To comply with payment-security rules, all PIN-entry keypads, the kind used at Cost Plus World Market stores, must incorporate encryption technology that protects consumers' data as the information travels across payment networks, Mercator Advisory Group analyst Tim Sloane tells CardLine. "This, however, does not eliminate the risk associated with criminals gaining physical access to the key pad. By adding skimming devices that get card data and cameras that catch the consumer's PIN, thieves are able to hijack the consumer's card," Sloane says. "Educating every merchant to be vigilant against this physical invasion is taking time and often meets the attitude that, 'this won't happen to me.'" That attitude is especially common among smaller merchants, he says. But as larger merchants, such as Cost Plus, "lock down" physical access to their PIN-entry devices, "thieves will gravitate to the smaller merchants that have failed to take appropriate action," Sloane says.