PCI 3.0 – What You Need to Know

The PCI DSS was updated for the fourth time (1.0, 1.2, 2.0, 3.0) in November 2013. As always, the changes the PCI Council made address the latest vulnerabilities and include additional clarification and new guidance.

The following covers the most important changes affecting the majority of merchants.

Requirement 0 – PCI Intro

The introduction section probably holds the biggest change for PCI 3.0. Web redirection systems are now defined as system components, which means they’re now part of scope for PCI DSS.

The principal of redirection is when a website points users to a third party that collects and processes all card data. Another form of redirection is client side redirection, in which a customer types card data into a web form generated by the merchant, and is then sent directly to a third party. Either way, card data will not pass through the original website.

In the past, these forms of redirection were validated using SAQ A, but new emphasis in PCI DSS 3.0 changes that.

The new SAQ-A EP form is designed for ecommerce merchants using client side redirection.

Review the new PCI 3.0 SAQ forms 

This new direction will affect many merchants who were previously completing an SAQ A and now must move to an SAQ A-EP, which is significantly longer and includes things such as external vulnerability scans and penetration testing.
The reason behind this requirement change? If a hacker is able to manipulate redirection code, he could direct your customers to a fake payments page that looks identical to the one you had originally outsourced.

Attacker directing customers to a fake payments page (i.e., man-in-the-middle attack)

 

Requirement 1.1.3

A cardholder data flow diagram should show how cardholder data enters your network, the systems it touches as it flows through your network, and any point it may leave your network (e.g., sent to a payment processor). You’ll want to maintain a diagram for each card flow that exists. Most businesses will have just one flow, but you might also have an additional flow if your website processes payment cards.

Simple card present flow diagram

Physically creating a document that explains the processes will help you better understand where card data lives on your network.

Requirement 2.4

This requirement involves a document that lists all in scope device types and their function (e.g., POS systems, computers). This inventory list is also a great place to document software/firmware versions. If you’re feeling a little daunted by this task, interviewing department heads is a great place to start.

Requirement 4.1

In addition to GSM (cellular) connections and wireless Internet, it is now required that any communication that includes cardholder data sent over satellite should be encrypted. Depending on your business, this may not have much impact.

SecurityMetrics has many large retail chain clients (e.g., gas stations, hospitality, restaurant chains). Many of these chains use satellite communications between chains and even as a backup connection. According to the PCI Council, it’s no longer good enough to rely on the link provider’s system security. It’s your responsibility to keep this data secure.

Requirement 5.1.2

For systems not commonly affected by viruses and don’t have anti-virus software installed, you are required to implement and document a new process that shows you periodically evaluate these systems against emerging threats.

The point of Requirement 5.1.2 is to acknowledge hackers invent new ways to hack into systems every day. It requires merchants to research and pay attention to security notices from PCI vendors. If a new attack method is deemed a threat to your system, evaluate if the threat requires anti-virus.

Requirement 5.3

This requirement states that anti-virus can’t be altered without managerial approval. Often, anti-virus needs to be turned off to do system maintenance. During maintenance, who knows what could slip past your unguarded system.

My advice is, if you are updating an application that requires disabling an anti-virus, don’t. Instead, take that system off the network or cut off its Internet connectivity for that period. As a side note, it’s not OK for system admins to just give all users admin access to get around the requirement. That’s missing the point entirely.

Requirement 6.3

Any custom software application for a cardholder environment (whether in-house or commissioned by a third party developer) is under your jurisdiction. It’s ok to outsource your software development, but it’s not OK to outsource your responsibility to ensure secure development practices are followed. If you’re planning to use the application, remember that it’ll be part of your PCI assessment…not your third party’s.

Requirement 6.5.10

This requirement to protect against broken authentication was added to fix common application vulnerabilities. You should create/add/adjust your application code to mitigate any exposure to vulnerabilities. This can be done through not exposing session IDs in URLs, using secure cookies, and enforcing appropriate session timeouts.

Requirement 7.1.1

You’re required to have a role-based access control system. That means access to card data and systems should only be granted on a need-to-know basis. PCI 3.0 requires a defined list of the roles that have access to the card data environment.

On this list, you should include each role, definition of each role, access to data resources, privilege level, and what privilege level is necessary for each person to perform normal business responsibilities. Users must fit into one of the roles you outline.

Requirement 8.4

Organizations are now required to not just document, but also train their users on how to implement password policies. This training should include guidance on how to select a strong password, how to secure it, and instructions not to reuse it.

