2020-112 - Laserfiche WebLink

Home Browse Search

• do use any separate merchant identification numbers provided to you for Internet orders in all your requests for authorization and submission of charges. • do provide at least 1 month's prior written notice to your acquirer of any change in your Internet address. DON'TS • don't exceed the percentage of your total payment card volume for Card Not Present sales, as set out in your application. • don't submit a transaction for processing until after the goods have been shipped or the service has been provided to the cardholder - the only exception to this is where the goods have been manufactured to the cardholder's specifications and the cardholder has been advised of the billing details. • don't accept card account numbers by electronic mail. • don't require a cardholder to complete a postcard or other document that displays the cardholder's account number in clear view when mailed or send any mailing to a cardholder that displays personal information in clear view. It is also recommended that, if feasible, you obtain and keep a copy on file of the cardholder's signature authorizing you to submit telephone and mail order transactions. Address Verification Service (AVS) (and other fraud mitigation tools such as Verified by Visa@, Mastercard® Secure Code, Discover Protect Buy®, American Express@ SafeKey, Card Validation Codes and Card Identification) does not guarantee against chargebacks; but, if used properly, they assist you in reducing the risk of fraud by confirming whether certain elements of the billing address provided by your customer match the billing address maintained by the card issuing bank. AVS also may help you avoid incurring additional interchange expenses. AVS is a separate process from obtaining an authorization and will provide a separate response. A transaction may be authorized regardless of the AVS response. It is your responsibility to monitor the AVS responses and use the information provided to avoid accepting high-risk transactions. If a disputed charge arises for a transaction conducted over the Internet or electronically, a chargeback may be exercised for the full amount. For Discover Network transactions, please refer to Appendix 3 for the Discover Network protocol for Internet transactions. Customer - activated terminals and self-service terminals Transactions processed at customer -activated terminals and self-service terminals have specific requirements for processing. You must contact Customer Service for approval and further instructions before conducting customer- activated terminal transactions or self- service terminal transactions. DO'S • do only present for payment valid charges that arise from a transaction with a bona fide cardholder. DON'TS • don't set a minimum transaction amount of more than $10 for any credit cards or of any amount for debit cards or Alipay transactions. • don't set a maximum transaction amount for any credit cards. • don't establish any special conditions for accepting a card. • don't make any cash disbursements or cash advances to a cardholder as part of a transaction with the exception of the Discover Network Cash Over service. • don't accept any direct payments from cardholders for goods or services which have been included on a sales draft; • don't require a cardholder to supply any personal information for a transaction (for example, phone number, address, driver's license number) unless (i) instructed by the Voice Authorization Center; (ii) presented an unsigned card; or (iii) processing a Card Not Present transaction. don't submit any transaction representing the refinance or transfer of an existing cardholder obligation which is deemed uncollectible, for example, a transaction that has been previously charged back, or to cover a dishonored check. • don't submit sales drafts or credit drafts transacted on the personal card of an owner, partner, officer or employee of your business establishment or of a guarantor who signed your application form, unless such transaction arises from a bona fide purchase of goods or services in the ordinary course of your business. • don't carry out factoring, that is, the submission of authorization requests or sales drafts for card transactions transacted by another business. You are responsible for maintaining the security of your POS devices and for instituting appropriate controls to prevent employees or others from submitting credits that do not reflect bona fide returns or reimbursements of earlier transactions. Please comply with the data security requirements shown below: DO'S . do install and maintain a secure firewall configuration to protect data. CardCo2305 A TRUE COPY CERTIFICATION ON LAST PAGE • do protect stored data, and do encrypt trainsmissions &ClAaRsent across open /public networks, using methods indicated in the Payment Card Industry Data Security Standard (PCI DSS) which is available at: www.pcisecuritystandards.orc. • do use and regularly update anti-virus software and keep security patches up-to- date. • do restrict access to data by business "need to know". Assign a unique ID to each person with computer access to data and track access to data by unique ID. • do regularly test security systems and processes. • do maintain a policy that addresses information security for employees and contractors. • do restrict physical access to cardholder information. • do destroy or purge all media containing obsolete transaction data with cardholder information. • do keep all systems and media containing card account, cardholder, or transaction information (whether physical or electronic) in a secure manner so as to prevent access by, or disclosure to any unauthorized party. • do use only those services and devices that have been certified as PCI -DSS compliant by the payment organizations. DON'TS • don't use vendor -supplied defaults for system passwords and other security parameters. • don't transmit cardholder account numbers to cardholders for Internet transactions. • don't store or retain card verification codes (a three digit code printed on the back of most cards and a four digit code printed on the front of an American Express card) after final transaction authorization. • don't store or retain magnetic stripe data, PIN data, chip data or AVS data - only cardholder account number, cardholder name and cardholder expiration date may be retained subsequent to transaction authorization. For Internet transactions, copies of the transaction records may be delivered to cardholders in either electronic or paper format. If you are receiving TransArmor services from us, the important DOs and DON'TS listed below apply to you: DO'S • do comply with the payments organization rules, including PCI DSS. • do demonstrate and maintain your current PCI DSS compliance certification. Compliance must be validated either by a Qualified Security Assessor (QSA) with corresponding Report on Compliance (ROC) or by successful completion of the applicable PCI DSS Self -Assessment Questionnaire (SAQ) or Report on Compliance (ROC), as applicable, and if applicable to your business, passing quarterly network scans performed by an Approved Scan Vendor, all in accordance with payments organization rules and PCI DSS • do ensure that all third parties and softwae that you use for payment processing comply with the PCI DSS. • do deploy the data protection solution (including implementing any upgrades to such service within a commercially reasonable period of time after receipt of such upgrades) throughout your systems including replacing existing card numbers on your systems with tokens. • do use the token instead of card numbers for ALL activities after you receive the authorization response, including settlement processing, retrieval processing, chargeback and adjustment processing, and transaction reviews. • do ensure that any POS device, gateway or VAR is certified by us for use with the data protection solution. If you are uncertain whether your equipment is compliant, contact a customer service representative at 866-359-0978. • if you send or receive batch files containing completed card transaction information to/ from us, do use the service we provide to enable the files to contain only tokens or truncated information. • do use truncated report viewing and data extract creation within reporting tools provided by us. • do follow rules or procedures we give you periodically regarding your use of the data protection solution. • do promptly notify us of a breach of any these terms. DON'TS • don't retain full card numbers, whether in electronic form or hard copy.- -- • don't use altered version(s) of the data protection solution. • don't use, operate or combine the data protection solution or any related software, materials or documentation, or any derivative works thereof with other products, materials or services in a manner inconsistent with the uses contemplated in this section. i. t - When accepting debit cards, you'll need to follow the specific requirements for each debit network, as well as, the general requirements set out in this section. DO'S • do read the account number electronically from the magnetic stripe/chip for transactions authenticated with a PIN. If the magnetic stripe/chip is unreadable, you must request another form of payment from the cardholder.