First off, I must commend on the industry for pushing merchants to a higher standard of care when it comes to security and better practices, but there is a line that has been crossed, and continues to be crossed, when it comes to merchants.

I will be the first to admit, it’s never a bad idea to educate, train and empower merchants to refocus some of their efforts on better security. After all, when it comes down to it, everyone should be more cautious about consumer data whether it be the CTO managing next year’s security budget, or the cashier taking the card itself- but when the industry decides to use scare tactics, that is just not right.

Fact is, PCI compliance is about merchants who store card data. There are countless options that allow merchants not to be required to undergo compliance requirements, whether it be hosting your payment page on your payment gateway or using third party billers, there are many ways you can avoid the need for PCI compliance, but it all comes down to not storing or transmitting card data.

When the industry decides to scare merchants into paying ridiculous annual fees or undue audit charges, that’s just absurd. In the end, the people often selling these “PCI” services often don’t even realize the idea behind PCI compliance other than to think that merchants “must” adhere to it. Most merchants do follow 100% of the PCI requirements, so when service providers attempt to scare merchants into unneeded fees and expenditures, especially in today’s economy, that’s just wrong.

If you or your company have been hit by undue fees, please let me know and I will be glad to expose companies that prey on unsuspecting merchants with exorbitant fees and charges when they simply aren’t needed.

Need help when it comes to PCI compliance? Go straight to the source. Visa (NYSE V) has a great online resource that is easy to understand and follow for merchants - http://usa.visa.com/merchants/risk_management/cisp_merchants.html. Yes, I admit most merchants will need help beyond informational pages like this, but I also think that before you or any other merchant decides to spend a couple of thousand dollars on ridiculous PCI compliance fees, you should read the information straight from the source and don’t feel bad about asking your service provider: “can you show me where it says I really need this?” Because most of the time, they wont be able to.