Credit Card processing and compliance

Len
I can only speak to the PCI compliance issues. I have had situations where people show up with their CC info written on a piece of paper and leave it with a receptionist. We always took the approach that to maintain the safety of our client's CC data, we could only accept at our corporate office on an original form. The CC info was always kept in a secured area and rarely touched. It was more common to contact the client to have them complete a new form. It was frustrating for them from a convenience sense, but they did understand that this was intended to protect them. This also meant that the client's account could not be turned on until the corporate office received and input the CC info, but it saved a lot of grief from the perspective of a rogue salesperson. Our auditors really liked this as well.

Len -

You're certainly running into some of the tricky aspects of PCI DSS; paper forms funneling through a business plays havoc with compliance. It's a matter of traditional and/or practical behavior versus secure procedures. As Sara implied, if you must accept paper forms with card numbers, keeping that paper safe from the bad guys is critical.

A few trends are addressing this vulnerability. Many businesses are imaging any paper forms, then destroying the paper. The digital images are easier/cheaper to secure, and has obvious advantages during subsequent access to the form. Tokenization takes this a step further, by sanitizing any sensitive data before it enters the business network confines.

In your scenario, tokenization may not be practical, but that general philosophy may help. For instance, the outside sales reps would benefit from a mobile-based enrollment form, that can be pulled up on their Android phone, iPad, etc. They love not having to deal with paper; and their new enrollments are delivered online, instantly. Similarly, new customers can be directed to a secure web site to enroll, and enter their payment credentials securely.

PCI's goal is to reduce, if not eliminate, card numbers from merchant environments. To that end, converting paper processes to digital not only eases the efforts of securing sensitive data, but typically improves the efficiency of the process itself. It doesn't solve the whole PCI question, but it's a good start.

Hope that helps!
Best ~
Cliff

Thanks for all the comments above. They triggered another thought: how do you manage the risk, e.g. regarding business insurance coverage. Do your policies cover exposure to claims from the public or from regulators if you are out of compliance?

Where can i find a PCI policy?