News

Visa program to tighten small-biz data security

July 16, 2007

SAN FRANCISCO - Visa USA has launched a program to help small U.S. businesses improve their security.

According to a news release, Visa's program calls for acquiring financial institutions to strengthen their data-security efforts to identify and address risks among their small-merchant customers, including identifying whether merchants are storing sensitive account data as well as complying with the Payment Card Industry Data Security Standard.

While more than 80 percent of all identified compromises since Jan. 1, 2005, have occurred at Level 4 merchants, less than 5 percent of potentially exposed accounts are stolen from Level 4 merchants, Visa says.

"Data security breaches involving payment card information occur at small businesses more frequently than at all other merchant levels combined," said Michael E. Smith, Visa USA's senior vice president of enterprise risk and compliance.

According to a survey conducted by Visa and National Federation of Independent Business, 57 percent of small businesses do not see securing customer data as something that requires formal planning, and 39 percent say they rely on common sense to keep data safe.

Visa and NFIB have partnered to educate small businesses about data-security threats and how to successfully avoid them. Visa and NFIB have developed free educational materials and tools to help small businesses protect themselves from data fraud. The materials are expected to be on NFIB's Web siteby Aug. 1.

Visa acquirers are required to provide Visa with a summary of their small-merchant compliance plans by July 31.

Visa is asking acquirers to verify that small businesses are not retaining prohibited cardholder data (including magnetic-stripe data, CVV2 and PIN data) after transaction authorization.

"This is precisely the kind of data most sought by hackers because of its use in counterfeiting payment cards," Smith said. "Merchants who store this sensitive data are placing their businesses in the cross-hairs for today's data thieves."