Why Security Matters

The security of cardholder data affects everybody.

The breach or theft of cardholder data affects the entire payment card ecosystem. Customers suddenly lose trust in merchants or financial institutions, their credit can be negatively affected -- there is enormous personal fallout. Merchants and financial institutions lose credibility (and in turn, business), they are also subject to numerous financial liabilities.

“The security benefits associated with maintaining PCI compliance are vital to the long-term success of all merchants who process card payments. This includes continual identification of threats and vulnerabilities that could potentially impact the organization. Most organizations never fully recover from data breaches because the loss is greater than the data itself.”

 — Quick Service Restaurant (QSR) Magazine

Following PCI security standards is just good business. Such standards help ensure healthy and trustworthy payment card transactions for the hundreds of millions of people worldwide that use their cards every day.

Potential Liabilities

  • Lost confidence, so customers go to other merchants
  • Diminished sales
  • Cost of reissuing new payment cards
  • Fraud losses
  • Higher subsequent costs of compliance
  • Legal costs, settlements and judgments
  • Fines and penalties
  • Termination of ability to accept payment cards
  • Lost jobs (CISO, CIO, CEO and dependent professional positions)
  • Going out of business

Payment Security

What Data Thieves Are After

Hackers want your cardholder data. By obtaining the Primary Account Number (PAN) and sensitive authentication data, a thief can impersonate the cardholder, use the card, and steal the cardholder’s identity.

Take a look at the payment card diagram. Everything at the end of a red arrow is sensitive cardholder data. Anything on the back side and CID must never be stored. You must have a good business reason for storing anything else, and that data must be protected.

Where Thieves Steal Data
Where Thieves Steal Data

Sensitive cardholder data can be stolen from many places:

  • Compromised card reader
  • Paper stored in a filing cabinet
  • Data in a payment system database
  • Hidden camera recording entry of authentication data
  • Secret tap into your store’s wireless or wired network
What Needs To Be Secure
What Needs to be Secure?

You secure cardholder data where it is captured at the point of sale and as it flows into the payment system. The best step you can take is to not store any cardholder data. This includes protecting:

  • Card readers
  • Point of sale systems
  • Store networks & wireless access routers
  • Payment card data storage and transmission
  • Payment card data stored in paper-based records
  • Online payment applications and shopping carts