Tag Archives: merchant services

Visa’s Ups and Downs

The Official Merchant Services Blog takes a look at Visa’s wild ride between May 2 and May 3. In the midst of a very active first quarter of 2012, Visa’s earnings report came in. The San Francisco based credit card giant then took a ride on a roller coaster in the span of two days after the report was released.

The Up Vote

The company had good news to report on May 2: Visa said Wednesday that its profit for the first three months of the year was up 30 percent from the year before, primarily because credit card use rose in the United States and overseas. Bloomberg broke down some key statistics from the report in their story here: “The company said Americans rang up 12 percent more on their charge cards for the quarter. Debit card use grew by only 4 percent to $284 million, however, the slowest growth in a year.”

So the boost in Visa profits is tied to an increase in the use of credit cards in the first three months of the year. But it appears the Durbin Amendment, financial reform legislation designed to address problems with swipe debit fees, has slowed down debit card use. As the Bloomberg article reports, the Durbin Amendment appears to be having an impact on profits: “Banks have eliminated some debit card rewards programs since October, when the government limited the fees banks can charge stores for card transactions.”

The profit breakdown for the quarter paints a very rosy picture. Visa’s net income was $1.3 billion, or $1.60 per share. Wall Street was expecting $1.51. Revenue rose 15 percent to $2.6 billion. Wall Street was expecting $2.48 billion.

The Down Turn

And then the roller coaster ride took a dip. Bloomberg reported the next day, May 3, that Visa stock took a decline based on the details of a U.S. Antitrust Probe into Visa’s Debit Strategy. The article states: “Visa Inc., the payments network that has lost market share amid new debit-card rules, slid as much as 4.5 percent in extended trading after disclosing a U.S. antitrust probe into the firm’s pricing and strategy.”

Visa adjusted the network’s fee structure to defend its leading market share after the Durbin Amendment took effect in October. On March 13, the U.S. Justice Department’s antitrust division issued a civil investigative demand asking for information about Visa’s debit strategy. Bloomberg quotes Visa Chief Executive Officer Joseph W. Saunders as saying in a conference call: “We are confident our actions are appropriate and that our response to the DOJ supports that.”

According to Saunders Visa has received four other requests for information from the Justice Department since 2007, and all have been resolved with Visa’s full cooperation.

The Durbin Factor

The Visa news comes after recent announcement from MasterCard, which stated that their own first-quarter profit increased 21 percent to $682 million. Like Visa, MasterCard’s profits also beat Wall Street estimates.

Speculation suggests that the hard cap on Debit Card Swipe fees imposed by the Durbin Amendment from October 2011 may have helped MasterCard take some market share away from Visa. MasterCard has been winning deals to handle processing of debit transactions according to the company’s Chief Financial Officer Martina Hund-Mejean.

Bloomberg quotes Hund Mejean as saying in a conference call to analysts: “In every quarter we’re going after business very surgically and opportunistically. You can see those results in our numbers.”

And according to Tien-tsin Huang, a JP Morgan Chase & Co. analyst in a May 1 research note, Bank of America Corp. — the biggest debit-card issuer and catalyst of post-Durbin media frenzy — switched to MasterCard.

Visa’s Fees Bite Back

Visa changed its debit-card fees in April, creating new fees like the Fixed Acquirer Network Fee (FANF) in an attempt to create incentives for merchants to route more transactions on the company’s network. The fees, which had been variable were broken into various components. To read more about those fees, you can CLICK HERE to see Host Merchant Services‘ own coverage of the April fees. The Bloomberg article suggests that Bank of America switched to MasterCard in reaction to the new Visa fees and MasterCard’s own surgical strike against Visa’s market share.

Internet Security

Security is one of the defining internet issues of this decade. While there is not one distinct body of law that governs a company’s rights and responsibilities, there are methods to prioritize compliance efforts. This issue is relatively unique to the internet space since the laws and regulations that apply come from many different areas. In recent years the Federal Trade Commission (FTC) has taken an increasingly prominent role in responding to these problems. In addition, almost every state has some sort of law that at least requires reporting of unauthorized disclosure of information. Indeed many state laws, particularly Massachusetts and California, go substantially beyond simple breach disclosure and mitigation.

Host Merchant Services is located in Delaware. The Delaware Security Breach Notification Law can be reviewed in its entirety at This Link.