It’s also crucial that you communicate password policy to your users. This will help them understand how to change their passwords and also not to use the same password between work and home.

Requirement 8.5.1

This new requirement is targeted specifically towards service providers who have remote access into a customer environment. This is common practice with vendors who do remote support or software training.

Any service provider with access to multiple customer systems is now required to maintain unique credentials for each customer environment. The PCI Council knows this requirement in particular will take some time to change, so they’ve given until July 2015 before this is officially required.

Requirement 8.6

The use of alternative authentication mechanisms (e.g., logical tokens, smart cards, certificates) must be tied to an individual user account and not shared among user accounts. To ensure this is met, every merchant must implement a control to enforce those authentication methods can only be used by the intended user (e.g., requiring a PIN, password, or biometric scan in addition to the token to validate the person is authorized).

Requirement 9.3

This requirement is all about controlling employee access to sensitive areas, which must be related to an individual’s job function. To meet this requirement, it’s  exactly who has access to these environments and their business need. Access must be kept up to date, especially when individuals are terminated or their job role changes.

 

Requirement 9.9

This is a huge addition to the PCI standards. Organizations that use point of sale systems, PIN pads, mobile devices etc., are required to do three new things:

1. Maintain an up-to-date list of all devices (9.9.1) including physical location, serial numbers, make/model.
2. Periodically inspect devices (9.9.2). That means looking at device surfaces to make sure they haven’t been tampered with, making sure the serial numbers match, checking that seals haven’t been broken, etc. This could be a very large task depending on the size of your organization. Whether you inspect devices every day or month is based on how at risk you are of tampering (e.g., publically accessible 24/7 gas station terminals vs. a behind-the-counter card swipe device). Make sure you document what you find.
3. Provide staff awareness training (9.9.3) for staff that interact with card present devices on a day to day basis (e.g., cashiers), and record the who, what, and when for future reference. Ideally, the training will help staff detect any suspicious activity around a payment device. Training should include how to report suspicious behavior and what to do when third parties claim they need to work on the system. For example, rather than assuming IT came in last night to install a new device on the side of her terminal, an employee should question if its supposed to be there and notify appropriate persons.

 

Requirement 10.6.2

Depending on its size and complexity, this requirement could have a large impact on your environment. In addition to the logging requirements in 10.6.1, you’re now required to review logs of all other system components periodically, based on your policies and risk management strategy.

Lots of different systems in your environment may impact your payment security. As part of your annual risk assessment, you need to identify systems that pose risk and define a process to periodically look at their logs to determine suspicious activity.

Requirement 11.1.1

Maintaining a complete list of authorized wireless access points will require extra documentation, especially in large environments. This list should include a documented business justification for each wireless access point.

It’s difficult to determine which wireless devices to remove if you don’t have an accurate list of them to begin with. That’s why the PCI Council requires you create a total list. If you’re a small ecommerce provider and all your systems fit into a single rack in your data center, this requirement should be pretty easy. If you’re a widespread organization, it will take a bit more time.

Requirement 11.3

The rewrite of section 11.3 is intended to provide additional guidance to both merchants and penetration testing organizations on penetration testing’s intended coverage.

Penetration testing organizations are now required to have documented and standardized testing methodologies that meet industry accepted standards, such as NIST 800.115. In addition, guidance is provided on how best to scope the penetration test and identify critical systems.

A penetration test Special Interest Group has been organized by the PCI Council to help merchants and penetration test organizations best interpret this new set of requirements.  Results from this SIG group are expected near the end of 2014.

The PCI Council knows this requirement in particular will take some time to change, so they’ve given until July 2015 before the changes in the penetration testing requirement become official. However, this doesn’t mean you can wait to receive a penetration test until July 2015. The guidance provided in PCI DSS 2.0 for penetration testing is still valid until then.

Requirement 12.8.5

Not only should merchants maintain a list of a third party service providers, but now they must maintain a list of all PCI requirements their service provider meets, and a list of PCI requirements they’re required to meet.

Requirement 12.9

In conjunction with Requirement 12.8.5, service providers are now required to provide written documentation to all customers stating which PCI requirements they cover on their behalf. These two requirements attempt to avoid past mis-communication problems between service providers and merchants. SOURCE

 Facebook   Twitter   LinkedIn   Website

Introducing Our New Merchant Application and Management System

Our new Merchant Application and Management System is ready to go and we have new solutions for merchants ranging from new/low volumes to high volume/higher risk with proven history. So you can now earn profit from even the smallest merchant

As an ISO, you are well aware of the lengthy process of applying for new merchant processing and how this affects your business and the Merchant. You also know how important it is to ensure application security, evaluate the future success and risk of your applicants, and how long it can take to approve or deny accounts.

