Tag Archives: PCI Compliance

AlignCloud and HMS partner up

Host Merchant Services, an industry leading provider of payment processing and e-commerce services for small and medium businesses, announced a promising new partnership with cloud consulting firm AlignCloud. This partnership is the product of extensive research and collaboration and the bold new alliance  represents an exciting opportunity for customers to benefit from the combined expertise of these two companies.

AlignCloud tailors services for cloud providers and end-users alike. From cloud readiness assessment planning to cloud vendor management, AlignCloud provides indispensable services for all cloud customers. For cloud hosting providers, AlignCloud can help providers train sales staff, draft sales plans and fully engage with Web marketing and SEO. With its focus on the cloud and web hosting market, AlignCloud is a natural referral partner for Host Merchant Services.

HMS CEO Lou Honick has aptly summarized the buzz surrounding this collaboration. “Our expertise in e-commerce, payment cost optimization, and security meshes perfectly with AlignCloud to create compelling offerings,” Honick said of the AlignCloud partnership. AlignCloud clients can now seamlessly access secure, reliable merchant services, PCI compliance solutions, and e-commerce.

In the business world, demand for cloud services has reached an all time high. As mobile devices become more important for business, public worries about information security keep pace. Cloud Hosting is a type of hosting platform that allows customers powerful, scalable and reliable hosting based on clustered load-balanced servers and utility billing. Web hosting services allow individuals and organizations to make their website accessible via the World Wide Web.

For AlignCloud’s customers, HMS has designed services to insure absolute peace of mind. According to AlignCloud CEO Stacy Griggs, the program will provide clients with “lower rates and better service for credit card processing, mobile payments and merchant services.” The experts at HMS combine technical knowledge with uniquely dynamic customer service. Through expertise in data security and fraud reduction, Host Merchant Services promotes more confident commerce, both for businesses and customers alike.

A cloud hosted website can be more reliable than alternatives since other computers in the cloud can compensate when a single piece of hardware goes down. Also, local power disruptions or even natural disasters are less problematic for cloud hosted sites, as cloud hosting is decentralized. Cloud hosting also allows providers to charge users only for resources consumed by the user, rather than a flat fee for the amount the user expects they will use, or a fixed cost upfront hardware investment.

For Host Merchant Services, the partnership with AlignCloud is part of their successful strategy to partner with the web hosting and cloud services industry. Companies like AlignCloud can better serve clients by integrating credit card processing into their offerings. Through Host Merchant Services, AlignCloud customers will experience hassle-free credit card processing with 24x7x365 hour technical support and responsive website.

Clients of AlignCloud can also earn extra revenue by referring their customers to the program.

About PCI Compliance Fees

Many businesses that accept credit cards wonder what the PCI compliance fee is and why they have to pay it. It all starts with the information that a retailer gains when a customer purchases a product or service using their credit or debit card to pay for the transaction. The thin black strip on the back of the cards holds sensitive information that can be used to defraud the card holder if a criminal gets hold of that information. A merchant must take steps to ensure that all personal information collected from a customer is kept safe and away from those who intend to do harm to others.

There have been some notable breaches of data over the past few years like what happened at TJX companies – the parent company of the T.J. Maxx and Marshall department stores. Over a 16 month period, thieves hacked into TJX’s computer system and stole information from over 45 million cards. This caused serious problems for the company and their customers that ended up costing a lot of time, money and effort addressing the damage caused by the breach.

Employees of businesses have also been known to steal this type of information. All they need is to gain access to credit and debit card receipts so they can purchase items using someone else’s card number. These types of incidents have increased with the proliferation of these cards. The major credit card companies like Visa, MasterCard, American Express and others developed guidelines that a business must follow to protect customer information. Failure to abide by these guidelines can result in the credit card companies deciding to discontinue doing business with a non-compliant company.

Many business owners know they should keep information safe, but many also have no idea why they are also being charged a PCI compliance fee.

These fees are charged for basically three reasons: education, non-compliance, and insurance.

Many credit card processing companies spend time working with business owners to make sure they understand what is required and how to meet those requirements. Some will add a fee to cover the cost of this educational component.

Businesses that do not show they are in compliance are also susceptible to being charged fees. This is generally done to remind the owners that they should take the time to fulfill the requirements. This portion of a fee could disappear once they have certified with the processors that they have taken appropriate action to protect their customer’s information.

A third component of some fees is insurance to help cover any breaches. The TJX breach ended up costing well over a quarter of a billion dollars. This is a cost many businesses cannot afford to absorb and still survive. The insurance will not cover breaches where the company was involved in the criminal activity.

The fees can be charged either monthly or annually. The fees range from five to 15 dollars per month to over 99 dollars per year.

