Digital Transactions Authoritative, insightful and timely information for payments professionals
With online merchants facing a June 30 deadline to prove they comply with a unified card-industry standard for data security, CyberSource Corp. said today it is rolling out a new service that will help Web-based retailers meet the security requirements. The Mountain View, Calif.-based transaction gateway for Internet merchants says that, with the deadline for compliance with the Payment Card Industry data security standard looming, preparedness among retailers is lagging. “We estimate that if an audit were done on PCI compliance today, the majority of U.S. merchants would be about 30% prepared,” said David Glaser, director of professional services at CyberSource, in a statement. The company's new PCI Compliance Service aims at helping clients meet the impending deadline while customizing security measures to individual merchant requirements, Glaser said. The Payment Card Industry data security standard, introduced in January, is a harmonization of card-data security rules that had been introduced since 2001 by Visa U.S.A., MasterCard International, American Express Co., and Discover Financial Services Inc., among other card companies. Although it applies to all merchants that accept cards, its June 30 deadline to show compliance applies only to online retailers generating between 20,000 and 6 million card transactions annually. Merchants generating 6 million or more card transactions a year faced a Sept. 30, 2004 deadline. Glaser said in the statement released today that customized security is important because PCI, while a good base-level set of rules, can't address individual merchant cases. “Every business has its own unique vulnerabilities,” he said. Recent thefts of customer card data have thrown a spotlight on the problem of merchant security (Digital Transactions News, April 19). Merchants that fail to show PCI compliance by June 30 could face penalties from acquiring banks, including fines up to $500,000.
