Merchant Guide to Modernizing Your Payment System

Transcription

1 Merchant Guide t Mdernizing Yur Payment System March 2017 A cllabratin between:

2 Disclaimer This Merchant Guide t Mdernizing Yur Payment System (this Guide ) assists U.S. merchants deplying EMV at their pint-f-sale (POS) with infrmatin t help wrk with merchant services prviders, integrated POS vendr, and dealers t accept chip cards in stre. This guide prvides high level infrmatin and nly relates t card present transactins. It is subject t change at any time withut ntice. Neither this Guide nr any ther dcument r cmmunicatin creates any binding bligatins upn any party. This Guide is prvided AS IS, WHERE IS and WITH ALL FAULTS. Neither, nr any f its members, directrs, fficers r emplyees (cllectively, the ETA Parties ) assume r accept any liability fr any errrs r missins cntained in the Guide. The ETA Parties specifically disclaim and make n representatins r warranties f any kind, express r implied, with respect t this Guide including implied warranties f merchantability and fitness fr a particular purpse. The ETA Parties further specifically disclaim all representatins and warranties with respect t intellectual prperty subsisting in r relating t the Guide r any part theref, including but nt limited t any and all implied warranties f title, nn-infringement r suitability fr any. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 2

3 Cntents Intrductin Mdernizing the Pint-f-Sale...4 Chapter 1: EMV Recap...5 What is EMV and Why is it Imprtant?...5 Hw Des Chip Technlgy Make Payments Mre Secure?...6 Cardhlder Verificatin Methds:...6 Chapter 2: Best Practices fr Mdernizing yur Payment System...7 Start planning early...7 Understand yur needs when discussing ptins with yur MSP r payment prcessr...7 D yu need t get yur system certified?...8 Chapter 3: Step-by-Step Guide fr Yur Business...9 Review Yur Current Payments Infrastructure Determine Yur Gals and What Yu Want Frm Yur New POS Hardware/Sftware Discuss Optins with Yur Merchant Services and/r Payment Prcessr Install Yur New POS Acceptance Hardware EMV & PCI Cmpliance Will EMV Make yu PCI Cmpliant? Train Yur Emplyees and Custmers Appendix A Glssary f Terms Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 3

4 Intrductin Mdernizing the Pint-f-Sale This Manual is intended t help merchants mdernize their pint-f-sale payment system t supprt chip card acceptance. The bjective is t be a hands-n guide fr facilitating discussins between the merchant service prvider (MSP), the prcessr, and the dealer t prvide slutins fr in-stre card-present transactins. We start with a recap n EMV r chip card acceptance which is a must fr any terminal system t be cnsidered mdernized. Best practices are then utlined which includes infrmatin related t data security applicable t chip card transactins cnsisting f tkenizatin, encryptin, and PCI data security standards. Then, a guide cvering six steps is ffered t assist with the POS system transitin frm reviewing the current payments system t training emplyees. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 4

5 Chapter 1: EMV Recap What is EMV and Why is it Imprtant? The U.S. payment card industry is in the midst f a majr transitin t supprting EMV while ther cuntries acrss the wrld have previusly implemented EMV. EMV is chip card technlgy verseen by EMVC, a glbal payments industry bdy that manages, maintains and updates EMV Chip Specificatins, fr bth cntact and cntactless payments, t facilitate interperability and enable payments between chip-based payment applicatins and POS acceptance terminals. The rganizatin is made up f six members: American Express, Discver, JCB, MasterCard, UninPay and Visa. Supprt fr EMV is imprtant because chip cards lessen the risk f fraud cmpared t magnetic stripe cards. An embedded micrchip uses dynamic data during each transactin, which makes them difficult t cunterfeit. On June 23, 2016, EMVC reprted that by the end f 2015, the number f EMV payment cards in glbal circulatin increased, year n year, by 1.4 billin t 4.8 billin. The UK Cards Assciatin said accrding t the EMV FAQ prduced by EMV Cnnectin, Fraud n lst and stlen cards is nw at its lwest level fr tw decades and cunterfeit card fraud lsses have als fallen and are at their lwest level since Implementing chip card technlgy n POS Terminals helps prtect against in-stre card present cunterfeit and lst/stlen fraud. Chip card technlgy is different than pint-t-pint encryptin (P2PE) and tkenizatin. Pintt-pint encryptin and tkenizatin are technlgies that help prtect card transactin data stred n merchants systems and card transactin data in transit transmitted t and frm POS Terminals t help reduce the risk f data breaches respectively. Each merchant shuld evaluate its fraud cncerns t determine a hlistic fraud preventin strategy. Pint-t-pint encryptin and tkenizatin slutins help prtect merchants when breaches ccur f static and in-transit card transactin data. There are tw main types f in-stre card present fraud that chip technlgy helps reduce: Cunterfeit Cards Unlike magnetic stripe cards, chip cards are difficult t cunterfeit because f an embedded micrchip that exchanges unique, dynamic data with a terminal each time it s used. Lst & Stlen Cards By supprting terminals accepting PIN preferring chip cards, merchants may be in a psitin t shift liability fr lst and stlen fraud in accrdance with payment netwrk rules. Even fr small t medium-sized merchants, accepting chip card payments is imprtant. As large, natinwide retailers have implemented this technlgy, fraud culd shift t less-prtected channels, s terminals that have nt been upgraded t accept chip payments culd becme a target. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 5

