PCI Talk is Cheap: Even Small Merchants Can Afford It
Written by David TaylorColumnist David Taylor is the Founder of the PCI Knowledge Base and former E-Commerce and Security analyst with Gartner.
I had the opportunity over the last several months to help launch a research study of PCI compliance among small (Level 4) businesses, and the findings from this study (a survey of 220 merchants) were just published this week. Frankly, It’s very difficult to get small businesses interested in PCI compliance at all (judging from low attendance at the webinars and events aimed at that market), and I wanted to use this research as a tool to understand why that is, and if anything can be done to raise awareness and motivate security improvements.
One of the first things about the study that surprised me was that two thirds of the respondents (65 percent) said that data security is a “high” priority and another 26 percent said it’s a “medium” priority. As a casual customer of many small businesses, I see business practices and POS technology that are shockingly unsecure. So the survey says that small businesses really do care about protecting customer data. Is it true? Maybe.
(Related Story: Survey: Level 4s Recognition Of PCI High, Understanding Of It Almost Nil)
One of the problems with multiple choice surveys is that it’s hard to present realistic tradeoffs to the respondents. You rarely see a question: “Which is more important? Spending $500 on a new network firewall or spending $500 to fix the delivery van?” But that’s the real issue. Data security may be a high priority in the abstract, but compared to “keeping the business running” types of concerns, it typically drops off the bottom of the list of things to spend money on. Why? Because small businesses do not believe they are going to have a data breach.
The small business survey also found 65 percent who said they have a low risk of a breach. Although some of them may be right in this view, most are not. Let me explain: There are small merchants and then there are “really small merchants.” Really small merchants are “mom and pops” running a single dry cleaning shop, using a dial up credit card terminal. Generally, mom and pop are pretty safe from a breach, because they are not running a server with a database of card data that’s connected to the Internet.
-Marc
August 13th, 2009 at 4:27 pm
I agree with you David. Opinion does not always translate into action when it comes to merchants taking the necessary steps to achieve compliance and secure credit card data. At the same time, I think that service providers in the payment processing industry are getting much better at developing solutions that lessen PCI Compliance scope and secure sensitive data for merchants – which will help move things along faster.
August 13th, 2009 at 5:31 pm
Hi, Bryan,
Good point. I really ought to write more about the use of service providers & outsourcing. It keeps coming up in our interviews with merchants. If you or anyone else reading this has suggestions for an “angle” for the piece, let me know. Remember, Evan always wants the topic to have a fresh approach. So, suggestions anyone?
thx, Dave T.
August 18th, 2009 at 8:19 pm
David you bring up some great points. Small businesses are targets for credit card hackers. In fact, a recent Visa review of fraud cases found that small businesses account for the vast majority of credit and debit card data breaches.
October 12th, 2009 at 12:55 pm
Rubbish,
The entire drive to PCI compliance is more driven by PCI committee members greed (many of which are involved in the network scanning and on-site consulting review business) than it has anything to do with any real steps toward reforming the overall card processing industry. Small businesses, like a martial arts school or a bicycle repair shop that just happen to process credit card transactions over an Internet connection are the least of the Industry’s problems. Hackers simply are not interested in spending a few days setting up to crack into a small merchant’s computer on the hopes of intercepting 50 – 100 credit card transactions a month. It just is NOT going to happen. They want the middle to large tier processors where they can be assured of a quantity of data to either resell or use directly.
What is happening is that small businesses, like the ones I mentioned above, are helping fund hundreds of new PCI compliance businesses with plenty of cash from unnecessary quarterly network scans. It simply results in wasted time from paperwork and trying to understand an industry that is not their core business. PCI DSS at this level, as currently implemented, does little to nothing to provide any more security to the card industry in general.
I am not bemoaning security standards or best-practices for keeping customer card data safe. I am just pointing out that it is the small businesses that are the absolute least contributors to the overall card industry losses that are paying the biggest price when tallied up. When I approach a new customer interested in accepting credit card payment and mention they will need to tag another $100 – $200 a year for quarterly network scans of their PC that they process credit cards on, in addition to any costs in time and software to GET compliant, they will likely tell me to go jump in a lake.
In the old days, the hard sell for a merchant account was always an argument of “will you waive the $50 set-up fee, we really can’t afford that as a small business.” Now I have to add these fees into the sales process. All these additional costs for small businesses via PCI DSS are an absolute death knell for anyone trying to sell these services to small businesses or for small businesses themselves.
If the PCI DSS committee members had focused their energies more on the card processors, gateway providers, and the myriad other middle to top tier providers, developed new standards for secure data transmissions, network compliance, etc., I would venture that some 25% – 75% improvement on losses could be seen by the industry in the next 5 years. Then, they could focus on education services for the small business owners and offer free (yes free) network scans and advice on making a merchant’s data safer for their own peace-of-mind and for the entire industry.
Let us not forgot the forest for the trees. The small mom-and-pop merchant is not the one making money to accepting credit cards. Indeed the merchant gives away between 2% and 5% of every transaction to Visa/MC/AMEX, etc. on each transaction. Yet it is the merchant having to pay even more to assure that those profits keep flowing to the big providers and their middle-man partners.