Here’s a link to a presentation by the PCI Security Council that will help explain the standards.

And, as always, if you have questions about your compliance, please give us a call.

Here are some tips to help you prevent fraud this holiday season:

Accepting Cards:

1. Check the card’s security features: embossed number, hologram, and the
   repetition of the first four numbers printed on the card. See
   this post for more information on card security features.
2. Swipe the card only once to obtain an authorization
3. Check the authorization response:
   • Approved – Ask the customer to sign the sales receipt.
   • Declined – Return the card to customer and ask for another Visa card.
   • Call or Call Center – Call your voice authorization center and tell the operator that you have a “Call” or “Call Center” response. Follow the operator instructions. (Note: In most cases, a “Call” or “Call Center” message just means the card Issuer needs some additional information before the transaction can be approved.)
   • Pick Up – Keep the card if you can do so peacefully.
   • No Match- Swipe the card and re-key the last four digits. If “no match” response appears again, keep the card if you can do so peacefully. Request a Code 10 authorization.
4. Match the embossed number on the card to the four digits of the account number displayed on the terminal.
5. Get the cardholder signature on the transaction receipt.
6. Compare the name and signature on the card to those on the transaction receipt. They should match.
7. If you suspect fraud, make a Code 10 call to your voice authorization center

Handling Key-Entered Transactions

If a Visa card cannot be swiped, you need to key-enter the card account data into your POS terminal. When you key-enter a transaction, you run the risk of accepting a counterfeit card because the magnetic stripe information is unavailable.

When the stripe won’t swipe:

1. Check the terminal to make sure it is working properly. If the terminal is okay and the problem appears to be with the magnetic stripe, follow your company procedures for key-entered transactions. Be sure to check the card security features and match signatures as described here.
2. Match the embossed account number on the front of the card to the number indent-printed on the back.
3. Check the card’s “good thru” or “valid thru” date to be sure the card hasn’t expired. If the card has a “valid from” date, be sure the card isn’t being used before it is valid.
4. Get a manual imprint of the card.
5. Ask the customer to sign the imprinted sales draft.
6. Compare the signature on the card with the signature on the sales draft to be sure they match. Do not accept an unsigned card!
7. If you suspect fraud, make a Code 10 call to your voice authorization center.

Six Warning Signs of Fraud:

Certain customer behavior could point to bankcard fraud. But remember, it doesn’t necessarily indicate criminal activity—you know your customers, so let your instincts steer you in the right direction. Watch out for customers who:

1. Purchase a lot of merchandise without regard to size, style, color, or price.
2. Ask no questions on major purchases.
3. Try to distract or rush you during the sale.
4. Make purchases, leave the store, and return to make more purchases.
5. Make large purchases right at opening or at the last minute when the store is closing.
6. Refuse free delivery for large items

Unsigned Cards

What is the proper procedure for accepting unsigned cards?

Ask the customer to sign the card and request to see valid government identification such as a passport or driver’s license. Compare the signature on the government identification to the signature on the card and the sales draft. If permitted by local law, write the serial number and expiration of the identification on the sales draft.

What if the customer refuses to sign the back of the card?

The signature on a card protects the cardholder from a criminal signing their name on the back and using the card, and allows you to compare signatures to ensure the transaction is legitimate. If the customer refuses to sign the back of the card, the transaction must not be completed.

What if the signature panel instructs the merchant to “CHECK ID?”

A card where the customer has written “CHECK ID” in the signature panel is considered an unsigned card.

Note: The words “Not Valid Unless Signed” are printed near the signature panel on all Visa cards. This requirement provides merchants with an independent source to refer to when requesting that cardholders sign their cards, as well as justification for refusing to accept an unsigned card.

Scam Alerts

1. Accepting an authorization number obtained by the cardholder and/or any outside source.
2. An authorization number not obtained through proper procedures will result in loss of funds by the merchant

   A legitimate authorization is only obtained through the terminal or if prompted by the terminal to call voice authorization line; the phone number on the side of the terminal is the only number registered to issue authorization numbers.

3. Allowing unauthorized offers to upgrade or change your terminal
4. When terminal is reprogrammed funds can be routed to third party bank account.

   Merchant Concepts will obtain management approval prior to replacing or reprogramming equipment.

5. Allowing unauthorized deliveries of paper
6. There is always a string attached, either as a bill for overpriced paper, or an offer to upgrade your services, leading to signing up for a new merchant account.

