Sears Credit Card Problem Shines Light On Marketing Data Madness
Written by Evan SchumanThousands of Sears consumers this month started receiving letters inviting them to join in a class-action lawsuit against the retailer, all because of a charge that Sears shared consumer payment card data (name, address, telephone number and scrambled or unscrambled credit card number) with a marketing partner without authorization.
To be clear, the credit- and debit-card data sharing that Sears is accused of sharing happened between Sept. 9, 1995, and June 22, 2001, long before PCI even existed. But such a thing could never happen today, in our PCI-compliant environment, right? Think again, Breach Boy.
As Dave Taylor’s PCI column this week articulates wonderfully, renegade marketing programs using live payment card data are still alive and well.
In some cases, marketing units use older data and IT is never aware of it. Forever 21 ran into this problem last year, when a data breach grabbed about 100,000 credit and debit cards including transactions from 2003 through 2005, which were stored on a corporate data center, apparently in violation of PCI rules. The data had been used for a system trial and was then forgotten.
The practice of marketing using such data is common, but many of the problems can be traced to attitude and policy. Even though marketing often needs—or thinks it needs—payment card data, how often is marketing invited into PCI meetings? Do marketing officials try to bone up on PCI themselves?
Other things to consider: When marketing asks for payment data to analyze, are they given the data outright or are they offered alternatives? And if true payment data is provided, does IT monitor its use and make sure that it’s properly deleted at the end of the analysis? Does IT offer to run the analysis itself, as a service for marketing and also as a nice-sounding way to guarantee that the data is kept in a PCI compliant fashion?
One of the more pernicious problems with PCI assessments is that are indeed assessments (focused on asking questions) rather than audits (focused on independent examinations). There are certainly elements of both, but the flaw with the question approach is that, even if the IT executive responding is being fully honest, they only reveal that which they know. If some other department has “borrowed” data without the IT Director’s knowledge, no questionnaire would reveal that.
In the Sears case, the payment card data exchange was a convenience. It was to make it easier for the marketing partner to sell services, of which Sears got a cut. And the inclination—even today—to use payment card numbers as customer identification numbers is still rampant.
The only way to truly address this is to let IT be in command of all uses of payment card. That data can be shared with other departments—with the CIO’s or IT Director’s permission—but an IT person must be involved from beginning to end. Yes, like overworked and layoff-prone IT departments have the time for such things. It may be difficult, but it’s the only way to minimize payment card surprises—along with fines and lawsuits—later on. In case you’ve forgotten, IT will get blamed at that point, no matter who did what, so you might as well take charge now.
-Marc
May 28th, 2009 at 1:22 pm
Sears was caught doing this type of thing in the 90s, so why is this news? They had shared information with an insurance partner who, when we were out of town, charged us for an insurance policy we never talked to them about.
This is a corporate culture problem where at the core of the company there needs to be integrity. Sears has been without that for a long time.
This is more of an information security role that should be internal to the IT department. Many companies don’t see the value in that either.
May 28th, 2009 at 3:26 pm
Sears was operating under the guidelines that were in place in the 90s. As a service provider to Sears I know first hand that Sears errors on the side of safety when it comes to privacy and PCI compliance.
Is it a question of integrity? I don’t think so. At its core Sears is not malicious.
Do people make mistakes? Absolutely. As the article states, how often is marketing involved in PCI discussions and visa versa?
This is just another frivolous lawsuit. The holes have already been closed. There is nothing to be gained from this lawsuit.
May 29th, 2009 at 12:43 pm
Sears right hand continues to do what its left hand doesn’t know about. We had a problem just last week. Sears marketing sent us numerous e-mail sale notices. When we tried to make a purchase, we found credit department had canceled our card because we don’t use it “often enough.” Guess what? The sale e-mails keep coming. With this lack of coordination and self-created barriers to customer service does Sears management truly expect to stay in business?
September 15th, 2009 at 4:24 am
So if this kind of problem happened before then why nobody did anything to prevent it from happening again? those credit card data that Sear got and shared without permission could be stolen by anyone and would make an abundant source of information for identity thieves.
As a credit card holder, I never felt so vulnerable until now.
November 6th, 2009 at 4:13 am
Thousands of Sears consumers this month started receiving letters inviting them to join in a class-action lawsuit against the retailer, all because of a charge that Sears shared consumer payment card data (name, address, telephone number and scrambled or unscrambled credit card number) with a marketing partner without authorization.
To be clear, the credit- and debit-card data sharing that Sears is accused of sharing happened between Sept. 9, 1995, and June 22, 2001, long before PCI even existed. But such a thing could never happen today, in our PCI-compliant environment, right? Think again, Breach Boy.
April 1st, 2010 at 12:53 pm
Sears just sent me a $32.00 membership fee ON A CARD I CANCELLED 6-YEARS AGO!
They had also checked my credit score every month over the past year before doing so.
After many calls to them, they first cancelled the card and then issued me a new one (with a new number and same membership fee), claiming that because I said “it was a FRAUD”, that it was automatic. I again had to cancel the new card.
They calaim they had no idea “who” issued/opened my old-cancelled card.
I SMELL A RAT AT SEARS.