News

PCI penalties remain unclear

December 10, 2007

Digital Transactions: The settlement TJX Cos. and Visa Inc. announced last week illustrates that not only is TJX well on its way to slipping past a long list of problems arising from the system leak that is believed to have compromised thousands to millions of debit cardholder accounts, but it also provides a glimpse into the secretive realm of penalties networks use to enforce rules meant to protect cardholder data. As part of the settlement, Visa will forego imposing pending fines on Fifth Third Bancorp, TJX's U.S. acquirer, and rescind another. Visa also has restored a favorable interchange rate to TJX — a deal that saved the Framingham, Mass.-based retailer an estimated $210,000. And according to documents filed by financial institutions in their suit against TJX for recovery of breach-related costs, TJX's fines have amounted to $880,000. The settlement does, however, impose one unusual requirement on TJX: The retailer must promote PCI for two years.