Security Developments in the Card Payments Industry
A A
Payment Card Industry Data Security Standards (PCI DSS)
In today’s retail environment, card data security has become important for every type of business that accepts card payments. There are payment card industry standards in place now which outline how card data should be protected by shops and retailers. Every shop or merchant that accepts card payments, whether in a face-to-face or card-not-present environment, must secure all card information using the global industry standards. By following these industry-wide procedures retailers will:- Protect their customers' payment information
- Boost customer confidence through a higher level of data security
- Prevent financial losses and customer dispute costs
- Maintain customer trust and safeguard the reputation of the company brand
- Provide a complete ‘health check’ for any business that stores or transmits customer information
- Avoid penalties or fines in the event of a compromise such as a data hack or theft
What is PCI DSS?
The Payment Card Industry Data Security Standards (PCI DSS) are global information security standards which include a set of comprehensive requirements for enhancing payment account data security. They were developed by the founding payment brands of the PCI Security Standards Council (SSC), including MasterCard, Visa and American Express, to help facilitate the broad adoption of consistent data security measures on a global basis.PCI DSS include requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. The comprehensive standards are intended to help organisations to proactively protect customer account data.
Requirements for all organisations that accept card payments
The PCI DSS include 12 key requirements for organisations that accept or process card payments. These are:
- Installation and maintenance of a firewall configuration to protect data
- Do not use vendor-supplied defaults for passwords or other security parameters
- Protect stored data
- Encrypt the transmission of cardholder data and sensitive information
- Use and regularly update anti-virus software
- Develop and maintain secure systems and applications
- Restrict access to data by business need-to-know
- Assign a unique ID to each person with computer access
- Restrict physical access to cardholder data
- Track and monitor all access to network resources and cardholder data
- Regularly test security systems and processes
- Maintain a policy that addresses information security
These requirements apply to all organisations that store, transmit or process payment card data.
All acquiring processors are responsible for their merchants' compliance with these standards and are required to report regularly to the relevant members of the PCI SSC (i.e. the card schemes). Merchants that have not completed PCI DSS compliance validation need to agree a plan for doing so with their acquirers and to update them regularly on progress.
All merchants, regardless of their size, are required to comply with PCI DSS. Some of the card schemes have produced simple guidelines for small merchants. For more information shops and retailers should contact their acquiring processor.
For further information on PCI DSS please visit the website of the PCI Security Standards Council.
3D Secure (Verified by Visa and MasterCard SecureCode)
3D Secure is the collective name given to a security system for Internet transactions developed by Visa (called Verified by Visa) and MasterCard (called MasterCard SecureCode). The security measures provide a more secure approach to credit and debit card transactions over the Internet. For merchants, signing up to Verified by Visa and MasterCard SecureCode enhances the security of Internet payments which helps to protect from losses due to chargebacks.
For further information visit www.SafeCard.ie or contact your bank or card processor.
Card Security Code
The card payment industry developed Card Security Code (CSC) to help prevent fraud on Card Not Present (CNP) transactions. For most payment cards this is the three digit number printed on or just below the signature panel on the back of the card. For AMEX, this is a four digit number on the front of the card. The CSC is used in a CNP environment to help verify that customers have the card in their possession.CSC is used to stop fraud attempts when a criminal obtains a card number and a valid expiry date and tries to shop using just these details. CSC has helped many merchants reduce their CNP fraud and customer disputes and chargebacks.
If a customer cannot provide the CSC, it is advisable not to proceed with the sale.
Chip and PIN
As well as dramatically reducing retailers’ exposure to card fraud at the point of sale, Chip and PIN provides many other significant benefits for businesses that accept card payments, namely:- Keying in a PIN is faster than the signature process
- Costs associated with card fraud are reduced
- There are fewer customer disputes and chargebacks
- Retailers are no longer required to store receipts for Chip and PIN transactions (contact acquiring processors for more details)
- The use of Chip and PIN shifts the onus of identifying the cardholder away from shop staff who no longer have to check signatures against those on the card
Most shops rent their point of sale terminals from their bank or card processor which have been upgraded to Chip and PIN. Shops that own their own integrated point of sale tills are required to ensure that their tills are compliant with the international Chip and PIN technical standards. Criminals are known to target shops that have not updated their tills with the secure technology.
 |
|
Company Registration Number: 267239
Copyright IPSO ©