The success of credit cards as a payment method within the retail sector has unfortunately provided new opportunities for credit card fraud and identity theft. This problem is compounded by the payment process itself, which includes multiple steps and several entities – creating various entry points for enterprising fraudsters to access and misuse customer information.

The retail sector therefore faces tremendous pressure to manage payment transaction risk flowing through its operations and, as a result, has set its own data security standard. The Payment Card Industry Data Security Standard (PCI DSS) is a set of comprehensive requirements for enhancing payment account data security, to help facilitate the broad adoption of consistent data security measures. PCI DSS is  designed to protect IT system breaches of personal credit card holder’s information. Failure to comply may result in prohibition from participation in credit card processing programs, which could greatly impact a retailer's ability to conduct business.

The PCI DSS mandate is working its way to smaller and smaller retail operations, where it is estimated 80% of the potential risk resides. The PCI program has placed significant pressure on retailers to establish solid enterprise-level security programs.