April 6, 2012, 4:10 PM

On their own

E-retailers fend for themselves in the wake of a data breach.

No one likes to hear of yet another network breach in which criminals steal sensitive payment card details. Not consumers, not e-retailers, not payment processors, not the banks that issue credit and debit cards. But there was more of that kind of bad news last week when payment processor Global Payments Inc. disclosed parts of its network had been hacked and that criminals made off with sensitive data from as many as 1.5 million payment cards.

While card brands Visa Inc., MasterCard Inc., Discover Financial Services and American Express Co. will deal with Global Payments, and banks will reissue thousands of credit and debit cards, e-retailers will have to contend with the breach fallout on their own. As Gartner Inc. security analyst Avivah Litan said of retailers, “They don’t get any fair warning.”

E-retailers can use the Global Payments breach as an impromptu reminder to reassess their fraud prevention efforts. This can be especially important for smaller e-retailers that may take a more hands-off approach and rely on their payment services providers.

If I ran an e-commerce business, I’d start first with an analysis of the fraud rate. Is it acceptable? If not, what can be done about it? What services can the payment provider supply? What can help the business without creating a headache for my customers or me?

If the fraud rate is fine, I’d still evaluate it to ensure that the resources put into keeping it low are not thwarting legitimate sales that get caught up in the anti-fraud measures.

I’d also ask what measures are in place beyond simply meeting the data security standards set by the Payment Card Industry Security Standards Council, commonly known as PCI. PCI compliance is a good starting point, but it’s designed to protect the integrity of the payment system, not to assure that a retailer is blocking fraud without turning down good customers.

As a smaller e-retailer, I’d find out if the payment services provider offers tools to help remove sensitive payment card data so my e-commerce system does not store them. Can that be done affordably and without impeding the checkout process?

I’d also ask about any PCI or security fees appearing on my payment processing statement. What really is delivered with those fees? Are they reasonable? Are these fees truly paying for a service that helps my bottom line, or my payment provider’s bottom line?

Essentially, I’d ask myself if I am doing everything possible to protect the cash flow my business must have. A company the size of Global Payments, which annually processes 5 billion global transactions, likely will survive this incident. But a smaller e-retailer that suffers a similar breach may not fare as well.

comments powered by Disqus

Advertisement

Recent Posts from this Blog

FPO

John Pincott / E-Commerce

The secrets to success of buy online, pick up in store

Training, signage and motivation are all critical elements to making in-store pickup work. If done ...

FPO

Meyar Sheik / E-Commerce

Time to spring clean your digital retail strategies

With holiday promotions starting as early as September, now is the time to assess the ...

FPO

Donna Fulmer / E-Commerce

Weekend sends: Email works—even when you’re not

Why give your email program the weekend off? A recent study shows consumers open emails ...

FPO

David Jones / E-Commerce

Web performance lessons from Valentine’s Day

Online dating sites are swamped with traffic in advance of the annual celebration of love. ...

Advertisement

Advertisement