While many agencies, such as the SEC, have regulations that address security issues in the industries they regulate, the FTC is the agency primarily tasked with addressing internet security issues. The FTC has the authority to prosecute companies and individuals who engage in deceptive trade practices. The best way to determine the enforcement priorities of the FTC is to look at recent enforcement actions. These actions have focused on the “locked door” problem: Many companies focus on the number of locks they’ve placed on the door to data, as opposed to making sure these doors do not become unlocked over time.

Sloppy security practices are an issue that the FTC has said is simply screaming for regulatory and enforcement activity.

Time and time again, the FTC has stated that companies must have procedures in place to ensure that their businesses are secure, to detect security vulnerabilities, and inform customers and, if necessary, regulators, when unauthorized disclosures are discovered. To avoid FTC action, internet businesses need to shift some of their security thinking and strategy from high profile areas to basic security and process control schemes. This could involve redeploying resources from traditional security screening measures (such as trying to breach firewalls) to creating change control processes, training staff on quality control and ensuring that vendors actually meet the security standards you need — and that they profess to have.

It is a bit trickier to generalize about state security statutes. That said, most state laws have relatively similar goals to their federal counterparts. As an initial matter you should ensure that your entire “ecosystem” has the same, or similar, breach definitions. Doing so avoids gaps that lead to misinformation and failure to comply with breach definitions set out in your state laws. A second component of general compliance is to create both internal and external notification plans. Your internal plan should create a system where both employees and vendors are alerted to a possible breach. External plans should contain at a minimum a statement of what is known about the breach, mitigation efforts, a contact point, and future steps you are taking regarding the breach. You should identify which information will be excluded from these notification efforts because of confidentiality or other restrictions.

A final component of a state compliance plan is to anticipate how you will fold in state regulators and law enforcement entities. At a minimum, these will be agencies in the state in which you are located, but may, in some instances, include regulatory agencies in other states. It is important not to play hide-the-ball and simply fail to provide the regulatory and law enforcement notifications required by law. In making these notifications, you should involve your attorney to determine how much information you are required to disclose, and methods of protecting your company from litigation.

For More Information

For more legal information you can visit my site:

David Snead’s Home Page

Merchant Services Document Download Graphic

To learn more about PCI Compliance, Host Merchant Services offers these resources:

PCI Compliance FAQ

PCI Compliance Guide

Disclaimer: Legal decisions must be made based on your unique situation. Please consult with an attorney prior to making decisions based on this post.

Industry Terms: Chargeback

This is the latest installment in The Official Merchant Services Blog’s Knowledge Base effort. Well we want to make the payment processing industry’s terms and buzzwords clear. We want to remove any and all confusion merchants might have about how the industry works. Host Merchant Services promises: the company delivers personal service and clarity. So we’re going to take some time to explain how everything works. This ongoing series is where we define industry related terms and slowly build up a knowledge base and as we get more and more of these completed, we’ll collect them in our resource archive for quick and easy access. Today’s term is:

Chargeback

Chargeback typically refers to the act of returning funds to a consumer. The action is forcibly initiated by the issuing bank of the card used by a consumer to settle a debt. Essentially what happens is a consumer disputes a transaction, and the credit card company’s bank responds by taking the money back from the Merchant and returning it to the consumer.

Customers dispute charges to their credit card usually when goods or services are not delivered within the specified time frame, goods received are damaged, or the purchase was not authorized by the credit card holder — the latter being the most common reason for a chargeback.

The chargeback mechanism exists primarily for consumer protection. To start a chargeback a consumer will contact their credit card company and ask for a chargeback. The dispute process then begins. During the dispute process he merchant will have to provide proof they rendered service properly. If the merchant can’t provide sufficient evidence, the credit card company debits the transaction amount from the merchant’s account and credits it to the consumer’s account. Additionally, the credit card company charges the merchant a chargeback fee as a penalty.

With each chargeback the issuer selects and submits a numeric reason code. This feedback can help the merchant and acquirer diagnose errors and improve customer satisfaction. The code also helps the merchant better investigate the transaction in order to find proof during the Dispute Process. Reason codes vary by bank network, but fall in four general categories:

Technical: Expired authorization, non-sufficient funds, or bank processing error.
Clerical: Duplicate billing, incorrect amount billed, or refund never issued.
Quality: Consumer claims to have never received the goods as promised at the time of purchase.
Fraud: Consumer claims they did not authorize the purchase or identity theft.

