PCI: Enough Carrots and Sticks or No Teeth?

Thanks to Mike from pcianswers.com for his recent comments to my post on PCI penalties not being stiff enough. I am thrilled that there are finally some carrots and sticks like Mike mentions in his recent blog.

But, how much is the one-time payment in the Visa CAP program? $10,000 a month? For you and I, that's a lot of money, but, to a large company ,it may be peanuts...or at least less expensive than the cost to comply.

To me, the best enforcement is by the CONSUMER. I would like to walk into a store or shop on-line and see some kind of sign that I would trust indicating that this merchant has been validated - a "Good Houskeeping seal" of some kind.

Conversely, I would like to know if the merchant is not compliant. As a consumer, I want to be informed so that I can make a decision to shop here or not. At the end of the day, it is about protecting consumers.

Give consumers the power to decide. That's my two cents.

Speaking of carrots and sticks, news stories are starting to give us some idea what TJX may be facing in fines as a result of their data breach. According to some stories, the amount could be in the half-million dollar range. A significant fine, to be sure, but, to my point above? What is that to a company like TJX? Not sure it's still a big enough stick, given the costs of covering the fraudulent purchases and replacement of millions of cards at $30 a piece. Evan Schuman talks about the lack of teeth in PCI on eweek.com this week.

What's your opinion?

 

Comments

[Mike]

Alex, good question. How about the debate that Alex and PCI Answers are having on this issue?

I would state that fines are steep for small merchants, but small for large merchants. So why should large merchants care? Check out the list:
http://pcianswers.com/2007/02/26/seek-first-to-understand-and-then-to-be-understood/

* Class action lawsuit
* Reissuance fees
* Card brand cost recovery programs for Issuers
* Credit monitoring
* Potential FTC regulation (did people forget that BJ's Wholesale club got hit with this?)
* Remediation costs

Now that those and multiply them by 40m card numbers... you can see the numbers add up.