Bank vs. Retailers: Who’s Responsible for Protecting Your Data?
Get ready for the blame game. The recent procession of payment card data breaches coming to light has the retail and financial industries trying to assign fault to each other. So, who should be held accountable for the breaches that have occurred to Target, Neiman Marcus, Michaels and, most recently, a number of hotels?
Obviously, every side has their own argument on how the blame should be placed on the other side.
Banks: Protect customer data
Banks and card issuers say that retailers aren’t taking the security measures to protect customer information, which is leaving banks and card issuers to clean up their mess by reissuing new cards and by sustain the losses that come from refunding fraudulent charges.
“Banks have proactively replaced millions of customers’ cards and allocated significant resources to correct a problem that, by all appearances, was not of their making,” said Richard Hunt, CEO of the Consumer Bankers Association, in a press release. “This comes at no small cost, and Target needs to take the financial responsibility where they are to blame.”
According to the CBA, member banks spent roughly $154 million to issue new cards to customers — an average of $10 to replace nearly 15.4 million cards.
Banks and card issuers argue that retailers have to increase the security on their payment systems.
Retailers: Upgrade card technology
Retailers are pointing out that banks and card issuers should be offering enhanced payment cards that have secure chip technology. The U.S. has long been criticized for being slow to adopt new card technology — called EMV — that has already become a standard in many foreign countries.
The EMV chip cards are inserted into payment terminals (like an ATM slot) as opposed to swiped like most U.S. debit and credit cards. EMV chips support dynamic authentication, so that someone who steals transaction data cannot use it to make fraudulent purchases.
“The retail industry is eager to work with banks and card companies to fight cyber attacks and reduce fraud,” wrote Matthew Shay, president and CEO of the National Retail Federation, in letter to Congress. “These efforts include installation of sophisticated new PIN-enabled point-of-sale systems and readiness to adopt cards with more secure microchip technology, but the fact remains that retailers cannot do this alone.”
Mandates by U.S. card networks
Recognizing the need for next-generation card technology to thwart card fraud, major U.S. payment networks are leading the transition.
Visa, MasterCard, American Express and Discover have issued mandates that require point-of-sale systems to support EMV chip technology by late 2015. Merchants that do not comply will have fraud liability shifted to them. (Deadline for fuel pumps is late 2017.)
Some U.S. credit card issuers, including Chase, American Express and Citi, have already started to provide EMV chip cards to customers. However, the chip card technology is commonly found on the more prestigious credit cards.
However, until EMV chip cards become the norm, the burden of safeguarding consumers’ payment data remains up in the air.
Let us know who you feel bears that responsibility:
Simon Zhen is the senior research analyst for MyBankTracker. He is an expert on consumer banking products, bank innovations, and financial technology.
Simon has contributed and/or been quoted in major publications and outlets including Consumer Reports, American Banker, Yahoo Finance, U.S. News – World Report, The Huffington Post, Business Insider, Lifehacker, and AOL.com.