6 Hw Des Chip Technlgy Make Payments Mre Secure? Chip technlgy makes in-stre card present transactins mre secure than transactins with magnetic stripe cards because: The chip helps prevent card clning it is harder t duplicate than a magnetic stripe card Cryptgraphy: In each card transactin, varius cryptgrams are generated based n public keys laded in the terminal and in the card Every time a card is inserted r a cntactless device is tapped, it is validated. Cardhlder Verificatin Methds: Befre chip card technlgy was available, payment cards were prduced with just a magnetic stripe cntaining minimal cardhlder infrmatin. Cardhlder verificatin at the pint f sale was limited t using signatures. Since U.S. cardhlders are familiar with magnetic stripe cards and prviding their signature fr verificatin with a card transactin, in an effrt t reduce cmplicatins at the POS in the U.S., mst U.S. credit card issuers are issuing chip cards that require a signature fr cardhlder verificatin rather than a PIN. Hwever, when selecting terminals fr a mdernized payment system, yu shuld require supprt fr cardhlder verificatin ptins that are flexible enugh t address current technlgy supprting current and future needs f yur custmers. PIN acceptance fr nline entry and als fr when the terminal is ffline t help reduce fraud are key features as is supprt fr acceptance f cntact and cntactless chip card transactins. Deplying cmprehensive terminal supprt fr cardhlder verificatin methds shuld ensure the system supprts acceptance f current card technlgy and helps manage fraud. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 6

7 Chapter 2: Best Practices fr Mdernizing yur Payment System As yu begin t plan yur transitin t mdernize yur payment system, current best practices and a step-by-step guide are prvided t assist with a smth transitin. Start planning early As yu transitin t mdernize yur payment system, yu have several factrs t cnsider that can impact yur business and yur custmers. Fr example, upgrading t an entirely new POS system instead f buying new terminal hardware may impact hw yu run yur business s yu shuld plan ahead. Discuss EMV readiness with yur terminal prvider t understand their ability t supprt the entire EMV transactin frm card t prcessr when setting deadlines fr yur transitin. Plan fr the future When selecting terminals, cnsider ptins that allw yu t supprt the current and future needs f yur custmers, such as cntactless payments, PIN, rewards and lyalty prgrams. Cnfirm that yur POS hardware is capable f supprting cntactless payments s yu can accept mbile wallet transactins, such as thrugh Apple Pay and Andrid Pay. As the industry mves t supprting EMV, many issuers will issue PIN preferring chip cards, such as debit chip cards. Cnfirm that yur terminals have PIN pads that are PCI PIN Transactin Security (PTS) cmpliant. Cntact yur payment prvider t ask abut yur ability t accept PIN payments and certificatin requirements. Understand yur needs when discussing ptins with yur MSP r payment prcessr With hundreds f hardware and sftware ptins in market, make sure yu are getting the technlgy that is right fr yur business and yur custmers. Select vendrs carefully. Befre selecting yur vendrs, make sure that an acquirer/payment prcessr and integrated POS slutins can prvide the POS hardware and sftware functinality that yu want, as well as the supprt yu need fr a seamless transitin and cntinued success. Understand hw PCI Data Security Standards (PCI DSS) and EMV wrk tgether EMV, Pint-t-Pint encryptin, tkenizatin, and PCI functin best when they are cmbined. When used tgether, EMV, Pint-t-Pint encryptin, tkenizatin and PCI cmpliance may reduce fraud and enhance the security f yur payments infrastructure. a. An EMV chip has security features that can reduce cunterfeit card fraud at in-stre card-present envirnments. Plus the supprt fr PINs can help merchants shift liability fr lst and stlen fraud fr card present transactins under payment netwrk rules. b. Pint-t-Pint encryptin is used t prtect card data by encrypting it at the POS frm the time the card r cntactless device is swiped/inserted/tapped in the POS Device until it is decrypted fr authrizatin. c. Tkenizatin helps prtect merchants when breaches ccur f static data. PCI prvides ther cmplementary levels f security t prtect sensitive cardhlder data within the payment ecsystem, thus limiting the availability t fraudsters. Please visit the PCI Security Standards Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 7