For transactions where the original invoice was signed by the consumer, the merchant may dispute a chargeback with the assistance of the merchant’s acquiring bank. The acquirer and issuer mediate in the dispute process, following rules set forth by the corresponding bank network or card association. If the acquirer prevails in the dispute, the funds are returned to the acquirer, and then to the merchant.

The merchant’s acquiring bank accepts the risk that the merchant will remain solvent over time, and thus has an incentive to take a keen interest in the merchant’s products and business practices. Reducing consumer chargebacks is crucial to this endeavor. To encourage compliance, acquirers may charge merchants a penalty for each chargeback received. Payment service providers, such as PayPal, have a similar policy. In addition, Visa and MasterCard may levy severe fines against acquiring banks that retain merchants with high chargeback frequency. Acquirers typically pass such fines directly to the merchant. Merchants whose ratios stray too far out of compliance may trigger card association fines of $100 or more per chargeback.

For More Information

To find out more about Chargebacks and to gain some Chargeback Tips, be sure to CLICK HERE and read The Official Merchant Services Blog entry from January 9, 2012.

VexxHost Partnership

One constant struggle that we’ve seen with our customers is the ability to perform credit card transactions on their website. While there are plenty of credit card processing companies in the market, it always seems like you need a degree in finance in order to understand all the fees involved, not to mention the plethora of documentation to go through.

It may also seem that a lot of the times, the credit card providers’ interests are not aligned with those of the merchant. While a business has to operate with the interest of making profits through offering a service, however, it is important to draw the line and understand the limit of what a company should charge for to maintain a good relationship with their customers.

As a company, we were extremely happy to partner and work with Host Merchant Services. When we were initially approached and presented with the opportunity that Host Merchant Services presents for their customers, it was undeniable that HMS works with their customer’s best interests.

All of our existing and new web hosting customers are now eligible for a $75 voucher that will cover their credit card processing fees, which means that all of VEXXHOST customers can now get started and offer payments via credit card either on their online e-commerce website or even in their store, as Host Merchant Services is not limited to online credit card processing.

From small things like having no contracts or any hidden fees up to the important details such as a locked-in lifetime rate that will never change and free equipment (such as terminals and supplies) for customers that do offline credit card processing. Host Merchant Services always goes to make sure that the customer is getting the best treatment they can possibly get.

We really hope that this partnership is equally beneficial, allowing our customers to leverage HostMerchantServices to process their credit cards online, if not start offering it now. VEXXHOST customers can get started by simply clicking the “Merchant Account” icon from their cPanel control panel to get started!

Industry Terms: Merchant Account [2023 Update]

This is the latest installment in The Official Merchant Services Blog’s Knowledge Base effort. Well we want to make the payment processing industry’s terms and buzzwords clear. We want to remove any and all confusion merchants might have about how the industry works. Host Merchant Services promises: the company delivers personal service and clarity. So we’re going to take some time to explain how everything works. This ongoing series is where we define industry related terms and slowly build up a knowledge base and as we get more and more of these completed, we’ll collect them in our resource archive for quick and easy access. Today’s term is:

Merchant Account

A merchant account is a specific kind of bank account that allows businesses to accept payments by payment cards. These are typically debit or credit cards, but can also extend to EBT cards, checks, and gift cards. A merchant account is established under an agreement between an acceptor and a merchant acquiring bank for the settlement of payment card transactions. In many cases a payment processor like Host Merchant Services, is also a party to the merchant agreement. Whether a merchant enters into a merchant agreement directly with an acquiring bank or through a payment processing specialist such as Host Merchant Services, the agreement contractually binds the merchant to obey the operating regulations established by the card associations.

The best known card associations are Visa, MasterCard, American Express, Discover, Diners Club, JCB and China UnionPay.

Industry Terms: Virtual Terminal

Virtual Terminal

A Virtual Terminal is a form of secure online payment processing. Using these web-based applications to create a virtual terminal, a merchant can access over an interject connection all the needed credit card processing capabilities from any computer through a secure, password-protected login.

After logging into the environment, a merchant can manually enter credit card details and perform any credit card processing transaction that a Point-of-Sale Terminal would perform, including authorization, capture and refund.

