Using First Data? Check Your Statements!

Update - since this blog post went up, I have also been contacted by TSYS users reporting a 11.5 cent/transaction non-compliance surcharge so its extremely clear that the credit card industry is cracking down on PCI/SHA-2/EMV requirements.

It has been reported to me that some First Data customers have started seeing $20 to $25 monthly fees on their statements for not being PCI compliant and/or not having the hardware in place to accept EMV/Chip Cards. While this may not sound like much, paying $240 to $300 per store location annually adds up quickly.

Microsoft Dynamics RMS users may want to take a look at Card Defender which is hardware and software for Microsoft Dynamics RMS that is PCI compliant, works with First Data, and also allows you to accept EMV/Chip Cards as payment.

More information on Card Defender can be found here: http://www.pospondering.com/p/card-defender-emv-for-rms.html 

You can also contact me at 208-340-5632 or kevinantosh@gmail.com for more information.

RITE Achieves PCI QIR Certification

Retail Information Technology Enterprises (RITE) of Sartlell, MN and Boise, ID has achieved PCI Qualified Integrated and Resellers (QIR) certification.

While this may not sound important - it is when looking for a point of sale company that provides complete point of sale solutions that include the ability to process payments made by debit and credit card. In fact, VISA has mandated that all level 4 merchants need to have a "Qualified Install" done for any payment applications.  In other words a QIR certified individual must perform the installation (or update) of any PA-DSS compliant payment applications.  This is to ensure the installation and configuration of the application is done in a PCI complain manner.

I'd recommend that you check to ensure that your point of sale VAR/Dealer/Partner has achieved the same level of qualification.  From a security stand point, this would be a "best practice" when working with a business for point of sale equipment.  Here are the websites that allow you to search to see if the company that you are, or will be working with, has the mandated certification:

https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_integrators_and_resellers

http://www.visa.com/splisting/searchGrsp.do

http://www.gorspa.org/professional/industry-certified/ 

As always, contact me at 208-340-5632 or kevinantosh@gmail.com with any questions.

You are Not PCI Compliant if You are Processing Credit & Debit Cards on a PC Running Windows XP

Wow - so I am discovering that a lot of folks are still running point of sale programs on computers running Windows XP. If you are in this situation and processing credit and debit cards through the computer, then you are NOT PCI compliant. No gray area here.

The reason is that operating systems that have reached "end of life" can not be PCI compliant since the operating system is no longer being updated.

What you do in this situation?

• Get with your local computer shop or the place that you obtained your point of sale system from to get the operating system updated or the computer(s) replaced
• Make sure that your point of sale system will run on Windows 7 or 8.1 
• Make sure all your peripherals (receipt printer, barcode scanner, etc) will work in a Windows 7 or 8.1 environment
• Check to see if your computer has enough memory, etc to run Windows 7 or 8.1
• Back everything (I mean everything) up before upgrading anything
• This is also a good time to check for other PCI compliance issues with other parts of your computer network and point of sale system

What are the costs?

• From the folks that I have spoken with, the low end estimate from their computer or point of sale company was around $500.00. On the high end was around $15,000.

This is too expensive - are there any other options?

• You can switch to using a separate credit card terminal/machine for authorizing credit and debit cards
• Keep in mind that you will have to reconcile 2 reports at the end of each day as part of your end of day close out procedures
• Having a separate credit and debit card machine opens the door for lots of errors. For example, the sale amount total is $59.50. Your employee could easily enter $5.95 or $595.50 as the total on the credit card machine (and the error would likely not be found until the end of the day or when one very happy or very upset customer contacts you).
• Look at switching to a more affordable point of sale system with a monthly fee that includes updates and upgrades in the monthly fee.  That way you will likely not find yourself in this situation again. New generation point of sale systems like Bindo Point of Sale (www.bindopos.com) not only have an affordable monthly fee but, in most cases, you can transfer your inventory, customer, and supplier information from your system in to Bindo.

Are you in need of some free point of sale advice or help?  Over the last 15 years I have helped thousands of folks find the best point of sale solution. Besides the free help and advice, I have also secured discounts with multiple trusted point of sale providers. You can reach me using the contact form to the right, via email at kevinantosh@gmail.com or on my cell at 208.340.5632.

PCI Compliance Survey Results

I've been harping a lot over the last year about planning for the upcoming EMV requirement which will affect everyone who takes credit and debit cards.  Based on a recent survey of retailers by ControlScan, it appears that many folks are still ignoring PCI compliance.  The survey results are surprising to me as PCI has been around for several years now and who wants to risk fines and fees that could put you out of business overnight.

I'm going to focus on some of the result specific to retailers with 1-50 employees and processing under $500,000 annually (which would approximate to annual gross sales of less than $800,000 annually).  Of the survey respondents...

• 71% feel that they are not at risk for a data breach
• 64% have no action plan should a breach occur
• 45% have no employee designated to check network and related security
• 36% don't feel that PCI compliance is a priority

Obviously, point of sale and merchant services companies have not done a good job of stressing the need to maintain on-going PCI compliance. One data breach (which can also come internally from a dishonest employee) can result in fines exceeding $20,000 as well as the loss of revenue and the ability to accept credit and debit cards.

If you are not sure about your PCI Compliance status, please contact the company that provides your merchant services (credit and debit card processing) to ensure that your hardware, software, and network equipment are PCI complaint.

Are you in the US and in need of no cost retail point of sale advice? I'm happy to help and can be reached on my cell at 208-340-5632 (mountain time) or via email at kevinantosh@gmail.com.