Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Applications
    • Applications
    • Cybersecurity
    • PC Hardware

    Retail Group Lobbies to Stop Credit Card Data from Being Stored

    By
    Evan Schuman
    -
    October 4, 2007
    Share
    Facebook
    Twitter
    Linkedin

      Retailings most powerful lobby is launching a campaign to change the way that credit cards and retailers interact.

      Conceding that the PCI (Payment Card Industry) procedures have not been effective at stopping massive retail breaches, David Hogan, CIO of the National Retail Federation, is pushing for a radical change in tactics, one that will require Visa, MasterCard and American Express to change procedures.

      “It is unlikely PCI will ever be able to keep pace with the continually evolving sophistication of the professional hacker, or anticipate every possible variation of future attacks,” Hogan said in a letter to Bob Russo, head of the PCI Security Council. “We believe the time has come to rethink the assumptions behind PCI.”

      Specifically, Hogan is trying to have the rule yanked that forces retailers to keep credit card numbers on file while awaiting potential returns or chargebacks. “A primary reason that PCI exists and retailers have been forced to jump through those [PCI certification] hoops is because credit card company rules require merchants to store the credit card data that criminals are so eager to steal,” Hogan wrote. “The bottom line is that it makes more sense for credit card companies to protect their data from thieves by keeping it in a relatively few secure locations than to expect millions of merchants scattered across the nation to lock up their data for them.”

      His proposed solution is straightforward: “Rather than requiring that merchants keep reams of data—currently required under card company rules in order to satisfy card company retrieval requests—credit card companies and their banks should provide merchants with the option of keeping nothing more than the authorization code provided at the time of sale and a truncated receipt. The authorization code would provide proof that a valid transaction had taken place and been approved by the credit card company, and the sales receipt would provide validation for returns or proof of purchase. Neither would contain the full account number, and would therefore be of no value to a potential thief. Any inquiries about a credit transaction would be between the cardholder and the card-issuing bank.”

      Hogan said he has discussed his proposal directly with Visa. The companys response? “Kind of noncommittal,” Hogan said in an interview.

      An audit of PCI weaknesses shows that retailers are still struggling with the same issues. Click here to read more.

      Some retailers have used the credit card numbers as unique customer identifiers, given that they had to hold the data anyway. “If youre required to store information, youre going to figure out ways to use it,” he said.

      A member of the PCI Security Vendor Alliance—a PCI group that is distinct from the Security Standards Council—applauded the NRF proposal but questioned how practical it was in the near term.

      “I think the NRF recommendation that retailers should not store credit card data is a great one. However, it is untenable in the short-medium term. It will take at least five years, given the reality of what it takes to change applications, test them, integrate and roll out into a production retail environment while keeping current operations intact,” said Prat Moghe, founder of data auditing vendor Tizor and a member of the PCI Security Vendor Alliance. “You also need to factor in the nightmare of transitioning old legacy applications where credit card data is stored. For example, there are black box applications where retailers have no idea how to make app changes because no one supports these apps anymore.”

      If someone could figure out a way around those obstacles, Moghe said, it would be a great thing. “If they can influence and get all the POS systems and back-end systems to change to get rid of the data, that will be fantastic. But in reality, it will take more than 5 years and cost more than all the PCI programs put together,” he said. “In the short-medium term, there is no choice but to secure the credit card data they are collecting, which brings us back to PCI. PCI is an inevitability for the next 5 years in the best case. Beyond that, NRF succeeds in getting rid of credit card data, PCI should go away.”

      Even under that scenario, Moghe said, much of the data security problem would remain because credit card numbers and the associated codes represent a very tiny fraction of the data retailers collect and store. “PCI is telling them that you need to think about where critical data is and know what is happening to it. This is not just about credit card numbers. Its about Social Security numbers, marketing data [and so on]. Look at what happened to Monster—seemingly benign data opened the door to much more serious data issues and possible ID theft. This can happen.”

      Moghe said that retailers have control of such a huge amount of customer data that focusing just on credit card numbers can obscure the bigger picture.

      “If you take PCI very literally, its about credit card data, but merchants need to look at all of their critical data. They have a lot of marketing data on customers. Lets say that PCI is 10-20 percent of the data they need to worry about and the PCI standard is crisply defined. If you cant make data security work in that context, how are you going to solve the rest of your data security problem?”

      Retail Center Editor Evan Schuman can be reached at Evan.Schuman@ziffdavisenterprise.com.

      Check out eWEEK.coms for the latest news, views and analysis on technologys impact on retail.

      Evan Schuman
      Evan Schuman is the editor of CIOInsight.com's Retail industry center. He has covered retail technology issues since 1988 for Ziff-Davis, CMP Media, IDG, Penton, Lebhar-Friedman, VNU, BusinessWeek, Business 2.0 and United Press International, among others. He can be reached by e-mail at Evan.Schuman@ziffdavisenterprise.com.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×