CenPOS’ Secure Payment Solution Receives HIPAA Compliance

Posted on by
Reply

CenPOS announces HIPAA attestation aimed to deliver a secure and robust payment architecture for healthcare.

October 11, 2017. CenPOS, a payment technology provider, recently announced that it has received a Health Insurance Portability and Accountability (HIPAA) attestation from a third party external auditor across a broad range of payment solutions offered by the company. The company also announced that it had achieved its Qualified Integrated Resellers (QIR) certification from the PCI Data Security Council.

According to Healthcare Informatics, 34.5 percent of all security breaches are within the healthcare industry. This industry is also one of the ones hit the hardest by hacking, phishing, and skimming attacks. Over 1,000 data breaches occurred in the U.S. in 2016 and the number is expected to increase, as research from Identity Theft Resource Center reports.

CenPOS is a merchant-centric engine that delivers enterprise-class solutions across many industries to improve customer engagement and save time and money. The cloud-based solution increases the efficiency of collecting payment across many channels, all without disrupting the banking relationships of the merchant.

“We live in a world where data is a valuable and prime target for hackers. Anyone familiar with HIPAA knows that HIPAA compliance is very complex, it is our job at CenPOS to simplify this process and develop business solutions to address these risks and ensure that our clients’ data is secure at all times”, commented Jorge Fernandez CenPOS’ Co-founder and Chief Executive Officer. “We provide a unique combination of solutions to the healthcare industry not found anywhere else under one roof with our validated Point-to-Point encryption, HIPAA attestation, and QIR. Risk comes in many forms today and the cost associated with risk mitigation tools and compliance is very expensive. Our all in one solution makes it very affordable for our clients to implement and maintain compliance”, added Mr. Fernandez.

With the healthcare industry being a constant target for hackers of all levels, it’s important for practitioners and facilities to focus on security solutions. CenPOS offers layered security solutions that deliver a secure and robust payment architecture. It enables those within the industry to focus on providing excellence to their patients. CenPOS will manage the day-to-day payment operations focus on security and compliance.

With the recent attestation from HIPAA, it gives healthcare professionals another reason to choose CenPOS. They can ensure that healthcare records are secure and less likely to be leaked, exposed, or otherwise hacked.

CenPOS is engineering the future of payments. Their comprehensive solutions are years ahead of the competition and continually eliminate fraud and human error. Exploring their solutions in-depth can be a significant benefit for those in the healthcare industry.

For more information, contact:
CenPOS
Telephone: 877.630.7960
sales@cenpos.com
https://www.cenpos.com/

About CenPOS
CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS’ secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships. | CenPOS | @CenPOS

Contact Christine Speedy, CenPOS authorized reseller, 954-942-0483 for all your CenPOS HIPAA compliant payment processing sales and integration needs.

cenpos logo

Magento Developer Alert: Visa Mandate and Payment Gateways

Posted on by
1

How can Magento developers help merchants get compliant with the Visa Stored Credential Transaction framework and mandates effective October 14, 2017?

Drive your profits while helping clients keep compliant with fast changing credit card processing rules.

Step by step guide:

How will clients manage consent record requirements? See Improving Authorization Management for Transactions with Stored Credentials https://usa.visa.com/dam/VCOM/global/support-legal/documents/stored-credential-transaction-framework-vbs-10-may-17.pdf . Will gateway provide a checkbox for consent records and ability to retrieve records on demand? (I called authorize.net on October 2 and they advised they will not offer this service, and will leave up to merchants.) Will you develop a custom application to include opt-in date, time and other requirements, plus storage and retrieval capability? Will you advise merchants to choose a technology solution, including payment gateway, that will manage automatically?  CenPOS, a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement will provide an automated solution for clients. Contact me for the plugin.

Update terms and conditions. Ensure online order terms include sale, refund and cancellation policies. Add a checkbox for customer opt-in to terms, including online payments. CenPOS has an opt-in box and you can customize the text.

