On The Other Hand, PCI Sometimes Actually Can Reduce Fraud

Written by David Taylor
July 8th, 2009

GuestView Columnist David Taylor is the Founder of the PCI Knowledge Base and former E-Commerce and Security analyst with Gartner.

Quite a lot has been written recently about the difficulty of quantifying ROI from PCI programs. In fairness, while those concerns are quite legitimate, it doesn’t mean that PCI compliance does not (or cannot) help reduce fraud.

It just means that the nature of the standard, current metrics, software tools, reporting and established business procedures haven’t been adapted to incorporate the types of controls and reporting that PCI enables. In short, merchants have focused most of their effort (and spending) on getting compliant, but hardly any effort has been focused on the “business by-products” of compliance, such as fraud reduction. Some examples:

  • Eliminating Track Data Storage
    Of all the PCI DSS requirements, 3.2, which prohibits the storage of track data, is perhaps the most important in stopping external credit card fraud. Because track data can be used to recreate credit cards, the elimination of this data is critical to reducing the ease with which organized crime (i.e., “fraudsters”) can commit credit card fraud.

  • Reducing Card Number Displays
    Requirement 3 is also critical for reducing both internal and external card fraud because it (along with the US Fair Credit Reporting Act, aka FACTA) is responsible for card numbers no longer appearing on printed receipts. These receipts come from credit card terminals, publicly visible terminal displays, call center applications and thousands of other places where individuals could casually or intentionally copy these individual numbers and use them later to commit card fraud (e.g., in a card-not-present transaction).

  • Reducing Web Application Vulnerabilities
    One of the few PCI DSS requirements that is specifically directed at reducing external fraud is 6.6, which is designed to eliminate certain well-known security vulnerabilities, specifically those identified by OWASP. Considering that these vulnerabilities can be used to extract massive quantities of data from poorly designed web applications, this requirement is especially important as a tool to prevent external fraud.

  • Limiting Card Access and Tracking Access to Individuals
    The principle of least privilege, which is built into the 7.1 access control requirements of PCI DSS, have significantly reduced the number of persons who have access to card data. In addition, by eliminating shared passwords per requirement 8.1, the standard significantly reduces the chances that a employee or contractor can steal data undetected by using generic ID’s, such as “night_cashier” or “tech_support.”

  • Separation of Duties
    The PCI DSS requirements regarding data management, key management, software development and other areas mandate a separation of duties, so that no single privileged employee can steal large volumes of card data without the knowledge or approval of another person. This makes internally generated fraud much more difficult. Collusion among multiple employees is extremely rare, compared with situations where a single disgruntled employee can exploit his/her access to commit fraud or steal large volumes of credit card data.

  • Reducing Dumpster Diving and Social Engineering
    The physical security controls in requirement 9 may actually be more important in reducing external fraud than most people seem to give them credit for. As awareness of PCI and data security in general has grown, social engineering of customer service representatives, administrative assistants, or retail store employees to give up information has become much more difficult.

    In addition, PCI requirements have resulted in far fewer of these employees having access to the data in the first place, further reducing the chances of fraud.

  • The Bottom Line
    I didn’t mean for this list to be exhaustive. In fact, I’m hoping that our readers will think of other examples of how PCI compliance helps reduce fraud and email them to me, or add them to this column via the comment feature. If you want to discuss this topic, please visit the PCI Knowledge Base if you want to view our research. If you want to have a personal discussion about PCI and its value in reducing fraud, just send me an E-mail at

  • advertisement

    Comments are closed.


    StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

    Most Recent Comments

    Why Did Gonzales Hackers Like European Cards So Much Better?

    I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
    Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
    A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
    The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
    @David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

    Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.