About Christine Speedy

B2B cloud payment acceptance solutions and CenPOS enterprise cloud payment solutions expert. Authorized reseller.

Hotel Third Party Authorization Form Alert

The best hotel third party authorization forms are fully compliant with card brand rules to mitigate chargeback risk, especially for friendly fraud, where cardholder claims they did not authorize the transaction. Fraud liability can be shifted nearly one hundred percent with best practices, plus risk of data breach from employee and other access to card data can be mitigated. Avoid the paper and digital credit card authorization form problems perpetuated by misinformation from people and incorrect internet postings.

Paper credit card authorization forms are dead.

Per Visa Core rule 5.4.2.5, a US merchant or its agent must not Request the Card Verification Value 2 data on any paper Order Form. I could go on with all the PCI compliance and data breach risk problems related to them, but because merchants must authenticate the cardholder with the security code or 3-D secure cardholder authentication (which requires digital interaction) for card not present transactions, paper forms are effectively dead. This also applies to secure document service companies and any solution where sensitive cardholder data can be viewed or decrypted for use in another solution.

Web-based third party authorization forms are best for card absent compliance.

More than just PCI compliance, a myriad of rules changes since 2017, and continuing into 2019, impact every hotel. Everyone must change to comply and it’s not automatic. For example, you’re getting a sales deposit, and will definitely or will possibly charge more later. There’s a new set of transaction data standards which include estimate, incremental, and final authorization. While the technical piece is handled by payment gateways, not all have made the modifications required. Additionally, some elements are left to merchants to manage.

  • Comply with Visa 5.8.3.1 Authorization Amount Requirements.  The Merchant must use the Estimated/Initial Authorization Request indicator for the first transaction,
    then the Incremental Authorization Request indicator for interim if applicable, and Final Authorization Request indicator when closing out the transaction; the same Transaction Identifier must be included for all Authorization Requests. Don’t accept an authorization online and then swipe or dip the same card later unless your card present system can tie back to the initial authorization.
  • Stored cards. Are you storing cards for ongoing charges? Comply with Visa Rules Table 5-20: Requirements for Prepayments and Transactions Using Stored Credentials. There are too many variables to list here so I recommend downloading the rules and getting familiar. Two keys when capturing card data for the first time:
    • Obtain express consent per specifications for your refund and cancellation policies, how you’ll use the stored card, when your agreement expires and how the Cardholder will be notified of any changes to the agreement.
    • Perform a cardholder verification either via transaction or zero dollar authorization with the proper indicator.
    • This is a change! Two transactions occur when capturing cardholder data for the first time. Again, technical part can be handled by a payment gateway that supports it, but other elements are left to you.

Hotel third party authorization form solutions.

Contact me for solution that works standalone or integrated with SynXis. Shift friendly fraud liability and potentially qualify transactions for better rates with your existing merchant account. That’s because non-compliance with various rules can result in higher fees.

Here’s some key elements if the initial authorization is not the final authorization. Terminology:

  • PCI compliance- short for Payment Card Industry Data Security Standards. All businesses are mandated to comply with rules which are outlined on the PCI Security Standards Council web site.
  • 3-D secure (3D Secure) is a global XML-based protocol designed to be an additional security layer for online credit and debit card transactions. Each card brand has their own version. For example, Verified by Visa. Merchants register for 3-D Secure with their acquirer; always consult with the payment gateway first for instructions and to confirm they’re registered to offer service. 3-D Secure is invoked automatically by the payment gateway which then based on issuer response may or may not prompt for additional information to authenticate the cardholder.  Friendly fraud liability, “it wasn’t me, I didn’t authorize it”, shifts to the issuer. Because there are many parts to any transaction, including acquirer and issuer communications, plus continually changing rules, it’s possible that it will not be invoked.
  • Link to Visa and all card brand Rules.

Call Christine Speedy, PCI Council QIR certified, for global sales. 954-942-0483, 9-5 ET, CenPOS authorized reseller based out of South Florida and NY. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

Visa Stored Credential Mandate Overview

How can merchants get compliant with the Visa Stored Credential Transaction framework and mandates effective October 14, 2017? Most companies are under the false impression that their acquirer and or payment gateway manages compliance. Not true. While some technical aspects are managed by the payment gateway, the merchant also has to make some changes for compliance.

