Credit Card PCI Compliance Letter

[Dominic Maricic]

Hi Guys,

All of you using our credit card processing service just received or will soon receive a letter from First National about PCI Compliance (I received my letter Saturday the 29th).

PCI compliance is something being FORCED upon all banks (see https://www.paypal.com/pcicompliance for paypal and their new $30 a month charge) and their credit card users by Visa, Mastercard, AMEX, etc, as a way to reduce the chances that your computer or website can be hacked and the credit card numbers stolen. Because of several large hacks recently on Barnes & Noble, Heartland Bank and a few others, totaling over 100 million card numbers being stolen, credit card companies are looking for ways to reduce break data theft (and their liability).

What is PCI Compliance? Basically a scan is done on your computer and web server (ours for 99% of you guys) to look for any security leaks. You can read more about it here: http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard . It also involves checking into how you collect credit card info and store it until you enter it into the payment system.

What does this mean for you? Right now it means that you have to pay $10/$120 a year to a third party (money does not go to the bank) to say you comply. I'm trying to work on a workaround with the bank if users don't ever use the payfuse login, we'll see where that goes.

The letter you received should have stated you had until October 31st to comply. Seems like there was an error on the bank end.

I have already talked to our attorney about this as I had a user want to cancel because of this. According to him, since this is a change to the agreement you signed with First National you will be able to cancel your contract without penalty. I'm working on who at First National to contact if this is the path you choose.

I'll update you guys as I get more info over the next few days. Let me know if you have any more questions you want me to pose to the bank.

[Robert Hutchinson]

I agree, I am not going to offer credit card services anymore.  I knew that there would be a way for these processors, banks or whomever these blood suckers are to raise their fees.  I agree that this was NOT in the original agreement and removing myself from First National should NOT cause penalty.  They had better honor this, or to court we go...

I am sick and tired of being bleed dry form these credit card companies....I get maybe 1% using these services anyway.  Bye Bye First National.

[Dominic Maricic]

Hey Bob,

Unfortunately every bank / processor will have to have compliance in place by the end of the year. This isn't something the banks wanted (as they're going to lose members and have to comply themselves). As you can see paypal is going to be charging 30 bucks a month via McAfee who is doing their scans so I'm glad First National chose a compliance company (Trustwave) that charges so much less.

I'm trying to find a way around this by removing users payfuse access and only allowing their direct data entry in the web page. I'm hoping this will avoid all fees. I'll fin out in the next few days.

I agree, frustrating as can be though.

[Robert Hutchinson]

The 30.00 per month for paypal is for what usage?  Does that mean that we have to pay 30.00 per month on top of the web hosting fee in order to use their services for payments?

[David Macy]

I believe I am leaning towards canceling my credit card account as well.
Not worth it and 99% of my clients are fine with paying by check or cash.

The only good I have noticed is if a client forgets there check.

[Bill Warner]

Thanks Dominic.
I received my letter yesterday. Let us know what transpires, but I feel we will all be required to pay these fees as individual business owners.

[Dominic Maricic]

The 30.00 per month for paypal is for what usage?  Does that mean that we have to pay 30.00 per month on top of the web hosting fee in order to use their services for payments?

If you're using Paypal and only having them click a button which takes them to the paypal site you're fine, which is what I'm trying to get through our system. If you use paypals service and you to take a credit card number when on the job site, or over the phone, you have to pay them $300+ a year to be in compliance through McAfee's testing.

To clarify that, we aren't charging you anything if you use paypal. Paypal is the one who will be charging you.

[James E. Braun]

I have all ready cancelled American Express because they wanted to charge me a $7.95 fee a month.  I only get about one AMEX card a year anyway.  Had been with AMEX for a good six years,

[Dominic Maricic]

Unfortunately every bank is being required to do this. The $120 a year ( $10 a month ) that First National is charging is the cheapest I've found so far.

[Louie Flores]

The 30.00 per month for paypal is for what usage?  Does that mean that we have to pay 30.00 per month on top of the web hosting fee in order to use their services for payments?

