Is PCI Skimping On Skimming?

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

PCI does not address skimming at your point-of-sale (POS) devices, especially those self-service areas that are not under constant control of a clerk or manager. I think it should and now may be the perfect time to make a change in your POS practices and PCI itself. Although this may be the season of sharing, that should not include sharing your POS devices with the bad guys.

The PCI Council recognizes the risk from card skimming. They have held information sessions highlighting the threat at the Community Meetings and they published in 2009 a document informing retailers of the risks of skimming. However, as of today, there is nothing in the PCI DSS directly addressing how retailers should protect their POS devices from being compromised by a bad guy installing a skimmer.

Self-service checkout areas in particular are not under constant observation and because of that they are that much more vulnerable to compromise. A retailer near me recently learned this lesson painfully. They discovered somebody had installed card skimmers at 20 of their stores and then they got to tell their customers (Note: I’m checking to see if this includes me) to monitor their credit and debit card accounts for unauthorized activity.

The timing for updating or clarifying PCI now is excellent. Each version of PCI DSS has a three-year lifecycle and we are now into the second year of PCI version 2.0. That means that as of November 1 we are in the formal period when Participating Organizations worldwide provide feedback on improving payment security and the PCI DSS itself.

I have written previously about changes I would like to see that would correct shortcomings in each of the Self-Assessment Questionnaires. This lack of clarity on POS devices is different, though, and it seems to justify an update to the standard itself. We need only a couple of changes to reduce the risk of POS skimming. Requiring daily inspection of devices by store managers or staff would go a long way to minimizing the threat. Such visual inspections do not seem onerous and, because PCI already requires daily log reviews, there is a precedent.A second change would be to monitor all POS devices and to generate an alert whenever a POS device is removed, disabled, turned on or off, or added. The bad guys are adept at removing retailers’ POS devices, then either compromising them or replacing them with their own compromised devices. I recognize this recommendation does nothing for dial-up POS retailers or those with standalone devices, but these are rarely unattended and I don’t think these merchants are necessarily the primary targets of skimmers.

The next issue is where in PCI to make the changes. PCI Requirement 9 (Restrict Physical Access to Cardholder Data) addresses physical security of your cardholder environment and that is a reasonable place to add POS devices. Some people think this requirement only applies to their datacenter, but it also addresses media (both electronic and paper) containing cardholder data.

Another potential place to address POS device security is Requirement 11 (Regularly Test Systems and Processes). This requirement addresses internal and external vulnerability scanning and it requires merchants to search quarterly for rogue wireless networks. Under PCI v 2.0, retailers may use visual inspection to find rogue wireless networks, so we have a precedent for adding visual inspection of POS devices to this requirement, albeit on a daily not quarterly basis.

Wherever we make the changes, we need to add requirements specifically aimed at protecting both attended and unattended POS devices from skimming attacks. The PCI Council can change PCI at any time without waiting for the three-year lifecycle to run its course. They have the flexibility to adapt PCI at any time to address new or expanded security threats. POS skimming is not new, but it does seem to be increasingly common so it might justify an interim update to the DSS.

Regardless of any action by the PCI Council, retailers do not need to wait before taking action. They can adopt the changes I suggested (and maybe others, too) as part of their security program. If, on the other hand, PCI is your entire security program, you will miss this chance to reduce your risk and you may be the next retailer to get to ask their customers to check their monthly credit card bills.

I look forward to some Participating Organizations providing this feedback to the Council. Now is the time since the feedback period is officially open. In the meantime, I hope retailers will limit this season of sharing so it does not include sharing their customers’ credit cards with the bad guys.

What do you think? Have you or your company been the victims of a skimming attack? Could you spot a compromised POS device in one of your stores? Are there other changes to PCI you will be suggesting during the feedback period? I’d like to hear your thoughts. Either leave a comment or E-mail me at [email protected].