Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Heads-Up Acquirers: You Have New PCI Security Rules to Follow for Your Small Merchants

When you think about all the customer data that the average retailer has to keep secure, it could feel overwhelming: Names, addresses, dates of birth, Social Security numbers, bank account numbers and, of course, credit card numbers.

Historically Payment Card Industry Data Security Standard (PCI DSS) has been focused on the large and big-box merchants, sometimes known as the "Level 1" businesses. But as their hands were forced to implement more mature security, the threats moved on as well.

Nowadays and perhaps contrary to conventional wisdom, it is actually the pizza restaurant down the street - not the massive department store chain - that is facing the most immediate data security threats. Small and midsize businesses, which typically fall into Level 4 of PCI DSS, are quite vulnerable to hackers and fraudsters, partly because their IT environments are easy to intrude upon. Add to this the fact that many of these merchants work with third-party service providers, which themselves are not practicing good security hygiene, and the losses can add up fairly quickly.

To protect and maintain the integrity of the payment network as a whole, the card brands have created and evolved their own security programs. Specific to the security of mom-and-pop shops, Visa late last year established new requirements for U.S. and Canadian acquirers that provide payment card processing accounts to these merchants. The new mandates take effect Tuesday. 

  • Effective Jan. 31, acquirers must ensure that Level 4 merchants using third parties for point-of-sale (POS) application and terminal installation and integration engage only PCI-qualified integrator and/or reseller professionals (QIR). 
  • Effective Jan. 31, acquirers must ensure Level 4 merchants annually validate PCI DSS compliance or participate in the Visa Technology Innovation Program (TIP).

There are some exceptions to these requirements, namely that single-use terminal merchants without internet connectivity are considered low risk and therefore excluded.

But what this means for most other Level 4 merchants, and really any merchant, is that there is an increased focus on ensuring data security and working with secure partners

It is worth noting that Visa is offering relief from compliance validation for those merchants that have invested in secure payment technologies, specifically EMV-compliant hardware and/or PCI-validated point-to-point encryption solutions.

We strongly encourage all merchants and payment card-accepting entities to double down on their security efforts and attest to compliance with PCI DSS. And for those that work with third parties on managing or installing their POS systems, only consider a certified PCI QIR professional.

Finally, acquirers should be aware that reporting on compliance for Level 4 merchants is going to be the new norm. We would encourage all acquirers and merchant service providers to ensure they have a PCI compliance program in place for their merchant portfolios.

James Zou is a systems engineer at Trustwave specializing in PCI DSS compliance.

Latest Trustwave Blogs

Unlocking Cyber Resilience: UK’s NCSC Drafts Code of Practice to Elevate Cybersecurity Governance in UK Businesses

In late January, the UK’s National Cyber Security Centre (NCSC) issued the draft of its Code of Practice on Cybersecurity Governance. The document's goal is to raise the profile of cyber issues with...

Read More

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More