If you're using Paypal and only having them click a button which takes them to the paypal site you're fine, which is what I'm trying to get through our system. If you use paypals service and you to take a credit card number when on the job site, or over the phone, you have to pay them $300+ a year to be in compliance through McAfee's testing.

To clarify that, we aren't charging you anything if you use paypal. Paypal is the one who will be charging you.

I just use the button only. Paypal sure charges a lot more if your clients are from out of the country..

[Dominic Maricic]

Yeah, we're trying to see if First National can allow us to get by with just allowing entry through our websites. PCI compliance comes into play when you see a credit card number in any way. But this is what allowed guys to process through their cell phones, websites and phone. But considering a wireless terminal is usually $65 a month and now they have to add $10-$30 a month for PCI compliance too, this is still much cheaper.

[John Adrian Sopher]

I got my letter and was meaning to call.  I'm glad I saw this posting.  I would like to know what you find out Dom.  My customers process their own card.

[Dominic Maricic]

Waiting for their response right now on any alternatives. From their standpoint this would bring our users (including me) to paying $15 a month where all their normal contracts are now paying $35 so they don't see it as such a huge deal, especially when they're not getting the $10. I'm still trying to find another solution though. I know I'll need to go through the process personally as I do 'touch' card numbers when people call me.

[Will Handley]

I agree, I am not going to offer credit card services anymore.  I knew that there would be a way for these processors, banks or whomever these blood suckers are to raise their fees.  I agree that this was NOT in the original agreement and removing myself from First National should NOT cause penalty.  They had better honor this, or to court we go...

I am sick and tired of being bleed dry form these credit card companies....I get maybe 1% using these services anyway.  Bye Bye First National.

Hey Bob;

I'm still using my paypal account online, there are NO PCI charges for using the online paypal processing system:

"PayPal adheres to international PCI (payment card industry) compliance standards for data security.† With Website Payments Standard, Email Payments, and Payflow Link*, PayPal handles the payment card information for you. So you don’t have to worry about your buyers’ payment card security or about compliance with PCI DSS for your business.††"

I have clients make payment through the system using credit cards every week, it's a no brainer.  Here's the difference between paypal and other accounts:

"†† All card data must be stored, transmitted, and processed by PayPal and not by the merchant."

[Dominic Maricic]

Yes, that's the key difference. If a client shows up and doesn't have their checkbook you have to rely on them paying later. You can't take their credit card information like our users do now. That's one of the main reasons guys sign up for the service. We're looking into an option that would be like paypal if you won't be touching any CC info. Also First National said we can use any PCI compliance company if we didn't want to use their own, but most are around $300 a year. The $120 deal they got is actually very good.

Basically if you wanted to do what you're doing now, through paypal, it would cost you $60 a month ( see https://www.paypal.com/pcicompliance )versus $15 through our banks system. If your only putting a payment page on your site and never taking a CC on site, over the phone or seeing a number in any way, you can use paypals free service. But even with their 1% higher interest rate they can be more expensive depending on how much you process a month. If it's one or two transactions, paypal will be cheaper, anything over that and it will be more expensive.

[Louie Flores]

What if they pay at time of inspection using my tablet and they go direct to paypal? I have the paypal button on my site.

[Dominic Maricic]

Technically you'd have to be PCI compliant and pay paypal $360 a year to have your computer scanned every month. In reality, they'd probably never know it was actually your computer rather than the clients.

[Louie Flores]

Cool what they don't know...

[Will Handley]

It's no problem!  I do it every week.  Paypal doesn't have a clue what computer system their logged into.  Or I just advise them I'll release the report when I have a confirmed payment via the paypal system.  They process it when they get home or to another online access point like Panera, Starbucks, Mikey D's, Barnes and Noble, Hotel, Jack-n-the-box, library, harbor, airport, etc....

Again, It's a no brainer....

[Louie Flores]

I will stick with paypal I don't get many with credit cards, I have been getting a lot with Cash Lately thats best..