IN YOU THEY TRUST - Protecting Customer Data is Critical

By Ian Griffith

 ( Reprinted from the “May 2017 issue of Beverage Media”)  

Shoppers who enter a credit card number into your website are trusting that you will protect the personal information they share.  The great damage you can do to your relationship with these customers is to leave their credit card number vulnerable to any number of bad actors.  A lapse in your firewall or poor password management might be all it takes for a backer to harvest all the card data on your servers.

The Internet economy relies on consumers having sufficient trust in their online merchants.  The security of consumer information-credit card, address, sometimes date of birth-is the concern to the Payment Card Industry (PCI) and their Data Security Standards (DSS).  You have probably heard of PCI compliance, the name given to regular reports that merchants submit to their processors (acquirer banks) about their compliance with the PCI DSS.

Compliance as a Process

The level of compliance required of a retailer is measured against the risk of exposure.  For retailers under one million transactions from a single card type (i.e., Visa, MC, Amex), completing a regular questionnaire and possible a vulnerability scan against your website is sufficient.  Assuming an average order size in-store of $25, and the dominant card type (often Visa) accounting for 50% of sales, stores with websites that process over $6M annually are likely to fall into the next level (3) of security, followed by stores with sales over $60M (level 2).  The stricter forms of compliance involve thorough audits of the hardware and processes used to support a merchant, and can require authentication by an accredited consultant.

Compliance is an ongoing process, not a snapshot, and as recent breaches have shown, compliance with the PCI standards is no guarantee that a business cannot be hacked.

Safety First

Avoiding breaches is a lot simpler if the card data is removed from your servers as early as possible in the transaction.  For instance, the Bevsites retailer websites are integrated with a payment gateway that authorizes and captures the funds.  Card numbers are encrypted immediately, displaying only the final 4 digits, and once the order is processed the card number is removed from our servers.  At no point can an admin access these card numbers, and yet the transaction can be edited and the card reauthorized if necessary until the order is processed.

The latest round of standards for PCI DSS, version 3.2, includes a requirement that admin access to websites that interact with cardholder data include multi-factor authentication.  This means that an e-Commerce administrator who processes orders will need to login with a password but also confirm with another form of authentication, maybe by responding to a text message or entering a code.  While initially inconvenient, these security standards will become normal, and definitely help protect retailers from a breach.

Having worked so hard to find a customer, the last thing you want is to hear is that card data was compromised because he/she bought something on your website.  In the same way your customers trust that their card data is secure, you need to work with your technology partners to understand their plans to meet PCI compliance standards.  A reliable partner could save you from a difficult conversation with a very unhappy customer.