Some ISO industry experts call them security breaches waiting to happen–the outmoded PIN-entry point-of-sale terminals that sit atop almost innumerable merchant countertops across the nation.
Most ISOs understand that pessimistic view of the machines, and that is why many are taking an optimistic approach to the problem. They are starting early on plans to meet a July 1, 2010, deadline set by Visa Inc. that effectively will remove vulnerable devices from those countertops.
In a March 24 document on its Web site, Visa says financial institutions or agents have until the 2010 deadline "to ensure that all of their installed POS PED [point-of-sale PIN-entry device] models have been approved by Visa." After the deadline, PIN-entry devices must be on the approved list at www.pcisecuritystandards.org/pin or the expired approval list at www.visa.com-/pin, the site says. The 2010 deadline follows a Jan. 1 deadline after which
merchants no longer could install point-of-sale terminals that do not comply with Payment Card Industry Data Security Standard.
ISOs face the daunting tasks of determining which PIN pads and terminals their merchants use are not on the lists and convincing the merchants to buy new equipment that is listed. Moreover, the ISOs need to convert the merchants without losing them as customers.
Build It And They Will Come
For Merchant Processing International, an ISO based in Beaverton, Ore., the current chore is finding out what equipment the company's 2,200 merchants are using.
"This is a real challenge," says Jim Keller, the company's CEO. Merchant Processing's strategy starts with sending merchants a newsletter outlining security issues, followed by a postcard that provides details of payment security as set out by the Payment Card Industry Security Standards Council, a Wakefield, Mass.-based organization that establishes and maintains standards. All five major card brands–Visa Inc., MasterCard Worldwide, Discover Financial Services, American Express Co. and JCB International Co. Ltd.–sponsor the council. Card brands levy fines when merchants fail to comply with PCI standards.
"Unfortunately, keeping track of what equipment a merchant uses is really difficult," Keller says of the effort to help merchants comply.
One way Merchant Processing surmounts the lack of knowledge is by building a database of its merchants, complete with lists of their payment equipment. When merchants call Merchant Processing's customer-service department, representatives ask what equipment they use, Keller says.
Acknowledging that waiting for merchants to call constitutes a passive approach, Keller says as the months tick away agents will begin to retrieve the database, scan it for merchants using noncompliant equipment and call them to let them know the bad news.
Those personal telephone calls will be expensive, Keller knows, but as a smaller ISO Merchant Processing can manage the cost more comfortably than a larger ISO could.
At Datalink Bankcard Services Co., CEO Steve Odom says new merchants are sold compliant devices from the outset of their relationship with the Richardson, Texas-based ISO. But, as some PIN-pads fall off of compliance lists, Datalink salespeople have to sell upgraded devices to merchants.
"We see issues with some smaller customers' resistance to spend money for hardware, but if the industry is in step with these standards they will eventually comply," Odom says of the company's merchants.
At International Merchant Services Inc., Bryce Gartner, chief marketing officer, hopes to tap into his experience as a merchant to improve the Westmont, Ill.-based ISO's chances of convincing merchants of the importance of payment security and the crucial need to comply with standards .
"Part of what I'm going to bring is their perspective," Gartner says of the retailers. As a former merchant, he knows PCI can seem confusing, and he will search for ways to simplify the procedures. International Merchant Services has a database of its 15,000 merchants and the equipment they use, Gartner says.
"We have an idea of how many PIN pads need to be replaced because we have an idea of the equipment we have out there," he says.
