Credit Card PCI Compliance Letter

[Louie Flores]

I plan to continue with the service.  I continue to offer PayPal as a payment option but routinely have clients who refuse to use paypal for one reason or another. The increased fees are still nominal in my opinion to be able to offer clients a convenient payment option during a time that seems to ask that the clients spend a lot of money (and often cash) in a relatively brief period. I don't like to bill to closing since there are too many unkowns that can prevent me from being paid. I maybe do it twice a year and only for clients who's realtor I know and trust.

Bill, I don't mind billing at closing since I have verbiage written in to my agreement. Plus I charge a extra fee for waiting to be paid so far have not had one problem.

[Dominic Maricic]

I'm surprised you can get away with that in California. I've had guys out here stop taking checks because so many bounce, let alone trust someone to pay you if their deal falls through!

[Louie Flores]

Payment at closing must be made with in 45 days from inspection
date even if the Real Estate transaction fails to close. CLIENT OR THERE AGENT WHO'S SIGNATURE APPEARS BELOW agrees to pay all legal and time expenses related to the collection of all unpaid Inspection fees.

So far not a problem let's see if I have not jinxed myself.

[Julian Benton]

Well, I just cancelled my account with First National.  They sent me an email stating that the first year was free (yes I still have it) but then they charged me anyways. When I called they said they knew nothing about it and would not credit me.  I told them to cancel and they said I would have to pay $250 early cancel fee.  Fine, at this point I would need to pay $119 for 2 more years + the monthly service they charge, so canceling costs less.  I am still trying to get ahold of Jay and complain.

I like the idea, but the fee does not make sense to me now.  Over the last year I have averaged 1 CC transaction per month and I don't take any info on site.  I just tell the client to go to my site when they get home and make the payment, the report will be released once I receive confirmation of payment.  I can do that with PayPal and not have to deal with these insane fees. As a matter of fact, I have already removed the First National payment page and added the Pay Now button from PayPal.

Now, if I can only get some of my money back.....

P.S. Not blaming you Dominic, not your fault.

[Dominic Maricic]

Julian, you should have let me know first. If you have some sort of email from them, you need to talk to our account reps, not general tech support. Call Jeff at 863 450 7760 and forward the email you have to him so he can take care of it.

The charges are being broken down to $10 a month + the original $5 service charge for a total of $15 a month ($119/12 = appx $10 a month) which is still much cheaper than anywhere else. Dale Duffy stated today he's paying $59 a month before processing a card.

As long as you're not taking payment info on the phone or at site paypal will be fine. But if you want to enter in card info on your own, it costs $360 a year + $30 a month through paypal. MUCH more than what's going through first national.

Please forward that email to me as well.

[Julian Benton]

On the way.

I don't want to handle the CC information so the PayPal option will be just fine.  I usually need until the next day to complete the report so having the client enter the info works fine.  Some have even done it onsite with their own phone/computer.

As far as the breakdown, that is not what happened to me. They charged me the full $119 at the end of Oct.

[Bob Hintze]

The $119 was the annual PCI scan fee for compliance (not part of monthly charges.) It is lower than the $199 scan fee I paid at my former processor. I find the rates for FNMS are good (thanks to Dominic.) I take between $3-4K a month in credit cards (all the snow birds and military folks.) The only issue I have is getting Jay to return phone calls; but I haven't needed to speak with him for a while...so I'm good.

Bob-

[Dominic Maricic]

Bob, if you can't get to Jay, call Jeff his brother. They handle the same accounts and I've been able to get a hold of Jeff more often. Jay has several kids and seems to get sick more often.

We figured out the free year Julian had gotten a letter about was actually referring to an SSL certificate (makes a http site into https) which is different than the compliance fee.

[Michael Merino]

I just spoke with FNMS about my PCI compliance. According to them, it does not apply to me and I do not have to pay the fee or fill out the questionnaire. I asked why, but she did not know. She said that her boss said it didn't apply to me.

