payments - Retail Systems

you’re looking for. So, this is in a pre authentication scenario, you
need the transaction to be both 3D secure and tokenised and
correctly charged. So once we have this more retailers out there
will find it easier to become compliant.
AJ: So what you’re saying is; it’s not a lack of awareness, it’s
just the tools aren’t really out there?
AH: I believe the tools are not available. The technical challenges
of implementing the harder PCI standard regulations are
just too great. Retailers have commercial drive and a limited
amount of money to implement these kinds of technologies.
The reasonable take on this would be to wait until the right tools
are out there, which is dangerous in itself because it becomes
too tempting to simply tick the box with your card portal and
implementation plan.
A SB: When we’re out speaking to merchants the thing that
often strikes me is that merchants don’t understand their
requirements around PCI. The biggest response we get is that
they’ve taken on a solution – whether that be a standalone
solution or PSP service – and as part of that the stand they’re
taking on everything is that they’re compliant. There’s a lack
of understanding on the retail side, they don’t understand all
the requirements around PCI. Yes, there’s a self assessment
questionnaire to fill in but how many retailers have actually got
somebody who’s got the expertise to answer those questions
and actually understand what those questions mean. In my experience
very few. It is for this reason why Phoenix, as vendors,
has taken it upon ourselves to help educate the smaller merchants
we are working with through various trade organisations.
Yes the acquirers have a responsibility to help and educate their
merchants but I believe everyone in the payments chain has a
duty to educate including the PCI Council and the vendors.
BF: I think the biggest problem we have in our company
is to get management to understand that it is a continuous
job and it does take a lot of energy away the likes of the IT
department, the infrastructure – because PCI is not only IT –
and educating the whole business. Our top management doesn’t
understand that we have to invest in that as well.
CM: We’ve had quite a focus on PCI for a number of years now
but we’ve only just become compliant in the US. And the UK,
which is another key market for us, is the only other market
where we’ve integrated solutions and at the moment we’re on a
standalone piece which removes the scope to a certain degree
depending on country by country and acquirer by acquirer. I
think it’s more difficult for an international brand to go across
the board with one solution and we’ve just have to tackle it
market by market.
roundtable
AJ: Did you take the same approach as Alex – taking your systems
out of scope of the PCI standard altogether by making
sure that sensitive payment information from customers does
not enter your systems?
CM: We de-scoped completely, that was our whole approach;
a semi integrated solution that de-scoped PCI completely.
We’re very much watching the market because of the dynamic
changes there are in payments solutions at the moment, that’s
got a big pull in terms of our vision going forwards.
CP: I always had the philosophy that if you don’t have it you
don’t have to protect it. I told my merchants to keep the cards
and payments area outside in e-commerce – this was way
before PCI. So when PCI came along I continued the philosophy.
In the five years that I did consultancy for the Post Office, from
the very beginning it was – get rid of the data. The Post Office
is the biggest retailer in Europe. And if the biggest retailer in
Europe doesn’t need to hold card data, then no-one else does.
There are 20 people who have access to data at the Post Office,
because they need to have access to data for prosecution
purposes. The key to it is outsourcing.
JK: Just to say that the big merchants, the tier 1 merchants of
the UK, don’t understand PCI is wrong. From my experience they
do and the vast majority if they aren’t compliant are in the final
stages of reaching compliance. Is there a problem with the small
merchants? Absolutely. The main problem is that they don’t
understand the language we’re talking. And it is our role, along
with everybody involved in this process – acquirers, banks, card
associations and brands – to try to simplify the message. If small
merchants only took payments face-to-face they wouldn’t have
a problem, but many small merchants are moving into e-commerce.
The problem is that they’re not IT experts, they haven’t
got a clue about security and they’ve walked into a minefield.
AJ: So is it more of a problem for the acquirers and the banks?
JK: It’s a problem for everybody, including the acquirers and
schemes and banks and brands. We have to get down there and
talk to the small merchants and say to them: ‘Just use a third
party payment provider. It’s going to cost you £60 a month, and
I know that’s a lot of money, but you’re going to save yourself a
whole heap of bother.’
AJ: Is the message then to outsource?
RS
June - July 2012 RS 33