Credit Card & eCommerce Best Practices Training Days 2010

1. Credit Card & eCommerce Best PracticesTraining Days 2010 Dan Hough and Robert Monasky Business Affairs

2. Agenda Introduction & Overview Credit Cards: The Good, The Bad & The Ugly Definitions Process Flow Processing Costs Disputed Card Payments Regulations Best Practices Becoming a Merchant Questions

3. Lots of Information– Take time to Digest Compliance Increase Sales Fees Security Reconciliation Breach Rep PII Convenience/Cost Savings Best Practices

4. In the End it’s a Balance!!

5. Credit Cards: The Good Increase sales and revenues Save costs Speed Security Reach

6. Credit Cards: The Bad Costs Increased responsibility for sensitive data Compliance administration Ongoing training Reconciliation

7. Credit Cards: The Ugly Confidential Financial Data breach Not being PCI compliant can have costly ramifications for you and/or the University Loss of Merchant ID for not following policy

8. Definitions Issuer – The financial institution or other organization that issued the credit card to cardholder. Acquirer – Financial institution accepting payment for the products or services on behalf of merchant. Card Association – An association of card-issuing banks such as Visa, MasterCard, Discover, American Express, etc. that set transaction terms for merchants, card-issuing banks, and acquiring banks.

9. Definitions (continued) Merchant – Entity accepting credit card payments for products or services sold to the cardholder. Interchange – The clearing and settlement system for credit & debit cards where data is exchanged between Acquirer and the Issuer. Authorization – The approval of credit worthiness of the transaction Settlement – The closing of credit card batches and the start of the movement of funding to a Merchant.

10. Process Flow: Step 1. Authorization Players Elavon (processor) US Bank

11. Process Flow: Step 2. Batching

12. Process Flow: Step 3. Clearing

13. Process Flow: Step 4. Funding

14. Interchange Costs Managed and updated by the Card Associations Interchange costs vary in amount based on: Industry type (grocery, restaurant, adult, higher education….) Length of time you have been in business Received method: swiped, over the phone, or via ecommerce. Average dollar amount of each sales transaction, the total dollar amount of sales per month. Timeliness of settling batch for payment Information the business captures during the transaction Card type (rewards, cash back…) Interchange fee (qualified/non-qualified)

15. YOU Can Help Control Costs - Remember These Interchange Tips Consider • Only One Authorization per Transaction • Avoid processing Pre-Auth with no matching settle transaction (remember it costs Per/trans) • Returns/Chargebacks Always • Close Batch Daily if not setup on Auto-Close • Follow POS device transaction prompts entering valid data not pressing enter or “0” to by-pass the prompt • Hand-keyed Transactions –Enter Address Verification ((AVS) Zip Code)

16. Your liability for disputed card payments A chargeback is a dispute with the merchant to reverse a transaction you have processed: • You, or your customer, have made an error at the point of sale, such as using an expired card. • A cardholder or card issuing business disputes the transaction. • The transaction was made fraudulently • You didn't respond to a request for a copy of a transaction in time. • It was a duplicate transaction.

17. Your liability for disputed card payments (continued) • The transaction was not authorized. • The goods or services ordered have not been received. • If a cardholder disputes participating in a transaction • Inadequate customer service (i.e. faulty product) • A chargeback can be made up to 120 days after the transaction • You're given 14 days from the date of the chargeback request to respond • They are expensive (initial transaction + chargeback + time) Chargebacks are a Merchant Responsibility (cashiers can assist with response)

18. Industry Regulations PCI DSS -Payment Card Industry Data Security Standards security standard that must be met to accept payment cards… CISP– Cardholder Information Security Program specifications developed and used by credit card companies for the purpose of ensuring the privacy and security of financial data. NACHA– Nat’l Automated Clearing House Assoc. operating rules and practices for the ACH Network and for electronic payments in the areas of Internet commerce, electronic bill & invoice… Oregon SB 583 – OR Consumer Identity Theft Prot Act regulation to ensure the safety of the personal identifying information (name in combo w/SSN, DL or ID card, financial, payment card #…)

19. Security Standards- PCI Data Security Standard Requirements Assess Vulnerabilities that pose risks to the security of cardholder How cardholder data flows from beginning to end of the transaction process Ensure transaction hardware/software is PCI compliance Remediate Review & remediation of vulnerabilities found Re-scan (if applicable) Report (Validation) Complete Self Assessment Questionnaire Annually Submitted through Business Affairs to US Treasury

20. Security Standards- PCI Requirements Install and maintain a firewall configuration to protect cardholder data Do not use vendor-supplied defaults for system passwords and other security parameters Protect stored cardholder data Encrypt transmission of cardholder data across open, public networks Use and regularly update anti-virus software or programs Develop and maintain secure systems and applications

21. Security Standards- PCI Requirements (continued) Restrict access to cardholder data by business need to know Assign a unique ID to each person with computer access Restrict physical access to cardholder data Track and monitor all access to network resources and cardholder data Regularly test security systems and processes Maintain a policy that addresses information security for all personnel

22. Security Standards- Consequences In 2006, over 30% of breaches involved colleges & universities If found liable for a breach VISA assesses fines $500,000 - $1,000,000 You must cover losses on individual accounts You must cover cost of reissuing compromised cards Submit to a forensic investigation Automatically requires an external security assessment Loss of Merchant ID

23. Security Standards- OSU Breach Response Do not access or alter compromised machine. Do not turn off the compromised machine. Instead, isolate compromised systems. Preserve logs and electronic evidence. Log all actions taken. Be on high alert and monitor all systems with cardholder data. Contact Business Affairs /Cashiers. Provide a report containing; account information at risk and the source and timeframe of the compromise.

