Merry Christmas, I know the season has passed already, but given the recent massive data thefts that have occurred at various retailers, and the misery this has caused both their customers and them, I thought, why not try to cheer everybody up a bit.
Besides, I needed a nice segue from what is, arguably, one of the most important stories to pop-up recently, to some business process questions every retailer must ask and answer about transactional security from the POS System (Point of Sale) upwards and how much money they are spending on marketing and then blowing on poor data security practices.
Don't Let Consumers Think This about Your Security Standards for Credit Card Transactions
As a consumer, and we are all ultimately, consumers, I never even heard of PCI-DSS until about six months ago, when I ran a SAP Greenfield implementation at a major retailer in Europe. It is now very clear that PCI-DSS Compliance is mission critical to the business. It's a key element of the solution architecture a retailer needs to have in place in order to securely drive sales.
So what does PCI-DSS stand for and why might you, a consumer, want to know about it?
It stands for Payment Card Industry Data Security Standard and if you have a credit card issued in Europe, you most likely have a chip in your card, whereas, if you have one issued here in the U.S., it probably does not, though there are a few issuers who use them.
It provides expert guidance that defines the information security standards that major credit card brands must use to handle transactions to remain in PCI DSS compliance. It also defines the standards and information security procedures and standards that those who accept Credit Cards must adhere to. It is a comprehensive list of Best Practices that should be followed by anyone accepting credit cards and debit cards to help manage risk. If defines methods and procedures for managing critical aspects of customer data, throughout the now often very long lifecycle of that data.
You should be aware that there are different levels of PCI DSS Compliance, based on a variety of factors, such as annual transaction volume and value.
Each of these levels requires various levels or elements that must be met in order for the merchant to work with different payment processors. It also affects the financial arrangement that affects merchant accounts and their associated payment processors.
I asked one of my Senior SAP FICO consultants (who also is an expert with various BPC functions and how retailers are using that solution as well for very advanced financial management functions) why this is and he explained the following to me:
"(Chip and PIN's) main attraction to banks and other financial institutions that issue Credit Cards is the 'liability shift,' which is precluded in the U.S. by Regulation E,"
"This shift means that disputed transactions will be blamed on the customer if a PIN was used and the merchant otherwise. Thus, in theory, the bank would never again be liable. In practice it has not worked. You can't have a secure system if one party guards it and another party pays the cost of failure.“
Such a shift isn't possible in the U.S. because of rules set up under the Electronic Fund Transfer Act of 1978.
This is probably good news for U.S. consumers, since the standard was fully adopted, it's been next to impossible for British consumers to recover money stolen in fraud.”
That last little tidbit, is, to me, of critical importance, having been a victim of Credit Card fraud in the past in the U.S. and ultimately having been made whole by my card issuer.
The marketing opportunity here is for a retailer to make it perfectly clear to a consumer that in addition to taking all possible technical security measures possible to secure their payment processing system, they will ALWAYS make their customers whole in the event of a data breach. In fact, it can and does form a major part of the sales strategy of several big box retailers who rely on the trust of their customers, suppliers and payment gateway providers.
As an Hubspot Consultant and Inbound Marketer, I could see several possible pieces of content one might want to generate and reuse constantly to assure consumers that their credit card/debit cards are safe to use in the stores:
Though highly unlikely, should consumers lose confidence in the security of their credit cards, they will revert to cash only transactions.
You will also need to do a self assessment on your internal business policies such as application security. You will need to make sure your e-commerce software is up-to-date with the latest patches. If you have a physical retail store, you will need to make sure your POS system is isolated from your WiFi and maintain a list of wireless access points.
PCI-DSS compliance has several different Self Assessment Questionnaires (SAQs) that must be followed to be PCI DSS compliant.
These allow you to document both your compliance process system design as well as how you have actually been performing against these industry standards.
Most people believe this is cheaper than a credit card transaction to the vendor, but, as most any large retailer will tell you, that may not be the case, at all.
For instance, if your store is doing 1 million a day in transactions, and 10% of those transactions are in cash, you are handling $100,000.00 of cash, which has to be counted, audited, secured and transported.
Each of those steps has a cost, and they all take far longer to accomplish than an electronic transaction.
Now imagine, tomorrow, that ratio is reversed, and you are doing $900,000.00 in cash transactions and $100,000.00 in credit card transactions.
Your logistics cost just went up, your risk of armed robbery during transport just went up (and your cost of security went up, no doubt), and your ability to squeeze the payment gateway provider commission rate just went way down.
You also now have consumers who are a lot less likely to make purchases as they don’t have access to cash so easily and you added a lot of sand in the transactional gears.
In short, these massive data thefts are a threat to the economy at the systemic level and may drive your marketing cost way up.
That is why you need to not only get PCI-DSS and EMV compliant, you need to have a marketing approach that leverages your efforts to secure those transactions at the lowest possible cost and communicate your success in doing this to your consumer.
You can start by learning more about how Inbound Marketing, (which is usually about 61% cheaper than other marketing means), can help you boost customer satisfaction, especially by providing content that reassures consumers that their Credit Card transactions conducted with your establishment are secure and does not result in any liability being shifted to them which should go a long way toward achieving your Retail Strategy goals.
People Who Read This Also Read:
About SAP BW Consulting, Inc.
SAP BW Consulting, Inc. provides comprehensive SAP solutions, including SAP Business Intelligence (BI) and SAP Business Warehouse (BW) consulting, SAP ABAP development, and project management. Our services also include a 1099 Contractor Invoicing and Payment Management System, Salesforce consulting, and Balanced Scorecard consulting for strategic planning.
As HubSpot Marketing and Sales Partners, we specialize in Google Ads, Facebook Ads, LinkedIn Ads, Account-Based Marketing, Content Marketing, and Ecommerce solutions, including Shopify.