Why PCI Compliance is Important for Retailers

By Kristen Graminga

If you own or operate a retail store, you probably don’t spend a lot of time thinking about payment security. After all, there are so many other things to worry about — e.g., generating sales and staying ahead of the competition. However, the health of your payment environment isn’t something you should gloss over.

In fact, the data security rules established by the Payment Card Industry (PCI) can have a profound impact on your bottom line. These guidelines govern how retail stores properly handle credit card transactions, including:

account numbers;
card expiration dates;
cardholder names; and
card verification values (CVVs).

If you capture, process, transmit or store any of the above, you must take steps to safeguard this sensitive payment data. Failure to do so means you're subject to the following:

risk of credit card fraud within your store;
hefty fees and penalties for noncompliance;
potential litigation and legal expenses; and
diminished consumer confidence in your business.

Why PCI Compliance is Especially Important for Retailers

PCI compliance applies to all organizations that handle credit card data of any kind, but these data security rules are particularly important for retailers because of the following:

Retailers are especially vulnerable to fraud because they often lack the IT resources to protect credit and debit card data from thieves. As such, they’re more attractive targets to would-be criminals.
Many retailers process card-not-present (CNP) transactions through their online stores. It’s impossible to verify the identity of anonymous shoppers, so e-commerce sites are especially susceptible to fraud. By some estimates, losses stemming from CNP fraud now approach $6 billion.

How Does Your Business Become PCI Compliant?

At first glance, the PCI compliance rules can seem overwhelming. This is why so many retailers put off the process for as long as possible. Don’t make the same mistake. The guidelines may seem complex, but they all fall within three main categories:

1. Payment Environment Assessment

This step involves taking a free self-assessment questionnaire (SAQ) that identifies any potential vulnerabilities stemming from how you capture, store and transmit credit card data within your payment environment. Think of the SAQ as a diagnostic test that analyzes the robustness of your current security protocols.

2. Vulnerability Remediation

During this phase, you begin fixing potential vulnerabilities. Remediation might include installing firewalls, patches or updates. It can also include eliminating unnecessary cardholder data from your system or assigning user-specific access to prevent employees from abusing stored data. Many retailers also work with a quality security assessor during this phase of the PCI compliance process.

3. Data Security Reporting

In this final phase, you begin compiling data security reports that you send on to your bank, payment processor and major credit card brands. You’re not officially PCI compliant unless you get the seal of approval from these stakeholders.

PCI Compliance is Only the Beginning

Many retailers hope once they become PCI compliant, their job will be finished. Sadly, this isn’t the case. True PCI compliance isn’t a one-time fix. Rather, it’s an ongoing process that must be revisited annually. Fraudulent tactics continue to evolve, so the prevention strategies you use must also evolve.

In fact, following the latest PCI guidelines may not be enough to keep your business safe. This is why you should take additional steps to make your store less attractive to potential thieves. Common strategies include using:

credit card tokenization;
point-to-point encryption;
EMV chip card processing;
hosted payment pages; and
fraud management filters.

The more roadblocks you present, the safer your payment environment becomes.

Taking the First Important Step Toward PCI Compliance

Still have questions about PCI compliance? Not sure how to get started? That’s understandable. Navigating the terrain can be daunting, especially if you’re a smaller retailer that's simply trying to make ends meet.

Below is an infographic that covers the most essential components of PCI compliance. You can use this resource as a reference guide as you begin conducting a thorough analysis of your retail store’s payment security.

Kristen Gramigna is chief marketing officer for BluePay, a provider of fast, easy and secure payment processing solutions.