Visa Covers Butt By 'Delisting' Breached Credit Card Payment Processors
Visa has removed Heartland Payment Systems and RBS WorldPay, the two huge payment processors that suffered recent data breaches, from its list of companies that are in compliance with Payment Card Industry (PCI) rules. It says they can get back on the list when they recertify that they have proper security in place. While this may sound like a significant change in the status of the companies, in reality it does little to change how the three companies do business with each other or with merchants. It's just a way for Visa to protect itself from any upcoming lawsuits by banks and credit unions against the payment processors.
Visa really wouldn't want to do much to hurt its business partnership with the companies, considering how big they are. In addition, the contracts they have with merchants aren't invalidated just because Visa delists them, so cutting ties completely could hurt Visa financially.
The recertification is just a formality, too:
"There have been no material system changes that would have negatively altered [last June's] certification, and we have in fact enhanced the security of our systems in the interim," RBS WorldPay said. "[But] because of the criminal intrusion, we need to be recertified earlier than the normal schedule."
In other words, this is purely Visa looking out for Visa by pretending to be concerned about payment processor security, while in reality just covering its butt.
"Visa drops Heartland, RBS WorldPay from PCI compliance list after breaches" [ComputerWorld] (Thanks to Roger!)
(Photo: orphanjones)
Post a comment
Comments:
@edrebber: Dontcha think that would lead to FAR fewer companies disclosing breaches in the first place?
The PCI Security standard in many ways is woefully inadequate. Yes, it has significant demands but like any "Broad Based" security standard; it's cookie cutter. Every technology enviornment is unique, and cookie cutter standards like PCI are just a publicity stunt.
On top of that the PCI security audit folks.... to put it nicely, are a joke. Visa included.
As they stated, they "were" PCI compliant. Which as you can see... obviously means nothing.
Pure shame really...
They don't have to keep our personal information safe, they don't have to disclose certain data breaches, they can make up new interest rates with 30 days notice and they can lower your limit below your current balance.
It's funny; these 'mega rewards' cards are appropriately named--it's just that the credit card companies get the mega rewards, not customers.
I got a nice little letter from my bank advising me that my debit card number had been compromised in the Heartland fiasco.
This "recession" (read: depression) is a good time for us to stop our own personal deficit spending. I've been paying cash or debit only for the last 10 years now, and have a total debt of $0. It's easy. If you want to buy something but can't afford it, then you save money until you can. You want change? Put these credit card companies out of business and get yourself out of indentured servitude at the same time. Nobody out there is looking out for you. It's up to you to look out for yourself. Visa doesn't care about you. Give your loyalty to people, not corporations. /rant off
So this is kinda like telling them to go stand in the corner but not actually making them do it? That'll show em'.
Actually this is a big deal. If a company is not PCI compliant (and being removed from the list means they are no longer PCI compliant) any new business cannot use Heartland or RBS to process credit cards.
Furthermore companies that currently use those two providers may be told by their banks that they have to change their provider or else they cannot process cards anymore.
FYI: I don't work with Visa, but I do work with PCI compliance on a daily basis and I know the penalties. Believe me this is a legitimate penalty provided they don't re-certify them within a week or two.
Good? Bad? Can we at least rag on Visa for not assuring PCI compliance before the breaches? The "you seem to be insecure due to a recent massive data breach" approach needs a rethink.
@ZManGT: yeah, it's a big deal, but it's also b.s. remember the cardsystems breach in 2004-5? it was the largest processor breach prior to this one at heartland. they were also delisted, but shortly thereafter they were purchased by a competing vendor - pay by touch - who wanted access to their merchants.
imo, the networks need to do a bit more to maintain the integrity of their systems, which includes auditing various aspects of their network for compliance.
Why stop there? Cut out AIG too and just pay it directly to the guy getting the insane bonus for doing nothing!
There need to be stiff fines for each and every data breach payable directly to the customer who's data is compromised. $10,000 per offense.