Today’s economy runs on credit, with credit cards accounting for a large portion of the transactions. By 2025, total payment card volume worldwide is projected to be $56.182 trillion. As the volume of card transactions continues to grow, the importance of preventing credit card fraud is on every card issuer and merchant’s priority list. Card-based payment systems worldwide experienced gross fraud losses equal to 6.78¢ for every $100 of total volume in 2019.
If your company issues or accepts credit cards, chances are, you already know the requirements for storing sensitive credit card information securely. Credit card data must be stored in compliance with PCI standards. This ensures that sensitive customer data is treated with proper care, with every effort to minimize fraud. ShipWizard, a trusted provider of PCI-compliant credit card fulfillment solutions, is here to guide you through the process.
What Is PCI Compliance?
Let’s start with basic definitions: what is PCI Compliance? Payment card industry compliance refers to the technical and operational standards that businesses follow to secure and protect credit card data provided by cardholders and transmitted through card processing transactions. PCI standards for compliance are developed and managed by the PCI Security Standards Council. Members of the PCI include major credit card brands like Mastercard, Discover, American Express and Visa. The PCI Security Standards Council is an open global forum, launched in 2006, that is responsible for the development, management, education, and awareness of the PCI Security Standards.
PCI standards protect the following sensitive customer data:
- customer name
- the full primary account number (PAN)
- the expiration date
- the card’s three- or four-digit security code, also called the card verification value (CVV)
By obtaining the Primary Account Number (PAN) and sensitive authentication data, a thief can impersonate the cardholder, use the card, and steal the cardholder’s identity.
PCI-DSS standards also protect sensitive authentication data, which is data embedded within the card’s magnetic stripe or Europay, Mastercard, Visa (EMV) chip and is used to process transactions.
PCI standards govern both the online and offline storage of credit card information. It doesn’t matter how big an organization is, or how many years they’ve been in business, if they handle credit card data, they must comply with PCI or run the risk of data breaches or fraud.
Why Is PCI Compliance Important?
By protecting both cardholder and credit card data with PCI compliance, merchants can reduce the risk of credit card fraud. In the US, up to $9.62 billion was lost to credit card fraud in 2019, up from up from $9.47 billion in 2018, according to a Nilsen report. Globally, card losses to fraud reached $25.53 billion in 2019, up from $24.86 billion in 2018. According to the same report, losses to fraud in the U.S. are projected to reach $12.51 billion in 2025.
Sensitive cardholder data can be stolen from many sources, such as:
- Compromised card reader
- Paper stored in a filing cabinet
- Data in a payment system database
- Hidden camera recording entry of authentication data
- Secret tap into your store’s wireless or wired network
Unfortunately, most victims of fraud only become aware that their credit cards have been compromised when charges begin to show up in their bank account transactions. However, most credit card thieves are usually part of larger criminal organizations. There are three distinct types of players in the credit card information theft industry: those who specialize in stealing and selling credit card details, those who focus on quality control, and a third group focused specifically on monetizing the cards by making purchases to be re-sold for cash.
Furthermore, the rise of cryptocurrencies like Bitcoin and specialized ‘Dark Web’ markets focused specifically on selling credit card details and other personal information are exacerbating the theft of information. Transactions can occur incredibly quickly, making it difficult to track exactly where the customer data is being moved. In short, the theft of credit card data is becoming more and more sophisticated, which means that theft-proofing your business has never been more important.
If your business suffers a security breach, there are numerous potential liabilities. According to the PCI, a breach involving personal information can result in the following:
- Lost confidence, so customers go to other merchants
- Diminished sales
- Cost of reissuing new payment cards
- Fraud losses
- Higher subsequent costs of compliance
- Legal costs, settlements and judgments
- Fines and penalties
- Termination of ability to accept payment cards
- Lost jobs (CISO, CIO, CEO and dependent professional positions)
- Going out of business
Plenty of businesses get hacked, with Capital One, Home Depot, and TJMaxx / Marshalls among brands that suffered from most notorious and wide-scale data breaches. Does this mean that breaches are impossible to avoid? Not necessarily. There are concrete steps your business can take to minimize the chances of a breach.
How To Ensure PCI Compliance For Your Business
First, audit how you currently collect and store cardholder data. Inventory your IT assets to look for vulnerabilities a hacker could exploit to steal cardholder data:
- Is your network secure?
- Are systems password protected?
- Is your antivirus and malware protection up to date?
Next, take action to address those vulnerabilities. This could include upgrading the security on your e-commerce site or moving away from storing cardholder data at all.
To become PCI compliant, you must meet the 12 PCI compliance requirements. At ShipWizard, we follow the PCI requirements to ensure that the credit card information of our customers’ customers is safe and secure. The PCI compliance requirements are:
- Install and maintain a firewall configuration to protect cardholder data
- Avoid vendor-supplied defaults for system passwords and other security parameters
- Protect stored data
- Encrypt transmission of cardholder data across open, public networks
- Use and regularly update anti-virus software
- Develop and maintain secure systems and applications
- Restrict access to cardholder data
- Assign a unique ID to each person with computer access
- Restrict physical access to cardholder data
- Track and monitor all access to network resources and cardholder data
- Test security systems and processes regularly
- Maintain a policy that addresses information security
According to a study conducted by Verizon PCI compliant businesses are 50% more likely to successfully endure an attempted breach. Customers are more likely to do business with businesses that invest in data security and are PCI compliant.
By leveraging ShipWizard to safely handle sensitive cardholder data outside of your premises, you can potentially reduce your business’s PCI compliance responsibilities. Contact us today to learn more about ShipWizard or request a quote for our PCI-compliant fulfillment service.