The process looks a lot like going to a secure web site. It’s flexible and can be used from a variety of locations allowing a merchant to either replace their standard terminals or use this as an option for when they’re out in the field. Virtual Terminals are very easy to use, accessed via Secure Socket Layer Encryption (SSL), enable separate authorization and settlement transactions, connect to Address Verification System (AVS) and Card Verification Value (CVV) fraud tests and support multi-user access with multiple permissions. In short, you can run your entire payment processing protocol through a virtual terminal safely and securely.

For more information, you can review how the process works at this link.

You can also find out more about the virtual terminals Host Merchant Services offers at this link.

A is for Acquirer

We’ve been working hard the past 7 months at The Official Merchant Services Blog to offer our readers a knowledge base — a place to come frequently to get clear and useful information about the payment processing industry. But we’re always looking to take things a step further. We want to offer more information and be even more helpful. I was recently inspired by this article over at UniBul’s Credit Card Blog which offers a definition of 21 confusing payment processing terms. Credit Card Processing has a lot of buzzwords that get used. This type of technical or industry language can sometimes make understanding statements very difficult for merchants.

Well we want to make these terms clear and remove the confusion. This is part of the ongoing service Host Merchant Services promises: the company delivers personal service and clarity. So we’re going to take some time to explain how everything works. This is going to be an ongoing series where we define industry related terms and slowly build up a knowledge base. We’ll start with the same term that kicked off the UniBul blog. But our coverage is going to go a bit deeper than just a definition. We’ll provide a little extra context. And as we get more and more of these completed, we’ll collect them in our resource archive for quick and easy access.

Acquirer

An acquiring bank (or acquirer) is the bank or financial institution that processes credit and or debit card payments for products or services for a merchant. The term acquirer indicates that the financial institution accepts or acquires credit card transactions from the card-issuing banks within an association. The best known (credit) card Associations are Visa, MasterCard, American Express, Discover, Diners Club, JCB and China UnionPay.

An acquirer is contacted to authorize a credit card or debit purchase. The acquirer will either approve or decline the debit or credit card purchase amount. If approved the acquirer will then settle the transaction by placing the funds into the seller’s account.

Every time you use your credit or debit card you are using the services of an acquirer. An Acquirer will charge a monthly and/or a per transaction fee to the stores or merchants to facilitate transactions. Acquirers need to be licensed with credit card companies, such as Visa or MasterCard.

To get a better understanding of how payment processing works, you can view this infographic.

Android Phone Now Takes Payments

Host Merchant Services finally gets to make this announcement official: All mobile payment solutions the company offers now feature both iPhone and Android compatibility.

On February 28, 2012 Host Merchant Services teased through its Facebook Page that it would have big news regarding HMS and Mobile Payments in March. But technical difficulties with the full release of Payfox’s Android solution held the news back until today. In the Android Marketplace, Payfox is now listed and available for download. You can see the listing here.

The App has been on the Android Marketplace since March 21. But now the rest of the support is in place to get the app working. The final piece of the puzzle was the card reader — UniMag II, Two-Track Secure Mobile MagStripe Reader. The device is a two-track, encrypted magnetic stripe reader that works with a wide variety of mobile platforms, including Apple, HTC, LG, Motorola, and Samsung devices. Use your mobile device to read credit cards, signature debit cards, gift cards, loyalty cards, driver’s licenses, and ID badges. The UniMag reads up to 2 tracks of information with a single swipe in either direction, providing superior reading performance for your mobile device. A merchant account is required to accept credit card transactions.

Host Merchant Services image of the Unimag II.

You can download the specs from the UniMag II data sheet right here. These are the Android devices supported by the reader:

HTC Aria
HTC Desire Z
HTC Eris
HTC EVO 4G
HTC EVO Shift 4G
HTC G2
HTC Hero
HTC Incredible
HTC MyTouch 4G
HTC EVO 3D
HTC Nexus One
HTC Incredible 2
HTC MyTouch 3G Slide
HTC MyTouch 4G Slide
HTC Thunderbolt
HTC Merge

LG Optimus T
LG Revolution

Motorola Droid 2
Motorola Droid X
Motorola Droid Pro
Motorola Milestone
Motorola FlipSide
Motorola Atrix
Motorola Droid 2
Motorola Droid 2 Global
Motorola Droid Bionic
Motorola Droid 3

Samsung Captivate
Samsung Droid Charge 4G
Samsung Epic
Samsung Epic 4G
Samsung Fascinate
Samsung Nexus S
Samsung Replenish
Samsung Infuse 4G
Samsung Continuum
Samsung Galaxy SII

Please Note

When you go to the Google Play Market and search for PayFox using your Android/Droid phone, the PayFox application will only display for those devices for which the application itself is compatible.