8 website fr varius educatin materials n this tpic: D yu need t get yur system certified? Every chip-enabled terminal must be certified by EMVC and end-t-end (E2E) certified by the payment netwrks yu want t accept. The size and cmplexity f yur business will determine the level f certificatin required. Unless yu have hundreds r thusands f lcatins and a highly custmized POS sftware (fully-integrated), it s likely that yu wn t have t play a majr rle in the certificatin prcess. If yu are required t btain certificatin fr yur POS system yu will want t wrk with yur acquirer t help guide yu thrugh that prcess. It can include needing: E2E terminal certificatin t be cmpleted fr each payment netwrk supprted by the terminal. Each terminal applicatin yu use, cmbined with any middleware sftware prduct, shuld be certified by each prcessr. The purpse f E2E testing will be t: Demnstrate that the deplyed POS terminals meet the requirements f bth the acquirer and payment netwrks. Send authrizatin requests and receive authrizatin respnses between POS terminals, acquirer hst systems and payment netwrks. Demnstrate that POS terminals can prcess chip-based functins including PINs, fallback transactins and CVMs as supprted by the POS terminal. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 8

9 Chapter 3: Step-by-Step Guide fr Yur Business We have prvided a step-by-step guide fr yur business t assist with yur transitin t mdernize yur pint f sale. Here are the steps that we will cver in the fllwing pages t help ensure yu address the key cnsideratins: 1. Review yur current payment infrastructure. a. Write dwn all the hardware and sftware enabling yur business t prcess payments. i. Nte all f the invlved vendrs. b. Recrd the details f the netwrk that pwers yur internet cnnectin fr yur business. 2. Determine yur gal f the hardware/sftware upgrade. a. Are yu happy with yur current set-up r d yu want mre functinality? Be specific. b. Are yu willing t pay a premium fr better, mre secure POS sftware and hardware? c. D yu want t future-prf yur hardware r just get the required minimum? 3. Discuss yur ptins with yur MSP and/r payment prcessr and questins: a. See what s ut there. Get recmmendatins frm the experts. b. Des the new technlgy meet yur payment security gals? c. Can it accept all the frms and channels f payment that yu desire? d. Will yu need additinal certificatins and testing? (Yur gateway, prcessr, r POS sftware prvider may be respnsible fr this if yu are utilizing a semi-integrated slutin.) e. What will the installatin and cnfiguratin entail? D they prvide assistance? f. Will yu need a new r upgraded secure wireless netwrk t supprt the hardware? g. Is there training and nging supprt available fr yur new technlgy? h. Hw will the new hardware impact yur daily wrkflw? i. What type f nging supprt will they prvide? Have thse terms been agreed upn cntractually? 4. Install yur new hardware. a. Get yur new system prperly installed and cnfigured. Cnsider hiring Qualified Integratrs and Resellers (QIR) t assist with the installatin. QIRs receive training and qualificatin n the secure installatin f Payment Applicatin Data Security Standard (PA-DSS)-validated payment applicatins int merchant envirnments in a manner that facilitates PCI Data Security Standard cmpliance. b. Make sure yur netwrk is reliable and secure. 5. Get yur system certified (if applicable) a. T learn mre abut certificatin, visit PCI Security Standards Cuncil: b. Each POS terminal applicatin, cmbined with any middleware sftware prduct, shuld be certified by each prcessr. c. Finalize yur PCI cmpliance as sn as pssible. 6. Train yur emplyees and yur custmers a. Make sure yur cashiers and/r wait staff knw hw t accept chip cards t assist yur custmers. b. Take advantage f marketing and educatinal materials fr merchants such as thse fund at: Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 9

