Every time you swipe your credit card and wait for the transaction to approved, sensitive data including your name and account number are ferried from store to bank through computer networks, each step a potential opening for hackers.
And while you may take steps to protect yourself against identity theft, an Associated Press Investigation has found the banks and other companies that handle your information are not being nearly as cautious as they could.
The US government leaves it to card companies to design security rules that protect the nation’s 50 billion annual transactions. Yet an examination of those industry requirements explains why so many breaches occur: The rules are curosry at best and all but meaningless at worst, according to the AP’s analysis of data breaches dating to 2005.
It means every time you pay with plastic, companies are gambling with your personal data. If hackers intercept your number, you’ll spend weeks straightening your mangled credit, though you can’t be held liable for unauthorized charges. Even if your transaction isn’t hacked , you still lose: Merchants pass to all their customers the costs they incur from fraud.
More than 70 retailers and payment processors in the US have disclosed breaches since 2006, involving tens of millions of credit and debit card numbers, according to the Privacy Rights Clearinghouse. Meanwhile, many others likely have been breached and didn’t detect it. Even the companies that had the payment industry’s top rating computer security, a seal of approval known as PCI compliance, have fallen victim to huge heists.
Companies that are not compliant with the PCI standards – including one in 10 of the medium -sized and large retailers in the United States – face fines but are left free to process credit and debit card payments. Most retailers don’t have to endure security audits, but can evaluate themselves.
Credit card providers don’t appeat to be in a rush to tighten the rules. They see fraud as a cost of doing business and say stricter security would throw sand into the gears of the payment system, which is built on speed, convenience and low costs.
That is of little consolation to consumers who bet on the industry’s payment security and lost.
In the past, each credit card brands – Visa, MasterCard, American Express, Discover and JCB International – formed the Payment Card Industry Standards Council and created uniform security rules for merchants.
Avivah Litan, a Gartner Inc. Analyst, says retailers and payment processors have spent more than $2 billion on security upgrades to comply with PCI. And the payment industry touts the fact that 93 percent of big retailers in the US, and 88 percent of medium-sized ones, are compliant with the PCI rules.
That leaves plenty of merchants out, of course, but the main threat against them is a fine: $25,000 for big retailers for each month they are not compliant, $5,000 for medium-sized ones.
Computer security experts say the PCI guidelines are superficial, including requirements that stores run anti virus software and install computer firewalls. Those steps are designed to keep hackers out and customer data in. Yet tests that simulate hacker attacks are required just once a year, and businesses can run the test themselves.
Merchants that decide to hire an outside auditor to check for compliance with the PCI rules need not spend much. Though some firms generally charge $60,000 and take months to complete their inspections, others are far cheaper and faster.
“PCI compliance can cost just a couple of hundred bucks,” said Jeremiah Grossman, founder of WhiteHat Security Inc., a Web security firm. “If that’s the case, all the incentives are in the wrong direction. The merchants are inclined to go with the cheapest certification the need”.
The key reason PCI exists is that the banks and card brands don’t want the government regulating credit card security. These companies also want to be sure transactions keep humming through the system-which is why banks and card companies are willing to put up with some fraud.
Fresh Comments