DURANGO, Colo. — "Credit card data thieves are so clever and persistent, all the rules about card data handling and storage are changing," said Matthew Turner, chief marketing officer for Mercury Payment Systems. "And that's forcing changes for all in the payment processing chain, from merchant to point-of-sale system developer to reseller to processor."
According to a company news release, Mercury Payment Systems, a payment processing company whose platform is integrated to most major point-of-sale (POS) systems, provides credit, debit, gift and loyalty processing for restaurants, groceries and specialty retail stores.
"Criminals just continue to get smarter," Turner said. "They first targeted online shoppers. Next they moved on to large brick and mortar retailers. Now they're active in all market segments."
The result is that the credit card associations developed the Payment Card Industry (PCI) Data Security Standards, a set of 12 rules for the secure handling of sensitive credit card data.
"A year ago, most merchants hadn't even heard of PCI," Turner said. "They are just beginning to realize their liability if they have a card data breach. The card associations developed these guidelines for everyone's protection. Even if card data is exposed inadvertently, the merchant faces a forensic audit and fines up to $500,000."
The PCI standard covers best practices for everyone connected with credit card payments, including all card association members, merchants, and service providers that store, process or transmit cardholder data. These security requirements also apply to all "system components," including the POS systems used in most restaurants.
"Now it's time for merchants to act," Turner said. "In this past year, POS developers have released newer, PCI-compliant versions of software that do not store prohibited data and that encrypt or truncate whatever data must be stored."
