Thursday, August 12, 2010

the continuing PCI discussion

Many of you are now keenly aware of PCI Compliance and its burden on merchants. For online merchants it is the single most expensive piece of the merchant account! I have spoken to Rep. Mike Castle's office about the burden of PCI Compliance during the discussion of the debate on the financial services industry and will continue to discuss it in the future.

There are some facts which are coming to light:

You have 30 days from the opening of your merchant account to complete the survey sent via email. For merchants using Metro Merchant Services, please contact me and I will walk you through the survey. You should result in a "SAQ-A" merchant category with N/A as the Question 9 list of responses and Yes as the Question 12 answers.

If you do not complete the survey within the 30 days, you will be assessed a monthly $20 noncompliance fee. Ouch!

But there is some good news with this - if you change your merchant account and have satisfied the PCI Compliance questionnaire through your original merchant account, you do NOT have to start over. You are in compliance for the duration of the original certificate. For some of you I have laughed and said to frame the certificate. Little did I know that was true! Keep that certificate so you can show your compliance through its expiration date. You'll be notified 2 months prior to expiration for a renewal. Same is true for you who have merchant accounts through other providers and are switching to our lower cost solution.

And above all, 82North and DonorMarket are compliant services, connected to the PCI-certified Metro Payment Gateway. If you are using a web-based donor/member database, make sure your solution is PCI certified. Security breaches are happening more frequently as more people use the internet for financial transactions!

Call me at 888-900-3658 or 800-979-0082 if you have questions.

Betsey

Wednesday, May 26, 2010

Visa Card Transactions and 82North

82North brings this to you because we are part of that ability to accept electronic payments without the headache. Yes, duly noting transparency, there is a monthly fee of $8.90, 82North is a PCI Compliant service using the MMS merchant account and online gateway - and still is the most cost effective in the industry.

...

Visa Card Transactions Rose 14%
As electronic payment volume continues to rise, corporations can streamline their operations by outsourcing electronic payment reconciliation management, active exceptions management and PCI compliance. Visa processed 9 billion transactions in the U.S. last quarter, up 14% from the year prior. Visa's debit card transactions were up 19% and credit card transactions were up 2% over the year prior. Electronic bill payments provide many benefits to the company accepting them; however, they also can create headaches in the form of managing payment reconciliation, exceptions and PCI compliance. By outsourcing treasury management, companies can continue enjoying all the benefits of accepting electronic payments without the headache.
Source: Digital Transactions News, April 29, 2010

Thursday, February 4, 2010

Online Donations and State Regulation

Thank you to Susan Detwiler (Bloom Metz Consulting)who brought up recent discussions surrounding online solicitations and the effect it has on state regulations for nonprofit registration. To explain, for an organization to solicit funds in a particular state, that organization has to register with that state. Pennsylvania is particularly adamant about this, and of course it does not come without expense - a few hundred dollars for each state's registration.

For most of you, this does not present a problem - you are local organizations soliciting your local constituency, even if you cross borders with DE, NJ and PA. The problem Susan mentioned was a zoo in MD sending a letter to PA - but we have no idea how the state regulators got involved.

The end result? Just know that if you decide to send wide-spread solicitation letters to, perhaps, people you do not know, you may run into regulatory issues. But if your solicitees know who you are, you should be fine.

It is always something, isn't it? If you have run into this, please let me know! And if you are truly concerned, your CPA will know the IRS regulations.

Thursday, January 7, 2010

Happy New Year!

Thank goodness 2009 and that "ought" decade is over - we can start afresh with a new year and a new decade!

Some people have been asking about online auctions and 82North. Quite frankly, there are some players in the online auction business with which 82North cannot compete (one rhymes with see-grey) and sees no reason to reinvent that wheel. However, perhaps what you want to do doesn't need that service from see-grey. depending on what you are hoping to do, you can create an 82North site which has a picture of the items being auctioned, then a currency field for the bid amount. At the end of each day (or the next morning) you can go in and update the site to give that day's minimum bid. This might be preferable when you have silent auction items for which you are generating interest before your event, but the items' purchase will conclude at your event. One thought if you do that - give a "Buy It Now" price so if someone wants the items but cannot make it to your event, you'll still be reaping in the big bucks - and acknowledging a good supporter of your organization.

If you provide this type of site on 82North, it is IMPORTANT!!! that you declick "collect payment information" on the 5th page of the Create an Event process. If you do not declick that button, the site will try to charge a credit card for the bid.