10 Review Yur Current Payments Infrastructure Shifting t chip technlgy prvides an pprtunity t take a cmprehensive lk at yur payments capabilities s yu can accept new frms f payment in the future. Since yu will likely be purchasing new POS hardware t accept chip payments, it is a great time t get hardware that enables ther frms f emerging payments that cnsumers have shwn interest in, such as mbile payments. Beynd payments capabilities, culd yur business benefit frm a mre hlistic POS slutin that can track inventry, prvide lyalty slutins, and much mre? If s yu may be interested in such functinality in additin t acceptance supprt. When yu re ready t get started, the first step is t walk thrugh the list belw and dcument the existing payments ecsystem at yur business: What brand(s) f hardware d yu currently use t accept payments at yur business? Hw many devices d yu have? D yu use a stand-alne payment terminal, r is it attached t (r integrated int) yur pint-f-sale system? What payment channels d yu have in place (in stre, nline, mbile, mail rder, etc.)? Wh is yur acquiring bank? Wh is yur payment prcessr? Wh is yur POS prvider (if applicable)? D yu use a gateway, middleware prvider? Wh d yu call fr technical issues? What debit/credit card brands d yu currently accept at yur business? D yu use wired r wireless internet t pwer yur payment terminal and POS system? Is the netwrk yu use t prcess payments secure? Befre yu mve n t the next step, answer these questins thrughly. The answers will guide yur future cnversatins with yur merchant services grup and payment prcessrs. Determine Yur Gals and What Yu Want Frm Yur New POS Hardware/Sftware One f the hardest parts f the transitin t chip technlgy is deciding n the right POS hardware and sftware fr yur business. Are yu lking strictly fr a way t accept chip cards with n additinal frills, r d yu want a full POS system t manage yur entire business peratin? If yur business already has EMV-capable terminal(s) in a stand-alne envirnment (see belw) r a need t swap ut nn-emv terminal(s) with nes that are EMV-certified, then the transitin will likely be seamless with minimal csts. If yu re thinking abut upgrading yur existing system t smething mre rbust r integrating EMV int an existing POS system, will require a few additinal decisins. Let s take a lk at the three main ptins yu have fr an upgrade. Stand-alne slutin This is the mst basic set-up. If yu nly want t be able t accept chip cards and nthing else, this is the easiest, cheapest and fastest ptin. Just swap ut yur nn-emv terminal(s) fr an EMV-enabled POS terminal. Keep in mind that this ptin ffers the least amunt f functinality. It s wrth nting that even with a stand-alne slutin, yu can still accept cntactless payments if yu select the right hardware. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 10

11 Semi-integrated slutin This is the mst cmmn set-up fr many businesses. A semi-integrated slutin is ne in which a payment terminal is used t capture card transactin data and prcess payments, but it is cnnected t a POS applicatin (ften residing n a PC r register) rather than being a stand-alne device. This apprach is generally straightfrward because the EMV prcessr certificatin and integratin t the POS are ften cmpleted by the terminal prvider and sftware applicatin prvider. In a semi-integrated envirnment, the POS sftware applicatins can be ften be changed mre easily and smetimes reduce recertificatin needs f the applicatin. Hwever, every initial EMV applicatin requires E2E certificatin with each card brand. Since payment data transmissin is limited t the payment applicatin and the prcessr (i.e. sensitive data never enters the POS applicatin), semiintegrated appraches can ptentially take POS applicatins ut-f-scpe fr PCI certificatin regulatins as well. Fully-integrated slutin The fully-integrated apprach is the mst cmplex integratin and nt as cmmn fr small businesses. There are tw main uses cases where yu may want t cnsider a fullyintegrated slutin: 1) Yu prcess millins f transactins per day and are lking t reduce payment gateway fees assciated with a semi-integrated slutin. 2) Yur business mdel (i.e. large fine-dining restaurant) requires t supprt specific needs t minimize the impact n wrkflw In a fully-integrated slutin, the payment applicatin is an integral part f the cre POS slutin. One piece f sftware handles every aspect f the transactin, which means each terminal is nt separated frm the rest and a card can be authrized and clsed ut n separate terminals. In this scenari, the entire payment system (POS, terminals, servers, firewalls, etc.) is within the business s wn infrastructure. This als means that the entire system is within PCI scpe and a change made t any part f the system affects the ther parts. Encrypted card hlder data and transactinal data is being stred n the system, and being sent fr prcessing thrugh yur internet cnnectin. EMV adptin will influence the apprach t payment applicatin integratin, because every EMV acceptance applicatin requires end-t-end certificatin with each card brand. Therefre, in a fullyintegrated envirnment, any mdificatin t the cre POS brings the ptential that recertificatin might be necessary, even if the payment-specific part f their applicatin ges untuched. If yu are interested in a stand-alne r a semi-integrated apprach, here are a few questins that yu shuld ask yurself as yu determine what hardware is right fr yu. Are yu willing t pay a mnthly fee fr added benefits and functinality (clud-based POS slutins typically average arund $50/mnth per terminal, but can be mre)? Yes, I am. N ne likes t spend unnecessarily, but the peratinal efficiencies that cme frm a full pint-f-sale system can be dramatic and may ultimately save yu time and mney. Nw that yu have decided that a new pint f sale system is right fr yu, write dwn a list f all N, I am nt. If yu re nt willing t spend extra, but yu are still interested in added functinality, there are a few ptins that ffer rbust slutins withut a mnthly fee. Keep in mind that with these bundled slutins, yu will likely pay higher prcessing fees than yu wuld thrugh yur current payment prcessr. Yu can run an analysis based n yur Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 11

