April 6, 2012, 4:10 PM

On their own

E-retailers fend for themselves in the wake of a data breach.

No one likes to hear of yet another network breach in which criminals steal sensitive payment card details. Not consumers, not e-retailers, not payment processors, not the banks that issue credit and debit cards. But there was more of that kind of bad news last week when payment processor Global Payments Inc. disclosed parts of its network had been hacked and that criminals made off with sensitive data from as many as 1.5 million payment cards.

While card brands Visa Inc., MasterCard Inc., Discover Financial Services and American Express Co. will deal with Global Payments, and banks will reissue thousands of credit and debit cards, e-retailers will have to contend with the breach fallout on their own. As Gartner Inc. security analyst Avivah Litan said of retailers, “They don’t get any fair warning.”

E-retailers can use the Global Payments breach as an impromptu reminder to reassess their fraud prevention efforts. This can be especially important for smaller e-retailers that may take a more hands-off approach and rely on their payment services providers.

If I ran an e-commerce business, I’d start first with an analysis of the fraud rate. Is it acceptable? If not, what can be done about it? What services can the payment provider supply? What can help the business without creating a headache for my customers or me?

If the fraud rate is fine, I’d still evaluate it to ensure that the resources put into keeping it low are not thwarting legitimate sales that get caught up in the anti-fraud measures.

I’d also ask what measures are in place beyond simply meeting the data security standards set by the Payment Card Industry Security Standards Council, commonly known as PCI. PCI compliance is a good starting point, but it’s designed to protect the integrity of the payment system, not to assure that a retailer is blocking fraud without turning down good customers.

As a smaller e-retailer, I’d find out if the payment services provider offers tools to help remove sensitive payment card data so my e-commerce system does not store them. Can that be done affordably and without impeding the checkout process?

I’d also ask about any PCI or security fees appearing on my payment processing statement. What really is delivered with those fees? Are they reasonable? Are these fees truly paying for a service that helps my bottom line, or my payment provider’s bottom line?

Essentially, I’d ask myself if I am doing everything possible to protect the cash flow my business must have. A company the size of Global Payments, which annually processes 5 billion global transactions, likely will survive this incident. But a smaller e-retailer that suffers a similar breach may not fare as well.

comments powered by Disqus

Advertisement

Recent Posts from this Blog

FPO

Deepak Agarwal / E-Commerce

Back-to-school insights from a Top 100 online retailer

It’s the second-largest online shopping season, and one nomorerack.com CEO pays close attention to. Here ...

FPO

Kevin Sterneckert / E-Commerce

The ghost economy: an $800 billion retail data disconnect

A new twist on a classic holiday story that online retailers will relive in the ...

FPO

Jim Erickson / E-Commerce

Why Western brands should register trademarks in China—now

China doesn’t recognize trademarks registered in other countries. Companies that register first in China get ...

FPO

Asher Elran / E-Commerce

E-commerce and duplicate content: solutions to common problems

Google penalizes retail web sites that display the same content on multiple pages, or that ...

Advertisement

Advertisement