Credit Card & eCommerce Best Practices

Training Days 2010

Dan Hough and Robert MonaskyBusiness Affairs

2

Agenda1.Introduction & Overview2.Credit Cards: The Good, The Bad & The Ugly3.Definitions4.Process Flow5.Processing Costs6.Disputed Card Payments 7.Regulations 8.Best Practices9.Becoming a Merchant10.Questions

3

Lots of Information– Take time to Digest

Increase Sales

Compliance

Reconciliation

Convenience/Cost Savings

Fees

Security

PIIBest Practices

Breach

Rep

4

In the End it’s a Balance!!

5

Credit Cards: The Good

1.Increase sales and revenues2.Save costs3.Speed4.Security5.Reach

6

Credit Cards: The Bad

1.Costs2.Increased responsibility for sensitive data3.Compliance administration4.Ongoing training5.Reconciliation

7

Credit Cards: The Ugly

1.Confidential Financial Data breach2.Not being PCI compliant can have costly ramifications for you and/or the University3.Loss of Merchant ID for not following policy

8

Definitions

1.Issuer – The financial institution or other organization that issued the credit card to cardholder. 2.Acquirer – Financial institution accepting payment for the products or services on behalf of merchant.3.Card Association – An association of card-issuing banks such as Visa, MasterCard, Discover, American Express, etc. that set transaction terms for merchants, card-issuing banks, and acquiring banks.

9

Definitions (continued)

5.Merchant – Entity accepting credit card payments for products or services sold to the cardholder.6.Interchange – The clearing and settlement system for credit & debit cards where data is exchanged between Acquirer and the Issuer. 7.Authorization – The approval of credit worthiness of the transaction8.Settlement – The closing of credit card batches and the start of the movement of funding to a Merchant.

10

Process Flow: Step 1. Authorization

US BankElavon (processor)

Players

11

Process Flow: Step 2. Batching

12

Process Flow: Step 3. Clearing

13

Process Flow: Step 4. Funding

14

Interchange Costs

1.Managed and updated by the Card Associations2.Interchange costs vary in amount based on:

•Industry type (grocery, restaurant, adult, higher education….)

•Length of time you have been in business

• Received method: swiped, over the phone, or via ecommerce.

•Average dollar amount of each sales transaction, the total dollar amount of sales per month.

•Timeliness of settling batch for payment

•Information the business captures during the transaction

•Card type (rewards, cash back…)

•Interchange fee (qualified/non-qualified)

15

YOU Can Help Control Costs - Remember These Interchange Tips

Consider• Only One Authorization per

Transaction• Avoid processing Pre-Auth with no

matching settle transaction (remember it costs Per/trans)

• Returns/Chargebacks

Always• Close Batch Daily if not setup on

Auto-Close• Follow POS device transaction

prompts entering valid data not pressing enter or “0” to by-pass the prompt

• Hand-keyed Transactions –Enter Address Verification ((AVS) Zip Code)

16

Your liability for disputed card payments

A chargeback is a dispute with the merchant to reverse a transaction you have processed:

• You, or your customer, have made an error at the point of sale, such as using an expired card.

• A cardholder or card issuing business disputes the transaction.

• The transaction was made fraudulently • You didn't respond to a request for a copy of a transaction

in time.• It was a duplicate transaction.

17

Your liability for disputed card payments (continued)

• The transaction was not authorized.• The goods or services ordered have not been received.• If a cardholder disputes participating in a transaction• Inadequate customer service (i.e. faulty product)• A chargeback can be made up to 120 days after the

transaction• You're given 14 days from the date of the chargeback

request to respond• They are expensive (initial transaction + chargeback +

time)

Chargebacks are a Merchant Responsibility(cashiers can assist with response)

18

Industry Regulations

•PCI DSS - Payment Card Industry Data Security Standards•security standard that must be met to accept payment cards…

•CISP – Cardholder Information Security Program•specifications developed and used by credit card companies for the purpose of ensuring the privacy and security of financial data.

•NACHA – Nat’l Automated Clearing House Assoc.•operating rules and practices for the ACH Network and for electronic payments in the areas of Internet commerce, electronic bill & invoice…

•Oregon SB 583 – OR Consumer Identity Theft Prot Act•regulation to ensure the safety of the personal identifying information (name in combo w/SSN, DL or ID card, financial, payment card #…)

19

Security Standards- PCI Data Security Standard Requirements

Assess•Vulnerabilities that pose risks to the security of cardholder•How cardholder data flows from beginning to end of the transaction process•Ensure transaction hardware/software is PCI compliance

Remediate•Review & remediation of vulnerabilities found•Re-scan (if applicable)

Report (Validation)•Complete Self Assessment Questionnaire Annually•Submitted through Business Affairs to US Treasury

20

Security Standards- PCI Requirements

1.Install and maintain a firewall configuration to protect cardholder data2.Do not use vendor-supplied defaults for system passwords and other security parameters3.Protect stored cardholder data4.Encrypt transmission of cardholder data across open, public networks5.Use and regularly update anti-virus software or programs6.Develop and maintain secure systems and applications

21

Security Standards- PCI Requirements (continued)

7.Restrict access to cardholder data by business need to know8.Assign a unique ID to each person with computer access9.Restrict physical access to cardholder data10.Track and monitor all access to network resources and cardholder data11.Regularly test security systems and processes12.Maintain a policy that addresses information security for all personnel

22

Security Standards- Consequences

•In 2006, over 30% of breaches involved colleges & universities

If found liable for a breach•VISA assesses fines $500,000 - $1,000,000•You must cover losses on individual accounts•You must cover cost of reissuing compromised cards•Submit to a forensic investigation•Automatically requires an external security assessment•Loss of Merchant ID

23

Security Standards- OSU Breach Response

•Do not access or alter compromised machine.

