March 10th, 2015 by Elma Jane

If you can’t accept credit cards for your business, you are losing out on potential revenue. Most people don’t carry more than $20 in cash with them at a time, and people who use credit cards tend to spend more than their cash-carrying counterparts.

These days you can turn your smartphone or tablet into a credit card reader, but which service should you choose? What do you need to consider when deciding?

NTC is here to help you understand all the intricacies of taking credit card payments with your smartphone or credit card.

Credit card reader or Wedge are useful in a variety of industries and for businesses of all sizes. Arts and crafts business accepting credit card payments at conventions and other events. A pub that gives its servers credit card readers rather than having to pay for everything at the bar. POS systems with a mobile integration can swipe your card on the spot rather than taking credit cards over the phone when ordering delivery.

If you work in one of these fields it might be time to think about getting a wedge:

Arts and crafts vendors: Do you sell your wares at conventions, art shows, and other big events? You could be a book reseller, an artist, a jewelry maker, a clothing retailer, or even a makeup seller.

Food Service: Food trucks were among the earliest adopters of mobile card readers, but there is no shortage of restaurants that are using them now. There are companies both offer POS systems in addition to their mobile card readers, which is perfect for delivery services.

Service providers: If you don’t have a brick-and-mortar office or base of operation where customers visit you, or if you conduct your business in your customers’ homes (carpet cleaners, plumbers, lawn care, mobile dog groomers, exterminators, etc.), a credit card reader/wedge gives you flexibility as well as credibility, as well as added security.

 

Understanding the Costs of Accepting Credit Card Payments

In the traditional business model, to accept credit card payments you would have to set up a merchant account. A merchant account typically entails a detailed look at your credit history and business.

Credit card companies assess a small fee to merchants for processing payments. With merchant accounts and card readers, the cost is built in and deducted automatically, so you don’t have to worry about paying it yourself. With a merchant account, you typically get lower rates because of the decreased risk.

It’s not just the standard fees that you need to worry about when you want to accept credit card payments. There are costs hidden everywhere, so let’s address some of these issues:

Internet Availability                                                                                                                            Typically, smartphone and tablet card readers need some sort of Internet connectivity, via a cellular signal or Wi-Fi. Most smartphones these days are capable of becoming Wi-Fi hotspots, so you can create your own Wi-Fi. However, this option relies on your phone’s data plan. The more transactions you make, the more data you use.

Compatibility                                                                                                                                    You also need to make sure that your devices are compatible with the card reader. Check the list of compatible devices before you commit to one service over another.

Also note that you’re going to usually have to enable location services on your phone.

Card Compatibility, Manual Entry Fees, Location                                                                           There are card readers that seems to work best with a specific device. You’re typically going to pay more    for manually entering credit card numbers because of the greater risk – the card doesn’t have to physically    be present to complete the transaction.

Likewise, you’re usually going to pay more for accepting international cards, and you’re not always going to be able to accept payments outside the U.S.

Taxes and Tips                                                                                                                               Several mobile credit card readers will let you add sales tax to the base purchase without requiring you to calculate it, which is handy if you’re not fond of math or just want the transaction to go more quickly.

As an alternative, you can build the sales tax into the listed prices, which some of your customers might appreciate.

Finally, depending on your industry, you may want to check that the credit card reader you use allows your customers to add a tip.

Time to Get Your Money                                                                                                                   The final cost to consider for credit card readers is more of a convenience fee than anything — it’s the time before you can access your money.

If you’re in a high-risk industry or have a high volume of business, you are probably better off obtaining a merchant account and using one of their mobile solutions.

You’re also going to want to worry about refunds and chargebacks. If, for whatever reason, a consumer complains to his or her credit card company and there’s a chargeback.