   Merchant Concepts employees always identify themselves, and paper is delivered upon request, not by schedule.

7. Give out transaction or financial information via phone request
8. Can result in Cardholder being contacted in an attempt to obtain full card data.Established merchant service providers have secured access to view a merchant’s transaction activity. Therefore no merchant service provider would contact a merchant to obtain cardholder data.

If you question any of the above, please contact management and Merchant Concepts.

Code 10

CODE 10 is a method to reduce fraud. Call your voice authorization center to alert the card Issuer when you are suspicious of the card, the cardholder, or the transaction. Indicate this is a CODE 10 call to get special assistance from your merchant authorization operator. They will connect you to the card Issuer. CODE 10 calls should always be made when you’re suspicious, even if you have already received an approval code.

When should a merchant use CODE 10?

In any of these instances:

• Whenever you’re suspicious of the card, the cardholder, or the transaction.
• When the four-digit number printed on the card does not match the first four embossed account numbers, or when the printed four-digit number is missing.
• When the embossing appears to have been altered or tampered with.
• When there’s no security character next to the expiration date.
• When the hologram appears to be fake.
• Whenever the signature panel appears altered or the signature on the sales slip does not match the signature on the back of the card.

Can a CODE 10 call be made if the customer is no longer present?

Yes. Your safety always comes first. If you are not comfortable making the call when the customer is present, or you don’t become suspicious until after the customer has left, call as soon after completing the sale as possible. This is just as effective in reducing fraud.

To initiate a code 10 call: 1-800-555-5707

Happy Holidays!

UnionPay

Things to know about UnionPay:

1. The logo appears on the card in similar locations as other payment cards
2. Valid UnionPay cards begin with “62″ and have 16-digit embossed numbers on the front of the card
3. The last four digits of the card are reprinted on the right edge of the signature panel.

Merchant Concepts’ clients can contact the office for an acceptance sticker.

A merchant should always hold onto the card until the transaction complete, this gives the opportunity to check the security features.

Each card type has the following features:

Visa, MasterCard, & Discover

1. The 16-digit card number is embossed on the card
   1. Visa starts with “4”
   2. MasterCard starts with “5”
   3. Discover starts with “6”
   4. All above card numbers are grouped in four digits across the card
2. The first four digits are printed under or above the embossed card number – Discover not included
3. The “Good Thru” or “Valid Thru” date is on the front of the card if applicable to the card design
4. The CVV2 number is to the right of the signature field, or in the right-hand end of the signature field on the back of the card.

American Express

1. The 15-digit card number is embossed on the card
   1. Amex starts with either “34” or “37”
   2. Amex card number is grouped in 4,6,5 across the card
2. The “Good Thru” or “Valid Thru” date is on the front of the card if applicable to
   the card design
3.  The CVV2 number is on the front above the last numbers embossed on the card

Card Verification Values/CID/

This number is used in card-not-present and card-present, hand-keyed transactions. The 3-digit security code on the card assures both merchants and consumers that the card is in the right hands. If a customer cannot provide the Card Verification Value or the card-issuing back responds that the code is invalid, the merchant should not accept the transaction. For security purposes, merchants are prohibited from storing this number.

Holograms

The use of holograms is common but not all card designs have them.  There are some American Express cards without holograms. Visa uses a dove either as a standalone feature, or as part of a holographic magnetic strip. MasterCard’s standalone hologram is the double-globe, or a series of linked globes when on the strip. Discover’s hologram is a globe pierced by an arrow. This appears on its own or is repeated across the magnetic strip.

Signature Panels

Each card uses a tamper-proof signature panel. When someone tries to remove a signature, the panel rubs off. The signature must match the name on the front of the card. Merchants should match the signature on the card to the receipt when appropriate.

Visa recommends merchants check these features during card-present transactions, as well as comparing the signature on the card to the signature on the receipt, before handing the card back to the customer.

Remember, cards must be signed. If a customer gives you an unsigned card or a card with “See ID” in the signature field, ask them to sign the card and compare it to another form of identification, such as a driver’s license.

Click here for printable PDF version

Here is why: your terminal may say the transaction was cancelled on the receipt or display of the terminal, there is a possibility that the transaction was approved by the cardholder’s issuing bank. Once the terminal is processing, the hand shake between the terminal and the cardholders issuing bank is still active. If you hit the cancel or escape button on the terminal, all you are doing is stopping the terminal from receiving the response from the issuing bank. In addition, since the terminal did not receive the communication from the issuing bank, if approved, the transaction would not show on the batch report either.

