I don't like to write about competitors. But in this case we have:

• Verifone publicly disclosing a security vulnerability in a competitor's (Square) product.
• Square dismissing the vulnerability as a pre-existing condition.

Shame on both companies. More shame on Square. Here's why:

Square cut corners.
Credit card industry insiders have known that the technology in use by Square was deeply flawed for several months. For example, VPS' mobile processing offering uses a card swipe device that encrypts card data before sending that data to the mobile phone.  The swipe device costs VPS around $50 and is $20 more expensive than a non-encrypting device.  Square could have spent a few bucks more on their card swipe device, but in their zeal to give customers a too-good-to-be-true deal, they went cheap and got caught. Of course, Square's entire business plan is predicated on cheap.

Square is Not Owning Up
Square's response to Verifone has been a perfect example of what not to do when faced with a bad situation. Instead of disabling the insecure devices and paying to make it right, Square is trying to blame others, like Visa and MasterCard who make cards that have, gasp, credit card numbers on them. Square had to know, as did VPS, that when they launched their service, that choosing an unencrypted card swipe device was a very bad call.

The moral of the story is that credit card processing companies have to live up to market expectations for security. Square, in their race to be the low cost leader, cut corners and got caught, leaving their merchants and more importantly cardholders holding the bag. This episode will do grave damage to Square's brand, and Square simply may not be able to recover in the long run.