EBill payments via text or email improve PCI Compliance video

Posted on by
Reply

Ebill and einvoice systems send invoices vs Electronic Bill Presentment and Payment or EBPP gets you paid from that request via text or email. This critical difference has a major impact on security and PCI Compliance. This  video demo is for a standalone solution to accept online payments, including credit card. ACH and wire. Integrated solutions for Quickbooks, ERP, or other, are also available.

Video CenPOS EBPP Lite demo shows the simplicity of sending an einvoice with request for payment via email to an existing customer, that has previously made a purchase and stored their credit card. Customers can self-update their payment methods, store multiple methods. Ask for any feature, and yes, we probably support it.

A layered approach to card not present fraud protection is critical with increasing financial industry changes. In addition to the traditional address and CVV verification, cardholder authentication, IP blocking and other tools can be used to guarantee payment against fraud globally (some restrictions apply).

Eliminate credit card authorization forms with sensitive cardholder data. No one likes them, they’re time wasters for both parties, cards get expired etc. At best, they offer flimsy protection against fraud. Worse, they’re a PCI Compliance nightmare.  In the event of a data breach, it’s likely impossible to prove compliance if you use them. Regardless of how secure and loyal you think your employees are, stuff happens and when identity theft related to credit cards occurs, your business has a 50% chance of survival.

Contact Christine Speedy, 954-942-0483, 3D Merchant Services, 9-5 ET. Your merchant account, our cloud hosted payment gateway solutions.

FTC To Study PCI Credit Card Industry Data Security Auditing

Posted on by
Reply

Commission Issues Orders to Nine Companies That Conduct Payment Card Industry Screening

March 7, 2016, The Federal Trade Commission has issued ftc pci audit request from 9 companies requiring them to provide the agency with information on how they conduct assessments of companies to measure their compliance with the Payment Card Industry Data Security Standards (PCI DSS).

PCI DSS audits are required by the major payment card issuing companies of retailers and other businesses that process more than 1 million card transactions in a given year, and are intended to ensure that companies are providing adequate protection to consumers’ sensitive personal information.

The nine companies receiving orders from the FTC are: Foresite MSP, LLC; Freed Maxick CPAs, P.C.; GuidePoint Security, LLC; Mandiant; NDB LLP; PricewaterhouseCoopers LLP; SecurityMetrics; Sword and Shield Enterprise Security, Inc.; and Verizon Enterprise Solutions (also known as CyberTrust).

The FTC is seeking details about the assessment process employed by the companies, including the ways assessors and companies they assess interact; copies of a limited set of example PCI DSS assessments, and information on additional services provided by the companies, including forensic audits.

Information collected by the FTC will be used to study the state of PCI DSS assessments.

The Commission is authorized to issue Orders to File a Special Report by Section 6(b) of the FTC Act.  The Commission vote to issue the orders was 4-0.

EMVCo Updates Payment Tokenisation Specification to Introduce ‘Payment Account Reference’ or PAR

Posted on by
Reply

Newly defined data element reduces reliance on primary account numbers when managing security requirements and delivering value-added services.

29 March 2016 – Global technical body EMVCo has released a bulletin updating the EMV® Payment Tokenisation Specification – Technical Framework to provide the payment community with a global, consistent framework to implement ‘Payment Account Reference’ (PAR). To be used by merchants, acquirers and payment processors, PAR can enhance security by limiting references to a cardholder’s primary account number (PAN) in the payment ecosystem.

Payment tokenisation is the process of replacing a PAN with a unique payment token that may be restricted in its usage, for example, with a specific device, merchant, transaction type or channel. Traditional PAN-based payments will continue to be used alongside EMV Payment Tokens. The introduction of PAR, which does not contain financially sensitive data, enables the payment acceptance community to link a cardholder’s payment token with their PAN transactions without needing to use their underlying card account number. This allows for a consolidated view of transactions on a payment account. This is also needed for security and regulatory reasons, such as risk analysis and anti-money laundering. It is also important for value-added services, as these often leverage historical transactional data to derive analytics and measurements to support customer programmes such as loyalty.