12 the functinality that wuld help yur business. Here are a few ideas: Inventry tracking Item discunts Autmated marketing slutins Integrated accunting sftware Barcde scanning Dynamic table service and bill splitting Lyalty prgrams Sales analytics Mbile table-side rdering prcessing vlume t see if it makes mnetary sense fr yu t g this rute. It s als a gd idea t priritize yur desired functinality frm mst imprtant t least imprtant. This will allw yu t cnduct the best cst/benefit analysis when yu are deciding n a system. Once yu utline needs, yu are ready t discuss the list with yur MSP r payment prcessr. They will be able t recmmend slutins that wuld wrk fr yur specific business type. Yu can als d yur wn research nline t cmpare sftware prducts and get a sense f what is available. D yu want t anticipate future card acceptance needs f yur business by being able t accept cntactless payments like Apple Pay, Andrid Pay, and Samsung Pay? D yu want t be able t accept chip and PIN in additin t chip and signature? Yes, I want t address the future card acceptance needs f my business technlgy. Yu will want hardware that can accept cntactless payments, which is what many mbile wallets use t trigger payments frm mbile phnes Yu will als want t make sure that yur terminal supprts all CVMs including PIN t avid respnsibility ver lst & stlen fraud. N, I m nt interested in new payment technlgies. Yu will nly need a terminal that supprts chip card acceptance and is capable f supprting current Cardhlder Verificatin Methds. Nte that yu may need t purchase new hardware again in a few years. At this pint yu shuld have a gd understanding f what payment hardware is right fr yur business. Once yu feel cmfrtable that yu knw what yu re lking fr, cntinue n t the next step. Discuss Optins with Yur Merchant Services and/r Payment Prcessr Nw that yu have taken inventry f yur existing hardware and determined what yu want frm the upgrade, it s time t talk t yur MSP, payment prcessr, and POS prvider (if applicable). Yur merchant services team knws yur business vlume and they have the mst insight int what is and isn t wrking in the market tday. They are als incentivized t make sure that yu are successful, because the mre successful yu are, the better they d. Yu shuld clearly utline everything that yu want yur new payment infrastructure t accmplish and ask them fr advice. Mst acquirers and prcessrs tday have hardware ptins that range frm the mst basic terminals thrugh highly custmizable clud-based POS systems. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 12

13 The first step is t get advice n the right hardware fr yur business based n the infrmatin yu utlined in the previus step. Once yu utline yur needs t the vendrs, here are a few questins t ask t get yu started: Based n the functinality I utlined, what is yur pinin f the best slutin fr my business? What payment frms will my new hardware be able t accept? Chip and signature, chip and PIN, magnetic stripe, cntactless payments? What is the cst f hardware t becme certified? Hw lng will the hardware take t arrive? Will it cme pre-cnfigured? If nt, what d I need t d when it arrives? Will the new hardware be wired r wireless? What des the installatin entail? D yu prvide any installatin services? If s, are yu a Qualified Integratr r Reseller (QIR)? Will yu train me n hw t use the new system nce it is set up? D yu prvide nging supprt in case I have questins abut the new technlgy and are there fees? Hw will the new hardware impact my existing wrk flws (e.g. will my staff need t return t the same terminal t authrize and clse ut a bill)? While yu re fcusing n getting the right hardware fr yur business, it s als imprtant t address yur security cncerns in additin t the necessary functinality. EMV is an essential cmpnent f an in-stre payments envirnment that mitigates security risks, but it s nly ne piece f the puzzle. Yu als want encryptin and tkenizatin t bring additinal layers f security t yur payment envirnment. But, what des that mean? Encryptin PCI Data Security Standards requires encrypting card transactin data stred n yur systems and transmitted ver a public netwrk. Card transactin data can als be encrypted within the terminal t help prtect data frm unauthrized access inside f a merchant envirnment. Card transactin data is transmitted with encryptin all the way t the prcessr r service prvider, where it can be decrypted. If encryptin is prperly implemented, the merchant s systems (utside f the terminal) will nt handle any clear-text card data reducing the risk f security breaches. PCI Security Standards Cuncil (PCI SSC) has intrduced a vluntary prgram called the PCI Pint-t-Pint Encryptin Prgram (P2PE). Encryptin slutins that are PCIP2PE-validated are required t fllw rigrus standards. POS sftware systems which are integrated with such PCIP2PE payment systems are kept ut f scpe fr PCI DSS cmpliance because the sensitive card data never enters the Merchant system, but rather the data is encrypted at the pint f interactin. Please visit PCI SSC website t get the current list f slutins that cmply with PCI P2PE standards. Tkenizatin Tkenizatin prducts devalue card transactin data by replacing the Primary Accunt Number (PAN) with a tken. When develped and used as specified, these slutins may reduce fr merchants by remving the need t stre valuable card numbers in their netwrks and systems. Tkenizatin prducts include hardware devices, sftware applicatins and service fferings. The security bjective f a tkenizatin prcess is t ensure the resulting tken has n value t an attacker. When evaluating a tkenizatin system, it is imprtant t cnsider all elements f the verall tkenizatin implementatin. These elements include the technlgies and mechanisms used t capture cardhlder data, hw Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 13