[Dominic Maricic]

Huh? That's not even possible. If you touch credit card data, it applies. Sounds like someone new didn't know what they heck they were talking about. Visa explains it on their site: http://www.visa.com/cisp

[Michael Merino]

I called them today. She even asked her boss and was told it didn't apply to me. They never sent me a letter about it and have not charged me a fee either. I heard about it on this thread. It may be because the client enters the information. I am not sure. She didn't know why.

[Michael Merino]

Today I get a letter saying I have to do the compliance. I guess the bank didn't know what the hell they were talking about. Anyway, I don't understand all the questions. Do we have to answer all of them? There are 227 questions. I do not know the answer to all those questions, doesn't the bank know all the technical details?

Has anyone completed their compliance yet?

[Dominic Maricic]

About 75% of the guys have completed compliance based on the last review that I saw. Most of the questions are regarding your business practices and maintaining CC protection. Those that are technical you can ask me. Just email me anything you don't know the answer to.

Unfortunately, this isn't the bank, it's a third party compliance company called TrustWave. The bank themselves aren't allowed to do it and we're not allowed to pre-answer certain questions for you.

[Michael Merino]

So 227 questions sounds right to you?

What is a loader?

What is the scan they want to do? And do I have to set up a scheduled monthly scan? I tried a scan and it failed.

[Dominic Maricic]

You have to have the questions all answered or the scan will fail. There's also a few items which will fail as our security prevents them from getting a proper scan. Let me know what the items are and I'll give you the info to appeal the items.

Not sure what a loader is, what's the entire question?

[Michael Merino]

OK, I am trying to do this PCI bullcrap. I sat through the webinar and those guys were no help, they even ended the webinar without answering my questions. I have to choose one of these options. Anybody got a clue? I have the system Dominic has set up. I am thinking I am the Fully Outsourced Model, but I am not sure.

Fully Outsourced Model   
Choose this option if your entire e-commerce site is managed by a third-party. You may design the store and provide the product listings and prices, but the shopping cart is run by a third-party, including all of the order forms and payment collection and processing, and your employees have no access to cardholder data.

Payment Redirect Model   
Choose this option if you manage your own e-commerce site except for the payment/order pages. Your site may be physically hosted at a colocation or hosting facility, but you are responsible for the web site and shopping cart. When a customer is ready to checkout and pay, they are redirected to a third-party (e.g. a payment gateway or payment service provider) to enter their card number before being returned to your web site for further information about your products or company. Customer credit card information is never sent directly to your web site.

Integrated Payment Model   
Choose this option if you manage your e-commerce site including the collection of payment information. Your site may be physically hosted at a colocation or hosting facility, but you are responsible for the web site, shopping cart, and the payment/order pages. Customers enter their credit card information on your site, which then communicates with a third-party (e.g. a payment gateway or payment service provider) for authorization. Examples of this include the Paypal Payflow Pro and Authorize.Net services.

Other   
Choose this option if you do not fit in one of the other three.

[Dominic Maricic]

Payment Redirect Model. They are actually redirected to a Home Inspector Pro page to enter their CC info (it's just embedded within your site) which passes the information along to payfuse.

[Michael Merino]

Thanks Dom, is The hosting from you compliant with the Payment Card Industry Data Security Standard? I am sure it is, but I want to confirm.

The PCI is bunk as far as I am concerned. I do not know what SAQ I am supposed to be and it has been 12 hours since I emailed Trustwave for an answer. I have no idea about all the technical questions. For example, it says my firewall is supposed to block all traffic then I have to add exceptions. If I do that I will have to go through and add sites I visit to the exception list. That is a ton of work.

[Dominic Maricic]

Your firewall blocks incoming traffic so say yes. And yes we're complaint. This is how the CC industry is preventing congress from enforcing more rules on them. It's costing us $5,000 a year and we make nothing on it. Now that's bunk!

[Julian Benton]

This is why I am just using PayPal.  I don't get a lot credit card users anyways.