April 6, 2012, 4:10 PM

On their own

E-retailers fend for themselves in the wake of a data breach.

No one likes to hear of yet another network breach in which criminals steal sensitive payment card details. Not consumers, not e-retailers, not payment processors, not the banks that issue credit and debit cards. But there was more of that kind of bad news last week when payment processor Global Payments Inc. disclosed parts of its network had been hacked and that criminals made off with sensitive data from as many as 1.5 million payment cards.

While card brands Visa Inc., MasterCard Inc., Discover Financial Services and American Express Co. will deal with Global Payments, and banks will reissue thousands of credit and debit cards, e-retailers will have to contend with the breach fallout on their own. As Gartner Inc. security analyst Avivah Litan said of retailers, “They don’t get any fair warning.”

E-retailers can use the Global Payments breach as an impromptu reminder to reassess their fraud prevention efforts. This can be especially important for smaller e-retailers that may take a more hands-off approach and rely on their payment services providers.

If I ran an e-commerce business, I’d start first with an analysis of the fraud rate. Is it acceptable? If not, what can be done about it? What services can the payment provider supply? What can help the business without creating a headache for my customers or me?

If the fraud rate is fine, I’d still evaluate it to ensure that the resources put into keeping it low are not thwarting legitimate sales that get caught up in the anti-fraud measures.

I’d also ask what measures are in place beyond simply meeting the data security standards set by the Payment Card Industry Security Standards Council, commonly known as PCI. PCI compliance is a good starting point, but it’s designed to protect the integrity of the payment system, not to assure that a retailer is blocking fraud without turning down good customers.

As a smaller e-retailer, I’d find out if the payment services provider offers tools to help remove sensitive payment card data so my e-commerce system does not store them. Can that be done affordably and without impeding the checkout process?

I’d also ask about any PCI or security fees appearing on my payment processing statement. What really is delivered with those fees? Are they reasonable? Are these fees truly paying for a service that helps my bottom line, or my payment provider’s bottom line?

Essentially, I’d ask myself if I am doing everything possible to protect the cash flow my business must have. A company the size of Global Payments, which annually processes 5 billion global transactions, likely will survive this incident. But a smaller e-retailer that suffers a similar breach may not fare as well.

comments powered by Disqus

Advertisement

Recent Posts from this Blog

FPO

Chad White / E-Commerce

The e-mail marketer’s holiday planning checklist: fall edition

It’s October, and time to make sure your e-mail marketing program is ready for the ...

FPO

Tony DiCostanzo / B2B E-Commerce

B2B e-commerce in a B2C world

Companies that sell online to other companies can learn a lot from looking at the ...

FPO

Vebeka Guess / E-Commerce

Three online shopping trends to note this holiday season

Lessons from the 2013 holiday season point the way for effective marketing tactics in the ...

FPO

Deepak Agarwal / E-Commerce

Back-to-school insights from a Top 100 online retailer

It’s the second-largest online shopping season, and one nomorerack.com CEO pays close attention to. Here ...

Advertisement

Advertisement