Stores Magazine - October 2007 - (Page 31) A STICKING POINT O ne of the real sticking points on the road to PCI compliance is chargebacks. For decades, retail companies have been required to hold on to credit card and receipt data for up to 18 months in the event of chargeback claims. Holding on to all this customer and transaction data is an onerous task, particularly for the chains that process millions of transactions each year. Retailers contend that bank authorization of a processed sale should be sufficient proof that a purchase was approved. The credit card associations and the banks see it differently; they argue that it’s the retailer’s responsibility to hold on to all the data – the credit card number, the expiration date, the authorization code and the receipt – for a significant period of time in case the purchase is disputed. With PCI requirements clamping down on how customer data is stored, retailers feel as though they’re caught in a quagmire. “Retailers are trying to do the right thing; they’re taking the required steps to secure customer data,” says Dave Hogan, senior vice president and CIO for NRF. “But, ultimately they feel that they shouldn’t have to shoulder the burden for storing all this sensitive data once the bank has provided an authorization code. Their contention for years has been, ‘Why can’t the banks or the credit card companies be responsible for storing their information?’ It seems to be a way for the card associations and the banks to shift liability and risk to the retailer. And, needless to say, we don’t think it’s an equitable solution.” Here’s a typical scenario that would prompt a chargeback: A customer purchases a big-screen television. Eight months later the customer calls his credit card company and says he never made the purchase. The credit card company sends the disputed claim to the retailer, requiring it to present evidence (such as a signed receipt) that the purchase occurred or risk a chargeback. If the retailer is unable to gather the data to prove the transaction occurred, it not only loses the merchandise and its value, it’s charged for the purchase, too. Dean Sheaffer, senior vice president, credit and customer relations management for Boscov’s Department Stores, explains that there are a number of reasons for chargeback – from dishonest customers and delivery problems to duplicate billing and the quality of the merchandise. He says that if the customer calls the bank with a dispute, it’s the bank’s obligation to track down the authorization. If the transaction didn’t have an authorization number or the bank can’t locate the data, the responsibility for tracking down the data is shifted to the retailer. “Tracking down this information is a costly and time-consuming task – not to mention dirty and grueling,” says Sheaffer. “The problem around PCI is that we’re forced to operate within the confines of a system that was created in the ’50s or ’60s when 16-digit credit card numbers and four-digit expiration dates were established. It’s almost insane that they haven’t found a better paradigm for us all to work under.” Sheaffer notes that many retail companies have little choice but to keep the data stacked in cardboard boxes in a warehouse. “Tracking down information in this environment qualifies as a Discovery Channel Dirty Job,” he says. tailer out there who would argue otherwise,” says Dave Hogan, senior vice president and CIO of the National Retail Federation. “Data breaches have continued to occur at an unacceptable rate. There have been numerous instances of hackers targeting sophisticated retail computer systems that store or process credit card data, stealing the data and then using it to commit fraud.The problem is that the PCI security mandates are difficult to interpret and the requirements for achieving compliance are proving to be elusive at best. “The relatively low rates of success bear out the magnitude of the task. Retailers are frustrated by the complexity of the project and amount of liability they will continue to bear in securing credit card data — even after they’ve got the piece of paper hanging on their wall that says they’re certified,” Hogan says. “Data security is an ongoing, ever-changing problem that can’t be solved with a checklist.” Describing retail CIOs as being “frustrated” hardly scratches the surface; often, their demeanor toward PCI DSS compliance is downright prickly. Although the sensitive nature of a company’s security procedures precludes most IT executives from speaking on the record, the chance to share their views anonymously opens a floodgate of grievances. They gripe about the costs involved and the fact that devoting so much time and capital to this task has forced them to shelve critical and/or innovative business projects. They also convey the gut feeling that no matter what they do, WWW.STORES.ORG they will still have to store some customer data and bear more risk than do the banks or credit card associations they’re working in partnership with, particularly with respect to resolving chargeback issues (see box, above). Needless to say, retail CIOs are fully cognizant of the financial stakes of non-compliance and the potential damage that could be sustained by their brand if a breach were to occur. No one questions the importance of protecting customer data: Still, they’re quick to point out that this exercise yields zero ROI, which is burdensome for an industry that operates largely on small margins and small IT budgets. “There’s no business benefit here,” says Stefano Gaggion, vice president of MIS for Retail Brand Alliance (RBA), the parent company of Brooks Brothers, which received its initial PCI Compliance Certification in December 2006. “Typically, we make IT investments in the context of improving the customer experience or customer satisfaction,” he says. “This does neither. Retailers have to absorb the brunt of the cost and we have all the liability.” Six years . . . and counting he origins of PCI can be traced to 2001, when each of the major credit card companies sought to create data security standards. There were four programs: Each was slightly different, but the main objective they shared was the creation of an additional level of protec- T STORES / OCTOBER 2007 31 http://WWW.STORES.ORG
For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.