Transaction Trends

Many banks and payment providers struggle to keep up with their portfolio risks, as threat actors are on the rise and PCI DSS version 4.0.1 requirements are now in effect.

The question remains, what can you do to reduce risk in your merchant portfolio? Honestly, more than you think. Let’s talk about 5 fail-safe strategies to reduce risk in your merchant portfolio.

1. Assess Your Portfolio: Finding the Invisible Risks

There are many ways to complete this step, but it might be time to update your approach. New compliance tools are constantly being developed to make the assessing process easier and more comprehensive.

Portfolio Risk Assessment Tools: Spectre AI

One example is Spectre AI. It’s an evolving tool that gives you a bird’s eye view of your portfolio. It allows you to see which merchants are responsive to compliance, which ones are ignoring it, and which non-compliant merchants have the highest likelihood of being compromised today. This tool gives customized insights into your portfolio, helping you to segment communication with them and tailor your advice based on their needs. You can also see your merchant PCI risk, BRAMs risk, chargeback data and transaction data all in one chart–allowing you to identify which merchants need help before the card brands come knocking on your door.

ASV Scans

You need to make sure that your ASV scans are in place and running.

Part of this is educating your merchants on getting the most out of their ASV scans, because many of them scan their network address and not their domain. Some merchants even have the misconception that their provider is solely responsible, and fail to run the necessary scans.

However you do it, start with an assessment of your portfolio. You can’t reduce the risks you aren’t aware of.

2. Prioritize Your Portfolio: Put Out the Fires

In assessing your portfolio, you’re going to find that your merchants present a varying range of risks. The best way to keep track of everyone is to create a prioritization system. List the highest risk merchants, the medium risk merchants, and down until the lowest risk merchants.

It might seem obvious, but many banks and payment providers waste time spamming their entire portfolio with high stress emails. Conducting thorough assessments and prioritizing the highest risk groups allows you to tailor your communication and start remediating the most vulnerable merchants first with the right message.

3. Education and Communication: Knowledge is Power

Unfortunately, a lot of merchants aren’t educated about even the basics of PCI DSS.
If you have representatives or agents that interact with merchants, you might want to start there. Make sure you present a unified front as a team. Educate your team and your portfolio about PCI, including:

• What is PCI DSS compliance?
• Why does PCI DSS compliance matter?
• How to implement your PCI program?

Another way you can take control of your portfolio is to stay up to date on current PCI tools and threats. Know what tools your merchants are currently using and be prepared to offer them alternative solutions if they need it.

For example, Shopping Cart Monitor (SCM) is one tool we offer in our PCI program at SecurityMetrics–making us the only PCI program to include built-in eskimming detection in its portal for merchants. This tool was created after our forensic team conducted 2,000 investigations and recognized a rising trend of javascript injections. We saw that 100% of the security failures happened on the merchant’s referring page, not their third party payment processor: highlighting the vulnerability of merchants who assume their third party payment processor is completely covering them.

In essence, knowing how your merchants process payments and how they handle PCI compliance can help you know what tools they might need. Open that dialogue with them and be proactive about identifying tools they can use.

4. Rely On Your Partner: Bridge the Gap

This is the step that usually gets skipped over and it’s a shame because you are the bridge between your merchants and the support they need to become PCI compliant.

Many banks and payment providers simply don’t want to look bad. When a merchant calls in with a question or concern, they give an empathetic spiel about how frustrating PCI compliance can be. This approach is counterintuitive.

If you have a responsive, educated PCI partner, utilize them. It starts with shifting your thinking–PCI is essential, but it isn’t all on you. You have a partner for a reason, so turn all questions and concerns to them. With the right PCI program, your merchants will have the support and information they need to successfully reach compliance. Afterall, that’s what you’re paying them for.

Consider the value of FAQs, shared messaging, and other tactics to connect your portfolio with your PCI partner. Bridging this gap will make a world of difference.

5. Measure What Matters: Don’t Let Your Portfolio Backslide

Many merchants will treat compliance like a checked box. This is when they start to slip up, failing to record their implementation of PCI requirements, and failing to stay up to date on their PCI compliance efforts.

One way to combat this is through reports. Being able to run reports ad hoc, breaking down multiple aspects of your program is a necessity and helps you keep your finger on the pulse of your program. Ultimately, if you’re not able to properly track the success of your program, you’re not going to be able to hit your portfolio risk management goals.

Keep track of how many merchants are enrolled in your PCI program, how many of them are compliant, and whether or not your portfolio is being secured. This requires consistent effort, but it reduces the overall stress of compliance because you’re able to properly report, analyze, and adjust.

Work Smarter, Not Harder

From these 5 strategies, you’ve likely noticed that spending more money or sending more emails isn’t going to make everything run smoothly. You need to take the right steps, tackle the biggest problems, and rely on the best partner.

You can reduce risk in your portfolio and save money, and these 5 strategies are an excellent way to start today. Good luck!