14 a transactin mves thrugh yur envirnment, the transmissin frm the pint-f-capture (e.g., pint-f-sale system) t the authrizatin endpint, hw tkens are retained fr use (e.g. in back ffice systems) and s n. Breach Insurance - It s imprtant t ask questins t cnfirm that yur new payment infrastructure is designed fr lng-term success. While breach insurance may be f sme value t the merchant cmmunity, it is crucial t understand that it is nt sufficient prtectin frm the reputatinal and financial impact f a data breach. Breach insurance shuld nt be cnsidered an alternative t adptin f chip, encryptin, tkenizatin r ther layers f security set up fr lng-term success. Questins t ask regarding the security f yur new system: Is the system yu re recmmending EMV-certified? Des the slutin prvide pint-pint encryptin, supprt tkenizatin and is listed with the PCI Security Standards Cuncil listing? D I need t play a rle in EMV certificatin based n my prpsed payment slutin? If s, hw lng will it take and hw much will it cst? Nte that E2E certificatin is required fr every hardware/sftware/platfrm cmbinatin (See the Get Yur System Certified sectin earlier in this dcument.) Will I need additinal hardware beynd the terminal t secure the transactin data? Has the terminal been certified under the Payment Card Industry (PCI) PIN Transactin Security (PTS) Pint f Interactin (POI) prcess fr versin 3.1 r mst current versin? Is the POS sftware apprved and listed as a being cmpliant with the PCI Payment Applicatin Data Security Standard (PA-DSS)? Once yu re satisfied that yur prpsed hardware will meet all yur desired functinality and security needs, it s time t place the rder and get ready t make the transitin. If yu are selecting smene t install yur new system it is imprtant t familiarize yurself with the PCI QIR Prgram. QIR Prgram: Organizatins qualified by PCI SSC as Qualified Integratr and Reseller Cmpanies (QIR Cmpanies), such as Bmtwn, are authrized t implement, cnfigure, and/r supprt validated PA-DSS Payment Applicatins n behalf f merchants r service prviders fr purpses f perfrming Qualified Installatins as part f the QIR Prgram. The quality, reliability, and cnsistency f a QIR Cmpany s wrk prvide cnfidence that the Payment Applicatin has been implemented in a manner that supprts the Custmer s PCI DSS cmpliance. It is imprtant t nte that the incrrect installatin and/r maintenance f payment applicatins can create pprtunities fr merchant s systems t be cmprmised. Integratrs and resellers play a key rle in the payments ecsystem, as merchants depend n these service prviders t install, cnfigure, and/r maintain their validated applicatins. Resellers are highly encuraged t pursue QIR training and certificatin, and merchants shuld use a QIR t install their devices - as it imprves security by validating that payment applicatins and terminals are installed and integrated in a manner that mitigates payment data breaches and facilitates a merchant s PCI Data Security Standard (DSS) cmpliance. Using QIR cmpanies prvides small merchants sme prtectin against cmmn cmpliance matters. Infrmatin can be fund at the PCI Security Standards Cuncil website. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 14

