Even the tiniest firms face fines for failing to protect credit card details

Chip and pin credit card

Small and micro businesses face huge fines unless they comply with security standards on credit and debit card payments.

Since December 1 it has been compulsory for even the smallest of firms to ensure they meet the Payment Card Industry Data Security Standard.

This was introduced to ensure that all firms that process, store or transmit financial data do it in a secure environment. Large firms already had to meet the standards.

Experts are warning that the change could have a huge impact on millions of small businesses, many of which are unaware of the conditions they need to meet.

For example, firms may be holding on to data such as the three-digit code from the back of cards, which is in breach of card company policies.

Companies that are not compliant also face being made liable for fraudulent transactions and could even have their merchant accounts closed.

Ensuring that they are fully compliant with the new code could cost small businesses hundreds or even thousands of pounds.

Andrew Ogilvie is managing director of Xtraordinary Hosting, a cloud-based storage and service company with offices in Edinburgh and the City.

He says: ‘Many businesses will now have to spend thousands of pounds updating their systems with better firewalls, anti-virus kit and other measures, or pay significantly more to a web hosting company who can provide the proper protection.

‘Small firms are failing to appreciate how complex the process is and they also may lack the IT knowledge to successfully achieve compliance.’

There are four tiers of compliance according to how many transactions firms carry out a year. Firms can identify which level of compliance they must meet by visiting the website pcisecuritystandards.org.

If they do not they could face a fine of tens of thousands of pounds.