What is a Stored Credential? A stored credential is information (including, but not limited to, an account number or payment token) that is stored to process future purchases for a cardholder.

What is the Visa Stored Credential framework and mandate? It outlines the rules related to storing and using stored credentials. Since it’s 15 pages long, I’ll only highlight a few important items here.

  • Merchant initiated or customer initiated transactions? Make sure your payment gateway is sending the correct code. For example, an ecommerce store checkout would be customer initiated. A recurring billing transaction is merchant initiated.
  • Get customer consent for terms and conditions of storing and using stored card.
  • Advise how the cardholder will be notified of any changes to the consent agreement.
  • For a transaction using a stored credential initiated by the cardholder, the merchant or its agent must validate the cardholder’s identity before processing. The only valid methods are 3-D Secure Verified by Visa and the security code.
  • Receipt must be provided for the initial cardholder validation ($0 dollar transaction or actual amount.)
  • All stored credential transactions must be submitted with a value of “10” in the POS Entry Mode Code field; this is for both newly stored cards and all prior transactions using stored credential. This is managed by the payment gateway. (Confirm your gateway is doing this.)

What about the other card brands? Mastercard rolled out their version in June 2018. If you comply with the Visa mandate, you’ll be in compliance with any others at this time.

What if I don’t comply? You risk issuer generated chargebacks for all transactions using the stored credential within the allowable chargeback timeframe. Additionally, a valid authorization is needed to qualify for the lowest interchange rates.

What are the benefits of compliance? Increased authorizations, better customer experience, more profits.

See Improving Authorization Management for Transactions with Stored Credentials https://usa.visa.com/dam/VCOM/global/support-legal/documents/stored-credential-transaction-framework-vbs-10-may-17.pdf . Are you going to manage documenting everything or are you going to use technology to help you manage it?

PCI Compliant credit card authorization form

Partial CenPOS PCI Compliant stored credential authorization form.

Verify if you have a system to manage authorization validity. What the heck does that mean? Many companies have complex needs including pre-authorizations, incremental authorizations, delayed shipping etc. While you may get issuer approvals, that doesn’t mean the authorization is valid. Are you compliant now? Look at your merchant statement ‘pending interchange fees. If you see  EIRF or STD or misuse of authorization fee, there’s a problem.

Replace paper credit card authorization forms, and any digital form that you can decrypt and view sensitive card data. Offer your customers a way to self-manage their own wallet with either a hosted online pay page or Electronic Bill Presentment & Payment.

New to online payments? See Visa best practices to prevent brute force attacks. https://usa.visa.com/support/merchant/library/visa-merchant-business-news-digest.html. CenPOS includes recaptcha and client managed velocity and other rules as part of a layered security approach.

Register for 3-D Secure, including Verified by Visa, with your acquirer. Don’t do this until you know which payment gateway will be used and get their instructions if applicable.

interchange rate qualification

The same transaction can process at different rates as shown above, depending on which rules you follow. CenPOS Smart Rate Selector automates compliance to qualify transactions at the lowest rate possible. Which rates are on your merchant statement now?

Where can I buy CenPOS or learn more? You’ve already found one of the top salespeople, Christine Speedy. All agreements are direct with CenPOS, no middle man.

Resources and documentation https://3dmerchant.com/blog/merchant-bulletins-downloads – bookmark it!.  Join Christine Speedy’s email list.

DISCLAIMER: condensed and incomplete information! Information may be quickly outdated.

With the fast pace of changing rules, companies need a technology partner to automate compliance. Did you know?

  • CenPOS has a suite of solutions for companies just like yours, solving common problems and increasing profits virtually overnight.
  • For those not ready to give up paper, CenPOS creates a printable PCI Compliant credit card authorization form for every stored card.
  • CenPOS has ERP, ecommerce shopping cart, accounting and other plug-in modules available for quick and easy implementation.
  • I’ve been selling for CenPOS since day 1. Though I have other payment gateways available in my arsenal, nothing else compares.

