Updates and News
Newsletters
PCI Compliance
First of all, PCI is an acronym for Payment Card Industry. Secondly, compliance is a
matter of adhering to the security standards set by the PCI DSS (Data Security Standards)
Council, the organization that was created by American Express, Discover Financial
Services, JCB, MasterCard Worldwide and Visa Inc. This council’s mission is to enhance
payment account security by creating and maintaining PCI Security Standards, as well as
fostering the education and awareness of these security standards
In other words, in an effort to reduce fraud and keep electronic payment information secure,
there are rules to follow. Your equipment or processing software must be current with these
standards and your business must take every precautionary method possible to keep such
information protected. This is why you should NEVER see a full credit card number print on a
receipt, and this is why you must NEVER store credit card information on computers or electronic
devices. You must also be processing your transactions in such a way that hackers cannot access
this information at any time.
If you have a specific question regarding PCI Compliance and your business, please contact
The Merchant’s Matchmaker © directly or go to the official website of the PCI DSS Council,
www.pcisecuritystandards.org. This website is a fantastic resource regarding the topic with
many FAQ’s that offer a better understanding of PCI compliance as a whole, and we highly
recommend that you visit the site if you’re seeking information.
PCI Compliance is very important to every business owner, regardless of how you do business: retail,
restaurant, online, seasonal, mobile, etc. If you accept card payments from your customers, you
MUST adhere to the PCI compliance regulations. If you fail to do so, knowingly or unknowingly, and
a data breach occurs, you could be fined up to $50,000/month and/or egregious fines of up to $500,000
by the payment brands. These hefty fines would put many small business owners out of business, so
please make sure you understand what is required for your specific business to avoid such an occurrence!!
All this being said, please make note of the following: There are far too many processing companies,
equipment vendors and Point-of-sale software retailers that are not being completely honest with
merchants. They will tell you that your equipment and/or software is no longer compliant and force
you to purchase new equipment or software upgrades, and at very inflated prices. They are sadly
taking advantage of the fact that few merchants understand this topic and have no resources whereby
they can determine the truth. This is where The Merchant’s Matchmaker © can really make a difference.
Before you buy that new equipment or pay for the software upgrade, call us to find out if you are being told
the truth for your specific business. We will assist you in discovering the truth, with absolutely no
obligation and no cost to you! As a business advocacy, it is our goal to help you protect your best
interests, and sometimes that just means asking the right questions of someone that you can trust to be
honest and objective. Be proactive, call today!
Data Breaches
There have been many data breaches since the beginning of the card processing option, but people really
started paying attention when TJX was hacked in 2007, and then again in 2008 when Heartland Payment
Systems was hacked, which, according to the Department of Justice was one of the largest data breaches
ever investigated and prosecuted.
PCI Compliance standards have been in place since card payment processing became mainstream, but the
enforcement of those standards was lax. As a result of the above-mentioned incidents, PCI compliance
awareness became a hotbed of information and activity as processors were forced to take a more proactive
role with their merchants. Education took a front seat and the cost of this has continued to be passed
on to the merchants.
Most merchants are now familiar with the term “PCI compliance”, though many are still in the dark when
it comes to how it affects their specific business. In addition, most merchants are not happy about the
PCI compliance and non-compliance fees they are forced to pay to their processing companies, and they feel
that these fees are unfair and often to no avail.
Some processors claim that paying those fees will offer the merchant some level of protection, or an
‘insurance policy’, if you will, in case there were a data breach. In most cases, what is covered and what
is not covered are not disclosed until something happens, and then the merchant discovers that there really
is no coverage or protection at all, or perhaps very little. Be very cautious to not believe everything you
are told, even by your processor. Fine print is king, remember!! Always ask for the Terms and Conditions in
writing regarding PCI compliance ‘insurance coverage’ and look for the loopholes.
Another misconception passed on to merchants, usually directly by the representatives of their processor, is
that the fees are ‘federally mandated’. This is absolutely false!! If your processor is telling you that
the fees are federally mandated when you question them, they are lying or have been grossly misled. The federal
government is NOT involved in PCI compliance fees whatsoever! And, in fact, the federal government, however
surprisingly, is not involved in the PCI compliance arena at all! PCI compliance standards are created and
maintained by the PCI DSS council, an organization developed and funded by the major payment brands, American
Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa Inc.
If you would like more information specific to your business on how to avoid data breaches, how to determine
if your business is PCI compliant, or how to avoid paying PCI Compliance fees, please contact The Merchant’s
Matchmaker © and we will be happy to answer your questions and help you find the information you need!
Mobile Device Insecurity
We definitely live in an age of technological genius and innovative progress, but when it comes to transacting
card payments or other banking transactions via mobile devices, cell phones, iPads, laptops, etc., consumers
and business owners alike need to be very aware of the lack of security for these devices. Often the manufacturers
of the mobile devices and software developers are assuring consumers that the devices are secure, when in fact,
they are not. Most of them can be easily hacked, even by a novice hacker.
This puts consumers at risk of fraud and identity theft, and it puts business owners at risk of allowing data
breaches, which can incur fines of up to $50,000 per month and/or up to $500,000 in egregious fines, assessed
to the business owner. This is a very serious matter and we need to start talking about it!
Most business owners using these devices have been erroneously led to believe that the devices are secure, but
some business owners know they are not secure and choose to continue to use them anyway because they like the
convenience. In either case, the business owner will be the one who is fined if a data breach occurs, not the
manufacturer of the device or software. If you research the fine print, their attorneys have the verbiage in
place that exempts them from responsibility.
This means that merchants need to be proactive and protect themselves, because no one else is going to protect
them! If you need further information about a specific device or software program, feel free to contact The
Merchant’s Matchmaker © and we will be happy to assist you in getting the answers you need! And don’t worry …. our
consultations are free of charge and without obligation! You can call or email, whichever is most convenient! We
look forward to being your resource for current and objective information for all things concerning payment processing!