Got Your Number! Taking credit card payments online - your options, security issues and regulations
-
Upload
rachel-andrew -
Category
Business
-
view
4.392 -
download
1
description
Transcript of Got Your Number! Taking credit card payments online - your options, security issues and regulations
Got Your Number!Taking credit card payments online - your options,
security issues and regulations27 August 2008
Payment Options
Providers such as PayPal, Google Checkout
A merchant account and Payment Gateway
PayPal etc. Pros
Quick and easy to implement
Donʼt require a merchant account with a bank
It may be that customers are happier giving their details to these companies than to you
PayPal etc. Cons
Canʼt brand the payment screens
Might be a confusing process
Makes you look like a small company
Lack of trust in PayPal etc.
What do you need?
- merchant account with a bank
- a method of processing the payment into that merchant account (payment gateway service)
- decide which method you want to use to take payments
Payment Gateways
You do not usually need to use the payment gateway owned by the bank you have your merchant account with. Shop around, all providers are not equal in ease of integration, features or costs.
Payment Options
“Pay Page” - card details are entered on the gatewayʼs server
API Integrations - card details are entered on your server
Pay Page
Card details are taken on the payment gateway server
- you have no responsibility for card data
- user goes to third party site
- some gateways allow templates to be uploaded to brand payment page
API Integrations
With an API integration you can keep the user on your server all the time and transmit the card data securely to the payment gateway.
Security of the card data is your responsibility during collection and transmission.
Keeping date secure
Use SSL - install a certificate on your server
- provides encryption for the data transfer
- provides reassurance for the user that you are who you say you are
3-D Secure
You will usually need to implement 3-D Secure (Verified by Visa/MasterCard SecureCode) as part of the API integration.
If using “Pay Page” this will be done for you.
Storing card data
You should not store the card data in your database. Send it to the gateway and let them look after it.
If you really need to...
Storing card data means that you or your client need to take responsibility for the security of that data.
PCI DSS
http://pcisecuritystandards.org
The Payment Card Industry Data Security Standard (PCI DSS) applies to anyone collecting and storing credit card data.
That means you.
What do I need to do?
The standards cover everything from data stored online to that stored in your office
(or on hard disks that get sold on eBay...)
Core principles1. Build and maintain a secure network
2. Protect cardholder data
3. Maintain a Vulnerability Management Program
4. Implement Strong Access Control Measures
5. Regularly Monitor and Test Networks
6. Maintain an Information Security Policy
Thank you!
Rachel Andrew
http://www.edgeofmyseat.com
http://www.rachelandrew.co.uk