risk
US retail industry body the National Retail Federation (NRF) has
warned of security risks related to the credit card industry’s
requirement that merchants must store credit card data for between
12 and 18 months. In a letter to the Payment Card Industry (PCI)
Security Standards Council, the NRF’s chief information officer,
David Hogan, requested the credit card industry allow merchants to
choose whether they want to store credit card data and, if so, for
how long.
“With this letter, we are officially putting the credit card
industry on notice,” he said. “Instead of making the industry jump
through hoops to create an impenetrable fortress, retailers want to
eliminate the incentive for hackers to break into their systems in
the first place.”
Hogan outlined the NRF’s approach, stating that credit card
companies and their bank clients should provide merchants with the
option of keeping nothing more than the authorisation code provided
at the time of sale and a truncated receipt, rather than requiring
merchants to keep significant quantities of data for an extended
period of time.
“If all merchants took advantage of this option, credit card
companies and their member banks would be the only ones with large
caches of data on hand and could keep and protect their card
numbers in whatever manner they wished,” Hogan said.
“The bottom line is that it makes more sense for credit card
companies to protect their data from thieves by keeping it in
relatively few secure locations than to expect millions of
merchants scattered across the nation to lock up their data for
them.
“We believe this is the most effective and efficient approach to
protecting credit card data and preventing a continuation of the
data breaches that have been seen in recent years.”
The NRF represents more than 1.4 million US retail establishments
that generated total sales of $4.7 trillion in 2006. As the
industry umbrella group, NRF also represents more than 100 state,
national and international retail associations.
The PCI was formed by major payment card brands American Express,
Discover Financial Services, JCB, MasterCard Worldwide and Visa
International in 2006 to oversee the ongoing development,
enhancement and dissemination of the credit card industry’s Data
Security Standard.
