The high cost of unprotected data

Stakes are high for small businesses hit by credit card fraud because there’s little margin to swallow losses — or fines — as the credit card industry cracks down on a multibillion-dollar problem.

Consumers might pay a fee but aren’t held responsible for fraudulent purchases made on their credit cards. Yet merchants get stuck with the bill and more. They can lose their ability to process credit card payments, be audited and/or face significant fines from their banks.

“It can literally cause a business to go out of business,” said Bob Russo, general manager at Wakefield, Mass.-based Payment Card Industry Security Standards Council LLC, which maintains standards developed by the credit card industry to protect private consumer information.

Payment card fraud cost U.S. merchants an estimated $4 billion in online revenue in 2008, according to CyberSource Corp. in Mountain View. That’s up from $3 billion in 2006 and $1.9 billion in 2003.

The five major credit card companies — Visa, MasterCard, American Express, Discover and Japan Credit Bureau (JCB) — developed the security standard in 2004. Merchants are supposed to follow the rules to prevent account information from falling into the wrong hands.

The standard applies to any organization that holds, processes or passes on credit or debit cardholder information.

This can mean anything from a dry cleaner to a home-based business, doctor or lawyer’s office, a mall kiosk or mom-and-pop restaurant, said Jay Cline, president of Minnesota Privacy Consultants and author of a how-to book on small-business compliance with the standards sponsored by CalBizCentral, a division of CalChamber.
Mistakes can be costly

Enforcement, which is handled by the banks that manage merchant accounts, started with big business at the top of the food chain, but it’s now down to smaller merchants. More than 80 percent of payment card breaches occur at small businesses, according to Jennifer Fischer, director of payment system risk at Visa Inc.

Fines vary by merchant size and the scale of the problem, but typically start at $5,000 per month for small businesses and go as high as $25,000 per month for large merchants, she said. Fines run until the system is in compliance.

Yet many small businesses don’t even know the rules exist, or assume the companies they work with protect the data.

A small microbrewery and restaurant in Lodi was fined $27,000 after an investigation into a possible data breach in 2007 showed the company’s computer system had stored private consumer data for three years, including card numbers for more than 11,000 customers.

Industry standards require merchants to keep cardholder data storage to a minimum to avoid risk that someone will hack into the system and use the information in the wrong way.  Lodi Beer owner Roger Rehmke blames the problem on the third-party credit card processor that transmits information from merchants to banks. Visa and MasterCard fined the intermediary $27,000 for noncompliance, but it passed the fine on to Rehmke.   “You’d be amazed what I went through,” said. “We had no idea we were holding the data.”

This kind of disconnect has credit-card companies, the council that maintains the industry standard and business groups working to step up education efforts.

Knowledge is key

CalBizCentral, which helps members understand and comply with laws and standards, supports the notion that the industry stepped up to regulate itself with one standard instead of a medley of rules from different card companies, said CalChamber executive vice president Jan Bell.

“There’s been a lot of exposure about security breaches at big companies, but the reality is breaches at small companies is where a lot of this occurs,” she said.

The data standards are “pretty technical” and written from a big company, information technology perspective, Bell said, so the chamber asked Cline to write a how-to book, called “Take Charge,” that simplifies the issues for small merchants.