PCI Talk is Cheap: Even Small Merchants Can Afford It

Written by David Taylor
August 13th, 2009

Columnist David Taylor is the Founder of the PCI Knowledge Base and former E-Commerce and Security analyst with Gartner.

I had the opportunity over the last several months to help launch a research study of PCI compliance among small (Level 4) businesses, and the findings from this study (a survey of 220 merchants) were just published this week. Frankly, It’s very difficult to get small businesses interested in PCI compliance at all (judging from low attendance at the webinars and events aimed at that market), and I wanted to use this research as a tool to understand why that is, and if anything can be done to raise awareness and motivate security improvements.

  • Small Business Says Security Is A Priority – But Is It Really?
    One of the first things about the study that surprised me was that two thirds of the respondents (65 percent) said that data security is a “high” priority and another 26 percent said it’s a “medium” priority. As a casual customer of many small businesses, I see business practices and POS technology that are shockingly unsecure. So the survey says that small businesses really do care about protecting customer data. Is it true? Maybe.

    (Related Story: Survey: Level 4s Recognition Of PCI High, Understanding Of It Almost Nil)

    One of the problems with multiple choice surveys is that it’s hard to present realistic tradeoffs to the respondents. You rarely see a question: “Which is more important? Spending $500 on a new network firewall or spending $500 to fix the delivery van?” But that’s the real issue. Data security may be a high priority in the abstract, but compared to “keeping the business running” types of concerns, it typically drops off the bottom of the list of things to spend money on. Why? Because small businesses do not believe they are going to have a data breach.

  • Small Businesses Feel Invisible to Hackers – But They Are Not
    The small business survey also found 65 percent who said they have a low risk of a breach. Although some of them may be right in this view, most are not. Let me explain: There are small merchants and then there are “really small merchants.” Really small merchants are “mom and pops” running a single dry cleaning shop, using a dial up credit card terminal. Generally, mom and pop are pretty safe from a breach, because they are not running a server with a database of card data that’s connected to the Internet.

  • advertisement

    4 Comments | Read PCI Talk is Cheap: Even Small Merchants Can Afford It

    1. Bryan Johnson Says:

      I agree with you David. Opinion does not always translate into action when it comes to merchants taking the necessary steps to achieve compliance and secure credit card data. At the same time, I think that service providers in the payment processing industry are getting much better at developing solutions that lessen PCI Compliance scope and secure sensitive data for merchants – which will help move things along faster.

    2. Dave Taylor Says:

      Hi, Bryan,
      Good point. I really ought to write more about the use of service providers & outsourcing. It keeps coming up in our interviews with merchants. If you or anyone else reading this has suggestions for an “angle” for the piece, let me know. Remember, Evan always wants the topic to have a fresh approach. So, suggestions anyone?
      thx, Dave T.

    3. Zsavonne Says:

      David you bring up some great points. Small businesses are targets for credit card hackers. In fact, a recent Visa review of fraud cases found that small businesses account for the vast majority of credit and debit card data breaches.

    4. FedupwithPCI Says:

      The entire drive to PCI compliance is more driven by PCI committee members greed (many of which are involved in the network scanning and on-site consulting review business) than it has anything to do with any real steps toward reforming the overall card processing industry. Small businesses, like a martial arts school or a bicycle repair shop that just happen to process credit card transactions over an Internet connection are the least of the Industry’s problems. Hackers simply are not interested in spending a few days setting up to crack into a small merchant’s computer on the hopes of intercepting 50 – 100 credit card transactions a month. It just is NOT going to happen. They want the middle to large tier processors where they can be assured of a quantity of data to either resell or use directly.

      What is happening is that small businesses, like the ones I mentioned above, are helping fund hundreds of new PCI compliance businesses with plenty of cash from unnecessary quarterly network scans. It simply results in wasted time from paperwork and trying to understand an industry that is not their core business. PCI DSS at this level, as currently implemented, does little to nothing to provide any more security to the card industry in general.

      I am not bemoaning security standards or best-practices for keeping customer card data safe. I am just pointing out that it is the small businesses that are the absolute least contributors to the overall card industry losses that are paying the biggest price when tallied up. When I approach a new customer interested in accepting credit card payment and mention they will need to tag another $100 – $200 a year for quarterly network scans of their PC that they process credit cards on, in addition to any costs in time and software to GET compliant, they will likely tell me to go jump in a lake.

      In the old days, the hard sell for a merchant account was always an argument of “will you waive the $50 set-up fee, we really can’t afford that as a small business.” Now I have to add these fees into the sales process. All these additional costs for small businesses via PCI DSS are an absolute death knell for anyone trying to sell these services to small businesses or for small businesses themselves.

      If the PCI DSS committee members had focused their energies more on the card processors, gateway providers, and the myriad other middle to top tier providers, developed new standards for secure data transmissions, network compliance, etc., I would venture that some 25% – 75% improvement on losses could be seen by the industry in the next 5 years. Then, they could focus on education services for the small business owners and offer free (yes free) network scans and advice on making a merchant’s data safer for their own peace-of-mind and for the entire industry.

      Let us not forgot the forest for the trees. The small mom-and-pop merchant is not the one making money to accepting credit cards. Indeed the merchant gives away between 2% and 5% of every transaction to Visa/MC/AMEX, etc. on each transaction. Yet it is the merchant having to pay even more to assure that those profits keep flowing to the big providers and their middle-man partners.


    StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

    Most Recent Comments

    Why Did Gonzales Hackers Like European Cards So Much Better?

    I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
    Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
    A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
    The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
    @David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

    Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.