Host Merchant Services image for difference between Android phones and Star Wars Droids.

Red 5 Standing By

Our friends at Transfirst also wanted to offer some clarification about the use and licensing around the word Droid:

“Android and Droid are often used interchangeably when referring to ever-growing & increasingly popular line of smartphones that run on Google technology. The difference, for most purposes, is one of legal definitions and intellectual property. Android simply refers to the operating system and software that powers phones built by any of number manufacturers, including HTC or Motorola, and that run on any of the major carriers.

Droid, on the other hand, is a term coined and owned by LucasFilm Ltd., the licensing rights for which Verizon had to purchase in order to brand their specific line of Android Smartphones.”

In short, Androids are phones, and you can now use them to swipe payments. Droids are what Jawas scavenge. Though I’m sure the Jawas will happily accept mobile payments from all you moisture farmers out there. Ootini!

Data Breach Solutions

Today The Official Merchant Services Blog has a quick follow up to its ongoing coverage of the Global Payments Data Breach. The past two entries in our blog have taken a sweeping look at the big picture of data breaches and PCI DSS and how effective those security standards are. PCI Compliance is a topic very near and dear to Host Merchant Services because the company pushes an aggressive initiative among its customers to keep them PCI Compliant.

PCI Compliance: The Foundation of Security

Past studies from Verizon and Gartner Research have suggested that business owners slack on their security needs, especially in terms of PCI DSS compliance. The most oft suggested reason for this lax outlook on security has to do with PCI itself not having a lot of traction with those business owners. The merchants tend to think any security issues are the responsibility of the third party processor or the bank or the credit card companies; they don’t see a direct link to their business because of the simple fact that their terminal that swipes cards wasn’t theirs to begin with. Other issues include Merchants getting lost in the complexities of the PCI DSS website and its many forms that need to be filled out, and the recent change to PCI version 2.0 in October 2010 changing the structure of the system. Merchants get distracted by their day to day responsibilities of the business and gloss over the minutiae of PCI compliance.

Host Merchant Services understands these problems. Part of their service mantra is that the company designs payment processing solutions that let their merchants focus on running their company. The general theme is to make payment processing seamless and easy for the merchants. This includes transaction security and was the catalyst that fueled the company’s PCI Compliance Initiative.

But as we’ve seen with the Global Payments Data Breach, security needs to go beyond just PCI Compliance.

An Extra Layer of Protection

This Article from The Data Center Journal suggests that better admin priveleges could have helped stave off The Global Payments Data Breach completely. From the article: “Avecto says that the possibility that the breach was caused by a compromised administrative account that was insufficiently protected shows that governance is a central requirement of modern IT security.”

The article maintains that multiple layers of security can go a long away to helping to prevent future data breaches of this type. Paul Kenyon, chief operating officer with Avecto, said in the article that “Our observations on this breach suggest that minimizing administrative privileges—an exercise in the principle of least privilege—would have gone a long way to preventing the breach.” It was suggested to Kenyon from another IT Security analyst that the privileged accounts that are reportedly at the heart of this breach need several layers of protection to properly insulate them from hackers.

Most articles looking at the aftermath of the data breach arrive at the consensus that security measures need to go beyond just PCI compliance. This article gives some very specific and clear advice on a step to take — a data breach solution.

Data Breach Penalties Stack Up

Yesterday’s blog also delved into the cost and fees companies face when they suffer a data breach.

And this article by Bank Info Security gives even more insight into the cost and impact of a data breach. It interviews Larry Ponemon, founder of the Ponemon Institute, which conducted this year’s Cost of a Data Breach study with sponsorship from Symantec. The study revealed that the average cost of a Data Breach has gone down this year. Which makes sense when you consider that even with the Global Payments Data Breach in the news right now, the scale is a lot smaller than the scale of the Heartland Data Breach.

In fact, this article, also from Bank Info Security, gives a side by side comparison between the much bigger Heartland Data Breach and the Global Payments Data Breach.

But back to Ponemon’s interview and his company’s study: “According to the annual report, the average per capita cost of a data breach has declined from $214 per record to $194 since 2011’s report.”

Ponemon suggests two reasons for the decline in average costs.

