Marble and Stone omnichannel payment solutions

Marble and stone manufacturers and distributors that use traditional payment technology will suffer from higher credit card processing fees, PCI Compliance problems, and increased fraud risk. This article identifies the main problems and how to fix them.

PCI Compliance Problems

It’s a fact there will be card not present transactions. Credit card authorization forms have been a primary tool to mitigate fraud risk, but they’re a PCI compliance nightmare:

  • Merchants cannot request CVV2 on any paper form, even if it will be destroyed later. (Visa Core Rules October 2014). Without CVV2, the merchant will lose any future fraudulent card dispute.
  • Forms contain sensitive data. It’s virtually impossible to keep the signature on file and be PCI Compliant.
  • Employees have access to credit card numbers
  • The receiving fax needs to be secured, and if digital, any memory securely wiped when the machine is replaced.

PCI Compliance Solutions

  • PCI compliant credit card authorization form for variable recurring billing
  • Tokenization to store card data outside ERP and other software to reduce scope and burden
  • Customers self-payment solutions so employees have no access to card data. Options include online hosted pay page and electronic bill presentment & payment (See also How to get CVV2 and be PCI Compliant)

Mixed Retail and Card Not Present Transaction Interchange Rate Problems

When a merchant has a retail merchant account, magnetic stripe data is expected with the transaction. When it’s not included, the merchant pays higher non-qualified interchange fees.  There are no desktop terminals, and few cloud based solutions that support level III processing for retail transactions. This is significant because most cards that qualify are MasterCard and the average savings is .75%.

When a merchant has a MOTO (mail and phone order) merchant account, and then swipes a card, they get the benefit of a signed receipt, but not the benefit of lower swiped merchant fees.

Mixed Retail and Card Not Present Transaction Interchange Rate Solutions

Marble and Stone merchants MUST have a solution with interchange rate optimization that solves the above and numerous other issues related to omnichannel credit card processing.

Multiple Locations, Centralized Billing Problems

With centralized billing, when there’s a dispute, the merchant needs to present the signed receipt. It’s time consuming and inefficient to store and locate paper receipts.

Multiple Locations, Centralized Billing Solutions

Signature capture terminals are essential. Mobile is not an acceptable substitute for signature capture, because marble and stone merchants benefit from pin debit and other optimization capabilities that are only possible with multi-lane terminals. EMV, NFC and P2PE are recommended.

CenPOS is the only payment gateway and payment engine that solves every problem listed above. CenPOS has solved these problems for years, while Authorize.net, Paypal, Payflow Pro, and even newer alternative gateways have not caught up. Contact Christine Speedy 954-942-0483 for sales and ERP or other software integrations.

 

 

 

 

3D Merchant Services Powered by CenPOS
2633 NE 26th Ave Metro South FloridaFL33064 USA 
 • 954-942-0483

How to get CVV2 and be PCI Compliant: request a payment

Credit card authorization form  pci

Credit card authorization form example is not PCI Compliant.

According to Visa Core Rules, October 2014 page 266, Merchant Must Not Request the Card Verification Value 2 data on any paper Order Form. So how can a merchant get the CVV for card not present customers?  Online payments, request a payment and electronic bill presentment and payment all solve the problem.

Online payments:

  • Requires SSL certificate, or hosted pay page with SSL and a payment gateway
  • Customer goes to a web page to make payments

Request a Payment: Passive

  • Merchant logs into CenPOS Electronic Bill Presentment & Payment (EBPP) portal, enters customer email or cell phone, invoice # and amount owed. The customer then receives a prefilled payment object to click and pay on a secure hosted pay page.
  • Reduces accounts receivable friction

EBPP Electronic Bill Presentment & Payment

Electronic bill presentment and payment: Proactive

  • Non-Integrated – the merchant sends an invoice with link to pay. The customer pays via a secure hosted pay page or logs into a portal.
  • Integrated – same as above, except payment is entered into accounting or financial software such as ERP.

At a minimum, merchants with card not present customers should offer online payments as a way to enable customers to securely pay a bill. If a signature is required, have the customer print and sign the receipt, and email that authorization back, which is more valuable than traditional credit card authorization forms.

Need a secure solution but don’t want to change your merchant account? No problem. Contact Christine Speedy for secure. cost effective and efficient solutions.

PCI Compliance: Card Not Present Merchant Quick Checklist

Do you (even occasionally or temporarily) create, receive, or otherwise come to possess any paper records or receipts that contain cardholder data? The number one rule card not present merchants violate is a Merchant Must Not Request the Card Verification Value 2 data on any paper Order Form.

Do you make sure that you NEVER, EVER store the card-validation code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions after authorization (even if encrypted)?

Are strong cryptography and security protocols, such as SSL/TLS, IPSec, or SSH used to safeguard cardholder data during transmission over open, public networks?

For SSL/TLS implementations, does HTTPS appear as part of the browser Universal Record Locator (URL), and is cardholder data required only when HTTPS appears in the URL?

Are policies, procedures, and practices in place to make sure that you NEVER, EVER send unencrypted PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat)?

Do your access limitations require restriction of access rights to privileged user IDs to least privileges necessary to perform job responsibilities?

Do your access limitations require assignment of privileges to be based on individual personnel’s job classification and function?

Is your security policy established, published, maintained, and disseminated to all relevant personnel (for the purposes of Requirement 12, “personnel” refers to full-time and part-time employees, temporary employees and personnel, and contractors and consultants who are “resident” on the entity’s site or otherwise have access to the company’s site cardholder data environment)?

Is a formal security awareness program in place to make all personnel aware of the importance of cardholder data security?

60 Minutes: What happens when you swipe your card?

This is a good episode for businesses and consumers. It’s also a good reminder to businesses of any size- the high cost of a data breach extends to bad PR for eternity on the internet. Aired on 11/30/14, as hacking of top retailers make headlines, Bill Whitaker discovers how insecure your credit card information is this holiday season. Michaels, Target, Home Depot, P.F. Changs all hit by data breaches.

Click here to watch video on CBS 60 Minutes: What happens when you swipe your card?

VX520 terminal with EMV NFC Contactless $99 Sale

The Verifone VX5520 is a reliable credit card terminal, compatible with any merchant account.

VX520 emv NFC verifone terminal

I rarely recommend desktop terminals, because they generally are not the best choice for my type of customers, which often are business to business, multi-location, or have a mix of card present and card not present. For single store retail shops and small businesses, this is a great value. Included:

  • Built-in debit pin pad
  • Built in printer
  • EMV Contact and contactless
  • NFC contactless
  • Ethernet & Dial

Sale price while supplies last, $99 with any new merchant account.

Verifone has a version without Contactless/NFC, however, I don’t recommend it for two reasons. One, it limits the types of payment methods your customers can pay with, such as excluding Apple Pay. Two, to meet additional incentives from MasterCard for upgrading to EMV, merchants must support both contact and contactless.