Verify if there’s a system to manage authorization validity. What the heck does that mean? Many businesses, especially B2B companies, have complex needs including pre-authorizations, incremental authorizations, delayed shipping etc. While merchants may get issuer approvals, that doesn’t mean the authorization is valid. The two most common rules businesses struggle with are “Settlement within 72 hours” for card not present sales, and “Authorization amount and settlement amount must be equal”. (I asked authorize.net support about both items on October 2 and was told they do not offer automated solution.) CenPOS automates compliance. Other payment gateways are incapable or may leave it up to developers to create a solution. How can a developer verify if merchant has an issue? Ask clients to look at their merchant statement ‘pending interchange fees. If you see EIRF or STD, that’s a red flag there’s a problem.

Create a hosted pay page. B2B Businesses almost always have more than one sales channel and use of paper credit card authorization forms is common. They need help to eliminate. You already have the SSL certificate, so it’s a natural add on to provide clients a secure web page with an iframe a solution to collect payments. With CenPOS, end customers can use the same stored credential in Magento and the pay page, both credit card and ACH. hosted online pay pagePrevent brute force attacks. System hardening is a PCI compliance requirement. See Visa best practices to prevent brute force attacks. https://usa.visa.com/support/merchant/library/visa-merchant-business-news-digest.html. CenPOS includes recaptcha and client managed velocity and other rules as part of a layered security approach.

Payment Gateway checklist:

  • Verify payment gateway will send correct transaction data and flags for the initial transaction and subsequent transactions.
  • Advise clients to set gateway for zero dollar authorization when storing a new card.
  • Ensure client is registered for 3-D Secure and it’s enabled.
  • Confirm if gateway will automatically flag a transaction as customer initiated stored credential or merchant initiated stored credential (automated recurring billing). Additionally, the merchant initiated transaction must be sent with the MOTO indicator, not ecommerce.
  • Does gateway support level 3 data?

CenPOS manages all compliance and other items seamlessly in the background.

Communicate with clients. Advise any upcoming changes will increase efficiency and security for everyone. Advise clients to learn more about CenPOS payment gateway – call Christine Speedy, 954-815-6040.

Why comply? With full compliance and following my recommendations, merchants can expect better qualified interchange rates, increased approvals (avoid declines based on issuer risk averse algorithms), reduced PCI Compliance burden, fraud liability shift to issuer and increased efficiency for both buyer and seller. The cost of non-compliance is hefty, including higher interchange rates, penalty fees, and risk of both issuer and cardholder chargebacks.

interchange rate qualification

The same transaction can process at different rates as shown above, depending on which rules you follow. CenPOS Smart Rate Selector automates compliance to qualify transactions at the lowest rate possible. Which rates are on your merchant statement now?

Magento developer billing: Developers also need to comply with recurring billing requirements for your sales. What’s worked before is not compliant- everyone needs to change.

Resources and documentation /blog/merchant-bulletins-downloads – bookmark it!.  Join Christine Speedy’s email list.

DISCLAIMER: condensed and incomplete information! Information may be quickly outdated.

With the fast pace of changing rules, developers need a technology partner to automate compliance. Did you know?

  • For those not ready to give up paper, CenPOS creates a printable PCI Compliant credit card authorization form for every stored card.
  • CenPOS has ERP, ecommerce shopping cart, accounting and other plug-in modules available for quick and easy implementation.
  • I’ve been selling for CenPOS since day 1. Though I have other payment gateways available in my arsenal, nothing else compares for meeting business to business needs.

Christine Speedy, CenPOS authorized reseller, 954-942-0483 is based out of South Florida and NY. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships.

B2B Steps to Visa Stored Credential Mandate Compliance

Posted on by
Reply

How can merchants get compliant with the Visa Stored Credential Transaction framework and mandates effective October 14, 2017?

Step by step getting started guide for B2B merchants:

Plan how you’ll comply with consent record requirements. See Improving Authorization Management for Transactions with Stored Credentials https://usa.visa.com/dam/VCOM/global/support-legal/documents/stored-credential-transaction-framework-vbs-10-may-17.pdf . Are you going to manage documenting everything or are you going to use technology to help you manage it? Ask your gateway if they’re going to provide a checkbox for consent and if you’ll be able to pull the opt-in records on demand. CenPOS, a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement will automates multiple elements for clients.

PCI Compliant credit card authorization form

Partial CenPOS PCI Compliant stored credential authorization form.

