So what’s the biggest RISK to conducting online registration? What’s the biggest thing that can go wrong? Answer: The biggest risk for any online registration software is in storing credit card information and not losing credit card numbers to hackers.
Hopefully, I have convinced you in my previous blog posts to go with an ASP, i.e. Application Service Provider, to provide you with online registration software. One of the chief reasons is because a good ASP should also be very good at protecting the credit card numbers of your customers. The PCI standard requires that your ASP encrypts credit card numbers. This fact alone is one reason why going with the cheapest ASP might end up in disaster. Even the big acquirers who encrypt their card numbers can hit the rocks. Consider what happened to Global Payments in April 2012. (read: http://www.theinquirer.net/inquirer/news/2165471/global-payments-admits-losing-million-credit-card)
So other than encrypting the credit card numbers, is there any more an ASP can do? How about the complete elimination of credit card numbers from all of the ASP’s servers.
Processing sales in real-time is essential for any ASP. In fact, the roll-over time, i.e. the time it takes the transaction to make a round trip from the ASP to the acquirer and then back to the ASP, should be under 4 seconds. But, what about processing refunds? How important is it that refunds are done in real-time? We’d all agree that a refund should occur on the day it is made, but what if we could gain some “extra” security by delaying refunds until later that same day?
Here’s what I mean. The simple process below dramatically increases the security of the credit card numbers housed on the ASP’s servers. The essence of the process is to keep ALL of the credit card numbers off of the production computers and instead on a secure encrypted USB drive. This encrypted USB drive would be locked in a vault, 99.9% of the time. For example, the Black Amour drive, made by Maxtor to military specifications, is an ideal USB secondary drive for storing the credit card numbers.
So how could you operate with 99.9% of the credit card numbers inaccessible in a vault? Consider the process below:
- Each day, say at a secret time of say 11:40 p.m., the ASP attaches the USB drive, locates any credit card numbers required, and runs all of the refunds that have queued up during the day. The result is that every refund that was supposed to run in real-time is instead delayed and run all at once at the secret time on the exact day the refund was made.
- Right after the refunds have completed ALL of the encrypted credit card numbers are REMOVED from the production machine and placed back on the secure encrypted USB drive. In addition, any new credit card numbers that were collected during the day are also removed. The drive is then placed back into the vault again until the next day.
Let’s examine what we’ve achieved through this process.
- The best hackers would be out of luck stealing credit cards from this ASP! That’s because the card numbers have be securely erased and don’t exist on the production machines.
- The cardholders get their refunds as they would have even if the refund had of been done in real-time.
- The gateway processor has a small window in order to void any undesired refunds or to monitor the flow of refunds before the funds are returned back to cardholders.
- Here’s an unexpected advantage. The merchant might be able to save money on the MDR fee, i.e. merchant discount rate. Consider this, acquirers charge merchants a percentage of the net dollars processed. This percentage is called the merchant discount rate. The MDR, is calculated based on NET SALES. That is, NET SALES = GROSS SALES – REFUNDS. So it is possible to add into the above process a mechanism which optimizes the flow of refunds so as to offset as much as possible the gross sales, thus minimizing the net sales, and hence minimizing the MDR. In order to do this, refunds might have to be delayed a day or two until there’s enough gross sales to offset the refunds against.
- The process requires a human to manually run the refunds daily at the secret time.
The bottom line, keep those credit card numbers secure!
Let the ASP store them on your behalf. Remember to a merchant, handling credit card information is like superman handling kryptonite.