Merchants must scan computer systems at various intervals for Payment Card Industry Data Security Standard (PCI DSS), depending on their merchant type and other criteria.

Read our merchant data security sticky web page for further information and links.

PCI Security Standards Council maintains a list of certified scanning companies

Below is a select list of those I’ve had the most positive interaction with over the years.

Comodo CA Ltd
www.comodo.com HackerGuardian PCI Scanning Service

ControlScan
www.controlscan.com PCI 1-2-3

Digital Resources Group
www.drgsf.com DRG SecureScan

McAfee Inc.  McAfee Secure, formerly Hacker Safe (I knew Hacker Safe very well, but have had little experience with McAfee Secure)
www.mcafee.com

Qualys
www.qualys.com QualysGuard

This list does not infer the other companies would be less acceptable to work with, only that I’ve personally not dealt with the company or simply not had enough interaction to remember them. To protect your company from credit card processing fraud and the costly repercussions of it, all companies should have completed a PCI Compliance Certification whether you have standalone terminals or are connected to computers.

To clarify the 2010 Debit Pin Entry Device standard merchants are expected to comply with by July 2010, not all merchants will need to change their pinpads. If you deployed a POS PED by December 31, 2007 AND  it was on the 2004-2007 Visa PCI lab approved list, you have until December 31, 2014 to replace it.

If you do not meet that requirement, then you’ll need to replace your PED by July 1, 2010 with a unit that meets the new Triple Data Encryption Standard (TDES) standard. Look carefully. There are companies that will sell you units that do not comply with the new standard.

POS- Point Of Sale

PED - Pin Entry Device

POS PED- a device in a merchant location where the customer is present at the time of the transaction.

Pinpad - pin pad- another name for PED

Triple DES- Triple Data Encryption Standard

3DES - same as above

OVERVIEW OF THE 2010 PCI COMPLIANCE RULE FOR DEBIT PIN ENTRY DEVICES:

The new standard is to improve the security of customer debit cards. The technology has been widely implemented over a number of years in ATM’s and such, and merchant pinpads are the last piece to complete.

DEADLINES:

July 1, 2010 If your unit was deployed after 12/31/2007 and it does not have Triple DES encryption, then you need to replace it. Any unit deployed prior to 2004 needs to be replaced.

12/31/2014 If you deployed a POS PED by December 31, 2007 AND  it was on the 2004-2007 Visa PCI lab approved list, then you must replace with a PCI SSC POS PED by this date. 

When you deployed your PED is a matter of record with your current service provider. Where is a copy of the 2004-2007 Visa PCI lab approved list?  https://partnernetwork.visa.com/vpn/global/category.do?userRegion=1&categoryId=19&documentId=33

HOW DO I VERIFY IF I HAVE A PCI COMPLIANT PED?

The PCI Data Security Standards Council has an updated list for all merchant providers. List of PCI compliant PEDs

WHICH NEW PIN ENTRY DEVICE DO YOU RECOMMEND?

First, make sure the unit has Triple Data Encryption Standard (TDES) certification. Just because someone is selling it, doesn’t mean it’s TDES. The PED must be matched to your terminal and the merchant services provider.  You can’t just pick any unit and attach it. A hugely popular unit is the

First Data FD-10 debit pin pad

because First Data is one of the largest payment processors in the country. Many merchant providers utilize the First Data system, therefore can use the unit. Additionally, it works with many different desktop terminals.

If you need to upgrade, now is the time to look at your entire system. Do you need a PED or would you be better off with a signature capture terminal that has an integrated PED? You can get a wireless, desktop or, or even a device that connects to a host based system like CenPOS that provides incredible benefits for organizations processing $1 million per month and up.  Take a look at the Ingenico i6580, a top of the line unit.

ingenico i6580 i6550

In summary, I like units that have in integrated Debit PED over a separate device that attaches. Oh, and this is another area that you have to be very careful reading product description text. Some product technical descriptions say they accept debit cards but they are not referring to accepting pin debit transactions! As if merchants don’t have enough to get confused about.

All debit PED’s must be encrypted. This is done via a process called an injection. There are a limited number of facilities in the USA that can perform the injection. That means you should not wait until the last minute because a lot of other people will.

3D Merchant Services is an authorized reseller for current equipment ONLY for major brands including Verifone, Hypercom, and Ingenico. We also offer Nurit, Way and other brands. Because of our high volume, we have wholesale prices compared to others. We’re independent- you can use our credit card processing or not. We don’t give free equipment- you’ll get a better deal on your processing and your equipment if you keep the transactions separate. Equipment is never really free.

Related article:

Which Verifone pin entry devices are pci compliant?

Non-receipt of PCI Validation fee for $19.95 showing up on your merchant statements? This is normally from failure to complete your required PCI Compliance paperwork at SecurityMetrics.com. What paperwork? If you’re one of my customers, below is what was sent in the mail from Security Metrics.

PCI compliance validation FAQ (PDF)
Security Metrics Enrollment (PDF)
Payment Processor Letter Security Metrics Overview (PDF)

DISCLAIMER:  Your documents and fees may vary. Newer documents may have been published since these. Please contact your processor for specific information about your PCI Compliance statement fees.

This subject was highlighted in the January 3D Merchant newsletter. First Data created a mandatory PCI Compliance Assistance Service Program in 2009. Since so many merchant processors have First Data relationships, the reach is huge. Security Metrics administers the program, which has a mandatory annual fee and compliance certification requirement. Merchants MUST return the PCI Compliance Validation form in a timely manner. If you do not return the form, or are not PCI Compliant, you’ll be charged $19.95/month. All fees are deducted from your merchant account. I’ve already seen this fee appear on a Sun Trust merchant statement from a non-customer as “non-receipt of PCI Validation” so please turn in your paperwork per the instructions.

A few merchants I’ve spoken to said they didn’t receive the letter from Security Metrics  but they are getting billed. Unfortunately, this is basically a blind program. We don’t know when letters are sent, and don’t know there is a problem until the non-compliance fee shows up. Merchants should read the ALERT messages that appear on their statements. There is information about upcoming fee changes, and other critical messages.

WHO GETS THE LETTERS?

It’s delivered to the same name and address that merchant statements are sent to. If you have an old name on your merchant statement, update your records.

WHEN ARE THE LETTERS SENT? They are being sent at random until every merchant receives them.

WHAT IF I DON’T HAVE A LETTER, BUT I’M GETTING A MONTHLY Non-receipt of PCI Validation FEE? If you’re one of my customers, you can go straight to SecurityMetrics.com and register. Your company is in the database and you’re automatically billed on your merchant statements.

DO I NEED TO FAX OVER THE ENROLLMENT FORM? No. That is one of the options. I recommend  that you simply start with the online form.

DO I NEED TO KNOW ALL THE ANSWERS BEFORE I START ONLINE? No, but I recommend you visit the PCI Security Standards web site first and download the appropriate SAQ (self attestment questionairre). That way when you do online you can zip through the questions.

WHAT IF I’VE ALREADY BEEN CERTIFIED BY ANOTHER APPROVED VENDOR?  You can submit your certification documentation via fax to 402-916-8240 or via email. Contact your processor or sales agent for details.

IS THE MONTHLY FEE PERMANENT? No. The fee is for non-receipt of materials. Once you are proven PCI Compliant, the fee will come off, however, it may not be immediate.

related articles:

First Data PCI Compliance fee

First Data Merchants Attain Record PCI Compliance