 

Features to look For in Your Credit Card Reader                                                                      Features-wise, you can at least expect the basics to remain consistent across smartphone credit card readers: you can swipe cards, manually key them in, and issue receipts. It’s the little things that will ultimately set one service provider apart from the rest. Some of the things you may want to look out for include:

Record-Keeping for Cash and Checks                                                                                             Sure, you can manage your cash intake the old fashioned way and let your bank deal with checks. But some credit card readers, (which doesn’t actually require you to swipe cards, but more on that later) will let you create digital receipts for cash and check transactions as well.

POS Integration                                                                                                                              Depending on your needs, you might want to look for a service that has easy POS integration.

E-Commerce Integration                                                                                                                Likewise, look for easy integration with an online store, if you have one. Easy integration is ideal for centralizing your accounts.

 

Accounting Integration & More                                                                                                           Do you use an accounting service? If so, you might prefer the ability to transfer your data directly from your card swiping service to your accounting software. 

Invoicing                                                                                                                                              If you do custom orders, offer services, or provide goods to a business, you’re all too familiar with invoices. With some services, you can generate invoices through them and send them to clients via email. The biggest advantage to this is simply that you get your money quicker because there’s no need to cut a check and send it through snail mail.

Voids and Refunds                                                                                                                                It’s unfortunate, but you do need to make accommodations to process refunds and void transactions. Sometimes your finger slips on a key and you don’t notice until afterward, and sometimes the customer just changes their mind. Make sure that you understand how to use these features in whichever service you choose.

Card Reader Design                                                                                                                      Needless to say there is more than a bit of awkwardness trying to balance a phone with a 5.1-inch screen in your hand while also stabilizing the card reader while swiping the card. Especially when you’re working with limited table space. It’s worth looking at the card reader and the device it’s attached to and making sure that the design works for you.

Permissions for Multiple Users                                                                                                          Do you have several employees? The ability to give permissions to multiple users comes in handy here. With it, you can enable employees (or your friends) to accept payments without giving them full access to your account. This is great if you happen to have multiple booths at events, or if you send multiple employees out on location and each one needs to be able to accept payments.

Accepting credit card payments doesn’t have to be a terrifying prospect, even if you’re running just a small-time business. You can get a mobile credit card reader for free in many cases, and while you won’t pay the lower fees associated with traditional merchant accounts, the costs are still readily manageable. What you need to consider are the hidden costs — not necessarily in the service providers, but the ones that come from using a data connection, or requiring Wi-Fi. How soon you get your money should also be a top priority.

 

 

Posted in Best Practices for Merchants, Credit Card Reader Terminal, Mobile Payments, Mobile Point of Sale, Smartphone, smartSD Cards Tagged with: , , , , , , , , , , , , , ,

January 26th, 2015 by Elma Jane

Accept Electronic Payments in Their Currency,

Convert it to Yours

DCC or Dynamic Currency Conversion is a system where the Visa or MasterCard holder in a foreign country can shop on an American based web site that displays prices in their own local currency. The web site can offer multiple choices as to which country the shopper is based in and the shopper can be immediately familiar with the pricing of goods and services.

Exchange rates are in constant flux. Dynamic Currency Conversion utilizes a Bank Reference Table (BRT) otherwise known as a Card Recognition Table (CRT). This table is updated on a daily basis so that transactions have the most up to date conversion rate for transactions. Your web site holds pricing information in $USD, and based on the selection of the shopper, prices are converted to their native currency. Even if the shopper does not choose the correct currency, at the time the card information is presented, the system automatically recognizes that the card is foreign and applies the appropriate currency and exchange rate.

At the close of the transaction an invoice or receipt can present the total to the customer in their currency, along with the merchants local currency along with the exchange rate that was applied. In today’s global business environment, this level of convenience to the customer insures they are comfortable with the transaction from shopping cart to the door. Your business reaches foreign nations expanding your market while presenting new opportunities, increasing your businesses bottom line.

On the merchant end, all transactions are settled in $USD. Reporting mechanisms can display the consumers pricing and the exchange rate they paid for analysis and cost reduction.