Update workflow and documents. Ensure your sales order or associated credit documents include sale, refund and cancellation policies. Add a checkbox for customer opt-in to terms, including online payments. CenPOS has an opt-in box and you can customize the text.hosted online pay pageVerify if you have a system to manage authorization validity. What the heck does that mean? Many B2B companies have complex needs including pre-authorizations, incremental authorizations, delayed shipping etc. While you may get issuer approvals, that doesn’t mean the authorization is valid. The two most common rules B2B businesses struggle with are Settlement within timeframe for card not present sales, and Authorization amount and settlement amount must be equal. Per Visa Core Rules October 2017, for typical distributor and manufacturer card not present transactions, the authorization must settle no later than 7 calendar days from the date of the initial Approval Response. CenPOS automates compliance. Other payment gateways are incapable or may leave it up to developers to create a solution. Are you compliant now? Look at your merchant statement ‘pending interchange fees. If you see  EIRF or STD, that’s a red flag there’s a problem.

Replace paper credit card authorization forms, and any digital form that you can decrypt and view sensitive card data. Offer your customers a way to self-manage their own wallet with either a hosted online pay page or Electronic Bill Presentment & Payment. CenPOS offers both options, including a lite ‘request a payment’ option, and lets your customers choose both text and email. For those not ready to give up paper, CenPOS creates a printable PCI Compliant credit card authorization form for every stored card.

New to online payments? See Visa best practices to prevent brute force attacks. https://usa.visa.com/support/merchant/library/visa-merchant-business-news-digest.html. CenPOS includes recaptcha and client managed velocity and other rules as part of a layered security approach.

Verify your gateway is ready or will be ready to send correct transaction data for the initial transaction and subsequent transactions for both customer initiated and merchant initiated use of the stored credential.  You’ll want the payment gateway to perform a zero dollar authorization and authenticate the cardholder with 3-D Secure. Ask your gateway if it will automatically flag a transaction as customer initiated stored credential or merchant initiated stored credential, or if they’ll require you to have multiple gateway accounts, one for each type. CenPOS does all this for you now in a single account.

Get an ecommerce merchant account. This is needed for online payments. Don’t run mail order telephone order (MOTO) transactions on the ecommerce account unless you know your payment gateway can alter the flag sent with transaction to change the transaction type. Many cannot. CenPOS manages all compliance seamlessly in the background; whether you need multiple merchant accounts varies by acquirer/processor.

Register for 3-D Secure, including Verified by Visa, with your acquirer. Don’t do this until you know which payment gateway will be used and get their instructions if applicable.

Communicate with customers. Advise any upcoming changes will increase efficiency and security for everyone.

Why comply? With full compliance, merchants can expect better qualified interchange rates, increased approvals (avoid declines based on issuer risk averse algorithms), reduced PCI Compliance burden, and increased efficiency for both buyer and seller. The cost of non-compliance is hefty, including higher interchange rates, penalty fees, and risk of both issuer and cardholder chargebacks.  

interchange rate qualification

The same transaction can process at different rates as shown above, depending on which rules you follow. CenPOS Smart Rate Selector automates compliance to qualify transactions at the lowest rate possible. Which rates are on your merchant statement now?

Why should developers choose CenPOS for their integrated payment gateway? CenPOS has native modules for ERP, shopping cart, accounting and other software.

  • Increase profits faster
  • More efficient, quicker reconciliation
  • More secure- from Encrypted Virtual Keypad to elimination of credit card auth forms
  • More robust- Wire, ACH, check, Paypal, credit card and more; text and email payments supported. No 3rd party Electronic Invoice solution needed such as BillTrust; CenPOS invoice portal and automated collections included.

Where can I buy CenPOS or learn more? You’ve already found one of the top salespeople, Christine Speedy. All agreements are direct with CenPOS, no middle man.

Resources and documentation https://3dmerchant.com/blog/merchant-bulletins-downloads – bookmark it!.  Join Christine Speedy’s email list.

DISCLAIMER: condensed and incomplete information! Information may be quickly outdated.

With the fast pace of changing rules, companies need a technology partner to automate compliance. Did you know?