Our new system, (built as part of our PCI Level 1 secure system) dramatically streamlines the Merchant Application process and shortens the approval time for both Agents and banks.

This new system allows you to input all your merchant data, follow the procedures and see the results. The system has integrated forms with multiple international banks and IPSPs so that each application that fits the banks criteria is electronically sent to the bank along with the backup documents and notes in the required format.

Now you can use this system that takes care of all your merchant application management issues and includes many features that help you provide the best service for your merchants.

Some interesting features in the new CRM Sales and Merchant Application System

So email us today at agents@paymundo.com

• You receive your own login to the system
• You can upload backup documents in the system
• You can include all your merchants data into the system
• You see the progress of the application with the bank
• You can review actual traffic statistics and commissions
• You have the option to add data input forms onto your site with our special link, so merchants can input their own data to start the process
• You get dozens of research materials, reports and useful memos on cardprocessing and solutions

We have solutions for all types of international processing. We want to chat with you and show how this system will improve your timelines, and increase your profitability.We have also completed our Bank Matrix, which provides you with a summary of our banking solutions, rates and types of business that you and your merchants can benefit from.

 

 Facebook   Twitter   LinkedIn   Website

 

New Role for Credit Card Payments in Credit Scores

Up until now, it’s not been hard for those with credit cards to understand how to avoid their plastic having a negative effect on their credit scores. All they had to remember was:

1. Make every payment (at least the minimum due) every month on time.
2. Keep balances below 30% of the cards’ credit limits. The lower that percentage the better, but the difference 10 and 20% make to your score compared with 30% is minimal.
3. Apply for new credit cards only when you need them. Having lots of recently opened accounts of any sort may be harmful.

Observe those three rules, and you’d have every reason to expect your cards to help rather than hinder your achievement of a good or great credit score.

Credit Cards and Scores: New Factor

But now a new factor might soon affect your score, according to a recent report from The New York Times. It suggested that at least one of the Big Three credit bureaus was already using the amount by which you pay down your cards each month to help calculate your score. Other bureaus and scoring companies may well follow suit.

The purpose of this is to differentiate between “transactors,” who pay down their balances in full each month, and “revolvers,” who routinely carry forward (“revolve”) balances from one month to the next. The theory is that transactors are likely to be more creditworthy, and so deserving of higher scores, though a FICO spokesperson told the Times that it was still studying the data, and was yet to change its systems. FICO is the company whose credit-scoring technologies are used in over 90% of lending decisions in this country.

If FICO and others in the credit-reference industry do in future begin to differentiate between transactors and revolvers, it could see the latter’s scores being downgraded even if they always make minimum or higher credit card payments on time every month. And that could see a significant change in how people view their plastic.

Credit Card Companies Likely Want Status Quo

This could be bad news for credit card companies because it could result in fewer revolvers. After all, would you use your credit cards to borrow if you knew that was likely to make your home, auto and other loans more expensive?

And the interest those who roll forward balances pay represents an important revenue stream for these purveyors of plastic. Indeed, within the card industry, transactors are known, unflattering, as “deadbeats,” because those who never borrow generate little profit.

Credit Scores Like Ketchup and Ice Cream

People talk about “your credit score,” but in fact pretty much everyone who has one has many. There may not be quite as many varieties of these as Heinz has, nor flavors as Baskin-Robbins, but it’s perfectly normal for an individual to have a couple dozen.

There are three main reasons for that:

1. Some lenders prefer to use older versions of FICO and other scoring applications, sparing themselves the expense of upgrading their systems. So they may use scores calculated slightly differently.
2. Scores are often often customized so that they’re especially good indicators for particular types of borrowing. So the score auto loan lenders see for a particular consumer may be different from the ones supplied to credit card companies, which may be different again from the ones viewed by mortgage lenders.
3. There are three main consumer credit bureaus (Equifax, Experian and TransUnion), and, although they all use FICO and probably VantageScore technology, they each tweak calculations to provide their own proprietary versions of your score.

Of course, the factors that create a good or great credit score remain the same, and whichever of your score or scores a lender views, it’s likely to reflect your past behavior. But it is worth being aware that, when you access your own score, the one you see may be different from the one used to decide whether to lend to you — and, if so, at what interest rate.

More to Come?