15 Install Yur New POS Acceptance Hardware The cmplexity f the installatin will depend n the type f POS acceptance system that yu have chsen. If yu re adding a new terminal, it shuld be plug-and-play installatin with a ptential sftware update (as lng as the hardware cmes pre-cnfigured fr yur business). Yur merchant services team r the POS prvider shuld be able t guide yu thrugh that prcess. If yu re setting up a new POS system, is the system wireless r hard-wired (cnnected with an Ethernet crd)? If it s a wired system, the installatin may entail running sme new Ethernet cables. With a hard-wired system, yu will have fewer cncerns related t the security f yur netwrk, but the general flexibility f the system is reduced. If yu are mving frm a wired t a wireless system, the first thing yu need t d is t make sure yur netwrk is reliable and secure in rder t seamlessly pwer yur payments. Belw yu ll find sme questins yu can ask t make sure that yur wireless netwrk is prperly cnfigured fr yur business needs. Is my internet fast enugh t pwer my new system? Yu can cnduct a free netwrk speed test by ging t: While pure payment prcessing desn t require significant dwnlad and uplad speeds, if yu want yur new wireless pint f sale system t run smthly, we recmmend, as a rugh guide, having at least 3Mbit/s dwnstream speed and 1.5Mbit/s upstream speed per pint f sale device. This shuld ensure a smth cnnectin fr yur pint f sale system. Is my signal strng enugh at the lcatin f each terminal? Yur system shuld prvide wireless signal strength n less than -70 dbm t each wireless terminal in any lcatin where the terminal will be in use. If yu are planning t have mbile terminals (e.g. tableside rdering), yu will need a strng and cnsistent signal strength thrughut yur business. If yu need a strnger signal in certain areas f yur business, yu can add additinal access pints t yur netwrk that will expand yur Wi-Fi cverage. Hw d I install the Ethernet cable t cnnect the ruters and access pints t the mdem? Yu can purchase pre-cut Ethernet crds t cnnect yur netwrk hardware if the distance isn t t far. If yu want a custm wiring jb, yu will need a spl f CAT5 cable, a cable stripper and crimper, a punch dwn impact tl, RJ45 tips, and a cable test kit. These tls will allw yu t cut yur desired length f CAT5 cable, add the tips and run it between yur netwrk hardware in yur business. Yu may want t munt the cables with surface munts and use a U-shape stable gun t hld the cables in place fr a cleaner and mre dynamic installatin. Prfessinal cabling is always available frm Bmtwn s lcal technicians if yu need assistance. What are sme things I shuld keep in mind when setting up my wireless netwrk? Generally it s nt advised t use ISP-prvided mdems/ruters because they tend t be lw quality and are ften years ut f date. They als may nt have the functinality and security features that yu want fr yur business. Finally, yu will likely pay mre ver the life f the ruter t rent it frm the ISP than t buy it yurself. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 15

16 D nt use multiple netwrk ruters in a chained cnfiguratin, even if ne is being used as an access pint. These shuld be replaced with prper access pints cnnected t yur mdem r switch. If yu are ging t prvide Wi-Fi access t yur custmers, yu must separate that netwrk access frm the netwrk that yur pint f sale and payments devices are n. Yu can use a separate ruter fr each netwrk r yu can use a dual-band ruter that has built-in security features. If yu need netwrk hardware recmmendatins, Bmtwn is happy t prvide guidance based n yur specific business type and needs. Hw d I minimize the risk f unauthrized access t my wireless netwrk? Encrypt yur system. Use at minimum WPA2/PSK encryptin t secure yur system. This is the mst trusted encryptin tday fr small business netwrks and it will add a passwrd t yur netwrk. Get a firewall. A prperly cnfigured firewall acts as the first line f defense in any netwrk. It allws yu t clse ff prts that aren t being used by yur business. The gd news is that mst business ruters have built in firewalls s yu can lg int yur ruter and cnfigure yur settings directly. Set a passwrd fr yur firewall. The firewall desn t d any gd if it easily bypassed. This can happen if yu keep the default username and passwrd, which can be changed frm the admin sectin f the ruter. Update Ruter Firmware. Ruter/firewall firmware can becme dated within a year. It s imprtant t update t the latest firmware t maintain security. This can easily be dne n the administratin view f mst mdern ruters. Disable SSID. This ptin decides whether r nt peple can see yur wireless signal. Since yu aren t using this netwrk fr a guest netwrk, yu shuld hide it t the utside wrld. PCI DSS includes several requirements in regards t wireless cnnectivity. Review these carefully t validate yu have prperly cnfigured yur wireless netwrks and firewalls t prtect cardhlder data. Once yur netwrk is prperly setup t limit unauthrized access, yu can install the pint f sale hardware, if that s what yu rdered. There are sme basic cmpnents that will be required and the installatin prcess will vary depending the cmplexity f yur system. Here s a general guideline f what a pint f sale installatin entails: Set up the payment statins r tablets If the statins are wireless, these can be placed anywhere in yur stre that yu have significant wireless netwrk cverage. If the statins need an Ethernet cnnectin, yu will need t run a cable frm the netwrk hardware t each lcatin t cnnect the system t the netwrk. Set up the peripheral devices (payment terminals, cash drawers, barcde scanners, receipt printers). Once the statins are in place, yu will need t cnnect all the peripheral devices t the cre netwrk. The peripheral devices can ften be cnnected with crds that are prvided with the hardware. Install the printers (if applicable). Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 16

