Do Consumers Really Care About Card Data Theft?
Mark Jewell, Business Writer for AP, looks at the same store sales figures reported by data breach victim TJX Companies that "reported sales at stores open at least a year rose 6 percent in March." Jewell reported that "customers leaving a T.J. Maxx store Thursday in Boston's Downtown Crossing shopping hub said the retailer's cut-rate prices on clothing and home goods are a big enough draw to offset any worries about lax data security. They said they didn't see TJX as any more susceptible to such theft than any other retailer." One recent consumer survey concluded that data breaches would matter to consumers and affect their decisions as to where they shop.
Interesting article. Thanks also for linking to our consumer study on data breaches. We were a bit perplexed by the latest TJX earnings report and certainly see the validity (on the surface) that this may be an indication that consumers don't care about data breaches.
However, the primary recommendation and call to action from our recent work on data breaches was to evolve PCI compliance -- making it a brand posted at the point of sale and making consumers more aware of the value of PCI compliance. This not only provides value to the merchant in going through the arduous compliance process (the only value they see in the present is that they will avoid fines for non-compliance), and it also gives consumers a better idea of who is actually working to protect their data from being stolen.
We believe that once this awareness is reached and PCI compliance gains brand equity, merchants can use it as a source of competitive differentiation. In the present, consumers have no way of knowing that TJ Maxx or any other merchant is protecting or not protecting their data. Branding PCI compliance to where consumers begin to actively look for signage may change their behavior.
Posted by: Bruce Cundiff | April 17, 2007 at 08:21 AM
There's always that proverbial gap in surveying consumers between them telling you what they think they should do - and what they actually do. This seems on the surface to be a great example of exactly that.
As for some indication of PCI compliance at the merchant POS, that feels to me like one more thing that consumers will just ignore - just like the VeriSign and Truste seals on various websites that add eye candy but little else.
Posted by: Scott Loftesness | April 18, 2007 at 06:07 AM