Posts Tagged ‘PCI compliance’

collecting political campaign contributions online

Thursday, June 3rd, 2010

Merchant services for political campaigns tend to cost more than for retail merchants. Why? The main reasons are their lack of knowledge about the subject and then all the other reasons. Other reasons include how payment is collected, the types of cards presented, and the credit card processing price plans they are on. Below I’ll address each issue in brief.

First their lack of knowledge makes it easier for other companies to charge them more money. Think used car salesmen 25 years ago. Small campaign races will generally pay more than big races because there is little to process. This is simply an ROI issue just like with small businesses. But what about the bigger campaigns?

How do politicians collect money for campaign contributions? The most popular are checks in the mail, donor cards collected at speaking events (check or credit card which is key entered later), and online donations. The donor card exposes the politician to substantial risk. Where are the cards stored while traveling from one event to the next? Who opens the mail? Who keypunches the data? What kind of training have they had in protecting card data? Do you perform background checks on volunteers who see donor cards?

  • Reduce risk by keypunching data into a virtual terminal on site.
  • Reduce risk and cost by attaching a card reader to a computer. You’ll save about 0.5% by swiping vs key entering.
  • Always securely shred card data upon completion of transaction. With a well-developed donor form, you can detach or cut off the credit card data while still keeping critical information on the form such as payment amount. Record the authorization number and date processed on the form for  your records.
  • Costs are affected by the type of card presented for payment. You can’t control this. But you also need to know the merchant services game because this is a big gotcha. In my experience, the card type can relate to the type of race; the bigger dollar donors use rewards or corporate cards. Campaigns targeting smaller donations attract a high amount of debit cards, up to 50%. Here’s the big catch on merchant agreements- QUALIFIED RATE. Chances are 80% of cards presented will never hit the qualified rate. So what’s your non-qualified rate? What’s your best rate for corporate cards for a MOTO merchant account? (Interchange is 2.2% plus $.10 per transaction. )

    Common Visa interchange rates for reference: RETAIL= swiped card. MOTO = mail order or phone order. Ecommerce rates are the same, but account set up and rules are different. Below is a very small list of the 500 or so possible rates.  We see every day on merchant accounts.

  • debit/check card, swipe .95% plus $.20 per transaction
  • debit/check card, MOTO 1.53% plus $.10 per transaction
  • credit card, swipe 1.79% plus $.10 per transaction
  • rewards card, MOTO 1.95% plus $.10 per transaction
  • Commercial card MOTO 2.2% plus $.10 per transaction
    Downgrade costs can be nearly 1%, and remember, these are interchange costs. Your fees will be higher.
  • Credit card processing price plans vary widely for this industry, but in general, are much higher than others. That’s not because the raw costs are higher, its because the payment processors take bigger profits. Remember what I said about the used car salesman. Credit card processing is not the core skill of the average politician and it may not be for the finance manager either. One of the most valuable assets of a politician is their time. Therefore they tend to copy what others in their party are doing, or simply look for the easiest solution that solves many of their time issues.

    Ecommerce solutions for politicians are plentiful as they are for non-profits. I have no problem with payment processing costs being higher than average if you get a robust software package at no cost. Companies have to recoup their investment somewhere. But what if you pay for the software and the payment processing?

    Let’s look a little deeper into an example such as Click & Pledge. It has lots of cool features to manage donors and build an online community. They also have an integrated payment processing solution option. I had to read several sections a few times, and based on what I read,  I’m still not sure. Can you use their other features but not the payment processing/ They have API section which looks like a yes, but the non-existent comments in the forum make me wonder.

    Their rates are among the highest I’ve seen at 4.5% and $.35 per transaction. But wait- that’s not for all cards. “Visa & MasterCard may add additional fees for affinity and cards which earn points. These cards are referred to as non-qualified cards and typically have 1% surcharge associated with them. The fees are not being charged by Click & Pledge and we have no control over which cards will be charged as a non-qualified card.”  So merchants can expect to pay up to 5.5%. Basically they’ve locked in at least 2% profit (also known as 200 basis points) by my estimation, and that’s very high in todays marketplace.

    Two percent is about double the norm for a small business from what I’ve seen, although that market is not my specialty. Maybe solutions like this are still a good fit for your campaign. But before  you buy, ask if you’re allowed to use your own merchant account. In most cases you’ll do better far on price and there are other benefits as well. For example, if I were managing your account, I’d make sure you had the right type of merchant accounts for different situations to meet Visa and MasterCard regulations. You’ll get advice and handouts for volunteers on proper data security. We can assist with your check processing, including remote deposit capture. We can assist with payment type and provide risk management advice to help protect you against embarassing data security breaches.

