pci compliance and fraud prevention for non profits
TRANSCRIPT
Patricia O’Connor, Partner Account Manager [email protected]
PCI Compliance & Fraud Prevention for Nonprofits
Don’t let the bad guys win!
Agenda
• The Harsh Reality: Fraudsters
• First Step: PCI Compliance
• Tools for Fraud Prevention
• Resources
Who are they?
The Harsh Reality: Fraudsters
• Fraudsters are smart and dedicated• Data breach vs. payment fraud• Attack vulnerable websites• Nonprofits have weaker security• Nonprofits can lose both money and
reputation as a result of fraud
What do they do?
• Testing stolen card numbers – $1.00 donations
• Card number tumbling • Name tumbling • Refund scam • Creation of clone charities
Ways to STOP them
• Velocity checking • Address verification (AVS) • CVV2 capability • IP blocking (high risk countries) • Minimum transaction limit • Payment Form – iFrame (least risk) – Direct Post (medium risk)
Fraud Tools
Quick Case Study
What is PCI?
• Payment Card Industry Data Security Standard (PCI-DSS)
• All merchants (regardless of size)
must meet established standards of security relating to how credit card data is stored, processed, and transmitted
How PCI Helps
• Creates an actionable framework to protect both nonprofits and donors
• Enables prevention, detection, and mitigation of incidents
• Maintaining PCI certification helps build donors’ trust
Becoming Compliant
• Identify level of compliance you need• Complete either:
– Self Assessment Questionnaire (SAQ)– Report on Compliance (ROC)
• Different types depending on systemsand processes
• Hire a security assessor
Compliance Levels
Level Description
1 Any merchant — regardless of acceptance channel — processing over 6M Visa transactions per year. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa network
2 Any merchant — regardless of acceptance channel — processing 1M to 6M Visa transactions per year
3 Any merchant processing 20K to 1M Visa ecommerce transactions per year
4 Any merchant processing fewer than 20K Visa ecommerce transactions per year, and all other merchants — regardless of acceptance channel — processing up to 1M Visa transactions per year.
SAQ Types SAQ Description
A Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants.
A-EP* E-commerce merchants who outsource all payment processing to PCI DSSthird parties and who have a website that doesn’t directly receivecardholder data but can impact the security of the transaction.
B Imprint-only merchants with no electronic cardholder data storage, or standalone, dial-out terminal merchants with no electronic cardholder data storage
B-IP* Merchants using only standalone, PTS-approved payment terminals with an IP connection to the processor and no electronic data storage.
C-VT Merchants using only web-based virtual terminals, no electronic cardholder data storage
C* Merchants with payment application systems connected to the Internet, no electronic cardholder data storage
P2PE-HW Merchants using only hardware payment terminals that are included in/managed via a PCI SSC-listed P2PE solution. No card holder data storage.
D* All other merchants not included in descriptions for SAQ types A through C above, and all service providers defined by a payment card brand as eligible to complete an SAQ
Where Are You?
What to do…
• Achieve and maintain PCI compliance
• Talk to your merchant provider–What tools are available?– How to implement?
• Train your staff so they know what tolook for– Refund policies, account patterns, etc.
Basic Strategy
As much as possible to
someone else
Work hard to only need to
follow SAQ-A or SAQ-EP
Make sure you understand questions
But don’t totally avoid it
• PCI encourage useful habits– Some of the policies are a
good idea anyway.
• Don’t sacrifice user experience– Don’t outsource to a platform your users
will hate. That may cost you more thancompliance.
What Professional Vendors Do
• Scanning systems quarterly and annually• Securing/removing direct access (physical and
software) to servers and networks• Completely locking down direct access to all platform
APIs• Fully logging every action taken on every server and
API• Creating 2 factor authentication to all systems used• Created strong internal processes and policies
around password strength/maximum allowed age,SSL certificates, office access, and more…
Key Takeaways
• You must own the process• PCI encourages useful habits• Create a sustainable culture• Don’t need to sacrifice userexperience
Resources from iATS
• White papers:Credit Card FraudPrevention in NonprofitsPayment processing 101• Infographic:Credit Card Fraud: How it impacts nonprofits • Infographic:Why PCI-DSS Compliance is a must have
General resources
• DrupalPCICompliance.org• PCI Security standards– https://www.pcisecuritystandards.org/s
ecurity_standards/documents.php