While we all enjoy the benefits and convenience of living and working in a high-tech era, unfortunately we must realize high tech crime comes with it. Computers and phone lines around the world are being hacked into on a daily basis and this has the major credit card companies more than just a little concerned as they’re suffering huge losses due to fraud. This is why PCI compliance was introduced to all merchants who accept credit cards as a form of payment.
PCI stands for Payment Card Industry and you will often see the letters DSS after it, which means Data Security Standard. This is a set of standards financial institutions and credit card processing companies have to comply with when facilitating credit card processing. The goal is to protect personal information and to make sure all transactions and data storage are handled securely by using a common security standard. Basically, it’s a way for the industry to regulate itself.
If banks and merchant account providers don’t comply with these standards they may be fined or could even have their credit card-selling privilege taken away. Merchants themselves must also meet the PCI compliance standards.
There are four different levels of standards that must be met, and these depend on how many annual sales you process. Level one is for merchants who handle over 6,000,000 transactions a year and level four refers to those that handle less than 20,000. The more transactions you process, the more security measures you must meet.
You should start off by filling out a Self-Assessment Questionnaire (SAQ) which will be sent to you with your merchant account statement. Your answers will be scrutinized by security departments and they will decide if you need to implement any further security measures.
If you process transactions via an Internet connection, then the system must undergo a security scan to make sure it can’t be compromised or hacked into. An auditor may also show up at level one merchants to make sure everything is being done according to PCI compliance.
There are several categories of PCI standards that need to be met for you to be considered as compliant.
- Your network has to be secure and the proper firewalls and other security measures need to be installed.
- Credit Card holder data must be protected when it’s stored and transmitted. This means limiting access to it and possibly encrypting the information. Encryption is essential for internet transactions and information must be encrypted with at minimum 128 bit SSL certificate to meet the standard.
- A vulnerability management program should be in place. This basically means that you must ensure that you’re using updated hardware, software, and operating systems. Be sure to install anti-virus software and run virus scans on a regular basis.
- Strong access control measures need to be implemented. Meeting PCI compliance means you should only give cardholder information access to employees who need it.
- Networks should be tested and monitored on a regular basis to meet the standard. Make sure you identify and immediately fix all possible security leaks.
- An information security policy needs to be maintained. This means you should make sure all employees fully understand and know what their responsibilities are when it comes to cardholder information.
If you can meet these standards above, you’re well on the way to PCI compliance. However, things don’t usually get that involved for level four merchants and they often meet standards by using a payment gateway or merchant account provider that offer compliant services. And remember, if you don’t store, transmit or process any credit card data at all, then you don’t have to meet PCI compliance.
While adhering to PCI compliance makes credit card transactions more secure for you and your customers, it doesn’t’ come without a cost. Because all of the security measures have been implemented by financial institutions and merchant account providers, the costs are naturally passed down to the merchants. However, you can shop around to see who offers the best deal as the price varies. Some credit card processing companies are currently waiving any PCI compliance fee.
Since PCI compliance is now a standard industry requirement for accepting credit card payments, there’s no two ways about it, you must become compliant. If you’re not sure you are, then contact your credit card processor to get all of the details as the monetary fines for not meeting the standards can be astronomical. You don’t want to find out the answer to the question, “What is PCI
Filed under: Merchant Services | Tagged: Accepting Credit Cards, all in one merchant services provider, contactless payment, contactless payment technology, credit card accounts, credit card fraud, credit card processing, credit card transactions, debit card transactions, electronic checks, good merchant services provider, merchant credit card processing service, qualified credit card | Leave a Comment »