New Guidance For Merchants On Ensuring That Service Providers Share Security Responsibility

For merchants, long gone are the days of using a card reader with a dial-up connection to their payment processor. Today's omni-channel retailers rely on multiple third party service providers to complete payment card transactions. These third parties—call center operators, payment gateways, loyalty solution providers, managed security services, data-center hosts, mobile app developers, and fraud prevention services—have access to or could impact the security of cardholder data. A quick review of recent security alerts regarding remote access tools and news articles regarding attacks on payment card systems highlights the fact that merchants still face the consequences that follow from an account data compromise event even if it was caused by their service provider. Indeed, contractual obligations merchants accept to be able to accept payment cards impose the ultimate responsibility on merchants for compliance with the Payment Card Industry Data Security Standard