Currency Conversion

  • Accept currencies from other nations.
  • Convert funds to US Dollars.
  • Set prices in local currency to avoid confusion or calculation.
  • Works with e-commerce as well as Mail Order / Phone Order.
  • Ease the sales process for your customers.
  • Increase customer familiarity.
  • Immediately convert currency to avoid value gaps.

Posted in Best Practices for Merchants, Electronic Payments Tagged with: , , , , , , , , , , , , , , , ,

January 15th, 2015 by Elma Jane

The fact that your business needs a mobile presence is by no means news. Brands today know that being accessible to the increasing number of smartphones and tablet users is a must NOW, the goal is to provide a top-notch user experience.

Mobile is opening the door for designing new experiences that complement a brand’s physical presence. The context of WHEN, WHERE and WHAT a customer is doing during their day allows companies to enhance a person’s interaction and customize device-specific experiences.

Brands will need to meet the following mobile experience expectations in 2015:

Combating fraud through mobile. Mobile users want to safeguard themselves against fraud, and 56 percent are willing to deal with a slightly more complex user experience if it means greater protection. Businesses can provide an intuitive, high-quality mobile experience that also protects against fraud by offering to validate transactions, set fraud controls and generate unique payment IDs through the user’s mobile device.

Complement, not copy: E-commerce providers must leverage mobile to complement the user experience, rather than provide a replica of what users get through a Web browser. Nearly 4 in 10 mobile users are most likely to use their mobile phone for shopping, so businesses need to ensure that those customers are getting something unique from their mobile interaction.

CRM through mobile marketing: Mobile marketing isn’t just for acquisition anymore. Today, it’s about boosting loyalty by using mobile for customer, consumers always have their mobile device on them and check it more than 150 times a day. Businesses can communicate with their existing customers through alert notifications, in-app, email and mobile Web. But don’t overdo it. The key to maintaining an effective relationship is doing so in a complementary way, giving users what they need when they need it.

Mobile apps and mobile Web: Got a mobile app but not a mobile-friendly website, or vice versa? You might want to put your energy into leveling out your mobile presence. Consumers are about equally split when it comes to their preference of app versus browser: The percentage of users who prefer their mobile browser when completing a task 28 percent is only slightly higher than the 23 percent that prefer to use an app. Both app and Web designs are critical for businesses in the mobile space, so it pays to do them right.

Posted in Best Practices for Merchants, Mobile Payments, Mobile Point of Sale, Smartphone Tagged with: , , , , , , , , ,

January 12th, 2015 by Elma Jane

Mobile Point of Sale (POS) systems have rocked the retail world and the trending topic when it comes to POS is all about the mobile kind. When one searches the term POS, nearly every article that comes up is all about mobile, and many seem to believe it will change the retail industry.

Is traditional POS on its way out? Not so fast.

While mobile POS is indeed a hot topic, it is likely to be an enhancement, rather than a replacement, to traditional POS

There is definitely a need and a place, for both.

Everyone was certain that dot.coms would eradicate brick-and-mortar stores; they are still alive and well, and traditional brick-and-mortar stores have, like traditional POS, embraced the Internet and allowed it to serve them in the capacity of extension.

Retailers everywhere have incorporated the Internet into their business model by creating multi-channel sales strategies, such as e-commerce, digital marketing, social media marketing, online product information, specifications, reviews and online customer service.

In addition to their online presence, these same retailers have started to bring the Internet in-house by integrating such services as customer centric promotions at point of sale, introducing loyalty programs and member registration, facilitating digital signage, offering e-receipts via email, and self check out centers; all at the traditional POS kiosk.

Why bother with mobile POS anyway?

While it is true that traditional POS systems won’t be going anywhere soon, and with good reason, mobile POS systems have allowed retailers to make great strides when it comes to efficiency and customer service, as well as customer satisfaction.

Since the advent of Mobile POS, companies have made big changes in the way they handle customer transactions in-store, thus affording faster checkout, waiting line reduction, consultative selling, and more.

