VoIP for credit card processing voids PCI Compliance

December 21st, 2008

If you plug a PCI Compliant credit card processing terminal into a VoIP connection, then your processing is no longer compliant.

This explanation attempts to detail why. Traditional phone = analog. Traditional lines use hardware to send data ie the copper line. When using a 2008 compliant credit card terminal, the desktop terminal sends encrypted credit card data from the merchant to the processor and back using analog signals.

VoIP = digital. VoIP traffic flows across the Internet in unencrypted packets, which means anyone that has access to the network between sender and recipient can intercept them. So the desktop terminal may be compliant, but once the data is on the open network, the merchant set up is no longer PCI Compliant. Even though there are optional packages that can be attached to some VoIP networks, they do not meet current PCI compliance standards for the credit card processing industry.

If you attach a magnetic card swipe to your computer the transaction is processed using SSL security. It is not the same as VoIP. SSL uses a cryptogaphic system. It has two keys to encrypt data- a public key known to everyone, and a private key known only to the recipient. The magnetic card reader can be used with many POS systems and a high speed DSL, cable modem or T1 line.

Internet, ecommerce, and virtual terminal transactions all use SSL.

There are important considerations to check for both mag card readers and ecommerce transactions. Each requires a Gateway. The Gateway enables secure, real-time payment processing of credit card transactions. It is not the same as a credit card processor. Most people don’t realize that gateways and ecommerce stores must pass specific information through to the credit card processor to get better rates. Most systems focus on fraud protection, but do not necessarily pass through critical data required to meet specific interchange requirements. Sometimes the store doesn’t pass the data, and sometimes the gateway doesn’t pass the data- it all depends on company capabilities.

I’m not a tech expert but in general, the description above is sufficiently accurate to explain why. Bottom line: Visa & MasterCard officially state there is no acceptable VoIP solution that meets PCI Compliance requirements.

Are interchange fees rising dramatically?

December 19th, 2008

Have interchange fees risen dramatically over the years? In reality interchange fees have risen very slowly, however, your credit card processing costs may have risen dramatically. That’s because years ago there was less competition in the industry, and few options for reducing pricing.

Key reasons why your credit card processing costs may have risen dramatically:

1. You have a price plan that does not allow you to access the many different levels of interchange. ie your price plan may have a qualified, mid-qualified, non-qualified rate, or something similar. When additional interchange categories are added, they may have all been automatically put into your non-qualified pricing, the most expensive. The most simplistic way to determine if you MIGHT have a problem is to look at your statement. If your statement has text like the image below, that’s OK if you are a small business, processing $5000-$10,000 per month. If you are processing $50,000 or more per month, then this is certainly not the right price plan for your business.

2. You are set up wrong- this could be terminal programming, improper account set-up at the processor, or other factors that have the same resulting affect. You are not processing at the least cost possible for the type of card presented and transaction type initiated. This is nearly impossible for a merchant to figure out since you would have to have specific industry knowledge as well as access to specific reporting to help you identify there is a problem.

3. The cashiers are making mistakes. This takes three things needed to identify this probem and correct it. First, you need the right price plan and set up per the above items. Second, you need a basic understanding of interchange qualification. Third, you need detailed reporting so that you can recognize the problem areas.

The long term solution is a processing partner who will give you the right pricing plan, the right tools, and the training to help you permanently manage your credit card processing costs. They are few and far between, but if you qualify, we can probably help you.

First Data Reveals Consumers’ Assessments of Rewards Programs for Financial Institutions

December 10th, 2008

This summer, First Data conducted a consumer loyalty study focused on rewards programs for the financial institution market sector.  More than 1,000 U.S. consumers participated in the study. Key findings include:



• Credit card rewards programs are the most popular, versus debit card or “other banking” rewards programs such as those tied to savings accounts



• Consumers are frustrated – especially when they cannot use the rewards being offered or have no choice when selecting rewards



• Consumers have strong opinions about what constitutes a “unique rewards program”



• The  most important program features are the ability to select rewards and ease of use



More detail is available on these findings.  Credit card rewards program study goes into further detail on these findings and provides additional statistics that offer important perspectives for financial institutions to consider.