Email the Editor    Email a Friend    Print this Page 

Credit card companies issue to consumers, who shop on credit and pay bills later. The companies make their money two ways: one, by taking commission from merchants and two, by charging interest from the consumers who use their services. The process could be no simpler.
Unfortunately, the credit card companies are also liable for any loss resulting through fraud. Globally, due to the increase of fraud through stolen credit card data, companies now don't want to cover financial loss unless the merchants and credit card service providers have made standard security arrangements. And that's where PCI SSC comes in.

PCI SSC

The PCI Security Standards Council is an open global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection.

Founded by American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa, Inc., the PCI Security Standards Council has been developed to enhance payment account data security by driving education and awareness of the PCI Security Standards.

In addition to creating the standards and spreading the awareness, the council manages training and certification through a list of approved PCI vendors.

How it Works

There are two kinds of entities that require enforcement of PCI standards: the 'merchants' and the 'service providers'. The merchants are defined as the ones who either have a physical shop with a POS (point of sale) device to accept credit cards, or alternately, have an online shop.

Each of them are issued a merchant ID. Think of the service providers like gateways or credit card processing companies that handle all the actual processing, storage, transmission and switching of transaction and cardholder data. They also help smaller merchants handle their transactions.

The PCI SSC along with the credit card companies, have created four levels of standards based on the risk involved with the merchants and service providers.

The merchants and service providers have to make sure that the security they have running on their systems is based on their respective level standard, which is categorized by the number card transactions they handle on an annual basis.

An example of Levels for Visa Card merchants is:
Level 1: More than 6 million transactions per year
Level 2: Between 1 and 6 million
Level 3:Between 20 thousand and 1 million
Level 4: Less than 20 thousand a year

share: