With the evolution of security threats and increased fraud in today's digital world, it is more important than ever to ensure that your customer's data and credit card information are safe by providing a robust, secure payment processing system. Not only can the reputational damage to merchants impacted by data breaches be severe, but also costly. According to a report by IBM, the coverage cost to a US company impacted by a data breach in 2021 was $4.24 million(1).

This article explains PCI payment certification and why it matters for airlines, inflight retail and the mobility industry. We'll also look at some of the requirements for PCI payment certification and how it helps protect against data breaches and other security threats.

What is PCI certification?

PCI certification(2), also known as PCI DSS (Payment Card Industry Data Security Standard), is a set of security standards designed to help ensure that payment and other IT systems that handle sensitive data are stable and secure. The Payment Card Industry Security Standards Council, whose members include major credit card companies such as Visa, MasterCard and American Express, is responsible for administering and continually updating PCI DSS as new security threats arise.

External experts carry out the certification annually and require that all systems and processes meet the highest security standards. This audit covers all aspects of the business. It includes employee training, regular police background checks for employees, software code, IT networks and other infrastructure for business processes and procedures.

Why is it important?

PCI certification is critical for both your customers and peace of mind. The impact of a data breach in your payment system, even if it does not immediately cripple the business, the penalties for non-PCI compliance in the event of an incident can be severe:

• The average cost of addressing an immediate breach is $4.2 million.
• Card companies can impose heavy financial penalties – direct fines can range from $5,000 to $100,000 per month or even permanent disbarment from being able to accept credit or debit card payments.
• You could be required to write each cardholder individually explaining the issue and the redress steps you will take to resolve it.
• Data breaches can lead to increased insurance premiums.

What are the requirements?

A payment solution must meet specific requirements to obtain PCI certification, including building and maintaining a secure network, protecting cardholder data, maintaining a vulnerability management program, implementing strong access control measures, and regularly monitoring and testing networks.

In today's digital age, choosing a payment gateway that prioritizes security is essential. Make sure to choose one PCI-certified for the best protection against data breaches and other security threats in the airline, inflight retail and mobility industry.

Bottom line

For airlines, inflight retailers, and companies in the mobility industry, choosing a PCI-certified payment gateway is a must to protect customer information and meet industry standards. PCI certification protects against data breaches and security threats and helps businesses in the airline, inflight retail and mobility industry meet regulatory compliance requirements. Choosing a PCI-certified payment gateway, such as most.Pay, ensures that customer information is safely handled, instilling customer trust and loyalty.

MOST and PCI certification:

At MOST, we take security seriously, with our systems certified against rigorous standards such as PCI. Our end-to-end practices help ensure that your and your customer's information stays safe.

PCI-DSS enables two options for handling payment data that maximize the security of payment card transactions in an increasingly complex regulatory environment: End to End Encryption (E2Ee) and Point to Point Encryption (P2Pe).

P2Pe and E2Ee each provide a payment security solution that instantaneously converts confidential payment card (credit and debit card) data and information into indecipherable code during a transaction to prevent hacking and fraud. most.Pay fully supports both options. 

P2Pe is a newer standard that offers advantages to merchants. It requires the payment gateway to implement additional security controls, such as ensuring card data cannot be decrypted using software but only on specialized hardware devices located in certified data centers. This extra security on the payment gateway can, in some cases, simplify and reduce overall costs for some merchants.

References:

1. IBM report on data breach cost and avoidance for 2022 - https://www.ibm.com/reports/data-breach
2. PCI security standards council website - https://www.pcisecuritystandards.org/about_us/