24. So…Do You Still Want To Be A Merchant?

25. New Merchants: Consider the Following What are you planning on selling? How are you going to sell it? Where will you be selling? How much revenue will be generated? Can you afford the discount fee? What’s driving the decision to take cards? Who will be the contact person? Privacy Policy Return/Refund Policy Segregation of Duties

26. New Merchants How to get started: Contact Business Affairs Define security and operational practices Choose a payment processor (TouchNet, VM) Complete forms (MID, detail code…) Process through Business Affairs office Complete Best Practices and application training Start processing!

27. New Merchants – Contact Business Affairs Offers expertise in our hosted solutions and applications Can connect you with others on campus with similar experiences Assists with obtaining a Merchant ID Provide application (i.e. TouchNet, Virtual Merchant) advice Best Practices training Other tools (i.e. Merchant Connect)

28. New Merchants - Costs Virtual Merchant – Point of Sale Transactions Monthly fee of $5.00 per merchant Optional equipment costs: Card Wedge (highly recommended for POS): $75 Printers: $249 TouchNet uPay or uStore – Web Only transactions No Cost to merchant Merchant ID – No cost The Payment Card industry & standards are dynamic and constantly changing. Greater focus on security may increase costs. Costs will be shared among all OSU merchants.

29. New Merchants Contact the Cashiers Office once you are setup, but before your first transaction. They will: Verify merchant account flow-through to Treasury Confirm everything is ready to go Conduct any needed testing for online stores Provide Merchant Connect login info (if requested).

30. Best Practices: Process Flow- Three Core Merchant Actions Authorization Merchants must obtain approval from the Issuing Bank to process a transaction Authentication Involves the verification of the cardholder and the card. Settlement Send approved transactions daily to the Merchant Bank

31. Best Practices: Transaction Processing- Card Present Always swipe the stripe Hold the card in the presence of the customer through the entire transaction. Before swiping the card, verify that the card expiration date has not passed. Obtain authorization (Approved, Declined, Call Center, or Referrals, Pick up, No Match) While the transaction is being processed, check the card’s features and security elements to make sure the card is valid and has not been altered. Card must be signed (see ID not valid)

32. Best Practices: Transaction Processing- Card Present Customer signs sales receipt. Compare the signature with the signature on the back panel of the card. Compare the name and account number on the credit card with name and last four digits of the account number on the printed receipt. If you suspect fraud, make a code 10 call (suspicious activity)

33. Best Practices: Transaction Processing- Card Not Present Obtain an Authorization on all transactions Authorization must occur before any merchandise is shipped or service performed. Compare card type and account number Request card Expiration Date Requesting Card Verification 2 (CVV2/CVC2) – never keep! Request AVS (Address Verification)

34. Best Practices- General Refund to the same card and no more than original transaction Keep equipment and applications up to date Keep Return/Refund & Privacy policies current Follow OSU Cash Handling Guidelines Reconcile/verify transactions regularly

35. Best Practices- Protect Cardholder Data Restrict access to cardholder data Store all info in a secure area Assign a unique ID to each person with system access Do not send or receive complete credit card numbers using email or campus mail Never write down the CVV2/CV2 number – no exceptions Mask the card number or only record the last four (4) Train all personnel on security practices

36. Merchant Connect - payment activity management Copies of recent statements View deposits (batches) and detailed information on transactions Research chargebacks Last ten days of deposit activity/6 months of statements Itemization of monthly fees

37. Additional Resources Merchant Statements and Information https://www.merchantconnect.com/CWRWeb/displayMemberLogin.do OSU Cash Handling Guidelines http://oregonstate.edu/fa/businessaffairs/cashiers/cash_handling_handbook.php OUS Controller’s Division http://www.ous.edu/cont-div/cobpp/10.20_ecommerce_creditcard_payments.php OSU eCommerce Info http://oregonstate.edu/dept/computing/ecommerce/ Treasury Cash Management Policies http://www.ost.state.or.us/divisions/finance/cjashmanagement/index.htm

38. Questions? Business Affairs Contacts: Dan Hough 541-737-2935 Email: Dan.Hough@OregonState.Edu Robert Monasky 541-737-0654 Email: Robert.Monasky@OregonState.Edu Janice Lee-Virnig (Cashiers Manager) 541-737-4109 Email: Janice.Lee-Virnig@OregonState.Edu