Call Christine Speedy for global sales. 954-942-0483, 9-5 ET, CenPOS authorized reseller based out of South Florida and NY. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

Insiders Cause More than 50% of Data Breaches, Reveals Netwrix IT Risks Report

In terms of main threat actors, expectation rarely matches reality, because most incidents were caused by insider mistakes rather than hacker attacks, as assumed by most respondents.

IRVINE, Calif., Oct. 2, 2018 /PRNewswire/ — Netwrix Corporation, provider of a visibility platform for data security and risk mitigation in hybrid environments, today announced the release of its global 2018 IT Risks Report. This year, Netwrix conducted an in-depth study of the major IT risks that are significant for most organizations and assessed respondents’ readiness to withstand cyber threats.

The report is based on the feedback of 1,558 organizations of various sizes from many different regions and industries. It summarizes the experiences and plans the organizations have in regard to addressing six IT risks: physical damage, intellectual property theft, data loss, data breach, system disruption and compliance penalties.

The report reveals the following key findings:

  • Most companies consider hacker attacks to be the most dangerous threat, but in fact, insiders cause the majority of security incidents by either malicious or accidental actions.
  • Not all critical security controls are reviewed regularly as required by best practices. The most neglected controls include getting rid of stale and unnecessary data and conducting data classification. These controls are exercised rarely or never by 20% and 14% of organizations, respectively.
  • Although 70% of companies have done IT risk assessment at least once, only 33% re-evaluate their IT risks regularly.
  • 44% of respondents either do not know or are unsure of what their employees are doing with sensitive data.
  • Nonetheless, over 60% of respondents think that their level of visibility is high enough, which lulls them into a false sense of security.
  • Only 17% of organizations have an actionable incident response plan; 42% have only a draft or have no plan at all.

“Our report illustrates that the foremost reason why the organizations fail to address major IT risks lies in a lax approach to security basics. They are giving priority to some controls and are leaving the most important ones out of scope. Haphazard approach to security basics and poor visibility into sensitive data gives IT pros a false sense of security. However, paying more attention to all security basics can help organizations manage IT risks with more success,” said Steve Dickson, CEO of Netwrix.

To learn more about the IT risks organizations face today, please visit: www.netwrix.com/go/it_risks_in_2018.

About Netwrix Corporation

Netwrix Corporation is a software company focused exclusively on providing IT security and operations teams with pervasive visibility into user behavior, system configurations and data sensitivity across hybrid IT infrastructures to protect data regardless of its location. Over 9,000 organizations worldwide rely on Netwrix to detect and proactively mitigate data security threats, pass compliance audits with less effort and expense, and increase the productivity of their IT teams.

Founded in 2006, Netwrix has earned more than 140 industry awards and been named to both the Inc. 5000 and Deloitte Technology Fast 500 lists of the fastest growing companies in the U.S.

For more information, visit www.netwrix.com.

Christine Speedy on ITPalooza Data Breach Panel

itpalooza south florida logoITPalooza is a key event that brings together the entire South Florida IT community from CIOs through Tech User Groups to top local, national and international presenters and guests. ITPalooza has a long history of presenting the region’s top subject-matter experts with passion and knowledge that both entertains and educates. Christine Speedy will be on the 2018 data breach panel December 13, 2018 at The Greater Fort Lauderdale-Broward County Convention Center.

According to the nonprofit consumer organization Privacy Rights Clearinghouse, a total of 11,019,555,688 individual records containing sensitive personal information were involved in security breaches between January 2005 and May 2017. The data breach panel will be led by a knowledgeable moderator who will guide the panel guests to a variety of topics, including PCI Compliance.

About ITPalooza

ITPalooza is an annual gathering of South Florida’s nonprofit Technology User Groups featuring all day format, CIO only track, Marine Toys for Tots toy drive, and more. ITPalooza is about content and connecting you, the tech professional, with the information you need to make informed decisions about technology and trends. Over 2,000 attendees experienced the event in 2017.

About Christine Speedy

Christine Speedy is a Qualified Integrator and Reseller payments professional, certified by the Payment Card Industry Security Standards Council, and authorized CenPOS Reseller. Christine is a subject matter expert on PCI compliance and card network rules compliance, offering secure cloud payment technology to businesses, transforming the commerce and customer experience. South Florida Technology Alliance member.