5 ms·

Yes you should. You are following the rules and no doubt at a cost. You should report him for the same reason that you should report a competitor that is dumpi

by pm24601 12y ago

Yes you should. You are following the rules and no doubt at a cost. You should report him for the same reason that you should report a competitor that is dumping toxic waste in a stream. They are externalizing costs to society as a whole to maximize their gain. There is no malice is demanding that everyone respect the law that safeguards us all. If the competitor does not wish to follow the law then they can move to a locale that does not have that law.

icebraining 12y ago
PCI is not a law, it's an industry standard. Only a couple of states legally mandate compliance to PCI DSS. I agree OP should report them, though.
- click170 12y ago
  This is true, but if the competitor is advertising PCI compliance and is not providing that, their consumers have a right to know that they are not getting what they paid for.
- dublinclontarf 12y ago
  He would lose his ability to process credit cards, possibly having bank accounts closed etc.
  - icebraining 12y ago
    Immediately? Wouldn't they give them a "second chance" to implement the necessary changes?
altron 12y ago
Thank you for your support. Edit:: I have not made up my mind yet. Admittedly, at the time of posting I was leaning more toward that side. After reading everyone's advice, I'm leaning more toward a multi-tiered approach as @jacquesm suggested. It seems to avoid bad karma and burning bridges. Also, it seems as though the PCI Industry rarely acts on reports. So, working with the competitor to fix their issues could be the best thing down the road. It's a very small industry, and the possibility of a buy-out could exist in a few years.
- cypher543 12y ago
  It sounds like you've already made up your mind and are just looking for people to agree with you.
  - hkailahi 12y ago
    This is the vibe I was getting, which is unfortunate. Of course I'm only speculating. Similarly, I find it to be insanely frustrating when people ask for advice, but are not willing to listen when they get it. It feels dishonest.
    - nitrogen 12y ago
      Not agreeing with advice doesn't mean the recipient didn't listen to or appreciate it.
      - hkailahi 12y ago
        A recipient could have listened. A recipient could have not listened. I still think it is dishonest when it is someone's intention to fish for agreements. I originally speculated as to whether this was the case, and he/she has said otherwise.
- MichaelGG 12y ago
  Don't be under the impression that reporting a PCI violation will matter. They'll just apply a bandage if anyone looks into it. The real risk is if they have a breach, then they'll be liable for more fines. I know businesses that are very successful and ignore PCI. One even sold for a large amount of money. They implemented BrainTree in a week to solve a due diligence issue. No big deal. Sure, if they'd been hacked it'd have really hurt, but they weren't and now have FU money. For it to actually really hurt your competitor, you'd have to probably astroturf some forums, acting like concerned customers, and get other customers upset. And even then, you're just going to cost them a week or so. Maybe if you timed it for maximum damage, but just don't waste too much time on it.
- ScottBurson 12y ago
88e282102ae2e5b 12y ago
I thought PCI compliance wasn't necessarily legally required, just that it was a contractual agreement between your company and the payment processor? Regardless, I still feel reporting is the ethical thing to do.
briandear 12y ago
I think it's a dick move. It's like calling the cops because your neighbor is smoking pot in their garage. The activity isn't harming you, it only "harms" the people with a relationship with the company. If it were me, I'd likely use the competitor's lack of PCI compliance as a tool for my own marketing -- I wouldn't even use the competitor's name, but do something like "Unlike many of our competitors <my_awesome_product> is fully PCI compliant because we care about your security." Turn the "weakness" of the competitor into your strength. But reporting him to the authorities? That's very Stasi-esque. Unless a law is being broken AND it's creating an unsafe situation for your customers or your company, leave it alone. In my opinion it's a classless move to go after your competitors in that fashion. Beat them with a better product. In this case, a "better" product would seem to be one with PCI compliance. As far as the "toxic waste" analogy -- I've never heard of anyone getting cancer and dying from a lack of PCI compliance. In fact, there are likely more important things to worry about than PCI compliance -- Target and all of the other high profile retailers that were credit-card hacked -- they were all allegedly PCI compliant, yet it still didn't do much good. I'm not hear to debate the value of PCI compliance -- if it's a requirement of your business, then obviously you have to do it. But I am debating the ethics of reporting a competitor for an activity that is NOT illegal, nor is it directly harming your customers or your business.
- chrischen 12y ago
  I think it's a dick move to only care about something when it affects yourself. Are you advocating that unless you're black, you shouldn't have supported (or got involved with) the black civil rights movement?
- vcarl 12y ago
  It may not be harming YOUR customers, but I don't agree with the premise that you only have an ethical obligation to protect the people paying you. The competitor's bad practice vastly increases their customer's risk of having their cards stolen, not only by people who break through the "security", but also by disgruntled employees.
- icebraining 12y ago
  The activity isn't harming you, it only "harms" the people with a relationship with the company Actually, no. If the CC numbers are used fraudulently, the clients of that company will just issue chargebacks; at most, they'll need to get new cards. The people who'll have to pay are the merchants who will get hit with those chargebacks - and indirectly everyone else, since prices are raised to pay for those losses.