Using your status as a transactor or revolver to help calculate your score may be just the beginning. Although the companies behind scoring systems are likely to be conservative about change, so as to maintain the credibility and predictability of their products, they are also constantly looking out for ways to better satisfy the credit card companies and other lenders who pay them.

Already, FICO is working on so-called big data concepts, though these are currently intended to help clients with marketing rather than credit scoring. But, over the medium and long term, we might see all sorts of new factors affecting our perceived creditworthiness. SOURCE

 Facebook   Twitter   LinkedIn   Website

Procesa tus Tarjetas de Crédito de forma Segura y Eficiente en el mundo del comercio electrónico

Paymundo ayuda a los comerciantes a que acepten tarjetas de crédito en línea con soluciones y portales de pago electrónico seguros y servicios que logran que la aceptación de pagos electrónicos sea de forma fácil, rápida y segura.

Incremente sus ventas en línea al aceptar tarjetas de crédito, débito, y pagos ACH a través de tu sitio web.

Por otro lado, simplifique el proceso de compra mediante la integración con los principales métodos de compra y proporcione a sus clientes la posibilidad de tener transacciones rápidas y seguras.

Además, Paymundo cumple con las normas PCI DSS para proteger sus datos en línea.

Paymundo es tu fuente de solución para todas tus necesidades en línea de procesamiento de tarjetas de crédito y comercio electrónico.

 

 Facebook   Twitter   LinkedIn   Website

Portal de Pago vs. Cesta de Compras

Puede que usted esta construyendo un sitio web para vender sus productos o servicios y este listo para empezar a aceptar tarjetas de crédito, pero puede estar confundido con todas las opciones disponibles, plazos y programas. Existen dos componentes principales en las plataformas de procesamiento de pagos de comercios en línea, los portales de pago y las cestas de compras. ¿Cuál es la diferencia entre ambas? Que bueno que tengan esta interrogante.

¿Qué es un Portal de Pago?

Un Portal de Pago seguro autoriza los pagos para los sitios web de comercio electrónico. Piense en ello como una terminal en línea de un punto de venta para su negocio. El uso mas común de un portal de pago es un portal de comercio electrónico.

 

¿Qué es una Cesta de Compras?

Las funciones de un Portal de Compras y una Cesta de Compras son muy diferentes. Una Cesta de Compras es un equivalente virtual al carrito de compras que usas en un supermercado o una tienda departamental. En esta cesta de compras, usted pone los productos que desea adquirir y lo conduce hasta la caja registradora, quien luego calcula el valor total a pagar. Y esto es exactamente lo que la Cesta de Compras en línea hace. Esta calcula el valor total de tus productos y suma el impuesto sobre las ventas y los gastos de envío, resta los descuentos a través de cupones o códigos de descuentos y luego muestra la cantidad total a pagar.

Una alternativa al la Cesta de Compras es una forma de pago integrado. Este método es ideal para los negocios en donde cada transacción es típicamente un solo elemento. Un pago integrado seguro esta diseñado para que coincida con el aspecto y la sensación de un sitio web, sin embargo, se encuentra en servidores seguros como los de Paymundo para así reducir cualquier riesgo.

¿ Por que los Portales de Pago y las Cestas de Compras a menudo se confunden?

Es fácil comprender como los dueños de negocios se pueden confundir por estos términos. Muchos de los componentes de los comercios electrónicos y el procesamiento de tarjetas de crédito funcionan de forma paralela y conjunta. En algunos casos, están integrados como parte de una solución de todo-en-uno. Sin embargo, no es de ayuda que algunos sitios web y empresas utilicen estos términos indistintamente.

Por lo tanto, ¿cuál necesitas? ¿Es un portal de pago una necesidad para su negocio?  ¿Su comercio electrónico necesita una cesta de compras? ¿Qué pasa con los otros componentes, como una cuenta comercial? ¿Dónde debo empezar?!

Respire profundo…porque estamos aquí para ayudarle.

En Paymundo, contamos con profesionales experimentados en esta industria y que trabajan con cientos de propietarios de comercios electrónicos y los ayudan a comprender las distintas opciones de procesamiento de pagos. Estamos para ayudarle a comprender mejor su negocio y diseñar una solución que se adapte a sus necesidades

 

 Facebook   Twitter   LinkedIn   Website

 

Programa de Socios de Paymundo

Paymundo le da una cordial bienvenida a todos los distribuidores y socios potenciales a que se unan a nuestro Programa de Socios de PAYMUNDO.  Este programa esta orientado a asociaciones que desean aprovechar mas los mercados y las oportunidades de distribuir nuestras confiables soluciones de pago en línea.

En Paymundo, ofrecemos a nuestros distribuidores un amplio respaldo y apoyo para así asegurarnos de que están bien equipados para promocionar nuestra oferta.

Nuestro Programa de Socios ofrece un esquema rentable y beneficioso con soluciones justas para nuestros socios y distribuidores.

Para mayor información sobre como convertirse en uno de nuestros socios y distribuidores, puede contactarnos a sales@paymundo.com

 

 Facebook   Twitter   LinkedIn   Website

iGaming Super Show 2014 Amsterdam

 We are coming to iGaming Super Show this June !

Contact us today to schedule for a meet up.

Hope to see you there !

 

 Facebook   Twitter   LinkedIn   Website

Do All Merchant Service Providers Have The Same Chargeback Rules?

Question of whether choosing a processor matters when it comes to chargebacks.  Well, if you just came here for a short answer then the answer is yes, how your chargebacks are handled does have a lot to do with which processor you choose to work with.  If you are still reading after getting the answer in the first couple of sentences I hope to shed some light on how those differences manifest themselves.

The first thing you might be asking is why your processor matters at all, isn’t the issuing bank (the one who gave the consumer the credit card) the one who ultimately decides whether a chargeback is won or lost?  Well, the answer is not so clear cut as that.  By the letter of the law your merchant processor, once they receive a chargeback from an issuing bank, is supposed to do an investigation on their end (get evidence from the merchant about the transaction) and then send it back to the issuing company who will then decide which side is right, the consumer or the merchant.  The problem with this process is that the merchant processor has a lot of leeway when it comes to what they send back to the issuer and what they don’t.

If a merchant processor thinks that it is unlikely that the merchant will win a chargeback they won’t send it to the issuing bank at all and the merchant will lose the chargeback.  You might be thinking, well the merchant service provider sees thousands of chargebacks per month so they know what will win and what won’t.  While that may be true in some cases, tell that to a merchant who just lost a chargeback that wasn’t even submitted.  Honestly, for the most part you can tell the likelihood of a chargeback being successful, we certainly can do that seeing over 10,000 chargebacks per month.  The problem is your merchant service provider, isn’t always right.

Could Chargeback.com predict accurately which chargebacks will be successful and which will fail?  Absolutely.  Could we predict with 100% accuracy?  Definitely not.  This creates a strange scenario where you are asking a company like a merchant service provider to predict, with complete accuracy, which chargebacks will be successful and which won’t.  To add more confusion to this many of the merchant service providers also have issuing banks as part of their business so there is a possibility of a conflict of interest.

Many merchant service providers are trying to do the right thing but there are still a number of them that aren’t following procedures completely.  They are supposed to be reviewing the chargeback on it’s merits and deciding if there is enough evidence to submit it to the issuing bank, not to pass judgment themselves.  While this sounds good it is rarely applied universally.  Let me give you a story that happened in the last few weeks.

We have a client who uses a smaller merchant service provider.  Our client does a lot of international transactions because it fits their business model, but obviously there are risks associated with accepting international transactions.  Inevitably this client received chargebacks from the aforementioned international transactions.  When this client disputed these chargebacks, because they were legitimate transactions, the processor refused to send any of the responses to the issuing banks.  Not just some of them that they thought they would lose, every single international transaction.  Their justification was that our client was taking a risk by accepting international transactions and one of those risks was getting chargebacks.  To be fair they were also basing it on the fact that they lose a lot of those chargebacks.

While it may be true that our client was losing a larger than average percent of those international chargebacks (compared to domestic), they were still winning some of them.  If this was a courtroom (which a chargeback can feel similar to) it would be like putting someone in place to decide if a defendant was guilty based on certain criteria so they didn’t waste the judge’s time in actually finding out if the they were guilty or not.  This is just the wrong way to do things.

Now, our client in this case certainly has the right to change processors if they find this unacceptable but that takes time and effort.  If the client was small or had a high rate of chargebacks, that might be impossible for them to make a change.  The point is that the processor shouldn’t have that power, the chargeback process is stacked enough against the merchant without adding another person in the chain that can just randomly veto a chargeback whenever they feel like it.

At this point you are probably wondering if all merchant providers are declining chargebacks whenever they feel like it?  The truth is that we have found that there are processors out there who want to do the right thing and represent the merchant very fairly in the chargeback process.  Not only do they represent a merchant with a fair process, they also make it easy to respond to a chargeback and give the merchant time to gather a response.  Which brings me to the next difference between processors, response time.

