Security breach

RS
supplement payment security
28 RS February - March 2013
Breaching
the subject
E-commerce has meant the rise of
card not present (CNP) fraud. But do
in-store security breaches still happen?
Dave Adams investigates
Consumers love card payments. How often do you pay in
cash for a purchase worth more than a few pounds these
days? Retailers’ relationships with the major card schemes
have sometimes been a bit more fraught, complicated by financial
issues and by the ever-tightening demands of PCI security
standards. But the PCI regulations, along with the introduction
of chip and PIN, have been of great benefit to retailers, making
it much harder for criminals to commit fraud by skimming card
data from card-present transactions. One unfortunate sideeffect
of that has been that the criminals have focused their
efforts online and targeted card not present (CNP) transactions
instead, but in store, the evolution of the PCI Data Security
Standard (PCI DSS) has been an invaluable weapon in the fight
against fraud.
While that means UK retailers are less likely to suffer from
card-present fraud than are their counterparts in countries
where magnetic stripe technology is still the primary medium
for card transactions, it does not mean they would be any less
likely to suffer from the sort of security breach that affected
customers of the US wholesaler Restaurant Depot in December
2012. The breach, discovered in early December when
a number of the company’s customers reported fraudulent
activity affecting their cards, came a year after a similar incident
in December 2011 which eventually affected more than
200,000 customers. After an investigation by security specialist
Trustwave revealed the breach had actually occurred in early
November, Restaurant Depot advised all customers who had
used their cards at one of its facilities between 7 November and
5 December to cancel their cards.
Now that’s bad PR: to be remembered forever afterwards by
thousands of customers as the cause, at the very least, of an
irritating encounter with the bureaucracy of the card provider;
and at worst as the cause of a fraud using your card. Yet the
company claimed that all its systems were in compliance with
payment card industry standards. At the time of writing the
precise origin or cause of the breach had not been made public.
Data breaches
Trustwave’s 2013 Global Security Report, published in February,
shows that the retail industry is now the number one target of
cyber criminals. That growth is driven by the increased focus on
hacking e-commerce systems, but it underlines the threat to
retailers in general. Is there any danger UK retailers will become
complacent about in-store security as a result of the progress
made by chip and PIN and PCI DSS?
Gary Munro, senior consultant at Consult Hyperion, contemplates
the Restaurant Depot breach from a UK perspective. “Do
these types of breaches happen here?” he asks. “Yes, but it is
becoming less commonplace as retailers upgrade their systems.
The criminals will always attack the weakest point in the system
and the card industry has done an awful lot to improve security.
In older systems some retailers would have a PC or server-based
system, possibly in the store, and these could be attacked
through a web connection or direct access. But implementing