•Do not turn off the compromised machine. Instead, isolate compromised systems.

•Preserve logs and electronic evidence.

•Log all actions taken.

•Be on high alert and monitor all systems with cardholder data.

•Contact Business Affairs /Cashiers.

•Provide a report containing; account information at risk and the source and timeframe of the compromise.

24

So…Do You Still Want To Be A Merchant?

25

New Merchants: Consider the Following

•What are you planning on selling?•How are you going to sell it?•Where will you be selling?•How much revenue will be generated?•Can you afford the discount fee?•What’s driving the decision to take cards?•Who will be the contact person?•Privacy Policy•Return/Refund Policy

•Segregation of Duties

26

New Merchants

How to get started:•Contact Business Affairs•Define security and operational practices•Choose a payment processor (TouchNet, VM)•Complete forms (MID, detail code…)•Process through Business Affairs office•Complete Best Practices and application training•Start processing!

27

New Merchants – Contact Business Affairs

•Offers expertise in our hosted solutions and applications•Can connect you with others on campus with similar experiences•Assists with obtaining a Merchant ID•Provide application (i.e. TouchNet, Virtual Merchant) advice•Best Practices training•Other tools (i.e. Merchant Connect)

28

New Merchants - Costs

•Virtual Merchant – Point of Sale Transactions•Monthly fee of $5.00 per merchant•Optional equipment costs:

•Card Wedge (highly recommended for POS): $75•Printers: $249

•TouchNet uPay or uStore – Web Only transactions•No Cost to merchant

•Merchant ID – No cost

The Payment Card industry & standards are dynamic and constantly changing. Greater focus on security may increase costs. Costs will be shared among all OSU merchants.

29

New Merchants

Contact the Cashiers Office once you are setup, but before your first transaction.

They will:•Verify merchant account flow-through to Treasury•Confirm everything is ready to go•Conduct any needed testing for online stores•Provide Merchant Connect login info (if requested).

30

Best Practices: Process Flow- Three Core Merchant Actions

Authorization

Merchants must obtain approval from the Issuing Bank to process a transactionAuthentication

Involves the verification of the cardholder and the card.Settlement

Send approved transactions daily to the Merchant Bank

31

Best Practices: Transaction Processing- Card Present•Always swipe the stripe•Hold the card in the presence of the customer through the entire transaction.•Before swiping the card, verify that the card expiration date has not passed. •Obtain authorization (Approved, Declined, Call Center, or Referrals, Pick up, No Match)•While the transaction is being processed, check the card’s features and security elements to make sure the card is valid and has not been altered.•Card must be signed (see ID not valid)

32

Best Practices: Transaction Processing- Card Present•Customer signs sales receipt. Compare the signature with the signature on the back panel of the card.•Compare the name and account number on the credit card with name and last four digits of the account number on the printed receipt.•If you suspect fraud, make a code 10 call (suspicious activity)

33

Best Practices: Transaction Processing- Card Not Present•Obtain an Authorization on all transactions•Authorization must occur before any merchandise is shipped or service performed. •Compare card type and account number•Request card Expiration Date•Requesting Card Verification 2 (CVV2/CVC2) – never keep!•Request AVS (Address Verification)

34

Best Practices- General

•Refund to the same card and no more than original transaction•Keep equipment and applications up to date•Keep Return/Refund & Privacy policies current•Follow OSU Cash Handling Guidelines•Reconcile/verify transactions regularly

35

Best Practices- Protect Cardholder Data

•Restrict access to cardholder data

•Store all info in a secure area

•Assign a unique ID to each person with system

access

•Do not send or receive complete credit card

numbers using email or campus mail

•Never write down the CVV2/CV2 number – no

exceptions

•Mask the card number or only record the last four

(4)

•Train all personnel on security practices

36

Merchant Connect - payment activity management•Copies of recent statements

•View deposits (batches) and detailed information on transactions

•Research chargebacks

•Last ten days of deposit activity/6 months of statements

•Itemization of monthly fees

37

Additional Resources

Merchant Statements and Informationhttps://www.merchantconnect.com/CWRWeb/displayMemberLogin.do

OSU Cash Handling Guidelineshttp://oregonstate.edu/fa/businessaffairs/cashiers/cash_handling_handbook.php

OUS Controller’s Divisionhttp://www.ous.edu/cont-div/cobpp/10.20_ecommerce_creditcard_payments.php

OSU eCommerce Infohttp://oregonstate.edu/dept/computing/ecommerce/

Treasury Cash Management Policieshttp://www.ost.state.or.us/divisions/finance/cjashmanagement/index.htm

38

Questions?

Business Affairs Contacts: • Dan Hough 541-737-2935 Email: Dan.Hough@OregonState.Edu•Robert Monasky 541-737-0654 Email: Robert.Monasky@OregonState.Edu•Janice Lee-Virnig (Cashiers Manager) 541-737-4109 Email: Janice.Lee-Virnig@OregonState.Edu