The list of mobile POS benefits goes on and on:

Email Receipts: Better for the environment, more convenient for customers and faster to process. A digital purchase receipts sent via email tells the customer that you care about the earth and about them.

Expanded Reach: With mobile POS, your sales are no longer confined within the four walls of your brick and mortar store. Sidewalk sales, seasonal mall kiosks, and special sponsorship events are just a few examples of all the places you can take your retail sales to, with a POS in hand.

Inventory and Price Search: When customers can be assisted with finding an item color, size or availability on the spot, rather than having to wait in line to do so, it makes them happier. The same can be said for pricing. POS in the hands of store reps can go a long way toward customer satisfaction.

Inventory Return Stations: There is always a certain volume of returns, but that volume increases for retailers particularly after the holidays. The implementation of mobile POS allows for retailers to set up additional return stations in order to avoid long lines and customer frustrations.

Mobile POS goes Mobile: Your investment in your company POS system doesn’t need to be one size fits all, regardless of store traffic volume in one location or another. Retailers may opt to have a blow out sale in one location, thus require additional checkout power for that location for a specific period of time. With mobile POS, devises and licensing can be utilized throughout different store locations on an as needed basis.

Optional Seasonal Subscription: The great thing about mobile POS is that you needn’t pay for a POS system year round if you’re not using it year around. Seasonal spikes in retail sales warrant the additional cost of extra POS licensing and hardware, but the rest of the year your budget shouldn’t need to encompass more than what is needed. Mobile lets you better manage your overall POS investment.

Storewide Promotion Opportunities: Mobile POS has allowed retailers to drive sales in various sections of the store by holding demonstrations or promotions in different departments to tout products or services. Customers can be marketed, and sold to, on the spot.

The growing industry of mobile payments doesn’t stop at in-store mobile POS. Digital wallets like Google Wallet and Apple Passbook, mobile-to-mobile cell phone transfers, Near Field Communication (NFC) payments, mobile device credit card swipe and other emerging technologies are quickly changing our cash and credit card world.

What about traditional POS?

Mobile payment systems are indeed terrific. So, when should you consider going with traditional POS? The reality is, in addition to the aforementioned benefits of traditional checkout kiosk functions, there times when mobile POS simply will not suffice.

Mobile POS is great when a customer wants to choose and pay for one item while on the sales room floor, but what about when the customer has a multitude of items? Ringing up and bagging groceries, removing anti-theft mechanisms, neatly folding and bagging clothing items and managing the sales of numerous agents, stations or departments are just a few examples of situations that often require the traditional POS checkout station.

By combining traditional POS strategies with mobile POS flexibility, retailers can leverage the command of a complex, and multi-dimensional, marketing and retail sales management system.

Posted in Best Practices for Merchants, Mobile Payments, Mobile Point of Sale, Point of Sale Tagged with: , , , , , , , , , , , , , , ,

September 29th, 2014 by Elma Jane

If  your retail business products sells only in-store, then you’re falling behind. Consumers in the digital age expect options when they shop, and if you’re not offering those choices, your customers may pass you by for a more tech-savvy competitor. Consumers go into stores, evaluate products and buy online, or research online and go into the store for purchase. The two worlds have merged, if you’re not covering both spectrums, you’re missing out.

Recent research by UPS showing 40 percent of today’s shoppers use a combination of online and in-store interactions to complete their purchases. The days of physical stores being separated from online shopping are over. They’re no longer channels that are happening on their own. The UPS survey found that a large chunk of online shoppers cross channels during their shopping path. Be present on both channels and take advantage of that.

It’s not always possible or economic for an online-only retailer to open up a physical storefront, but existing brick-and-mortar stores or wholesalers can easily introduce an e-commerce component to their sales to expand their customer reach. Online sales help reach consumers that may not otherwise be able to purchase your products. Even if your company’s main focus is creating a personalized in-store experience, there are still ways to capture the online shopper market. In addition to giving consumers a way to research your products before coming in-store to purchase your offerings, you can offer people a way to conveniently buy items they already know they want.

