I just read a great article on the Heartland breach, which I’ll talk more about later. There is one quote in there that really stands out:
End-to-end encryption is far from a new approach. But the flaw in today”s payment networks is that the card brands insist on dealing with card data in an unencrypted state, forcing transmission to be done over secure connections rather than the lower-cost Internet. This approach avoids forcing the card brands to have to decrypt the data when it arrives.
While I no longer think PCI is useless, I still stand by the assertion that its goal is to reduce the risks of the card companies first, and only peripherally reduce the real risk of fraud. Thus cardholders, merchants, and banks carry both the bulk of the costs and the risks. And here’s more evidence of its fundamental flaws.
Let’s fix the system instead of just gluing on more layers that are more costly in the end. Heck, let’s bring back SET!
Reader interactions
5 Replies to “The Most Powerful Evidence That PCI Isn’t Meant To Protect Cardholders, Merchants, Or Banks”
[…] companies have had their certifications retroactively revoked for political reasons after the fact. As I keep saying, PCI is really about protecting the card companies first, with as little cost to them as possible, […]
I tell people that PCI compliance is like a high school diploma: if you don’t have one, people suspect you’re an idiot. If you do have one, no one is impressed.
I think the same analogy applies to a QSA’s certification as well. QSAs do nothing to elevate the baseline required by PCI, they only reinforce the low standards and encourage complacence after an audit. I would weclome a QSA that asks hard questions about our policies and practices and then checks to see if our documented policies and practices match our real world implementation.
After reading up on SET (hadn’‘t heard of it until now), it makes sense that it wasn’‘t adopted (SET makes too much sense). SmartCards have not gained traction in the U.S. for similar reasons, “too expensive to change over”, and “slower transaction times” are often thrown around as excuses. Which is ridiculous because fraud is easily more expensive to all those involved than a transition to Smartcards.
[…] comment from Jack Pepper on “PCI isn’t meant to protect cardholder …” […]
Yes the standard is considered the bare minimum. And yes it’s primary purpose is to protect the card companies and not the end consumer. But it was a much needed standard since it gave the credit card companies a standard by which they could threaten the revocation of companies processing credit card transactions. Without the standard it would would have been to subjective and more difficult to enforce disciplinary actions.
Why is this surprising? the PCI standard was developed by the card industry to be a “bare minimum” standard for card processing. If anyone in the biz thinks PCI is more that “the bare minimum standard for card processing”, they are mistaken.
I tell people that PCI compliance is like a high school diploma: if you don’‘t have one, people suspect you’‘re an idiot. If you do have one, no one is impressed.
jp