Mike Matan, current Chair of the EMVCo Executive Committee, comments: “Payment tokenisation enhances the underlying security of digital payments by limiting the risks associated with the compromise or unauthorised use of PANs. As well as increasing security, we want to ensure the payment acceptance community can continue to deliver associated payment processing and value-added services which are currently enabled by PAN. PAR addresses this by enabling all payment transactions – regardless of how they are initiated – to be processed in a consistent manner.”

The presence of PAR fulfils a fundamental need to link PAN-based and token-based transactions together. PAR enables the industry to move away from dependence on the PAN as the primary linkage. PAR data cannot be reverse-engineered to reveal the PAN or EMV Payment Token and cannot be used on its own to initiate a transaction such as authorisation, capture, clearing or chargeback. Users of PAR data are required to protect PAR data in accordance with national, regional or local laws and regulations.

“EMVCo recognises the need to continually adapt and advance the EMV payment infrastructure to support and promote user convenience without compromising security,” adds Jack Pan, EMVCo Board of Managers Chair. “Our work to establish a secure and scalable payment tokenisation ecosystem is no different. Since EMVCo launched its activity to focus on the development of a tokenisation specification, we have been working with industry stakeholders and EMVCo Associates to solicit feedback and determine appropriate updates to the framework, which will optimise the benefits of this technology. In addition to PAR, EMVCo has launched a Token Service Provider (TSP)

Registration Process, to promote transparency and interoperability of TSP entities. We look forward to continuing our work with the industry to manage and evolve this payment technology further.”

EMVCo – which is collectively owned by American Express, Discover, JCB, MasterCard, UnionPay and Visa – launched the EMV Payment Tokenisation Specification – Technical Framework v1.0 in March 2014. The PAR framework is designed to ensure global interoperability and support broad industry adoption. These latest updates are documented in the EMV Specification Bulletin No. 167, available to download without charge from the EMVCo website.

The specification bulletin accomplishes the following:

• Introduces PAR as an industry aligned data structure.

• Describes the presence of PAR in payment token and underlying PAN transactions.

• Defines PAR to be used as a consistent value for all payment tokens affiliated with an underlying PAN.

• Outlines how PAR can be used by acquirers, payment processors and merchants to link payment token transactions to those of the underlying PAN.

To join other industry stakeholders in contributing to EMVCo’s development of the tokenisation framework, become an EMVCo Associate.

– ENDS –

For further EMVCo media information please contact Sarah Jones / David Amos – Tel: +44 1943 468007 or email: sarah@iseepr.co.uk / david@iseepr.co.uk

Notes to Editors:

EMV® is a registered trademark in the U.S. and other countries and an unregistered trademark elsewhere. The EMV trademark is owned by EMVCo.

About EMVCo:

EMVCo is the global technical body that facilitates the worldwide interoperability and acceptance of secure payment transactions by managing and evolving the EMV Specifications and related testing processes. Adoption of EMV Specifications and associated approval and certification processes promotes a unified international payments framework, which supports an advancing range of payment methods, technologies and acceptance environments. The specifications are designed to be flexible and can be adapted regionally to meet national payment requirements and accommodate local regulations.

EMVCo is collectively owned by American Express, Discover, JCB, MasterCard, UnionPay and Visa, and focuses on the technical advancement of the EMV Specifications. To provide all payment stakeholders with a platform to engage in its strategic and technical direction, EMVCo operates an Associates Programme and encourages all interested parties to get involved.

Visit www.emvco.com for further information and join EMVCo on LinkedIn.

Steps to Reduce Credit Card Fraud For Distribution Industry

Posted on by
Reply

dealer fraud credit card processingCredit card fraud is still rampant in the US, even after US EMV liability shift convinced many merchants to purchase terminals to support chip cards. Marine, auto, and other high value parts dealers have long had a problem mitigating fraud risk with local and international parts.

  1. For card not present orders, require self-pay with cardholder authentication. Taking cards over the phone, and or requiring a credit card authorization form, will not protect against all forms of counterfeit card fraud. However, consumer authentication shifts liability back to the issuer; the issuer guarantees payment, and because it’s lower risk, dealers can qualify for lower interchange rates, the bulk of merchant fees. Online payment, ecommerce payment, and electronic bill presentment and payment are the 3 methods dealers can use to enable self-payment.
  2. For retail orders, EMV is mandatory. Not by regulation, but by necessity. If a chip card is presented, and merchant supports, they’re 100% protected from counterfeit card fraud, and sometimes lost or stolen cards; if not supported by the merchant, the merchant can be automatically charged back at the issuers discretion and there’s no dispute process for merchants.
  3. Check guarantee. Whether in person or via echeck, check guarantee services are only good if they don’t reject your checks later on. Surprisingly (or maybe not), some services seem to look for ways not to approve your claim, such as information is missing from checks. This can be avoided with technology that forces users to collect the right data, including for remote self-payers.

If all of the above are implemented, dealers are protected from virtually any type of credit card fraud. The following tips will help prevent other types of lost disputes, or serve as supporting documentation if not all the above are implemented.

  1. Get a signed sales order. This can reduce non-fraud claims related to disputes about what was expected. The sales order should clearly state what was sold, refund policy, and cancellation policy, or refer to another document that specifies the information, but is initialed acceptance on the sales order.
  2. Ship to cardholder billing address. If not possible, then get cardholder approval that states bill to and ship to address are different, and they’re approval.
  3. Require all communications to cardholder business email address if selling wholesale. Free email like gmail is not OK.
  4. Require cardholder respond from business email address approving transaction receipt. This is a strong document in the case of a dispute for “I didn’t approve it”, especially when a third party is picking up the part from the dealer.
  5. The marine, automotive and other distribution companies are hit particularly hard with non-qualified transaction penalties when shifting between retail, key entered, and online payments. It’s critical that transactions are presented properly not only to qualify for lower rates, but to protect against lost disputes that require specific evidence for each type of transaction.

Not related to security, but critical for interchange rate qualification, the bulk of credit card processing fees, all services (retail, MOTO, ecommerce) should support level III processing.

In summary, dealers need US EMV and cardholder authentication to maximize risk mitigation from credit card fraud. US EMV requires terminal certification, and gateway certification* to your merchant account provider. Cardholder authentication requires a payment gateway certified for the service.  There are very few companies that meet all these requirements so if your credit card processing salesperson gives you a blank stare when you ask, it’s time to explore other options.

*A payment gateway certified for level III retail to your acquirer is required; countertop terminals are incapable of sending level III data.

3 Profit Boosters for Lumber, Building Materials, Distribution Companies

Posted on by
Reply

Lumber, building materials, and distribution companies increase profits and cash flow almost instantly with these credit card processing and accounts receivable tips.

  1. Use a credit card processing solution that supports level III processing for retail. Prior to the October 2015 EMV liability shift, there were more companies that offered this, but today, to my knowledge, we offer the only solution that has both US EMV and level 3 retail certification.
    level 3 processing interchange rate

    Sample interchange rates for the same credit card transaction; Failing to qualify for level III is costly.

    Benefit: Potential 1% or more profit margin increase.  TIP: No countertop credit card terminal supports level 3 due to the data that must be sent with transactions; no bank currently offers a level 3 retail solution with US EMV. A cloud-based payment gateway is required.

  2. Ensure key entered transactions are sent for authorization with the MOTO (mail order, telephone order) transaction type indicator. If not, the transaction will default to the highest ‘non-qualified’ interchange rate possible for the card type, and in the event of a dispute, merchant must be able to produce a signed receipt.  TIP: Never key enter on a countertop terminal since it is set up for RETAIL. VX520 emv NFC verifone terminalThe best solution manages proper presentment for processing automatically so employees don’t need to understand the nuances of the best way to process any transaction to qualify for lower rates or mitigate risk.
  3. Enable online payments, with level III credit card processing. By empowering customers to pay 24/7, they’ll pay faster to clear up credit lines to buy more. Also, with cardholder authentication, payment can sometimes be guaranteed against fraud and qualify for even lower interchange rates due to lower risk; key entered transactions carry more risk and while risk can be mitigated, payment is not guaranteed. Accepting alternative methods like ACH, wire, and Paypal will also reduce friction, increase efficiency and increase cash flow.
On the surface negotiated rates are often great, but the right tools are critical to qualify transactions for maximum profits.  The building supply industry, including plumbing, electrical, lumber, windows, doors, stone, marble, flooring, insulation, lighting, fencing, roofing, gutters, appliances and more will greatly benefit from 3D Merchant Services solutions and consulting expertise. Free trial to measure the value with existing merchant account.