Quantcast StorefrontBacktalk » Blog Archive » Instant Credit Income Verification: A Retail IT Migraine On The Horizon?
advertisement
advertisement

Instant Credit Income Verification: A Retail IT Migraine On The Horizon?

Written by Evan Schuman and Fred J. Aun
December 10th, 2009
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

A U.S. Federal Reserve Board proposal being fought by retailers would have store clerks asking customers for proof of their salaries before issuing instant credit. But the Credit Card Act proposal raises many troubling questions for retail IT execs. To be able to later prove its compliance with the federal rule, will retailers have to enter the salary data into its POS? Will copies have to be retained and scanned? Will this new mandatory goldmine of identify-thief-fantasy-data points attract more aggressive cyberthieves? Even worse, will retailers be tempted to add such information into CRM databases?

From a non-IT perspective, the move would certainly discourage consumers from accepting—or even pursuing—instant credit, which has been a wonderful thing for merchants. It’s unlikely that shoppers will be thrilled when asked by gum-chewing, teenage POS jockeys to whip out paystubs or a copy of last year’s 1040s.

Consider an analogy: The police chief who lives next door has a town ordinance passed requiring you to store in your basement a ton of heroin and cocaine that the police department has just seized. “Wait a second,” you say. “First, I don’t want this stuff, nor do I need this stuff. If you think it needs to be preserved, then you preserve it. All it’s going to do for me is make my house an irresistible target for every drug dealer in the next three counties, putting my family in danger.”

The argument has been made before that a lot of payment data would be better protected if it were retained by banks and processors and not the local fish-seller or upholsterer. But by adding paystub and/or tax return data into the mandated data, this is getting ludicrous. We’re reminded of the old commercial for Life cereal. “Let’s get Mikey the merchant to store it. He’ll store anything!” But in this case, it’s highly unlikely the retailer will end up liking it.


advertisement

4 Comments | Read Instant Credit Income Verification: A Retail IT Migraine On The Horizon?

  1. James Loar Says:

    1- Who ever carries around their pay-stub or tax return?
    2- This would be a great means to kill off the credit concept and force people to only buy what they can afford – in cash. Maybe that’s the real goal?

  2. Chris Phillips Says:

    I think this post is mostly based on misconceptions about the Fed proposal. While the Reg Z proposed rule is certainly a problem for instant issue private label credit, the Fed was quite careful to point out that no verification would be required for income data provided by the consumer. Issuers have to ask about income and they have to consider income (and liabilities), but they don’t have to verify. That could change in the final regs, but it’s not on the table now.

  3. Evan Schuman Says:

    Editor’s Note: The story didn’t contradict that. But if you think this through, how would this likely work? Is a cashier–in front of everyone–supposed to ask this? And those same associate cashiers are given strong incentives for speed, to keep the line moving. Is not a quick peek at a document more confidential and faster? Even if it’s solely verbal–which seems unlikely–what is the associate supposed to do with that? Wouldn’t it be more likely that they would have to write it down or enter it somewhere? For management purposes only, there has to be some kind of record. And the capturing of that data is what the story was discussing. The last thing any major chain would want to do is blatantly follow the letter of the rule and not the spirit. For the moment, we stand by the concerns and issues raised in the story.

  4. Chris Phillips Says:

    We may be saying the same thing, or we may not. The requirements to consider income and liabilities is certainly a huge impediment to instant issue credit cards. Thoughtful concerns have been and are being lodged with the Fed. These rules (to me) seem to be solutions in search of a problem. Failure of consumers to repay private label credit cards did not cause the current crisis. Mortgage companies are now required to verify income, which seems somewhat more on target.

    But in terms of information collected, I don’t think issuers want to verify it unless the Fed requires them to – and if they do want to verify it, they are probably already doing so (at one time Amex required 1040s for credit issuance, and may still do so for some cards).

    The consumer will have to fill out an application (paper, terminal or verbal) just as they do now, and, just as they do now, the information from the application will have to get into the system. Your question about how this information is communicated (verbally?) is certainly one of the thorny issues that issuers have raised, but to someone wanting to steal my identity, my income level is a lot less important than my DOB, DL# or SSN, at least a couple of which are already in the system. I’m not sure that information about income or liabilities is qualitatively different than what is currently collected and not any huge quantitative leap.

    My original comment and this response is in no way intended as confrontational, I’m just pointing out that verification isn’t currently proposed, and I don’t think most retailers intend to do it. I’d certainly be interested to hear of issuers with plans to the contrary.

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...