PCI DSS

Important Announcement to all EROL Users – PCI DSS Compliance

As part of a continuing drive to reduce credit card fraud, you may be aware that the card schemes (Visa, MasterCard etc.) have introduced new rules governing the way in which businesses process and store credit card information. The new rules are known as the Payment Card Industry Data Security Standards (PCI DSS) and are mandatory for all businesses that accept payment by card.

What is PCI-DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of comprehensive requirements for enhancing payment account data security. The founding members of the PCI Security Standards Council; American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa International, developed the standard to help facilitate the broad adoption of consistent data security measures on a global basis. This standard is supported by all banks. Put simply, PCI-DSS is about preventing card payment information held by merchants, or their third parties, from being used fraudulently and all the consequential financial and reputational losses associated with this.

PCI-DSS and compliance with this standard applies to every merchant. You must be PCI-DSS compliant if you handle, accept or process payment cards. It equally applies to manual processing and storage of cardholder information as well as to electronic methods of storage.

The responsibility for PCI DSS compliance rests with individual merchants and lies between them and their card acquirer.

What is the deadline for Merchants to become compliant?

Visa Europe has set a new deadline-date of 1st October 2009 for compliance for those merchants who are processing fewer than 1 million Visa eCommerce transactions per year.

If you are processing more than this amount of transactions via Visa please call us asap.

Are there penalties if Merchants are not compliant?

There are severe financial penalties for non-compliance, including liability for any compromised Card-data, as well as significant fines by Card-Issuers eg Visa and MasterCard if you are not compliant by this date. As part of your agreement with your acquirer you agree to these penalties.

How do I become compliant?

There are 2 ways of becoming compliant with the new PCI-DSS Standard.

Firstly, you can become compliant as a Merchant yourself. This involves a time-consuming and often costly Annual PCI-Assessment and quarterly network-scan by an approved vendor. This approach also involves implementing and monitoring security procedures within your business that meet required standards.

The other option is to ensure that you are using a PCI-compliant 3rd-Party Payment Processor such as EROL PAY. This way, all handling and storing of Card-data is processed on the Payment-Providers servers, all via PCI-DSS compliant systems.

EROL have partnered with Creditcall to deliver the EROL PAY payments service. Creditcalls’ infrastructure has been accredited to the very highest-level available for PCI-compliance by authorised security-advisors.

All merchants must make the change before the October deadline in order to meet the required PCI Standard.

Is EROL SSL PCI-compliant?

Although EROL SSL incorporates sophisticated features to ensure that cardholder data remains secure throughout transaction processing and has been working successfully for several years, as a payment method it does not fully meet the requirements of PCI DSS.

As such, we will be ceasing this service in the next 2 months, and last payments using EROL SSL will be processed on the 18th September 2009.

EROL SSL Customers have been contacted directly with information about the required changes. If you are an EROL SSL user and you have not seen this email please contact us asap to discuss your options.

Is Dreamteam Design Ltd. PCI Compliant?

As a merchant Dreamteam Design Ltd. Have been through the SAQ (Self Assessment Questionnaire) and Vulnerability Assessment earlier this year and have passed the required levels of compliance for our internal processes and payment systems.

.

Can I talk to someone to discuss what I need to do?

Yes! Just give us a call on 0845 072 6060 and we will be happy to address any questions or concerns you may have.

Are there other options from other Payment Providers?

Yes. EROL integrates with most of the UK’s leading Payment Service Providers (PSP’s).

A full list of these can be seen at www.erol.co.uk/payment-gateways-951-0.html - with all contact details and setup guides also available on this site.

We have also managed to secure some very special offer-pricing for EROL customers signing up with some of our Payment Partners. These offers differ depending on the Payment Partner – some are offering Free Processing for 2 months, others have removed setup Fees, etc.

We can offer special pricing from the following Payment Partners, exclusive to EROL Customers:-

• EROL Pay
• Sagepay (Protx)
• PayPoint.net (formerley SecPay and Metacharge)
• RBS Worldpay
• Secure Trading

To find out more and to take advantage of any of these special offers you need to contact EROL Sales who will be able to give you application details to make sure you receive whatever is on offer.

Please note these specially-agreed offers are not available directly from the Payment Provider.

Call 0845 072 6060 for more information or with any questions.

Where can I get more information on PCI-DSS?

For more information and the detailed standard on PCI-DSS please refer to www.pcisecuritystandards.org/