Complacency: “We think people in general may be becoming numb to the data breach notification process. Most people have received at least one data breach notice; they may not even be aware of it because they don’t open their mail. The may see it as junk mail.”
Topical Shift, or rather the rise of intellectual property breaches, which are not a part of the annual study: “We focus on one type of data breach – the type of data breach [of personal records] that requires notification in the United States and then other parts of the world – but in reality there are other, maybe more costly, data breaches that companies are experiencing every day.”

HMS Data Breach Security Program

The hackers that go after credit card information are a creative group of criminals who are constantly pushing technology forward and tying security systems in knots. Many times a discussion about data breaches ends up with the conclusion that “it’s not if a data breach is going to happen, it’s when a data breach is going to happen.”

Host Merchant Services offers a key resource in preparing a business to tackle that issue: Its Data Breach Security Program. This program protects a business and a merchant can get up to $100,000 in coverage per location for the most common forms of data breach:

Employee Dishonesty
Skimming
Theft of Credit Card Receipts
Theft of POS Terminals
Stolen Card Numbers
Theft of Computers

The Data Breach Security Program helps cover fees for any industry-mandated audit of a suspected breach, card replacement costs and related expenses, and industry fines and assessments. All of these fees come from non-compliance with PCI DSS and are fees and issues that any company even suspected of a breach can face as we described yesterday in our blog. The coverage would exceed even the penalties that Cisero’s faces as we saw in the article about their lawsuit targeting the PCI itself.

How Does It Work?

Host Merchant Services makes it easy to file claims once you’ve gotten on board with the Data Breach Security Program. A simple online form starts the process:

Step 1: Fill out the online claim form at www.merchantdatabreach.com
Step 2: Upload or fax the notice from the acquiring bank, which stipulates that there has been a breach or a suspected breach at your location and choose an authorized, qualified security assesor.
Step 3: When the forensic audit is complete, upload or fax a copy of the assessor’s report.
Step 4: HMS takes it from there. We process the claim for payment and if all documentation is in order you will receive a check for the expenses incurred from the audit and/or card replacement costs and/or fines incurred for a breach.

HMS Team 2

To recap

Data Breaches can and will occur. They are costly. The recent Global Payments Data Breach reminds us all how important transaction security is for all parties involved. Merchants need to understand how important PCI Compliance is for their business. And they also need to take more steps than just PCI Compliance. Host Merchant Services is committed to keeping its merchants safe and secure. The company takes the lead in the industry in terms of PCI Standards with its PCI Compliance Initiative. And the company offers added layers of protection to its merchants through its Data Breach Security Program.

PCI and the Data Breach [2023 Update]

TodayThe Official Merchant Services Blog continues looking at the bigger picture of the impact from the Global Payments Data Breach — specifically looking at the affect it’s going to have on PCI DSS as well as a little foray into State Security Breach Notification Laws.

You’ll remember yesterday we highlighted some of the criticisms found in the PCI DSS, specifically this article by Taylor Armerding which suggested that PCI compliance is not enough to protect data from the skilled and focused hackers who cause these data breaches.

We then focused on how PCI Compliance is still a great foundation for your transaction security. The standards and protocols set up by the council are the first step a merchant needs to take to protect their data. And Host Merchant Services offers a PCI Compliance Initiative that helps its merchants quickly and seamlessly take that step.

Still the idea that PCI DSS is not living up to its billing as security shows itself in this story from Wired about a small business filing suit against against its bank claiming that the financial institution, which used to process the restaurant’s credit and debit card transactions, wrongfully seized money from the business’ merchant bank account. In short, the business is suing the bank for taking funds as penalties for being non-compliant with PCI DSS.

Taking it to Court

The story explains that Stephen and Theodoara “Cissy” McComb, owners of Cisero’s Ristorante and Nightclub in Park City, Utah, racked up $90,000 in fines that Visa and MasterCard imposed after alleging that Cisero’s had failed to secure its network and suffered a data breach that resulted in fraudulent charges on customer bank cards. U.S. Bank seized about $10,000 from the McComb’s merchant account to cover those penalties and then sued the McCombs to obtain the remaining balance on the fines, saying a contract the McCombs signed with the bank makes them liable for such fines.

The McCombs struck back with a bold countersuit. The story explains: “But in their countersuit against U.S. Bank, the McCombs allege that the bank, and the payment card industry (PCI) in general, force merchants to sign one-sided contracts that are based on information that arbitrarily changes without notice, and that they impose random fines on merchants without providing proof of a breach or of fraudulent losses and without allowing merchants a meaningful opportunity to dispute claims before money is seized.”

