Are retail POSs still storing credit card info?

Question

A couple of years ago my bank sent me a new debit card and deactivated my old one unexpectedly. I suspect this was because of the Home Depot hack in which the details of some 56 million credit cards were stolen because they were being stored for no apparently good reason on Home Depot's POS system. The problem was greatly magnified because Home Depot was not just using the card information to execute transactions. It was actually storing the customers' card details permanently without their knowledge or consent.

Has this event resulted in retailers changing their policies and not secretely saving copies of their customer's card information, or are retailers still engaging in this conduct? Are card issuers like Mastercard doing anything about this, such as making it part of their merchant contract that the merchant does not keep secret copies of customer cards?

Answer 1

In the general vein of- is security around retail credit card processing improving- the answer is yes, in fits and starts.

The main driver has been the shift towards tokenization, whose most visible champion is ApplePay, but improvement is also manifest in the presence of machines at retailers which rather than accepting a swipe of the magnetic strip hold the credit card to construct a credential using the card's chip that is only valid for that individual transaction.

The card brands- Visa and Mastercard- have been aggressive in using their compliance regime- PCI- to require improvements from retailers. Most recently, in October 2015, there was to be a shift in rules with the goal of increasing risk of fraud liability for retailers who did not move to chip-based payments. This shift has not resulted in wholesale adoption of chip-based payments, but these are framed as exceptional cases, and compliance will increase over the next few years.

PCI regulations have always distinguished between "data at rest" and "data in transit" and the compliance standards for merchants who keep data at rest have always been significantly higher. Fines and other penalties for merchants whose PCI compliance submissions- called Reports on Compliance- are found through a breach or through an audit to dramatically depart from reality are very steep.

Now, are dumb practices still in place around the retail industry? Of course they are, and there is significant inertia as retailers continue to be under enormous pressure from Amazon. Their incentives are not to add friction to the customer payment process, or to increase their own costs with wholesale adoption of new technology.