPOS guidance issued earlier this month, before MasterCard’s guidance came out. The Council cites the “new risks to the security of cardholder data” and directs merchants to a P2PE solution as the best (only?) way to achieve a PCI-compliant MPOS solution.

The difficulty is that both retailers and MasterCard recognize there won’t be any P2PE approved solutions for months, and the mobile space is moving rapidly today. Retailers do not want to wait. Not willing to be left out of a growing market (see page 10 for instructions on displaying the brand’s acceptance mark on the device’s screen), MasterCard has recognized the inevitable and offered a reasonable (risk adjusted?) set of best practices to guide solution providers and merchants alike. As a QSA, though, I would have been happier if there were less “should” and more “must” in MasterCard’s recommendations.

Naturally, there are a few questions.

• Will the recommendations (the “shoulds”) ever become requirements (“musts”)?
• Will MasterCard’s best practices change to reflect or even require P2PE MPOS solutions when they become widely available, possibly in just a few months?
• Will the other card brands adopt the payment facilitator and sub-merchant model?
• How happy will acquirers and processors be that payment facilitators have this sub-merchant market segment to themselves, without requiring PCI compliance?
• What happens to the payment facilitator when its first sub-merchant is breached?
• Should payment facilitators be subject to additional PCI-compliance requirements, as service providers are today?
• Once a sub-merchant hits the $100,000 transaction threshold, will an acquirer let it continue to use its non-validated mobile payment application?

None of us knows the answers, but I’d like to hear what you think. Will this set of best practices change your mobile POS plans? I’d like to hear your thoughts. Either leave a comment or E-mail me.