This suit challenges the basic foundation of PCI security standards and opens up a lot of old wounds and criticisms about PCI DSS in context of the card issuers that make the call and form the council for PCI DSS. As the story says: “The controversial system, imposed on merchants by credit card companies like Visa and MasterCard, has been called a “near scam” by a spokesman for the National Retail Federation and others who say it’s designed less to secure card data than to profit credit card companies while giving them executive powers of punishment through a mandated compliance system that has no oversight.”

The linked article provides much of the details that led to the data breach with Cisero’s, as well as why the fines and penalties were applied according to PCI DSS standards. The McComb countersuit relies heavily on their assertion that PCI DSS oversteps its bounds in applying those penalties, offers no recourse for people to dispute the penalites, and levies penalties against businesses for violations even when no fraudulent transactions occur.

The Cost of a Data Breach

This case above and much of the criticism targeting PCI DSS deals with the fines banks, processors and subsequently merchants face when data gets breached. This article looks into the cost merchants face when the worst case scenario occurs. A lot of merchants feel that lack of compliance isn’t an issue because they feel they are not responsible of something goes awry. But this article sheds some light on that: “suppose you or your merchant is suspected of one of those inevitable human errors, or of being a victim of a hacker. As long as there isn’t actually a breach, it’s no big deal, right? Wrong.”

The article lists the costs of penalties:

Forensics Audit done by investigators when they suspect your business is susceptible to a breach: Between $8,000 and $20,000
$3 to $10 per card to replace all cards compromised in a breach that happens.
$5,000 to $50,000 in fines for lack of compliance.
And even further in fines specifically tied to any fraudulent transactions that do occur as a result of the breach.

The article states that the average cost comes to $36,000, a hefty sum that can cripple small businesses. The McComb data breach may seem high in comparison, but going over the huge variance in the fine structure, it’s pretty easy to see how the bank came to a $90,000 figure.

Back to Global Payments

Speaking of the fees and penalties, it’s interesting to note that the company faces many of the same problems that small businesses do now that Global has been breached and run afoul of Visa in terms of PCI Security and Compliance. However this story for ZDNet states that the company will likely absorb any costs from the data breach and not be affected as badly as some of the small businesses discussed above are affected by fees and penalties.

Global Payments continues to process, even after being dropped by Visa’s list of providers that meet security standards. The company is now working on being reinstated and once again being PCI Compliant. Working in their favor is their statements that they reported the breach to authorities the moment they found out it happened.

Which brings us to …

Security Breach Notification Laws

Security Breach notification laws were enacted in response to an escalating number of breaches of consumer databases containing personal information. The first such law was the California data security breach notification law, or SB 1386. It was enacted in 2002 and became effective on July 1, 2003. Currently 46 states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted similar legislation requiring the notification of security breaches involving personal information. The only states that currently have no such law on their books are Alabama, Kentucky, New Mexico and South Dakota.

Host Merchant Services is located in Delaware. The Delaware Security Breach Notification Law can be reviewed in its entirety at This Link.
Global Payment Systems is located in Georgia. The Georgia Security Breach Notification Law can be reviewed in its entirety at This Link and its subsequent amendment can be found at This Link.

These laws tend to follow a similar basic structure to the one California passed first in 2002 — companies need to immediately disclose a data breach to customers, usually in writing. There have since been a number of bills that would establish a national standard for data security breach notification but none have been passed in Congress yet.

The Bottom Line

So what does this all mean? For now it appears that Global is weathering the storm brought on by the news of the data breach. They’ve minimized the impact of the bad news and are working to get their compliance situation straightened out. The data breach has put the spotlight onto the PCI DSS itself and we’ve seen that some small businesses and merchants are highly critical of the system. Comparing the crippling fines they can theoretically face for a breach that leads to no fraud against the impact that a large processor like Global faces for the same type of problem can leave some thinking the system needs more oversight. But PCI DSS does set the bar for security. It forces hackers to work harder than they would if it didn’t exist. It is a first step in terms of what merchants and processors need to do to protect transaction and data security.

The court case in Utah is very fascinating as it really takes the contract aspect of the PCI DSS to task. The Official Merchant Services Blog will continue to follow the news on that case. And we will keep you posted on the latest developments with this Global Payments Data Breach.