Firms must allow time for chip and Pin test

Retailers must not underestimate the complexity of the testing process required before going live with chip and Pin projects,...

Retailers must not underestimate the complexity of the testing process required before going live with chip and Pin projects, fashion retailer River Island has warned.

The firm, which is participating in the Northampton trial of the anti-fraud technology, said retailers with integrated point-of-sale systems should allow a minimum of six weeks to complete acquirer acceptance testing.

This process of ensuring that every acquirer's credit card works with new chip and Pin compliant point-of-sale systems, is complex with a number of stages, said Tim Barton, retail systems manager at River Island.

"Retailers need to ensure all systems are ready for testing. A full pre-test is advisable and the effort to achieve this should not be underestimated," he said.

"Firms should also ensure all their internal departments, such as IT, finance and retail operations, are involved and ready to work together."

Retailers should assume there will be problems with the testing and ensure IT staff are available to fix small glitches on the spot, with an additional software expert on-site to help with more complex problems, Barton said.

There must be enough time to complete acceptance testing, he said. "While the initial execution of the first cycle of acquirer acceptance testing may only take two or three days on-site, and the review and test results will take four to five days off-site, it is likely that this process will require a number of test cycles."

"Integrated point of sale retailers like River Island should allow an absolute minimum of six weeks to complete this testing."

Barton said the major stumbling blocks retailers will encounter during testing are the availability of the 200 test cards; the acquirer capacity for testing; the availability of suppliers for on-site support and the availability of chip and Pin hardware.

Although retailers without chip and Pin compliant systems will not be liable for fraudulent transactions until January 2005, companies should aim for October 2004, Barton said.

"That is the deadline when retailers should have found and installed the systems and trained staff before the Christmas peak. Directly after Christmas the liability shift kicks in and from that date the retailer is vulnerable.

"I heard that a major name in clothing and footwear had taken the decision not to do anything. They are simply taking the risk," Barton said.

"I think this is very dangerous. Fraudsters will soon suss who is chip and Pin enabled and who is not and fraud will simply migrate to those who are unprepared."

Read more on IT risk management