For all the advantages a multi-channel sales strategy can give a retailer, there are still some challenges to this approach. Managing inventory versus cash flow and ensuring even demand on both channels have been company’s two greatest challenges in balancing in-store and online sales. Creating demand is how companies set themselves apart from competition. The secret sauce. The challenge is making sure that retail operations have a turnover ratio that works for the shipping schedules from the main warehouse. This isn’t a problem for e-commerce businesses, because product can be packaged and shipped as fast as it gets produced. But an omnichannel company has to take retail and e-commerce into account when stocking a warehouse.

There are a few different strategies retailers can use to help keep their sales operations well-balanced. Offering different items online versus in-store, to avoid inventory competition (i.e., selling seasonal or discontinued items online and current items in-store). Requiring a minimum order for online purchases or grouping products together rather than selling them individually to make e-commerce more worth your while.

The best way to balance a multi-channel sales strategy is to take a unified view of consumers online and offline by connecting their on- and offline behaviors via technology. Some of the retailers questions have is how to connect a person offline with what they buy online, how to recognize who they are in the store and know what they look at on your website, because people are switching back and forth. Link behaviors online with a unique ID through email or a mobile app, since 66% of customers use smartphones in-store.

Even if your business can’t actually sell and ship products via e-commerce,it’s still important to be in tune and up-to-date with the way customers want to interact with you on the Web. People are on the go, researching on phones and tablets. If you’re not savvy to what’s happening out there and don’t have the best-in-class SEO, you’ll miss out. You still need to engage in the digital world, even if it’s not always obvious.

 

Posted in Best Practices for Merchants, e-commerce & m-commerce Tagged with: , , , , , , , , , , , , , , , , , , ,

September 19th, 2014 by Elma Jane

MasterCard is claiming a 98% success rate for pilot trials of a biometric verification system combining both voice and facial recognition.

It recently held a closed pilot to understand the consumer experience around voice and facial recognition.

A beta mobile app was tested in an e-commerce environment on over 14,000 transactions.  The test group, used both Android and iOS operating systems. The results, yielding a successful verification rate of 98%, mixing a combination of voice and facial recognition. The process usually took less than 10 seconds.

With the first wave of apps utilising Apple’s TouchID fingerprint recognition system coming to market – both US neo-bank Simple and PFM outfit Mint have shipped their first iOS upgrades to incorporate the technology. Biometric verification is beginning to gain currency among businesses and consumers as a useful tool in the fight against fraud.

The launch of Apple Pay will start to bring true scale to the next generation of payments authentication. The challenge is to take lessons from the different applications of biometrics already in place and elevate them into the next generation of authentication, not just for one platform, but for the mass market globally.

MasterCard already has first hand experience of a mass-market implementation of biometric card technology with the recent launch of the Nigerian eIDcard, which combines payment card functionality with a mix of fingerprint, facial and iris recognition.

 

Posted in Best Practices for Merchants, EMV EuroPay MasterCard Visa, Visa MasterCard American Express Tagged with: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

September 15th, 2014 by Elma Jane

Visa has taken advantage of the hoopla surrounding Apple’s application of digital account tokens to replace card numbers for online and mobile purchasing by initiating the roll out of its Token Service to US clients.

Visa Tokens will be made available to issuing financial institutions globally, starting with US banks next month, and followed by a phased roll-out overseas beginning in 2015. The technology has been designed to support payments with mobile devices using all major mobile platforms.

More than 750 staff from across the Visa organisation globally were involved in the effort, working closely with initial launch partners – financial institutions, merchants and processors to ensure the ecosystem was ready. Today, Visa is making these services available and believe it will help transform connected devices and wearables into secure payment vehicles.

Visa Token Service replaces sensitive payment account information found on plastic cards with a digital account number or token. Because tokens do not carry a consumer’s payment account details, such as the 16-digit account number, they can be safely stored by online merchants or on mobile devices to for e-commerce and mobile payments.

