Changing Times in the Payment Card Industry

Credit card fraud has been a growing problem and is big business for malicious individuals and organized groups alike. According to the July 2007 Neilson Report, losses to card issuers (Visa^®, MasterCard^®, etc.) due to card fraud in 2006 totaled $4.84 billion, up 12.8% from the previous year. As fraud losses have increased, credit card companies have realized a greater need for formalized security standards and practices.

In June 2004, in an effort to facilitate the broad adoption of consistent security measures on a global basis, American Express^®, Discover^® Financial Services, JCB^® International, MasterCard^® Worldwide, and Visa^® Inc. jointly created the Payment Card Industry Data Security Standard (PCI DSS). The PCI DSS is based on 6 fundamental objectives that are further divided into 12 major requirements and a slew of sub-requirements. These requirements cover broad topics such as network design, software development, security administration, and IT governance.

The Impact to Nonprofits

How does PCI affect your organization? Well, first you need to determine what information you maintain and whether or not it is within the scope of PCI DSS. PCI DSS defines cardholder information as the primary account number (PAN or credit card number); data obtained as part of a payment transaction including cardholder name, expiration date, and service code; and "sensitive authentication data" such as magnetic stripe data, PIN, CVV2, or CVC2 information. The PAN is the defining factor in the applicability of PCI DSS. If your organization stores, processes, or transmits PANs then you are expected to comply with the full extent of the PCI DSS. Organizations that do not store, process, or transmit PANs are not required to comply. If you are uncertain as to how PCI affects you, the best course of action is to contact your processor or acquiring bank to determine your compliance requirements.

Penalties for non-compliance vary, ranging between $5,000 and $25,000 per month for each month an organization is found to be non-compliant. These fines are typically levied directly against the card processor or merchant bank who issues the merchant account to the merchant found to be in violation. Those fines, however, are typically passed down to the merchant in one form or another. Despite these hefty fines, the most costly penalties for non-compliance are actually incurred in the event your organization experiences data loss. The loss of your reputation, your customers, and the risk of litigation are far more damaging to your business than simple fines. If the circumstances surrounding the data loss are particularly egregious, the card companies could even deny your ability to process credit cards altogether.

Why Is This Important?

In the end, securing credit card information is not about protecting the card companies or addressing yet another compliance standard. It’s about our due diligence to protect cardholders from having their information distributed — whether intentionally or unintentionally — to those who intend to misuse it. For too long organizations have been frivolous in the use and protection of our personal information. You need only to pick up the newspaper or watch the news to see the numerous cases that substantiate this claim. If you have ever been a victim of identity theft, you know that the burden to resolve issues related to the loss of personal information is placed solely on the individual. The fact that identity theft has impacted over 3% of the U.S. population to date should be disquieting to most. What's worse is that number continues to grow. Now is the time for organizations to come together to do something about this trend, and one important step is the broad adoption of the Payment Card Industry Data Security Standard. It's simply the right thing to do, and that is what nonprofits do best.

Learn more online about the Payment Card Industry Data Security Standard , read our Frequently Asked Questions, or check out our PCI Compliance blog.