And what are the benefits of having an 82North site do your online bidding?
1. if you are a "multiple sites" client, it costs you nothing
2. you let the bidders create the bidding sheet - you don't have to do it through emails to you
3. you have the ultimate control on the site.

Send us your fresh ideas and we will highlight them through the year.

Happy 2010!

82North
Betsey Moran

Thursday, December 17, 2009

The IRS and the Merchant Account

News from the IRS is that starting 2011, all merchants will be receiving 1099s from their credit card processing banks. What this means is the IRS will track credit card charges through your merchant account as income. For 99.9% of you, this is not an issue. For the other .1%... well, you got some work to do!

Of note: the IRS considers nonprofit organizations as prime money laundering targets, so these 1099s to nonprofits may be especially important.

Monday, December 14, 2009

82North and DonorMarket Certification

well, as we've said from the beginning, you don't know what you don't know!

82North (hence DonorMarket) are PCI Compliant and have contracted with McAfee for daily scans through their HackerSafe program. 82North has always been hacker safe and passed the first scan with flying colors - what else?!

Going forward, you can ask your constituents to download "securityadvisors" which will attach itself to the web browser and indicate the site's hacker safe protection.

82North has done everything it can to be on the forefront of ensuring your data's protection while continuing to provide a value-based product. Because DonorMarket uses the 82North software, DonorMarket has the same assurances in place.

Please contact us at 82North and DonorMarket with any questions you may have: 302-425-3658, 888-900-3658.

Happy Holidays! Betsey

Thursday, December 10, 2009

how to fill out the questionnaire

thanks for keeping track of this nonsense!

Ok, for the Metro Merchant Services questionnaire, you use a Completely Outsourced Shopping Cart (I hate that term, 82North is so much more!). If it requires you to answer something about a terminal, your use a Virtual Terminal - unless of course you actually bought a terminal and use it.

Once you have completed the survey, you may get a "Congrats you can fill out the SAQ-A" which is where all of 9 is N/A - you do not carry around any cardholder data on any media (meaning paper or hard drive or whatever) and all but one question for part 12 is YES. As I recall, there is one piece, again about media, which is N/A.

Later on the SAQ-A it will ask you to explain N/A - do so saying that no cardholder data is kept on any media.

Wednesday, December 9, 2009

Who is an "acquirer"?

Most of you have First Data as your acquirer; some will have a different acquirer if you process using CardFlax, PayTrans, BuyTrans, or ImpactPay.

But you are no longer allowed to send your SAQ-anything to your acquirer!

For MMS merchants ONLY, you are required to send your SAQ to:

ControlScan
ATTN: Christina Leighton
340 Interstate North, Ste 347
Atlanta, GA 30339

Non-MMS merchants should contact their service provider directly for more details.

PCI Certification

Ok, so you've dutifully filled out the questionnaire, and if you are lucky you get a message that says "you qualify for SAQ-A", and it provides it there for you. At the end of SAQ-A, you are told to send it to your acquirer. Same thing as if you went to the website I told you about.

Well here is the newest wrinkle I learned last night - you STILL get charged a monthly fee even if you are PCI Certified! What a racket this has become. I am told by MMS that when certified, you will be charged $4.95 per month - $8.90/mo if you require a scan. SAQ-A merchants do not require a scan, but don't expect them to lose out on a fee when they can claim you do need a scan.

Nothing about this process makes any legitimate sense and it is all a money making scheme.

I welcome your comments if you disagree!

Monday, December 7, 2009

PCI Compliance - one more piece

In filling out the SAQ-A for 82North and DonorMarket, I now realize there is a second piece of documentation (nearly identical to the first) which is required: the Attestation of Compliance, or AOC-SAQ-A.

So after completing SAQ-A, download and fill out AOC-SAQ-A.

Stay tuned for the exact location of where to send the completed forms.

Thursday, December 3, 2009

Some useful tools

Did you know Vertical Response (www.verticalresponse.com) gives non-profits 10,000 FREE emails per month? here is a shout out to that generosity!

And I hope everyone has signed up with Tech Soup (www.techsoup.com) which provides access to deeply discounted software and hardware.

Monday, November 23, 2009

PCI Compliance - what is the credit card industry up to now?

PCI Compliance for 82North and its Clients

This paper has been prepared with the 82North client in mind and uses the Personal Card Industry Data Security Standard information provided by various sources as noted.

PCI Compliance means that you have security measures and procedures in place as outlined for your level of merchant account and credit card data activity. This compliance has been required effective July 2007, though it has evolved and is slowly being implemented by merchant account providers (Independent Sales Organizations/ISOs).