The release of the service has been given added urgency by a spate of successful hacks on merchant card data stores, such as the recent plundering of card account data at Home Depot and Target.

MasterCard has its own equivalent Digital Enablement Service, which will be released outside of the US in 2015.

Posted in Best Practices for Merchants, Credit Card Security, e-commerce & m-commerce, Mobile Payments, Visa MasterCard American Express Tagged with: , , , , , , , , , , , , , , , , , , , , , , , ,

September 10th, 2014 by Elma Jane

If your businesses considering an iPad point-of-sale (POS) system, you may be up for a challenge. Not only can the plethora of providers be overwhelming, but you must also remember that not all iPad POS systems are created equal. iPad POS systems do more than process payments and complete transactions. They also offer advanced capabilities that streamline operations. For instance, they can eliminate manual data entry by integrating accounting software, customer databases and inventory counts in real time, as each transaction occurs. With these systems, you get 24/7 access to sales data without having to be in the store. The challenge, however, is knowing which provider and set of features offer the best iPad POS solution for your business. iPad POS systems vary in functionality far more than the traditional POS solutions and are often targeted at specific verticals rather than the entire market. For that reason, it’s especially important to compare features between systems to ultimately select the right system for your business.

To help you choose a provider, here are things to look for in an iPad POS system.

Backend capabilities

One of the biggest benefits of an iPad POS system is that it offers advanced features that can streamline your entire operations. These include backend processes, such as inventory tracking, data analysis and reporting, and social media integration. As a small business, two of the most important time saving and productivity-boosting features to look for are customer relationship management (CRM) capabilities and connectivity to other sales channels. You’ll want an iPad POS that has robust CRM and a customizable customer loyalty program. It should tell you which products are most and least frequently purchased by specific customers at various store locations. It should also be able to identify the frequent VIP shoppers from the less frequent ones at any one of your store locations, creating the ultimate customer loyalty program for the small business owner. If you own an online store or use a mobile app to sell your products and services, your iPad POS software should also be able to integrate those online platforms with in-store sales. Not only will this provide an automated, centralized sales database, but it can also help increase total sales. You should be able to sell effortlessly through online, mobile and in-store channels. Why should your customers be limited to the people who walk by your store? Your iPad POS should be able to help you sell your products through more channels, online and on mobile. E-commerce and mobile commerce (mCommerce) aren’t just for big box retailers.

Cloud-based

The functions of an iPad POS solution don’t necessarily have to stop in-store. If you want to have anytime, anywhere access to your POS system, you can use one of the many providers with advanced features that give business owners visibility over their stores, its records and backend processes using the cloud. The best tablet-based POS systems operate on a cloud and allow you to operate it from any location you want. An iPad POS provider, with a cloud-based iPad POS system, businesses can keep tabs on stores in real time using any device, as well as automatically back up data. This gives business owners access to the system on their desktops, tablets or smartphones, even when not inside their stores. Using a cloud-based system also protects all the data that’s stored in your point of sale so you don’t have to worry about losing your data or, even worse, getting it stolen. Because the cloud plays such a significant role, businesses should also look into the kind of cloud service an iPad POS provider uses. In other words, is the system a cloud solution capable of expanding, or is it an app on the iPad that is not dependent on the Internet? Who is the cloud vendor? Is it a premium vendor? The type of cloud a provider uses can give you an idea about its reliability and the functions the provider will offer.

Downtime and technical support

As a small business, you need an iPad POS provider that has your back when something goes wrong. There are two types of customer support to look for: Downtime support and technical support.

iPad POS systems are often cheaper and simpler than traditional systems, but that doesn’t mean you can ignore the product support needs. The POS is a key element of your business and any downtime will likely result in significant revenue loss. You could, for instance, experience costly downtime when you lose Internet connectivity. iPad POS systems primarily rely on the Web to perform their core functions, but this doesn’t mean that when the Internet goes down, your business has to go down, too. Many providers offer offline support to keep your business going, such as Always on Mode. The Always on Mode setting enables your business to continue running even in the event of an Internet outage. Otherwise, your business will lose money during a loss of connectivity. Downtime can also happen due to technical problems within the hardware or software. Most iPad POS providers boast of providing excellent tech support, but you never really know what type of customer service you’ll actually receive until a problem occurs.

