Let us now praise a famous brand, Visa.
One of the differences between card processing and many other businesses is that you're totally dependent on a few big players for survival.
Of the three big guns -- Visa, Master Card and American Express -- the first is most important. The bank association's changing requirements are generally a road map for other processors, defining necessary changes under enforced deadlines.
When Visa pulls its business from a processor, even for a little while, it's terribly destructive. When they do it permanently, and publicly, it's time to get out the resumes. When they do it alongside American Express, it's a corporate death penalty.
UPDATE: My saintly wife (that's the original St. Jennifer there to the left) notes the AmEx decision is effective at the end of August. Visa's decision becomes effective at the end of October, so you might call them the "good cop" in all this.
So say goodbye to CardSystems International, the small (90 employee) Atlanta processor which revealed in May that a computer worm had exposed 40 million customer accounts to possible identity theft.
What I found most fascinating, however, was what was below the headline.
Visa didn't move immediately after the breach was revealed May 22.
Apparently Visa investigated the incident, and found that CSI was storing unprocessed transactions in an "exceptions file," violating their cardmember agreement. The requirement to dump numbers that don't process was put in specifically to prevent this kind of theft.
The official statement from Visa was unequivocal. "CardSystems has not corrected, and cannot at this point correct, the failure to provide proper data security for Visa accounts."
What can the company do now? Its bank customers have to find a new processor or they are cut off. The best move might be to sell the business now, while it's still worth a few dimes, and get out. I don't see any way to fight this.
And I'm glad that, at least in this business, someone is on the case. I'm giving Visa their props today.