FALL2014
19
SALE SYSTEM
FACILITY
and go back to a standard, dial-up swipe machine.
Dial-up swipe machines are not at risk for internet
security breaches.
• Contact your credit card processor regarding PCI
DSS compliance and ask them to confirm that they
are encrypting all data during transmission and
purging records daily.
•
Review your internal procedures. Protect written
copies and do not store confidential customer data
on computers or where accessible by unauthorized
employees.
•
To reduce payment card fraud risk, contract with
a Qualified Security Assessor (QSA) to validate
your compliance to the PCI DSS. This includes
completing the Self-Assessment Questionnaire to
address business and system processes around
data security and quarterly network vulnerability
scans. Contact your credit card processor to
discuss validation programs or visit the PCI
Security Standards Council's website for a list of
QSAs at www.pcisecuritystandards.org.
Compliance with the Data Security Standards is a
necessity in terms of building a secure electronic
payment system. The PCI DSS creates the road map
to follow but compliance must not be thought of as
a one-time achievement. Think of compliance with
Data Security Standards as an ongoing journey not a
destination. If your facility is compliant right now, it
only applies to right now, to this point in time.
If you are notified by a bank or by the United States
Secret Service that a security breach is believed to
have occurred at your facility, take the following steps,
which are best practices in the industry and may be
required by law.
•
Notify your Attorney General's Office
• Notify your point-of-sale vendor.
• Notify your credit card processor and ask for a
temporary, dial-up standalone terminal, to be
delivered ASAP so you may continue to process
cards.
•
When cleared to do so by the Secret Service,
issue a press release in your local paper notifying
your customers that a breach has occurred at
the facility, credit card information may have been
compromised, and customers should carefully
monitor their bills for fraudulent charges.
Criminals do not follow the rules as they look toward
high-tech methods of theft. As a facility operator,
you must be on guard in this world of ever-evolving
technology.
Patrick Murphy is Senior Director of Business
Development at Heartland Payment Systems® (NYSE:
HPY), a leading provider of credit/debit/prepaid
card processing, payroll and gift/loyalty solutions to
more than 250,000 business locations nationwide.
Heartland, in partnership with the US Indoor Sports
Association and many other state and national
associations, empowers business owners across
America to improve their businesses with a full course
of business solutions. For more information, please
visit their website or call 1.888.904.6773.
by Patrick Murphy