  • CenPOS has a suite of solutions for companies just like yours, solving common problems and increasing profits virtually overnight.
  • For those not ready to give up paper, CenPOS creates a printable PCI Compliant credit card authorization form for every stored card.
  • CenPOS has ERP, ecommerce shopping cart, accounting and other plug-in modules available for quick and easy implementation.
  • I’ve been selling for CenPOS since day 1. Though I have other payment gateways available in my arsenal, nothing else compares for meeting business to business needs.

Christine Speedy, CenPOS authorized reseller, 954-942-0483 is based out of South Florida and NY. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships.

First Data level 3 processing solutions

Posted on by
Reply

Need a solution for level 3 processing with your First Data merchant account? A payment gateway that supports level 3 processing is required, but that’s not enough. Payment gateway selection and implementation impact whether a transaction actually qualifies for level 3 rates.

The main requirements to qualify for level III interchange rates are:

  1. Submit required extra order detail. This varies by card brand; for example Ship to/from ZIP code, Destination country code,VA/ tax amount, invoice number, order reference number, Discount amount, Freight/shipping amount, Duty amount, Order date, unit of measure and more.
  2. Valid authorization. For example, the authorization and settlement amount must be the same.
  3. Interchange Rate Special Requirements, which may vary by card, industry etc. For example, here are requirements to qualify for MasterCard Data Rate III
    1. U.S. Merchant
    2. Applicable Electronic Authorization Data must be included and match Settlement Data
    3. Valid Banknet Reference Number and Banknet Date in valid date format MMDD
    4. Settlement within 2 days of transaction
    5. Level II & Level III Corporate Card data (Level II Data includes the entry of customer code, card acceptor type, tax ID and sales tax. Level III Data includes Level II data, line item detail, item description, item quantity, item unit of measure, extended item amount, product code, and debit or credit indicator.)
    6. Non-T&E MCC
    7. Card Acceptor Type and Tax ID must be provided

Visa Stored Credential Framework Impacts Authorization Validity

For business, corporate and purchasing card transactions to qualify for Level 3 interchange rates, a valid authorization is required. New rules change requirements for card not present transactions using stored cards. US businesses must comply with Visa Stored Credential Transaction framework effective October 14, 2017. Without getting into too much detail, payment gateways must update to comply, and merchants will also need to make some changes going forward.

Merchant requirements include:

  • When capturing a stored credential for the first time, complete special requirements, including cardholder authentication as applicable (Managed by payment gateway or integrated solution.)
  • Send correct transaction type on subsequent transactions: Installment Payments, Recurring Payments, or Unscheduled Credential On File. (Managed by payment gateway or integrated solution.)
  • Authorization and settlement amount must match. (Managed by payment gateway or integrated solution.)
  • Obtain cardholder consent and disclosure agreement. (Most likely managed by payment gateway or merchant.)

For years, authorization and settlement amount mismatch has been a common problem for merchants to qualify for level III rates. Even if a gateway solves this problem, an integration may limit the capability. This is easily identified by EIRF, STD/ standard, level I and level II rates present in the “pending interchange” section on merchant statements.

To solve all of the above problems, merchants can use a third party payment gateway with their merchant account, that manages authorization validity and continual changes within the gateway, including integrated solutions. Below image shows before and after interchange rates from actual merchant statements; same merchant account, just changed the payment gateway.level 3 gatewayContact Christine for a level 3 payment gateway that works with your First Data Merchant Account, as well as other acquirers.

Christine Speedy, CenPOS authorized reseller, 954-942-0483 is based out of South Florida and NY. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships.

Insurance Installment Payments: Visa Credit Card Processing Rules Change 2017

Posted on by
Reply

Insurance companies must comply with new VISA installment credit card processing rules changes effective October 2017 to maximize business profits and mitigate chargeback risk. Everyone in the payment ecosystem has or will need to make changes to comply, including acquirer, issuer, payment gateway, merchant, and sometimes integrated billing software.

payment gateway SaaS recurringVISA DEADLINE:

  • October 14, 2017 Visa stored credentials compliance mandate.