by pm24601 12y ago

icebraining 12y ago

PCI is not a law, it's an industry standard. Only a couple of states legally mandate compliance to PCI DSS. I agree OP should report them, though.

click170 12y ago
This is true, but if the competitor is advertising PCI compliance and is not providing that, their consumers have a right to know that they are not getting what they paid for.
dublinclontarf 12y ago
He would lose his ability to process credit cards, possibly having bank accounts closed etc.
- icebraining 12y ago
  Immediately? Wouldn't they give them a "second chance" to implement the necessary changes?

altron 12y ago

Thank you for your support. Edit:: I have not made up my mind yet. Admittedly, at the time of posting I was leaning more toward that side. After reading everyone's advice, I'm leaning more toward a multi-tiered approach as @jacquesm suggested. It seems to avoid bad karma and burning bridges. Also, it seems as though the PCI Industry rarely acts on reports. So, working with the competitor to fix their issues could be the best thing down the road. It's a very small industry, and the possibility of a buy-out could exist in a few years.

cypher543 12y ago
It sounds like you've already made up your mind and are just looking for people to agree with you.
- hkailahi 12y ago
  This is the vibe I was getting, which is unfortunate. Of course I'm only speculating. Similarly, I find it to be insanely frustrating when people ask for advice, but are not willing to listen when they get it. It feels dishonest.
  - nitrogen 12y ago
    Not agreeing with advice doesn't mean the recipient didn't listen to or appreciate it.
    - hkailahi 12y ago
      A recipient could have listened. A recipient could have not listened. I still think it is dishonest when it is someone's intention to fish for agreements. I originally speculated as to whether this was the case, and he/she has said otherwise.
MichaelGG 12y ago
Don't be under the impression that reporting a PCI violation will matter. They'll just apply a bandage if anyone looks into it. The real risk is if they have a breach, then they'll be liable for more fines. I know businesses that are very successful and ignore PCI. One even sold for a large amount of money. They implemented BrainTree in a week to solve a due diligence issue. No big deal. Sure, if they'd been hacked it'd have really hurt, but they weren't and now have FU money. For it to actually really hurt your competitor, you'd have to probably astroturf some forums, acting like concerned customers, and get other customers upset. And even then, you're just going to cost them a week or so. Maybe if you timed it for maximum damage, but just don't waste too much time on it.
ScottBurson 12y ago

88e282102ae2e5b 12y ago

I thought PCI compliance wasn't necessarily legally required, just that it was a contractual agreement between your company and the payment processor? Regardless, I still feel reporting is the ethical thing to do.

briandear 12y ago

I think it's a dick move. It's like calling the cops because your neighbor is smoking pot in their garage. The activity isn't harming you, it only "harms" the people with a relationship with the company. If it were me, I'd likely use the competitor's lack of PCI compliance as a tool for my own marketing -- I wouldn't even use the competitor's name, but do something like "Unlike many of our competitors <my_awesome_product> is fully PCI compliant because we care about your security." Turn the "weakness" of the competitor into your strength. But reporting him to the authorities? That's very Stasi-esque. Unless a law is being broken AND it's creating an unsafe situation for your customers or your company, leave it alone. In my opinion it's a classless move to go after your competitors in that fashion. Beat them with a better product. In this case, a "better" product would seem to be one with PCI compliance. As far as the "toxic waste" analogy -- I've never heard of anyone getting cancer and dying from a lack of PCI compliance. In fact, there are likely more important things to worry about than PCI compliance -- Target and all of the other high profile retailers that were credit-card hacked -- they were all allegedly PCI compliant, yet it still didn't do much good. I'm not hear to debate the value of PCI compliance -- if it's a requirement of your business, then obviously you have to do it. But I am debating the ethics of reporting a competitor for an activity that is NOT illegal, nor is it directly harming your customers or your business.

chrischen 12y ago
I think it's a dick move to only care about something when it affects yourself. Are you advocating that unless you're black, you shouldn't have supported (or got involved with) the black civil rights movement?
vcarl 12y ago
It may not be harming YOUR customers, but I don't agree with the premise that you only have an ethical obligation to protect the people paying you. The competitor's bad practice vastly increases their customer's risk of having their cards stolen, not only by people who break through the "security", but also by disgruntled employees.
icebraining 12y ago
The activity isn't harming you, it only "harms" the people with a relationship with the company Actually, no. If the CC numbers are used fraudulently, the clients of that company will just issue chargebacks; at most, they'll need to get new cards. The people who'll have to pay are the merchants who will get hit with those chargebacks - and indirectly everyone else, since prices are raised to pay for those losses.