While there is a set standard in the time to respond to a chargeback by the issuing bank, your merchant service provider can set whatever time limit they deem fit.  We have seen time limits for responses, on average, as short as 3 days and as long as 14 days, it varies that wildly.  This can make a huge difference when a merchant is gathering all the documentation necessary to fight a chargeback.  Assuming you actually noticed a chargeback the first day only 3 days to respond is extremely hard when you have other business problems to solve in the meantime.  It’s even worse if you don’t notice it for a few days.

There seems to be no rhyme or reason to why certain merchant service providers do what they do when it comes to chargebacks but it is something that definitely needs to be investigated before you sign an agreement with a provider.  SOURCE

 Facebook   Twitter   LinkedIn   Website

Payment Gateway VS Shopping Cart

If you are building an online presence to sell your goods or services and you are ready to begin accepting credit cards, all of the options, terms and programs available may be confusing. Two common components of an E-commerce payment processing platform are payment gateway and shopping cart. What’s the difference exactly ?  I am glad you asked.

What’s a Payment Gateway?

A secure payment gateway  authorizes payments for e-commerce websites. Think of it as an online point-of-sale terminal for your business. The most common use of a gateway is an E-commerce store on the internet.

What’s a Shopping Cart?

The functions of a payment gateway and a shopping cart are very different. A shopping cart is a virtual equivalent to the grocery cart you wheel through the local big-box store. You put your goods into the cart and drive it to the cash register that then tallies your order and gives you a total amount due. This is exactly what an online shopping cart does. It totals the costs of your goods, adds in applicable sales tax and delivery fees, subtracts discounts via coupon codes and the like, and then displays a total amount due.

An alternative to a shopping cart is a hosted payment form. This approach is ideal for businesses where each transaction typically has just one item. A secure hosted payment is designed to match the look and feel of your e-commerce website, yet is hosted on Paymundo’s secure servers to reduce liability.

Why Are Payment Gateways and Shopping Carts Often Get Confused?

It’s easy to understand how a business owner could be confused by all this terminology. Many components of e-commerce and credit card processing work together. In some cases, they’re integrated as part of an all-in-one solution. It doesn’t help that some websites and companies use these terms interchangeably.

So which do you need? Is a payment gateway a necessity for your business? Does your e-commerce site need a shopping cart? What about other components like a merchant account? Where should you begin?!

Take a deep breath. We’re here to help.

Paymundo’s experienced industry professionals work with hundreds of business owners to help them understand their payment processing options. We’ll work with you to understand your business and design a solution that fits your needs.

 

 Facebook   Twitter   LinkedIn   Website

Why Accept Credit Cards Online?

If your business is finally delving into e-commerce,congratulation ! Then what you need to do next is to get an all-in-one payment processing service and ready to go. For business owners who are not so tech savvy, accepting credit cards online may seem daunting. That could be the reasons that many stick stick to brick-and-mortar sales. Unfortunately, this means missing it out on potential sales as many researches had shown that online shopping is growing dramatically.

Here are three hard-to-ignore reasons for accepting credit card payments online.

• The majority of online shoppers pay with credit cards.

About 90 percent of all transactions carried out online are paid for using credit cards, which means accepting online payment via credit cards is an ESSENTIAL for e-commerce sites. Down the road you might consider offering other options, but first focus on setting up a reliable system for accepting credit card payments.

• A growing share of retail sales take place online

Businesses across a variety of industries realize the importance of online marketing and online selling. Electronic payment processing is an important part of taking full advantage of the online opportunities to market your products and services. No matter what product or service you provide, accepting credit cards online lets you compete for a share of the market.

• Accepting credit card payments online is simple

Naturally, credit card companies want the cards they offer to be used as frequently as possible. Therefore, they design payment processes and policies to facilitate frequent use of their cards. This works to the advantage of your small business. Since using a credit card to purchase items and services is simple and quick, more customers will turn to your company for services both online and off.

Online credit card payments also reduce errors: With our integrated CRM application and other accounting software, your payment processor can help you reduce accounting mistakes and spend less time inputting data.

Here’s another advantage for businesses with recurring billing: Improved cash flow. When you send recurring electronic invoices, customers can pay you through your website as soon as they receive your invoices, so you get paid faster.

If you’re ready to start accepting credit cards on your website, call us to get started . We have worked with businesses just like yours and we’re ready to help you!

 Facebook   Twitter   LinkedIn   Website