Sep 08 2014

Buffer between Target and banks

Published by at 10:10 pm under PCI,Risk

We all know that Target got compromised last year, but what some of you might not know is that the banks who issued the credit cards that were compromised are suing Target.  They’re saying that because Target didn’t take sufficient measures to protect the card data the banks had to spend millions of dollars in order to re-issue every one of the cards that were compromised.  It makes sense on the surface, since the banks incurred the cost due to the insecurity of Target’s systems.  But here’s the rub: there’s no direct relationship between the issuing banks and Target.

I find it funny because this relationship is one of the things that was drilled into me from the start of my Qualified Security Assessor training.  There is a relationship between the merchant and its bank, called the acquiring bank, between the acquiring bank and the card brands, between the card brands and the issuing banks and finally between the issuing bank and the consumer.  This was done with careful thought to create a buffer between the card brands and both merchants and consumer.  As a consumer if you have an issue, you have to take it to your own issuing bank or the merchant, since you have no direct relationship with the card brand or the acquiring bank.  It’s also why the card brands have always said that they don’t issue fines to compromised merchants, it’s the merchant’s bank that have to issue the fine. The picture below illustrates this relationship and is similar to what was used to train QSA’s when I went through training.


I find a certain poetic justice in this defense being used by Target.  The card brands and the banks developed this system in part because it’s a reasonable way for transaction clearance to work, but also in large part because it gave as many parties as possible a way to distance themselves from the sins of another party.   Except the banks and card brands meant for it to be a buffer from lawsuits between them and both merchants and consumers, never thinking it would provide a buffer for the merchants as well.

I don’t claim any deep understanding of the underlying legal statutes that could affect this case, but I do see that Target’s defense could bring up any QSA that is worth his or her salt to the stand to illustrate their point.  It’s going to be much harder to establish a responsibility from Target to the issuing bank when any witness with knowledge of the Payment Card Industry Data Security Standards is going to have to say, under oath, that they had been trained from the first day that there’s no relationship between the two entities.  On the other hand, if the buffer is dismantled legally, it also opens a venue for merchants to sue the card brands, so either way the banks are going to be losers in this battle.  Well played, Target, well played.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

One Response to “Buffer between Target and banks”

  1. Armorguyon 11 Sep 2014 at 10:16 am

    You’re right from a PCI perspective… But try this hypothetical…

    Armorguy Industries creates and sells to distributors the Happy Fun Ball (TM). Note they only sell to distributors and not to the public.

    McKeay Super Fun Products Company Limited is a distributor of Happy Fun Ball (TM) and, through its website, sells one of these awesome things to Little Bobby Tables.

    Little Bobby Tables proceeds to taunt Happy Fun Ball (TM) and, in the ensuing explosion, is horribly maimed.

    Under Target’s reasoning Little Bobby Tables would be precluded from suing Armorguy Industries because of lack of relationship. That’s ridiculous on its face. Our system of civil law basically says that if you, through your actions or inactions, injure someone they can come after you for damages.

    I don’t think Target is going to find much joy here…

Trackback URI | Comments RSS

Leave a Reply

%d bloggers like this: