Identity Theft News

Congress calls for greater payment card data security

Thursday, April 2, 2009

Members of Congress yesterday called on the payment card industry to step up their efforts to thwart cybercriminals and halt data breaches, in a hearing on the effectiveness of the Payment Card Industry Data Security Standard.

Lawmakers and retail industry representatives said the PCI standard, developed by the major credit card companies, does little to stop payment card data thefts and fraud.

Representative Yvette Clarke, chairwoman of the subcommittee that held the hearing, said the standard by itself is not "worthless" in protecting consumers, but it does not go far enough.

Representative Bennie Thompson said he was concerned that credit card companies were trying to "shift risk" of fraud and the associated costs to the retailers rather than improving their "product and procedures."

Thompson said the payment card industry and merchants and vendors standards must rededicate themselves to the goal of securing their networks. "For the payment card industry and the issuing banks, this is going to mean significant investment in infrastructure upgrades," he said.

Lawmakers said even vendors who are in full compliance with the standard are exposed to data breaches, as was the case last year with Hannaford Bros. The grocery chain received its PCI certification "while an illegal intrusion into its network was in progress," Clarke said.