PCI Guidelines for Mobile Apps

Today the Official Merchant Services Blog will examine the PCI Security Standards Council’s most recent guidelines, and their slow crawl towards comprehensive security requirements for mobile devices.

On Thursday, the PCI Security Standards Council released a set of best practices geared toward software developers of mobile devices.  These guidelines come four months after they released some guidance about mobile payments for small businesses.

The PCI Council, based in Wakefield Massachusetts administers the Payment Card Industry data-security standard and affiliated standards for secure payments software and also PIN-based transaction devices. The guidelines were released during the Council’s annual North American meeting in Orlando, Florida on Thursday, after hinting at a possible PCI clarification in early September.  Present at the gathering were security assessors, merchants, processors and vendors, all preparing for the update of the main PCI standard next year.

The Council announced that it is starting to approve hardware for mobile payments such as card readers that plug into smart phones or tablet computers.  The Council has not delved into the approval of software for mobile payments and have they made it clear when that will happen. They have however, announced that more guidance for merchants will come next year and that they will continue to take input from the payments industry on the serious task of protecting card holder data when payments originate from mobile devices.

Correcting software vulnerabilities is the most important aim of the Council’s new guidelines, as app developers crank out new programs for processing payments on smart phones and tablets everyday.  The guidance covers everything from the payment transaction, access protection, and remote disablement of a missing device.

The last point is arguably the most important aspect of a new mobile PCI security system.  Since mobile payments are true to their name, mobile, the chance of someone running away with your credit card terminal is an increasingly possible risk.  The same applies for any tablets acting as POS systems in a store. An unlucky shopkeeper may open up in the morning only to find part of his or her POS system missing, and all cardholder data inside compromised. This is what the PCI Security Standards Council seeks to avoid.

The Future of PCI and Data Security

Today The Official Merchant Services Blog marks the triumphant return to the timely topic of PCI DSS and cardholder data security. This tantalizing topic has been touted time and again in the peerless pages of our payment processing chronicles.

Days of Future Past

The crafty criminals that defraud, hack and swipe courageous consumers for their cardholder data are a constant concern for the entire credit card processing and data security sector. The industry has to be ever vigilant in its commitment to curb the high tech criminal activities and keep that cardholder data safe.

Retailers need to be eagle-eyed when it comes to defending data and securing customer information. They also need to be prepared for disaster, with a protocol-based plan of action for the worst case scenario — the dreaded data breach. But none of these advance preparations will save a merchant from data breach dangers if the merchant is unaware of PCI DSS, what it all means and what the requirements for PCI Compliance are.

The misdirection and misinformation out there about the process of PCI Compliance has led to complacency among many merchants. Face front true believers, we’ve even expressed the fantastic facts and figures to support merchant apathy regarding PCI Compliance in previous published purveyances of PCI related blogs.

The media gloms onto the gargantuan headlines of something as garish as a Global Payments data breach and the searing spotlight of data security dazzles the masses with the terrifying tidbits of these capricious crimes. But the nature of the crime has the danger spreading to small business merchants more and more frequently in the past few years. In fact, this article from Convenience Store Decisions, it is suggested that the heinous hackers and nefarious fraudsters are backing away from the big fish and targeting the smaller retailers with easier to breach defenses.

The CS Decisions scribe John Lofsock posits that one of the prime reasons for this shift can be pinpointed to an alteration in the criminals’ own dastardly demographics. Today’s hacker is becoming less the angst ridden, misunderstood teenager with whiz-bang keyboard and coding powers and turning into a far more treacherous group of villains. As the article puts it, “When hackers run up against businesses with sophisticated information technology and up-to-date security, they’ll turn to easier systems, including those of small non-profit agencies and family businesses.”

Datapocalypse Now

So what does a merchant do? The hale and hoary Host Merchant Services PCI Compliance pioneers readily suggest utilizing their very own PCI Compliance Initiative.  PCI Compliance is a fantastic foundation for top notch transaction security. The superlative standards and powerful protocols set up by the powers that be on the PCI-DSS Council are a forceful first step any enterprising merchant needs to take to protect their data. This is why helpful Host Merchant Services offers a power-packed PCI Compliance Initiative that gets merchants quickly and seamlessly up to speed.

Add to that amazing Initiative the second step that Merchants can take to shore up their security: Host Merchant Services Data Breach Security Program. Click that link to download a PDF explaining the value-added service HMS provides its merchants that goes above and beyond just simple PCI Compliance and helps ensure a merchant’s peace of mind. This program offers data breach insurance.

The article from CS Decisions quotes Trinette Huber, of Sinclair Oil Corp. in Salt Lake City as saying “as a merchant, I can go through all the steps to do this and do it in good faith, and yet if I have a breach — which is entirely possible — the PCI council will say I wasn’t literally compliant.”

