Retail lobby offers alternative to PCI standard

In a letter to PCI Security Standards Council, General Manager Bob Russo, the chief information officer of the National Retail Federation, said parts of the PCI standard are only necessary because credit card companies require merchants to store numbers for retrieval requests, such as returns or charge backs.

"We believe the time has come to rethink the assumptions behind PCI," CIO David Hogan wrote in the letter. "Let me be clear. All of us – merchants, banks, credit card companies and our customers – want to eliminate credit card fraud. But if the goal is to make credit card data less vulnerable, the ultimate solution is to stop requiring merchants to store data in the first place."

The PCI Data Security Standard is a 12-step process for securing cardholder data. Requirements include encryption, access controls, monitoring and testing systems and processes for vulnerabilities.

Hogan proposed a plan in which credit card companies would allow merchants to only store authorisation codes and a truncated, or shortened, receipt of the sale. This would save them time and money associated with complex requirements such as encryption.

"The authorisation code would provide proof that a valid transaction had taken place and been approved by the credit card company, and the sales receipt would provide validation for returns or proof of purchase," the letter said. "Neither would contain the full account number and would therefore be of no value to a potential thief.”

Hogan said that when he proposed his idea a few months ago, he received a "noncommittal" response from a major credit card company, which he would not name.

Hogan said that even the basic account number – which is permitted to be stored under PCI, but must be protected by encryption – can lead to identity theft.

"You get rid of that, the incentive to hack almost disappears overnight," he said. "We're just trying to come up with a different model to protect the consumer. If I have a question about a particular charge, that should be between me and the credit card issuer."

The PCI Security Standards Council, in a statement, said Hogan "should be directing his concerns to those individual [payment] brands," but that the organisation planned a response.