When you accept credit and debit cards from your customers, you are entering into a sacred trust. Your customer is expecting that your company and the various systems that you use will ensure that the personal information they have provided will not be intercepted and used by criminals for their own malicious purposes. At the same time, you too must ensure that these processes remain as airtight as possible. After all, your business’s good name is involved. In order to give your buyers peace of mind and protect your own reputation, it is crucial that you do all you can to make your payment processing secure. Taking the following steps can bring you a long way down the road to achieving this goal.
Particularly since the turn of the century, data breaches have become an increasingly serious problem for businesses of all sizes. In order to address this escalating situation, members of the credit card industry, including Visa, Mastercard, American Express, Discover, and JCB, formed the Payment Card Industry Security Standards Council in 2006. After careful deliberation, this body came up with a unified set of data security protocols known as the Payment Card Industry Data Security Standards (PCI DSS) more commonly known as PCI compliance. Since that time, any and all businesses that manage, transmit, store, or otherwise handle sensitive customer data must comply with this complex set of requirements. In general, PCI compliance involves the following stipulations:
If your company does not directly come into contact with customer data on your servers, you are only required to adhere to 22 PCI compliance security controls. In cases such as this, you are wise to allow a PCI-compliant third party to do the hands-on payment acceptance and also carry the responsibility for meeting the full range of rigorous PCI standards.
The Secure Sockets Layer (SSL) protocol is technology that establishes a secure link between a server and a client, usually a website and a browser, or an email server and a client that uses encryption to hide sensitive information from view. In order for your customer’s browser to be able to communicate in a secure way with your website, you must have an SSL certificate. If you do, the following process can occur:
It should be noted that the SSL protocol has been used for many years to safeguard and encrypt transmitted data. However, the most recent versions of this protocol have been renamed TSL, with the latest update being TSLv1.2.
In simple terms, tokenization involves using one thing to represent something else. In the world of data security, it means providing a digital representation of any sensitive customer data that you may have in your possession before it is sent for processing. You should never store unsecured customer data on your servers, as doing so leaves you highly vulnerable to costly data breaches. Tokenization enables all sensitive information to be encrypted before it even gets to your server, thus relieving you of any liability that you would incur otherwise. The process works like this:
Three-domain structure (3D Secure) is a payer authentication security protocol that can help you to further protect your customers’ online credit and debit card transactions from fraud. Created by the Visa and Mastercard brands, this is a multi-step process that involves the issuer, the acquirer and the interoperability domain or payment system. The 3D Secure process works as follows:
When you employ 3D Secure, you can expect that you will decrease the likelihood of fraud. Furthermore, your customers will feel safer doing business on your website and may be more loyal to your brand for the long haul. In the end, this should result in increased sales for your online business.
To further deter criminals, require that your customers always log in using unique usernames and passwords. Using a CAPTCHA code verifier field also requires that users input information about an image or task to prove that they are not automated bots. This step helps to shield your site from SQL injections or other types of hacks.
Only request what is absolutely necessary for a transaction to be processed from your buyers. Sensitive data such as dates of birth and Social Security numbers are particularly tempting to criminals looking to exploit any vulnerabilities in your website. In the end, it is best for your customers to keep such information to themselves.
Just because your systems and processes were compliant and secure last year does not mean they still are. It is your ongoing responsibility to ensure that your entire payments landscape is as safe and protected as possible. To that end, frequently check for software and firmware upgrades. In addition, regularly assess your site to ensure that:
It is recommended that you perform an informal audit of your website and payment pages at least once per week to ensure that all is well.
Keeping your payment processing secure is a job that everyone in your organization must take responsibility for performing. All personnel should receive comprehensive training concerning your expectations for how to handle email, store data, use tablets and other mobile devices, handle customer returns, and so forth. Provide cashiers with the tools they need to spot red flags and be sure to contact authorities should a suspected incident occur. In the end, the more transparent you are about situations that may arise, the better it will be for your reputation. You may even avoid being charged substantial penalties.
Keeping your networks and protocols locked down against intruders is one of the most important investments you can make in your business and your customers. Although incorporating these processes and protocols may seem overwhelming at the outset, they will move your company miles ahead in terms of compliance with industry standards and will help to create happy customers who should return to your physical store or website again and again.