As the established large e-commerce sites pour millions of dollars into security and enterprise-league hardened point-of-sale systems, cyber-crooks have been giving more attention to much smaller and less well-protected merchants.
Those smaller merchants cant even necessarily protect themselves by opting to not have a Web site, as the thieves are grabbing credit card information as its transmitted over the Internet to POS servers.
“In general, the smaller retailers, whether theyre operating e-commerce sites or physical stores, dont have the resources to think about security,” said Gartner Group retail security analyst Avivah Litan.
Many of the POS programs used by smaller retailers “have vulnerabilities,” Litan said. “[Criminals] can log into these systems using programs like PCAnywhere, and, lo and behold, they can get the credit card and debit card data, and sometimes theres even magstripe data being stored. A small retailer doesnt have the time or the resources or the inclination to know about all this.”
A recent Washington Post story highlighted the issue, but its been common knowledge in the law enforcement world for years that smaller retailers are very attractive targets.
The goal of the thieves is typically not to use the data to create bogus credit cards as much as it is to collect a large number of numbers and authentication codes and to sell that collection of data to support fraudulent e-commerce purchases or to purchase stored-value cards and use those to make brick-and-mortar purchases.
Gartners Litan said some global cyber-crooks have gotten fairly sophisticated in selecting their victims. “I was told by a forensics analyst that there are some thieves in Vietnam who have figured out which point-of-sale cash registers are vulnerable,” she said. “They go to the manufacturers Web site, find out who the big customers are, and they may even find out small customers. They then go attack those terminals. They may not even know how vulnerable they are. For example, they may not have an e-commerce site, but they may use a terminal program that the vendor maintains through an Internet protocol.”
This trend has started to impact consumer e-commerce purchasing habits, as consumers tell surveys that they are much more comfortable buying from larger e-commerce because they feel safer doing so. The dream of every large retail marketing exec—who initially feared those startups undercutting their price—is being realized.
Not that the feds arent doing as good a job as could be expected against cyber-crime, with a recent major Secret Service probe a good example of the kinds of techniques todays law enforcement agent is using.
Much of the problem, though, resides with software vendors pushing POS options for smaller retailers. Greg Buzek, president of the IHL Consulting Group, estimates that there are some 2,000 POS vendors pushing products for the small-retail market, which is a dramatically larger number than that service the worlds largest retail chains POS needs.
In Buzeks opinion, the biggest cause of the security weakness for smaller retailers “is bad software.”
Another belief is that smaller retailers do not always rigidly abide by accepted security rules, such as the PCI rules forbidding the retention of key credit card information. Many retailers disobey that rule so that they can more easily handle product returns, where the customer will want the credit applied to the credit card that was used, he said.
But many smaller retailers also dont fully understand what their POS software can and cannot do, which is what the cyber-thieves are counting on.
Also at fault are security auditors and consultants who tell smaller sites—after an audit—that theyre safe when theyre not.
Buzek and Litan discussed the small retailer security situation with analysts from Forrester, the Lakewest Group and the Retail Systems Alert Group recently during a Web audiocast.
Retail Center Editor Evan Schuman can be reached at [email protected].
Check out eWEEK.coms for the latest news, views and analysis on technologys impact on retail.