Test the friendliness of customer service reps by calling or emailing the provider with questions and concerns before signing any contracts. This way, you can see how helpful their responses are before you purchase their solution. Your POS is the most important device in your store. It’s essentially the gateway to all your transactions, customer data and inventory. If anything happens to it, you’ll need to be comfortable knowing that someone is there to answer your questions and guide you through everything.

Grows with your business

All growing businesses need tech solutions that can grow right along with them. Not all iPad POS systems are scalable, so look for a provider that makes it easy to add on more terminals and employees as your business expands. Pay attention to how the software handles growth in sales and in personnel. As a business grows, so does it sales volume and the required software capabilities. Some iPad POS solutions are designed for very small businesses, offering very limited features and transactions. If you have plans for growth, look for a provider that can handle the changes in transactions your business will be going through. Find out about features and customization. Does the system do what you want it to do? Can it handle large volume? How much volume? What modules can you add, and how do you interface to third parties? You should also consider the impacts of physical expansion and adding on new equipment and employees. If there are plans in the future for you to open another store location, you’ll need to make sure that your point of sale has the capabilities of actually handling another store location without adding more work for you. If you plan on hiring more employees for your store, you’ll also want to know that the solution you choose can easily be learned, so onboarding new staff won’t take up too much of your time.

Security

POS cyber attacks have risen dramatically over the past couple of years, making it more critical than ever to protect your business. Otherwise, it’s not just your business information at risk, but also your reputation and entire operations. iPad POS system security is a bit tricky, however. Unlike credit card swipers and mobile credit card readers that have long-established security standards namely, Payment Card Industry (PCI) compliance — the criteria for the iPad hardware itself as a POS terminal aren’t quite so clear-cut. Since iPads cannot be certified as PCI compliant, merchants must utilize a point-to-point encryption system that leaves the iPad out of scope. This means treating the iPad as its own system, which includes making sure it doesn’t save credit-card information or sensitive data on the iPad itself. To stay protected, look for PCI-certified, encrypted card swipers.

 

 

Posted in Best Practices for Merchants, Mobile Point of Sale, Point of Sale Tagged with: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

August 28th, 2014 by Elma Jane

Merchants are still using pedestrian passwords that crooks can easily break, security company Trustwave has found. Of the nearly 630,000 stored passwords that Trustwave obtained during penetration tests in the past two years, its technicians were able to crack more than half in just a few minutes and 92% within 31 days. Even though adding new information about weak passwords or ongoing malware investigations gets frustrating because the same problems facing the financial and payments industries persist, it does not surprise Trustwave researchers. For a lot of software or hardware developers, their main concern is availability of the service. They want to make sure their POS is available and running to accept credit cards, often at the cost of a lot of security controls. It is difficult to implement security and to do it correctly.

Trustwave recommends longer passwords with more characters, rather than shorter ones with letters and numbers. A longer password that is a phrase not easily figured out is better than a shorter, complex password. These findings have been added to an online version of the 2014 Trustwave Global Security Report. To accommodate the fast changing nature of security threats, Trustwave is regularly updating its research and making the information available to consumers and payments industry stakeholders on the company’s site. The criminals stealing data are a constantly moving target. It no longer made sense for those interested in our research to have to wait a year to see new statistics. Having access to updated security reporting should be helpful to merchants. They can see how trends are tracking over time, instead of constantly having to go online to see what is relevant to them or rely on the trade groups to keep them informed. This provides one switch to keep them in the know, so there is some value there and it’s a smart move on Trustwave’s part. Since the new Payment Card Industry security requirements call for security measures to be embedded in software development lifecycles, there is some utility in Trustwave’s new approach to sharing research information.