    Keep more money from your online donations. Get a merchant account separate from your software or web host.

    3D Merchant newsletters

    Wednesday, June 2nd, 2010

    Merchant Account and Payment Processing Newsletters, events, and marketing collateral. 3D Merchant shares insights with you. Not all newsletters are posted for public viewing.

    3d merchant news cover 3D Merchant news ISSUE 3, 2010: May Madness follows April price increases, Data Security- PCI Compliance, Internal Fraud Prevention, PCI Compliance fees. (PDF download 2mb)

    First Data Extends Payment Card Security to Merchants

    Monday, May 31st, 2010

    TransArmorSM Solution Piloted by Spectrum of Brick-and-Mortar and Card-Not-Present Retailers; First Commercial Transaction Tokenized on STAR® Network

    RSA CONFERENCE 2010 – SAN FRANCISCO, March 1, 2010 First Data Corporation, a global leader in electronic commerce and payment processing, today announced the expansion of a merchant pilot of the First Data® TransArmorSM solution. More than 400 U.S. merchants of all sizes will assess the comprehensive data security solution over the next four months. The TransArmor solution (previously called First Data® Secure Transaction ManagementSM) was developed in close partnership with EMC Corporation (NYSE: EMC).

    The TransArmor secure payments service is designed with the needs of merchants in mind, and it has the opportunity to fundamentally change the way merchants secure and manage cardholder data. The TransArmor solution addresses the root cause of merchant data security issues by removing payment card data from the merchant environment as part of processing the transaction, significantly reducing risk and the scope of PCI compliance efforts.

    Deploys RSA SafeProxy™ Architecture
    The solution leverages the RSA SafeProxyTM architecture, a powerful combination of asymmetric encryption, tokenization and key management engineered to provide the benefit of end-to-end protection and eliminate on-site cardholder data storage for merchants. Unique features of the token make it possible for merchants to continue to handle key business functions such as returns, recurring billing, loyalty programs and other analysis, without enabling card data to be used for fraudulent transactions.

    On Feb. 26, 2010, the TransArmor solution tokenized the very first commercial transaction over the STAR® Network at the Center of Science & Industry (COSI) in Columbus, Ohio. A First Data company, STAR is one of the nation’s leading electronic funds transfer (EFT) networks with more than two million retail and ATM locations.

    As an early participant in the TransArmor pilot, COSI is already experiencing the benefits of the solution. “Like most consumers today, several of our customers had concerns about the safety of their credit and debit card data while visiting our center. TransArmor gives us peace of mind that their payment card data is locked in a virtual vault at First Data and nowhere on site at COSI,” said Brad Morgan, senior IT operations manager at COSI.

    Works with Existing Merchant Hardware
    Unlike some solutions in the marketplace, the TransArmor solution can be implemented without the need for new hardware or back-end IT operations. The solution works with First Data as well as other terminals or point-of-sale systems and can be consistently applied across brick-and-click environments.

    “The response from merchants interested in participating in this trial has been enormous and a testament to the sought-after service TransArmor delivers,” said Craig Tieken, vice president of Merchant Product Management at First Data. “Up until now, there have been few easy and cost-effective solutions to the growing problem of managing the risks of handling sensitive payment card data. TransArmor represents a fundamental change in how merchants can confidently protect and manage cardholder data.”

    The consequences of a merchant data compromise in legal, financial, consumer confidence and brand loyalty terms can be overwhelming. According to the 2009 U.S. Cost of a Data Breach Study by the Ponemon Institute, the average cost for merchants coping with a data breach in 2009 rose to $6.7 million with the cost per customer record breached estimated at $204. With the TransArmor solution, customer card information is retained only at the processor and protects merchants from the dangers of malicious attacks designed to steal payment card data in transit or in storage from merchant databases.

    “Implementing effective data security can’t mean more complexity for businesses,” said Brian Fitzgerald, vice president, Marketing, RSA, The Security Division of EMC. “TransArmor successfully embeds industry-leading security technology into the payment processing infrastructure to make it available to, and more importantly, usable, by merchants of all sizes. TransArmor is an example of the type of partnerships required from industry leaders that will reduce the reliance on point solutions and enable an industry ecosystem with pervasive built-in security.”

    Teams from RSA and EMC Consulting worked collaboratively with First Data through product strategy development and technology proof of concept for a successful pilot and product launch.

    About First Data
    First Data powers the global economy by making it easy, fast and secure for people and businesses to buy goods and services using virtually any form of electronic payment. Whether the choice of payment is a gift card, a credit or debit card or a check, First Data securely processes the transaction and harnesses the power of the data to deliver intelligence and insight for millions of merchant locations and thousands of card issuers in 36 countries