INSTALLMENT CREDIT CARD PROCESSING BEST PRACTICES:

  • Obtain cardholders’ consent to store the credentials. Opt-in check box stored with payment gateway record is recommended.
  • Have a solution to retrieve consent records on request.
  • Disclose to cardholders how stored credentials will be used.
  • Notify cardholders when any changes are made to the terms of use.
  • When capturing card data for the first time, use a PCI compliant payment gateway to create a random token replacing sensitive data; eliminate paper credit card authorization forms or digital signature forms where payment data is collected on the form, not via a payment gateway.
  • Inform the issuer via a transaction that payment credentials are now stored. For example, perform an Account Number Verification Transaction via a Zero Dollar Authorization with 3-D Secure Verifed by Visa.This is managed by the payment gateway, and requires specific transaction indicator.  TIP: If the solution you’re using performs a $1 authorization, often with a void or reversal after, that’s because the payment gateway, and or the implementation, are out of date and don’t support current requirements. Ask how yours works- assume nothing!
  • Identify subsequent transactions with appropriate indicators when using stored credentials. Payment gateway to identify all future transactions after storing:

– With an indicator that shows that the Transaction is using a Stored Credential for either Installment, Recurring or Unscheduled Credential On File.
– With the Transaction Identifier of the Initial Transaction.

  • Follow all cardholder disclosure and consent requirements specified in the Visa Rules. Opt-in check box with digital record managed by the payment gateway is recommended to comply with issuer records requests.
  • If performing a preauthorization for any transactions, additional new requirements must be met, including for reversals and reauthorizations.

INSURANCE INSTALLMENT BEST PRACTICES

Increasingly complicated rules vary by card brand, business type and many other factors. This article may oversimplify such complexities. Merchants are advised to:

  • Use tools, including intelligent cloud-based payment gateways, to help comply automatically.
  • Segregate payment acceptance from applications; example, embedded payment object or i-frame.
  • Review Visa Stored Credential Transaction Framework bulletins
  • Review Visa Core Rules and Visa Product and Service Rules
  • Review workflow for the customer payment experience and confirm payment technology workflow is compliant with new rules. There is no automated update; merchants must actively participate in process to ensure compliance.

COMPLIANCE RISKS AND REWARDS:

  • Compliance will increase approvals, customer satisfaction, and profits.
  • Reduce time spent on collections, increase automation, reduce attrition.
  • Cardholder authentication can qualify some transactions for lower interchange rates plus mitigate losses related to “it wasn’t me”, more commonly seen in higher risk insured policy holders.
  • Compliance required to participate in Visa Account Updater service.
  • Non-compliant transactions are essentially invalid authorizations, and issuers will be within their rights to chargeback via Reason Code 72. This is different than a consumer generated chargeback. Issuers are getting slammed with missed payment cardholders and need to get their money back some way; JP Morgan wrote off about $1B in Q1 2017 according to one source. The Wall Street Journal has published several articles over the last year about the surge in subprime credit cardholders missing payments. Overall, we’re looking at a national rate over 4% per quarter- over 16% annually, representing over a trillion dollars. Issuers may want to offset losses from subprime cardholders by collecting monies from merchants for the same.
  • Chargeback Risk includes the initial transaction and all subsequent transactions that are not in compliance for the allowable chargeback period. For example, if non-compliant the issuer could chargeback installments on October 14, November 14, and December 14.

Reference: Visa Stored Credential Transaction Mandates and also Visa Core RulesTable 5-21: Requirements for Prepayments and Transactions Using Stored Credentials.

Before selecting a payment gateway for installments payments, ask these questions:

  • How will it help with new Visa Stored Credential Mandates compliance?
  • Does it support 3-D Secure cardholder authentication, for customer initiated payments?
  • What type of digital record is created at the time of customer opt-in to terms, how is it retrieved, and how long is it retained?
  • Does it support Zero Dollar Authorization?
  • Does the receipt dynamically change based on type of transaction, i.e. cash, credit card single payment, installment payment etc.
  • Does it support level 3 processing for commercial cards (if applicable to business type)?
  • If I change banks or payment processors, how will it affect my customers? My business?

TIP: Most payment gateways will not be compliant on October 14. An easy starting point to reduce the list of vendor choices is to ask the payment gateway what type of digital record is created at the time of creating an installment agreement, and how will it be accessed? Need help to get compliant? Contact Christine Speedy to learn more about solutions for your business that are quick and easy to adopt, increasing efficiency and growing profits virtually overnight.

Christine Speedy, CenPOS authorized reseller, 954-942-0483 is based out of South Florida and NY. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships.