Mr. Carr

Finance & Investment

Guarantee Secure Credit Transactions Before you Swipe that Card

By Bob Carr, Chairman & CEO, Heartland Payment Systems

There's no denying that credit card fraud is on the rise. A 2007 report from the Association for Payments Professionals found 72 percent of 3,000 members surveyed had been victims of actual or attempted fraud in 2006. That's up from 68 percent in 2005.

Unfortunately, 80 percent of data compromises originate through small merchants-those generating less than 20,000 e-commerce transactions or a million total transactions annually-according to Visa USA.

These smaller merchants - such as independently owned hotels -- don't always have the technology to provide the secure systems needed in today's increasingly risky financial world. Worse, many hotel owners dismiss the problem because they think they are protected by their merchant acquirers. But they are not.

Indeed, as payment technology becomes more sophisticated, so do hackers' and thieves' methods for stealing sensitive information. And the results can be disastrous for any business, regardless of size.

For example, Massachusetts-based TJX Companies Inc., the world's leading off-price apparel and home fashions retailer, experienced a major customer credit and debit card data breach last January. It turned out to be the most expensive cybercrime ever recorded, with over 45.6 million customer credit and debit card numbers stolen.

Besides $150 million in breach costs, the company now faces FTC investigations, over a dozen lawsuits, with some litigation seeking tens of millions of dollars in damages. Analysts project the breach could ultimately cost TJX anywhere from $500 million to nearly $1 billion in expenses.

Beyond monetary loss, security breaches can also tarnish a hotel's reputation. While security is the responsibility of both the hotel and its merchant acquirer, cleaning up after a breach falls on the hotel, as it is its name that will make headlines and ultimately pay the price of the fraud.

In addition, to ensure that security is a priority, the Payment Card Industry (PCI) Security Standards Council -- an independent organization formed by Visa, MasterCard, American Express, Discover Financial Services and JCB International -- is cracking down on business owners with its new Data Security Standards (DSS) - a move that could cost hotel owners big bucks.

The PCI DSS contains steps to protect organizations, customers, and the card processing system from fraud. The steps include requirements for security management, payment policies, data storage procedures, network architecture, software design and other payment system measures.

While the Council develops and maintains these standards to tighten security, each card company independently implements and enforces those standards.

Now, hotels that don't comply with PCI regulations face stiff fines. In 2006, the card companies leveled fines totaling some $4.6 million to card processors of non-compliant merchants around the country -- and these fines were passed directly to the businesses.

For hoteliers accepting credit or debit cards branded by any of the five major card companies, the message is simple: You are required to uphold and comply with the PCI DSS. Failure to do so may result in fines, even without evidence that your system was compromised.

In the past, card companies have not enforced PCI DSS equally across the board, so it has been overlooked by some businesses and their card processors. However, that is no longer the case. In fact, Visa recently announced a five-phase approach to eliminate the use of non-secure payment applications for all merchants. In short, this means all hoteliers, regardless of size, need to address security issues immediately.

The good news is that it's not hard to avoid fines. You simply need to understand the PCI DSS's six core principles and work with your card processor and other technology providers to meet the standards.

Here is an overview of the six tenets of PCI DSS.

1. Build and Maintain a Secure Network. Choose, install and maintain an up-to-date network firewall, antivirus and anti-spyware programs. And always change the default password for your programs, firewall, routers, computers and other systems. This ensures only authorized persons can log on to your various network resources. Hackers know every product's default password. Their first line of attack will be to try to access your network using these well-known logon credentials. If you change all of your passwords, this type of attack will fail.

2. Protect Cardholder Data. Encrypt all transmissions across open, public networks. Encryption software is required for point-of-sale (POS) systems connected to the Internet for cardholder data transmission. Also, it's imperative you only store guest data that's essential to the business, such as receipts and reports. Sensitive information, such as magnetic stripe data or card validation codes, should never be stored beyond what is required for business, legal, or regulatory purposes.

3. Maintain a Vulnerability Management Program. If you're using a credit card payment software application or a point-of-sale terminal with a debit card PIN pad, you should ask your card processor to verify the compliancy and request an upgrade on outdated equipment or applications. Dated systems without proper software face an exponentially higher risk for network breaches and data theft.

4. Implement Strong Access Control Measures. Only allow the most senior company employees to have access to cardholder data. Protect access by issuing user IDs and passwords and assigning access control rights through your network.

5. Regularly Monitor and Test Networks. This includes computers, POS systems and anything storing or processing cardholder data. Maintain tracking records to demonstrate your security systems and processes are regularly tested and validated.

6. Maintain an Information Security Policy. Document and maintain an enforceable policy that addresses details of information security. All employees handling sensitive information should know and understand the rules.

If it sounds daunting, consider this: it's less overwhelming than a six-figure fine. As a first step, find out if you're compliant by taking the required PCI DSS Annual Self-Assessment Questionnaire available online at http://tinyurl.com/2ayk9w. Next, make sure your merchant acquirer is serious about the security of your business and your customers.

Many hotel owners also depend on their merchant acquirers to supply them with the tools that help monitor transactions and flag suspicious activity. Yet many merchant acquirers have not implemented the required technology. If they have, they may not have made the full financial investment required for the most up-to-date technology that will completely protect their systems.

This lack of transaction and fraud monitoring leaves hotels exposed and vulnerable to hacking. And once hacked, they often don't have the resources to effectively recover from the security breach.

That's why The Merchant Bill of Rights -- developed in 2006 by Heartland Payment Systems in conjunction with trade associations in several states - educates merchants on how to help protect their businesses from the ravages of cyber crime.

By knowing the risks, you can take the necessary steps to prevent fraud. The Merchant Bill of Rights calls for the knowledge that every company-no matter how small-has the right to the same real-time fraud and transaction monitoring systems as large companies. And every business has the right to the most up-to-date technology to keep its customers' credit, debit, and PIN numbers safe.

The bottom line: No hotel can afford a security breach, and every company has the right to stop it. Although updating systems with the most current security measures and monitoring transactions for fraud can be costly, the price for security is ultimately much cheaper than the alternative.

Bob Carr is chairman and chief executive officer of Heartland Payment Systems ¯ the nation’s fifth largest payments processor and the official preferred provider of card processing, gift marketing, check management, payroll and tip management services for the American Hotel & Lodging Association and 38 state lodging associations. In line with Heartland’s commitment to merchant advocacy and education, Mr. Carr spearheaded The Merchant Bill of Rights (www.merchantbillofrights.org) to promote fair credit and debit card processing practices for all business owners. He has also been a driving force in the enhancement of payment card security with E3™ (www.E3secure.com), Heartland’s end-to-end encryption technology. Mr. Carr can be contacted at Bob.Carr@e-hps.com Extended Bio...

HotelExecutive.com retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by HotelExecutive.com.