Patricia O’Connor, Partner Account Manager patricia.oconnor@iatspayments.com

PCI Compliance & Fraud Prevention for Nonprofits

Don’t let the bad guys win!

Agenda

• The Harsh Reality: Fraudsters

• First Step: PCI Compliance

• Tools for Fraud Prevention

• Resources

Who are they?

The Harsh Reality: Fraudsters

• Fraudsters are smart and dedicated• Data breach vs. payment fraud• Attack vulnerable websites• Nonprofits have weaker security• Nonprofits can lose both money and

reputation as a result of fraud

What do they do?

• Testing stolen card numbers – $1.00 donations

• Card number tumbling • Name tumbling • Refund scam • Creation of clone charities

Ways to STOP them

• Velocity checking • Address verification (AVS) • CVV2 capability • IP blocking (high risk countries) • Minimum transaction limit • Payment Form – iFrame (least risk) – Direct Post (medium risk)

Fraud Tools

Quick Case Study

What is PCI?

• Payment Card Industry Data Security Standard (PCI-DSS)

• All merchants (regardless of size)

must meet established standards of security relating to how credit card data is stored, processed, and transmitted

How PCI Helps

• Creates an actionable framework to protect both nonprofits and donors

• Enables prevention, detection, and mitigation of incidents

• Maintaining PCI certification helps build donors’ trust

Becoming Compliant

• Identify level of compliance you need• Complete either:

– Self Assessment Questionnaire (SAQ)– Report on Compliance (ROC)

• Different types depending on systemsand processes

• Hire a security assessor

Compliance Levels

Level Description

1 Any merchant — regardless of acceptance channel — processing over 6M Visa transactions per year. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa network

2 Any merchant — regardless of acceptance channel — processing 1M to 6M Visa transactions per year

3 Any merchant processing 20K to 1M Visa ecommerce transactions per year

4 Any merchant processing fewer than 20K Visa ecommerce transactions per year, and all other merchants — regardless of acceptance channel — processing up to 1M Visa transactions per year.

SAQ Types SAQ Description

A Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants.

A-EP* E-commerce merchants who outsource all payment processing to PCI DSSthird parties and who have a website that doesn’t directly receivecardholder data but can impact the security of the transaction.

B Imprint-only merchants with no electronic cardholder data storage, or standalone, dial-out terminal merchants with no electronic cardholder data storage

B-IP* Merchants using only standalone, PTS-approved payment terminals with an IP connection to the processor and no electronic data storage.

C-VT Merchants using only web-based virtual terminals, no electronic cardholder data storage

C* Merchants with payment application systems connected to the Internet, no electronic cardholder data storage

P2PE-HW Merchants using only hardware payment terminals that are included in/managed via a PCI SSC-listed P2PE solution. No card holder data storage.

D* All other merchants not included in descriptions for SAQ types A through C above, and all service providers defined by a payment card brand as eligible to complete an SAQ

Where Are You?

What to do…

• Achieve and maintain PCI compliance

• Talk to your merchant provider–What tools are available?– How to implement?

• Train your staff so they know what tolook for– Refund policies, account patterns, etc.

Basic Strategy

As much as possible to

someone else

Work hard to only need to

follow SAQ-A or SAQ-EP

Make sure you understand questions

But don’t totally avoid it

• PCI encourage useful habits– Some of the policies are a

good idea anyway.

• Don’t sacrifice user experience– Don’t outsource to a platform your users

will hate. That may cost you more thancompliance.

What Professional Vendors Do

• Scanning systems quarterly and annually• Securing/removing direct access (physical and

software) to servers and networks• Completely locking down direct access to all platform

APIs• Fully logging every action taken on every server and

API• Creating 2 factor authentication to all systems used• Created strong internal processes and policies

around password strength/maximum allowed age,SSL certificates, office access, and more…

Key Takeaways

• You must own the process• PCI encourages useful habits• Create a sustainable culture• Don’t need to sacrifice userexperience

Resources from iATS

• White papers:Credit Card FraudPrevention in NonprofitsPayment processing 101• Infographic:Credit Card Fraud: How it impacts nonprofits • Infographic:Why PCI-DSS Compliance is a must have

General resources

• DrupalPCICompliance.org• PCI Security standards– https://www.pcisecuritystandards.org/s

ecurity_standards/documents.php