There are four levels of merchant account activity, each requiring its own set of measurements and standards. Organizations with merchant account activity between 20,000 and 1,000,000 transactions per year are considered Level 4. This level, the lowest of the standards, means that those organizations can self-assess their security, but it does not mean the requirements for that security are any less.

Now that you have determined what your Merchant Level is, you now need to determine which Self-Assessment Questionnaire fits your business model. Go to http://www.pcicomplianceguide.org/pcifaqs.php#4 or https://www.pcisecuritystandards.org/saq/index.shtml.

• SAQ-A is for merchants using 82North as the sole eCommerce solution and who do not store or process any credit cards any other way. 82North clients with no knucklebuster (hand swiper) or swipe machine can fill out SAQ-A
• SAQ-B is for merchants using a knucklebuster ONLY (does not apply to 82North clients)
• SAQ-B is also for merchant who use a swipe terminal only (does not apply to 82North clients)
• SAQ-C is for those 82North clients who use the 82North service as well as a knucklebuster and/or a swipe machine

As you know, those of you who have merchant accounts through Metro Merchant Services (MMS) are beginning to see requests for surveys which identify what type of merchant you are. If you use an online service, MMS is attaching an $8.90/mo fee to “certify” you as an online merchant. If you do not use 82North but only 1 swipe machine, you will incur a $4.95/mo fee. If you do not use 82North but have more than one swipe machine, you will incur the $8.90/mo fee.

This is the most important piece for you to understand – as a merchant account holder, you MUST certify yourself. If there is a data breach with your credit card activity, you can be fined!
“Q: What are the penalties for noncompliance?
A: The payment brands may, at their discretion, fine an acquiring bank $5,000 to $100,000 per month for PCI compliance violations. The banks will most likely pass this fine on downstream till it eventually hits the merchant. Furthermore, the bank will also most likely either terminate your relationship or increase transaction fees. Penalties are not openly discussed nor widely publicized, but they can catastrophic to a small business.
It is important to be familiar with your merchant account agreement, which should outline your exposure.”

In essence, your organization must implement security procedures to ensure any data you collect is safe and that you are PCI Compliant/Certified. However, if you do not store data in-house (ie, use 82North) you do NOT require a server scan.
But we aren’t finished there. As a merchant you must be certified, but the services you use must also be certified. This is where 82North and your online gateway come in. Remember, as an 82North client, you have three pieces to the puzzle - your merchant account, the online gateway and 82North as the web "portal":

1. You have the merchant account, many of you through MMS but other merchant account providers are represented as well. You have to certify yourself as a merchant (those SAQ levels).
2. Your merchant account has an online gateway through which 82North authorizes and captures credit card transactions on your behalf. This online gateway must be certified as well. Metro Payment Gateway, the gateway MMS merchants use is PCI Certified. If you use another online gateway, you must ask that gateway representative about their PCI certification – ask for nothing less than PCI Certified and make them prove it.
3. As an 82North client, you use 82North as your online transaction processor which also stores your credit card data. 82North must also be PCI Certified.
82North is now in the process of becoming PCI Certified. As a Shared Hosting Provider (SHP - we host your secure websites), 82North is required to complete SAQ-D. SAQ-D is for those SHPs who process between 20,000 and 1,000,000 transactions per year. 82North has determined that an upgrade to server hosting will have to be made and should be made by the end of 2009. To give you a sense of the effect on this service, hosting costs will now go from $2,500 per year to $14,400 per year, an 826% increase. Wow. No, the rates for 82North are not going up to match that hosting cost increase, but I share it with you to give you a sense of the magnitude of effect PCI Compliance has on a company like 82North.
There will be a few changes in the password requirements for the Administrative Interface. PCI Compliance requires a 7 digit password combining numbers and letters which is changed every 30 days.
As for the 82North database and storage of credit card data, it has been compliant from Day 1. We do not store the entire number and never have nor do we save the CVN and PIN. From a software standpoint, 82North has always been PCI Compliant.

In summary, what does PCI Certification and Compliance mean to you?
1. You have to fill out the MMS survey when they ask you to, and yes, pay the fee.
2. You have the choice to complete the SAQ which corresponds to your activity and become PCI Certified as a merchant. Once you do this, your certification letter can be sent to MMS and they will eliminate the fee. Self-certification costs nothing but your time, and I heartily recommend it.
3. In order to remain as value-based as it has, 82North requests that you send referrals! The best way to cover the increased costs of the PCI Certified servers is to increase revenue.
This is a major fork in the road for 82North, the third one since starting up in 2004. The first was redoing the software, the second was personally guaranteeing the merchant account activity in 2005 when it was no longer allowed for you to use the 82North merchant account and now we have the PCI Certification issue. 82North has shown to be committed to providing a cost-effective service for your needs. This new world of secure data continues to evolve and 82North continues to do the research so you are better informed – and be nimble enough to quickly evolve with the industry!
These requirements do not apply to DonorMarket clients, but are shared for your information. You DO have the responsibility to have secure procedures in place for any cardholder data. Consider filling out a SAQ-A for yourselves, though no need to send it anywhere.

