Do Small Businesses Plus Mobile Devices Equal Trouble?

The rapid rise in small businesses’ use of mobile devices for accepting electronic payments has an unwelcome companion: merchant indifference to data security, a poll of more than 6,000 businesses found.

According to ControlScan Inc.’s survey of 6,186 randomly selected businesses that are customers of eight of the information-security company’s payment-processor clients, 21% had adopted mobile payments at the point of sale. That compares with 17% using mobile devices for card-present sales in a similar ControlScan survey in April 2013 and only 10% in July 2012. Another 4% of this year’s respondents were in the process of implementing mobile POS payments when queried. The businesses, three-fourths of which had 10 or fewer employees, were polled by Internet in June and July.

But lax attitudes and practices regarding security are evident. Some 63% of respondents reported being “not at all concerned” about the data they were transmitting via a mobile device. Only 10% said they were very concerned while 27% said they were somewhat concerned.

Another cringe-worthy finding is the high degree of personal use of payment-processing mobile devices. Employees provide their own devices in a full 40% of cases while employers supply 60%, the survey found. The PCI Security Standards Council, which updates the Payment Card Industry data-security standard and its related standards, has noted that off-the-shelf mobile devices may not have incorporated generally accepted information-security standards.

Some 78% of respondents answered yes when asked if the mobile devices they used for accepting credit card payments also are used “for other tasks such as checking and sending email, surfing the Web, etc.?”

“The nature of these mobile devices provides some barriers to PCI compliance,” says Steve Robb, senior vice president at Alpharetta, Ga.-based ControlScan.

The findings represent an opening for independent sales organizations and acquirers to educate their small-business clientele about payments security—and to showcase their services, according to Joan Herbig, ControlScan chief executive. “Use this as an opportunity to promote your mobile-security solutions,” she says.

It’s no surprise that small businesses are interested in using mobile devices given all the attention on mobile payments generated by prominent startups such as Square Inc. as well as by ISOs, tech specialists and big merchant acquirers. Square quickly came to dominate mobile-payment services for micro businesses and somewhat bigger small enterprises when it burst onto the scene in 2010, but all the new competition apparently has eroded its market share even though the company is still reporting strong growth. Some 28% of ControlScan’s respondents reporting using Square services in 2014, down from 45% in 2012.

“It may have been Square was the only game in town; today we’re seeing processors and ISOs bringing their own solutions to the marketplace,” says Herbig.

Indeed, 59% of respondents get their processing services from “other.” Six percent of reported they use PayPal Inc.’s PayPal Here service while 4% use North American Bancard’s PayAnywhere and 1% each use Roam Data’s RoamPay, ID Tech’s iMag, and ShopKeep POS.

A full 33% of respondents said they have always used a mobile-based POS system, while 20% said they had or would replace a traditional system with one based entirely on mobile devices. Forty-seven percent said mobile devices supplement the traditional POS systems they use.

—Jim Daly