Trustwave said the trend of businesses detecting breaches continues to rise, with 29% of businesses doing so in 2013 compared to only 9% in 2009. Trustwave compiled that data from 691 post-breach forensics investigations conducted in 2013. The report also indicated e-commerce breaches are increasing, with 54% of all breaches targeting e-commerce sites in 2013, compared to only 9% in 2010. More regions, including the U.S., being in various stages of converting to EMV chip-based cards for card-present transactions fuels the criminals’ shift to e-commerce fraud. Additionally, the company is working with law enforcement officials after discovering a control center of eight servers behind what is being called Magnitude, an exploit kit of Russian origin that has led to thousands of attacks and millions of attempted malware attacks globally.

Posted in Best Practices for Merchants, Payment Card Industry PCI Security, Point of Sale Tagged with: , , , , , , , , , , , , , , , , , , , , , , , ,

August 11th, 2014 by Elma Jane

Tokenization technology has been available to keep payment card and personal data safer for several years, but it’s never had the attention it’s getting now in the wake of high-profile breaches. Still, merchants especially smaller ones haven’t necessarily caught on to the hacking threat or how tools such as tokenization limit exposure. That gap in understanding places ISOs and agents in an important place in the security mix, it’s their job to get the word out to merchants about the need for tokenization. That can begin with explaining what it is.

The biggest challenge that ISOs will see and are seeing, is this lack of awareness of these threats that are impacting that business sector. Data breaches are happening at small businesses, and even if merchants get past the point of accepting that they are at risk, they have no clue what to do next. Tokenization converts payment card account numbers into unique identification symbols for storage or for transactions through payment mechanisms such as mobile wallets. It’s complex and not enough ISOs understand it, even though it represents a potential revenue-producer and the industry as a whole is confused over tokenization standards and how to deploy and govern them.

ISOs presenting tokenization to merchants should echo what security experts and the Payment Card Industry Security Council often say about the technology. It’s a needed layer of security to complement EMV cards. EMV takes care of the card-present counterfeit fraud problem, while tokenization deters hackers from pilfering data from a payment network database. The Target data breach during the 2013 holiday shopping season haunts the payments industry. If Target’s card data had been tokenized, it would have been worthless to the criminals who stole it. It wouldn’t have stopped malware access to the database, but it would been as though criminals breaking into a bank vault found, instead of piles of cash, poker chips that only an authorized user could cash at a specific bank.

A database full of tokens has no value to criminals on the black market, which reduces risk for merchants. Unfortunately, the small merchants have not accepted the idea or the reality and fact, that there is malware attacking their point of sale and they are being exposed. That’s why ISOs should determine the level of need for tokenization in their markets. It is always the responsibility of those who are interacting with the merchant to have the knowledge for the market segment they are in. If you are selling to dry cleaners, you probably don’t need to know much about tokenization, but if you are selling to recurring billing or e-commerce merchants, you probably need a lot more knowledge about it.

Tokenization is critical for some applications in payments. Any sort of recurring billing that stores card information should be leveraging some form of tokenization. Whether the revenue stream comes directly from tokenization services or it is bundled into the overall payment acceptance product is not the most important factor. The point is that it’s an important value to the merchant to be able to tokenize the card number in recurring billing, but ISOs sell tokenization products against a confusing backdrop of standards developed for different forms of tokenization. EMVCo, which the card brands own, establishes guidelines for EMV chip-based smart card use. It’s working on standards for “payment” tokenization with the Clearing House, which establishes payment systems for financial institutions. Both entities were working on separate standards until The Clearing House joined EMVCo’s tokenization working group to determine similarities and determine whether one standard could cover the needs of banks and merchants.

 

Posted in Best Practices for Merchants Tagged with: , , , , , , , , , , , , , , , , , , , , , , , , , ,