As always, please contact 82North with any questions you have: EMoran@82North.com, 800-979-0082, 302-425-3658
Thank you for what you all do for your community!

Wednesday, October 8, 2008

82North on a roll!

Lest you think I have been shirking my duties, things are popping along at 82North! Welcome to many new clients over the past few months (no, not going to name them and mistakenly forget one!), and well as welcome to the new Auto Team Create users. The newest one to come online is the Mental Health Association in De (www.eracingtheblues.com).

Another new tweak in the offerings is a "Bill Me" payment method.

Here is what concerns me in the months ahead: the stock market has taken a nose dive as has the housing market and the general economy. So why does 82North care? Very simple - what is going to happen at the end of the year? Nonprofits receive their annual fund gifts around the end of the year, and with the stocks being so low, I am guessing many nonprofits will be taking a huge decrease in revenue. And that is sad. I am concerned for people's jobs, those whom they serve, and the ripple effect around our communities.

If you know of a nonprofit in a tighter than usual financial squeeze, mention 82North to them. What better way to help than create a mechanism for gift receipt without any human intervention! And event registration, membership - you know the drill. Taking care of those pieces of paper which come through the mail take valuable manual resources. Let the internet save your organization time and money - especially now that you need it the most!

Stop by 82North - oh, that's right, that's how you got here! - and poke around. Blessings to you all!

Wednesday, March 5, 2008

Now we are cookin'!

Tuesday March 4, 82North switched to a VPS and now has the horsepower to make your experience even better on the site. Check it out!

Saturday, February 16, 2008

DonorMarket is using this blog too

so you get to hear all about both companies - well, why not. It is all me anyway.

DonorMarket doesn't have a merchant account yet - everyone turns me down because I helped y'all with using 82N's merchant account. The credit card companies didn't like that, so my name is blacklisted. makes me feel kinda special.

So hang in... just as I am doing...

DonorMarket has a website!

Thanx to Leslie Kedash for the new logo - check it out on www.DonorMarket.org.

Saturday, February 2, 2008

Don't use Buy.com!

So who has a Wii? Not me! Using zaptxt.com to get updates when a Wii is available (cuz I hate paying above MSRP on Amazon etc), I got a notification that one was available on Buy.com. I purchased it, gave my cc information, have the receipt. Later that day I get an email stating me credit card information was incorrect. The wrong person to claim that on! I know exactly what credit card information they needed, including billing not home address, and I know they were trying to blame ME for not getting a Wii rather than saying they had oversold.

It is one thing to be blatantly charging you too much, but to then try to say the lack of machine is your fault, not theirs? And of course I emailed them stating nothing was wrong with my cc information!

Anyone hear of customer service? Not at Buy.com!

Thanx for listening, and I personally guarantee that customer service is prompt, courteous, honest, and hopefully 100% accurate at 82North.com!

Friday, January 11, 2008

Like our logo?

82North hired Leslie Kedash to create our logo 4 years ago when we started the business. A huge thank you to Leslie to remind us to put the logo on the new Blogger software!

Google her if you need great graphic design help!

82North and DonorMarket - quite a team!

DonorMarket has received its tax-exempt status!

Why do you care? 82North, the service with the unparalleled software, now can process your tax-deductible monies without your having to have a merchant account. You see, this is where DonorMarket comes in. Using the same software, DonorMarket provides your small non-profit the online capability at a minimal cost; when you become larger and more sophisticated, you can graduate to 82North!

There is NOTHING online that 82North or DonorMarket can't do. If you have found something with the same features at a lower cost, please let us know!

Saturday, November 17, 2007

Thank you AFP-Brandywine Chapter

All of you who went to Philanthropy Day Nov 15 know how hard it is to put on an event for 350 people (just a guess, but there were a lot!). It was a great day to mingle with fellow fundraisers, get a few hints about what others are doing, and to listen to Dr. Ben Carson and his passion for education and helping others. That's what it is all about, yes? So thank you to AFP-Brandywine for a great day!