About accepting credit cards for businesses

Big Losers To Fraud are the Credit Card Accepting Businesses

Did you know thieves can steal credit card information without even touching or seeing your credit card? NFC or Near Field Communication has made paying for credit card purchases much easier and faster but at a cost. The even have an app for that. The free app, available on the Samsung Galaxy S3 through the Google Play store, allows the phone to read the RFID chip on a credit card, picking up the cardholder’s name, credit card number and expiry date. Although it is a real pain for the card holder to get his card back in good standing and clean up the mess they generally don’t have to pay the bill. You can stop this by putting your credit card into a special foil pouch or wrapping it in aluminum foil.

Theoretically merchancredit cardxts shouldn’t have to pay either but more times than not it is the unsuspecting merchant who pays the toll. Taking credit card numbers over the phone is risky business and never, never accept a credit card number by email way too risky and insecure. If a customer emails credit card information to you and it is intercepted you the merchant are responsible. If you must take credit card information over the phone have it entered immediately into the terminal and do not retain any of the information.

There are a set of rules for everyone who accepts credit cards called PCI/DSS standards or Payment Card Industry Data Security Standards. They are setup by the PCI standards council in the U.S. and apply to all businesses that accept credit cards anywhere in the world. Penalties for being non compliant start at $10,000 a month and Visa can and does do spot inspections on businesses to verify their compliance.

All of the processors have and do inform their customers of their need to be compliant either through a blurb on their web site or a notice in statements. Some Processors have made arrangements with security companies to assist their customers in becoming compliant which involves filling in a SAQ or “Self Assessment Questionnaire” and doing quarterly scans of your online network if your transactions are over the Internet and not a phone line. The costs for this varies to the extreme from $6 a month to thousands if you are not compliant.  One Processor includes  $100,000 in breach insurance once you are compliant in their $6 a month fee and charges $20 a month if you are not compliant mainly as an incentive to get compliant. At the  other extreme another Processor charges 4 monthly flat fees ranging, depending upon volume from $6 to $50 plus, 2 each for “PCI Admin” and “PCI Non Compliance” plus a per transaction fee for each and a percentage of sales for each. One of our clients was charged over $10,000 in these fees in 3 months last year (they became a client after finding the fees).

Some suggestions for businesses:

  1. Never accept credit card information by email
  2. If you must take credit card information by phone destroy the information immediately and properly
  3. Don’t store credit card information in files or keep hard copies.
  4. If you do a lot of your business by phone set up a “Virtual Terminal” with your Processor and recurring payments for regular customers.
  5. Make sure you and your staff follow common sense rules when accepting credit card information. Do not allow customer to make changes to sales information when entering their pin and make sure you know who you are doing business with when doing “card not present” transactions.
  6. Get PCI compliant make sure your customers credit card information is secure.
  7. If you have “tap n go” credit cards make sure they are shielded in a special aluminum pouch or simply aluminum foil.

Good New For Charities

Visa and MasterCard agreed to big Interchange reductions for registered Charities effective in May of 2015. Interchange is the fee that the Acquirer/Processors pay to the card issuing banks (their first cost).

Visa has put charities into the “Emerging Segments” classification. This means the Interchange rates for electronically processed payments are now .098% for Classic, Gold and Platinum Visa Cards, 1.17% for Infinite Visa cards and 1.95% for Infinite Privilege Visa cards. This compares to 1.42%, 1.61% and 2.08% for most merchants.

MasterCard has made a new classification for charities and their rates are 1.00% for Core MasterCards, 1.25% for World MasterCards and 1.50% for World Elite MasterCards. This compares to 1.49%, 1.77% and 1.96% for most merchants.

Charities should contact their processor to ensure that they are given the full benefit of these reductions. As always the best way to do this is with a “Cost Plus” program however this is not always possible but charities should be receiving a better discount rate than most businesses.

Beware of the Cold Call

Most businesses receive at least 2 or 3 calls from call centres every week offering to save them money on one thing or another. Many of these come from companies offering to save money on credit card processing. I tell my clients to direct them to me, generally after a few minutes on the phangry1one they call for a supervisor or hand up on me. Below is a recent experience I had with a call directed to me:

  • The Premise they want to make sure you got the fee reductions due to you because of the recent reduction of 40% to 50% in fees.
  • My Answer “fees” were not reduced Interchange rates were reduced an average of 10%; Interchange being the Processors cost
  • We Can Save You Lots! This person was extremely aggressive and would not back down insisting that I agree to let them check my statement for analysis.
  • My Answer I agreed wanting to see just what they would come up with. Note I had informed this person that I was a consultant and understood the system
  • A Response By Phone This call was from another person in the statement audit department with good news for me. Based on the statement I sent to them I would save $171 a month on a $313 bill!!!
  • My Answer I asked for the fees and rates and I know by what he told me there was no possible way we would be receiving those savings (the savings he quoted would put him well below his cost). Please send me those figures in writing
  • What I Received I received an application by email only partially completed without all of the fees filled in and provisions for a leased terminal with no lease documents.
  • My Answer I asked about cancelling by current contract he said he would help. I asked about cancellation fees he said it would be $250 and he would pay $150 of that after 3 months of processing. Note unfortunately this customer is with a particularly nasty ISO with a large cancellation fee much more than $250.

Finally I let the cat out of the bag and told him that there was no way he could save me as much money as he quoted. The Interchange fees alone were more than what he said our net bill (including equipment) would be and the rates he quoted were all more than the Interchange rates so the math just didn’t work. To my surprise (I am hard to surprise) he continued to argue comparing his “effective rate” to our current “effective rate. Note I have no way of knowing what the final cost would be as the application  was not complete. Finally I had to hang up on him he just would not give up and believe it or not he called me again a month later to see if I had reconsidered.

It should be noted that the average business owner could not possibly have been able to determine what the savings would actually be until they got their first statement. This company was smart enough to quote a different rate structure (tiered compared to Interchange Differential) to make it very difficult to compare for most. Most business owners would also not know how to read the contract let alone know what was missing.

My original plan was to turn this nefarious character in to the proper authorities to get his proper comeuppance. However after some long thought I realized that the best result I could expect was to see this individual take the blame for his company and life would proceed as usual for them with someone else slipped into his slot. Too much work for me with too little reward, the best I can do is to keep informing the public so they are aware.