This is where breach insurance comes into play true believers. The Data Breach Insurance that cutting edge and customer-oriented companies like Host Merchant Services offers can curb the pernicious penalties that merchants face when a breach occurs. As we’ve stated time and again here on The Official Merchant Services Blog, security only begins with PCI Compliance. It’s a never-ending battle for safety, justice and the power of payment processing. Merchant Services providers need to work in conjunction with merchants to stay out in front of any and all security issues. And even then, disaster can occur, so a solid data security plan will have backup protocols like data breach insurance.

The CS Decisions article also quotes Huber as saying that PCI “is asking thousands of merchants to do something (the credit card companies) should be doing themselves. They should be fixing the magnetic stripe (in credit/debit cards) so it’s not something that can be easily stolen, instead of asking merchants to fix (the security issues) for them.” 

That concern right there is why Visa has been pushing so hard for its EMV chip program with newer, more secure smartcards that have worked so well in Canada and Europe. Huber is noted in the article for describing the overbearing cost that the switch to EMV could entail for small business owners, as well as the fact that the EMV chips have been in place for decades and have already had data compromised before.

So if not EMV, Then What?

Will no canny crusader for competent credit card processing and dependable data transfer step up to take the challenge presented by the PCI DSS? John Lofsock, the audacious author of the article we’ve been analyzing, thinks that Point to Point Encryption (P2PE) might be the champion the industry needs. This tantalizing technology that is newer than EMV chips apparently ensures that credit card data is protected from the moment it is swiped all the way through to the nanosecond it arrives with the payment processor. This could curry favor with retailers because it completely eliminates the need for the retailer to secure cardholder data, as the retailer never has possession of said data.

The real boon, as noted by Lofsock, is that the P2PE method will make it much cheaper for merchants to be PCI Compliant by removing the need for merchants to deal with network segmentation and other costly and time-consuming parts of the compliance process like the audit.

It is noted that PCATS and PCI are preparing future standards that deal with P2PE so it is on their radar.

In the meantime, Host Merchant Services continues to offer the lowest PCI Compliance rates in the industry, as well as a vigorous PCI Compliance Initiative that seeks to inform and educate everyone interested as to the details of the process, step-by-step.

Industry Terms: Payment Gateway

This is the latest installment in The Official Merchant Services Blog’s Knowledge Base effort. We want to make the payment processing industry’s terms and buzzwords clear. We will eliminate any and all confusion merchants might have about how the industry works. At Host Merchant Services, we promise to deliver personal service and clarity. So we’re going to take some time to explain how everything works. This ongoing series is where we define industry related terms and slowly build up a knowledge base and as we get more and more of these completed, we’ll collect them in the resource archive for quick and easy access.

Payment Gateway

Today we will focus on Payment Gateways and how they work, in order to wrap up our week of E-commerce driven content. A payment gateway allows E-commerce merchants to accept credit cards on their websites. Sensitive payment information is encrypted by the gateway to ensure that it passes securely between the customer and the merchant. We have defined a POS, or point of sale system already for the Knowledge Base. A payment gateway can be considered a virtual point of sale system. The gateway acts as a “middle man,” allowing communication between online shopping carts or virtual terminals and the banks processing the transaction.

The process can be broken down like this, it starts when a customer places an order on a website by pressing the “Submit Order” button in an online shopping cart. The payment gateway then forwards the transaction information to the payment processor used by the merchant’s acquiring bank. From there the payment processor forwards that information to the appropriate card association (ex Visa, MasterCard). The credit card issuing bank receives the request, or the Authorization and does the necessary credit or debit check and then sends a response back to the processor in the form of an approval code (ex approved, denied). Next the processor forwards the authorization response back to the payment gateway. After receiving the response, the gateway forwards it on to the website, which then evaluates it as a relevant response and relays the outcome to the merchant and cardholder. Finally, the merchant then fulfills the customers order, then after a batch the acquiring bank receives the funds, and deposits them into the merchants bank account.

Payment gateways can be stand-alone systems designed for integration with other 3rd party systems, or they can be bundled with their own shopping carts and virtual terminals. It’s worth noting that most merchants will not need to install additional software on their own servers to run a basic payment gateway. Some payment gateway providers are simple to implement, but do not offer much customization. Others are more complex but can be customized to your needs.

Host Merchant Services offers a variety of E-commerce solutions to fit your business, including Transaction Central, our own cutting edge in house payment gateway. HMS is able to interface with most of the major Payment Gateways out there, including Authorize.net. We also offer unparalleled protection for all of our merchants in the form of our PCI Compliance Initiative.