Card Payments – DoMoreWith Less and Reduce Security Requirements


L BY FABIEN PESENTI


ET’S BE FRANK. The only way a card holder can be sure his or her data will never be com-


promised is simply to not pay by credit card. And the only way a merchant (company accepting card payments) can be certain that the business is safe from security breaches is to not accept card payments.


But howmany businesses can afford such a restriction? Implementing andmaintaining processes related to card data


security are complex and costly. To reduce complexity and cost, goals should be to remove staff involvement from the payment processes and staff access to card data, plus to eliminate asmuch as possible storing, processing and transmitting card data within themerchant’s environment. These goals can be accomplished by leveraging advanced


managed solutions and value-added services from PCI DSS- compliant service providers (www.pcisecuritystandards.org). For a merchant, one simple step toward compliance is to


ensure that all payment applications in operations (applications / systems used to create card transactions) and third party service providers are compliant.However, the scope of card security goes well beyond these compliances.A common mistake is that com- panies focus on the compliance of their vendors but overlook reviewing all aspects of their business to understand where, how and for which purposes card data are being stored, transmitted and accessed. It is often believed that card data are needed to fulfill tasks


related to customer support and back-office requirements. Such tasks include handling of customer inquiries, researching trans- actions, managing disputes, reviewing of charges, manual cap- ture of transactions, reconciliation, and issuing of adjustments and refunds. But onemust ask if the access to card data is a true need. Could such tasks be completed without storage and access


to card data?Also, accepting card payments requires the ability to issue refunds. Do organizations have clear refund processing procedures? Do they know how refunds are being done, by who and and if employees are accessing card data to do so? If proce- dures are in place, are they up-to-date with card data security requirements and are they being followed?


How the solutions & services apply to the parking industry While understanding the true picture, implementing and


maintaining card security processes are significant and costly endeavors for a retail organization with multiple standardized locations., It is even more complex for parking operators with a broad range of locations and a variety of revenue control systems


26 MARCH 2010 • PARKING TODAY • www.parkingtoday.com


of all ages inherited with each location over time. There are many ways to look at


card security, but essential goals should be (1) to remove staff intervention from the payment processes and access to card data and (2) to eliminate storing and handling of card data from the merchant’s environment or at least remove them from the control of the merchant’s staff. These goals can be accomplished


while allowing customer support and back-office tasks to be fulfilled by leveraging advanced managed solu-


tions and value-added services fromcompliant providers.


Advancedmanaged solutions and value-added services:


• Solutionsmanaged by compliant service providers: Merchants should standardize on processing solutions with-


out local staff access, independent from local revenue control systems and managed by compliant service providers.Manage- ment services should includemonitoring and upgrades of operat- ing systems and software to account for ever changing PCI-DSS requirements. • Real-time authorization and off-line processing capabilities: One drawback of real-time authorization,which is nowcom-


mon in the parking industry, is that it is dependent on high-speed connectivity at the time of payment.At a parking facility, inabili- ty to accept card payments can quickly result in an operational nightmare, with traffic flow through the facility interrupted as parkers and cars are unable to leave. A common procedure in such circumstances is to raise the gates, thus resuming traffic flow but at the same time losing significant revenue. For optimal operations, systems should have the ability to


automatically and temporarily switch to an off-line mode, allow- ing transactions to be accepted locally. From a merchant’s per- spective, this process should be outsourced and managed by a compliant PCI DSS provider. Services should include monitor- ing of off-line activity to identify potential starting or recurring connectivity issues and the ability to reattempt declined offline transactions without access to card data. •Tokens for “Card-on-file” applications: For “card-on-file” applications, such as for automated recur-


ring payments (monthly parker fees), card data storage can be removed from merchant’s environment using token-based solu- tions.Tokens are dummy numbers issued by the service provider to be used by the payment application in place of card data when creating transactions. Card data are stored remotely by a compli- ant service provider and linked to tokens. No actual card data are stored on themerchant’s systems. • Remotely hosted solutions: Web-based payment solutions hosted by compliant service


providers can completely remove card data from the mer- chant’s environment.


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52  |  Page 53  |  Page 54  |  Page 55  |  Page 56