The correct procedure, when you realize your mistake, is to let the transaction go through its normal course. If the transaction was run as a credit, once the transaction is approved for the wrong amount, immediately void the credit card transaction. Then proceed with the correct amount. If it is run as debit, you must run a return, as you cannot void a debit. Explain to the customer that used debit they will see a total of 3 transactions on his or her statement. Then after the initial transaction is voided or returned, run the correct amount through the terminal. Again, do not hesitate to call if you hit cancel and weren’t sure if the transaction was captured before you run a second transaction. Feel free to call about any other training tips, or to schedule your next face-to-face training!

What does this mean to you? Lowering the cost of PIN-passed debit transactions can significantly reduce your overall processing cost. A few of the key changes are as follows:

1. A lower transaction fee that will be significantly less than your current rate.

2. These lower fees will apply to both consumer and business debit cards.

3. Both PIN- and signature-based transactions will have lower fees.

4. Merchant can select which transaction type (PIN or signature or both) they wish to offer.

5. Merchant can select which debit networks they process through.

These are just a sample of a host of changes that will be implemented as soon as mid-2011.

As a Merchant Concepts’ client, you know that we have always stressed the importance of processing debit transactions. We remain to be one of, if not the only, merchant services provider to offer debit training and quarterly performance reviews. Now, more than ever, you will want to increase debit awareness to your sales staff.

If you would like to learn more about capturing debit and understanding how it could benefit your current program, please contact Chris Mattison, Customer Support Specialist, with any questions you may have or call to set up a training session. As your merchant processor, Merchant Concepts wants your company to be as cost-effective as possible so that you can keep those extra dollars in your pocket versus someone else’s.

• Free special event loaner terminal
• POS equipment lifetime parts/labor warranty
• All POS supplies
• Emergency supply replacement
• Gift/loyalty program download, set up/app fees waived
• Check Services download, set up/app fees waived
• New application software upgrades
• Free service loaner
• Programming of two additional terminals

Call our office to reserve a unit for your event. Please give us at least 7 to 10 days notice to secure availability of equipment for the dates of the event. If you would like more information regarding how you can begin utilizing Platinum Program benefits, please ask for Chris.

1. Unauthorized offers to upgrade/change your terminal

Merchant Concepts will always obtain management approval, so staff is aware of training, and/or terminal updates/repairs. If anyone calls or comes in requesting to change or update your equipment: Do not give out any information, notify management and call us immediately for verification.

2.   Requests for financial information

Merchant Concepts does not share any client information with any third parties. Anyone asking to verify your account and asks for bank statements, bank account information, equipment types, or terminal programming is not Merchant Concepts! Do not give out any information, notify management and call us immediately for verification.

3.    People claiming to work for or affiliated with Merchant Concepts

If there is any question of anyone that calls or walks in claiming they work for Merchant Concepts request a call-back number, a business card, and management names. Do not give out any information, notify management and call us immediately for verification.

Merchant Concepts wants to help protect your business. If you suspect any of the above red flags, get the individual’s full name, company name, phone number, automobile license number (if possible), business card, and/or any other pertinent data that can be used to track down these individuals and/or companies. The best defense against potential fraud is training your staff. Call today to schedule fraud prevention training.

At Merchant Concepts, we want to make sure that you have the most cost effective and efficient processing system possible. If you are receiving offers that sound too good to be true, they probably are. However, if you are seriously considering making a change in an effort to lower costs, let Merchant Concepts help.

Whether you want to offer recurring payments, run special promotions with installment payments or collect fees, Orbital Managed Billing makes it easy to offer flexible payment solutions. All the card information is stored online and only the last four digits of the card number will show in the system. This eliminates the need to have the information on file in paper form.

With this module, you will also be able to set billing parameters for frequency, length of billing cycle, amount and more. You can also set up email alerts to notify your clients of expiring cards, declined transactions, pending billing and successful transactions.

If you are interested in adding this module to your Orbital account, please contact us. If you currently do not have an Orbital account and would like to discuss how it can benefit your business, we will be happy to schedule an appointment with you to go over the details.

More specifically, the benefits pertaining to your business are:

• Improved cash flow
• Expanded revenue
• Increased efficiency
• Reduced risk
• More accurate forecasting
• Quick, easy integration with your current Orbital account