17 It is generally a best practice t run a cable t cnnect yur printers t yur pint f sale system because the wireless signal can be weak r incnsistent. The last thing yu want is t slw dwn business because yur wireless cnnectin n yur printer drpped. This entails installing a separate cable fr these printers, which takes mre time but will prvide a better experience ver the lng-term. Cnfigure the sftware Nw that yur hardware is prperly setup, yu will need t cnfigure all the peripheral devices that yu purchased t functin as yu want them t. This will include making sure yur terminal prcesses payments, yur receipts print t the crrect printers, yur barcde scanners enter infrmatin crrectly t yur sftware, and yur cash drawer pens when yu need it t. Once yur hardware and netwrk are setup crrectly, yu re ready t validate yur new system and ensure yur cmpliance with the necessary standards. Yu can take advantage f free Discver Prductin Validatin test cards t cnfirm yur terminal/peripheral is wrking prperly fr EMV. Fllw this link t request yur test cards: EMV & PCI Cmpliance Will EMV Make yu PCI Cmpliant? It is nt nly POS sftware that matters fr PCI cmpliance, the entire business peratin cntributes t PCI cmpliance. This includes, but is nt limited t, hardware, sftware, and internet cnnectivity as well as peple and prcesses. Based n brand cmpliance requirements, in a stand-alne r semi-integrated scenari, yu may be able t cmplete a self-assessment questinnaire (SAQ) fr yur attestatin f PCI cmpliance. Nte that this wuld nly be in cases where a PCI listed P2PE slutin has been prperly implemented and n card data is stred elsewhere thrugh ther channels. Be sure t check with yur acquirer regarding the details f yur specific requirements. PCI has launched a small business taskfrce t prvide additinal guidance fr merchant t imprve their security. Please refer t this link fr infrmatin: PCI has published several guidance papers n securing wireless, accepting card transactins n telephne etc. Please refer t Train Yur Emplyees and Custmers Finally, nce yur new system is installed and yur netwrk is secure, yu need t train yur emplyees hw t use the mdernized POS system. Fr example, when yu intrduce EMV yu shuld expect: Fr mst terminals, chip cards are inserted chip-first and chip-side up. Chip credit cards must typically remain in the terminal fr the entire length f the transactin. Emplyees shuld advise custmers t fllw terminal prmpts that indicate when the card shuld be remved. Fr this new technlgy, it is imprtant that, in additin t training yur emplyees, yu capitalize n pprtunities t train custmers. Running a pilt prgram will be imprtant as new prcesses will take time t get used t, and there may be a number f questins frm custmers. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 17

18 Designate experts amng yur team t understand payment ptins Identify and train staff t be the experts in the different payment methds, including EMV and cntactless payments, s they can help stre emplyees and custmers. An expert with the new POS system must be able t understand hw all cmpnents wrk tgether, hw t trublesht and crrect issues, and be able t escalate t ensure questins and prblems are reslved. Discuss the checkut prcesses fr chip cards with stre managers and emplyees Chip cards may prcess differently frm each ther when used at the terminal. That s because sme card issuers will have a PIN behind their card, and thers might have a signature. Be sure t educate all emplyees n hw the transactins might wrk nce custmers start using their chip cards. And always remember t indicate fr custmers t fllw the prmpts f the terminal. Als, luckily, if a custmer swipes a card that has a chip, EMV-enabled terminals will recgnize the card has a chip and prmpt cnsumers t insert the card. Walk thrugh the transitin t chip cards and any ther recent terminal updates Recently, new payment methds have been intrduced in additin t chip cards, such as mbile wallets, s it s imprtant t keep emplyees well-trained n the latest POS terminals and devices. When educating yur staff n the transitin, walk thrugh the g-live date fr chip card acceptance in yur stre, but als remind emplyees abut each type f payment yur stre accepts, frm chip cards t cntactless payments t mbile wallets, s n ne accidentally turns away a certain payment type at checkut. Peridically gather emplyee feedback t identify ptential issues with a certain card brand/payment methd, etc. Leverage vides, stre signage, and ther useful industry resurces Educate emplyees further by using trusted industry resurces. T help navigate thrugh this new envirnment, Discver Netwrk can help yu t better understand chip cards and EMV-enabled terminals and ther changes t the industry. Yu can visit the Discver Netwrk EMV Resurce Center, which prvides many free resurces t prepare fr yur migratin t EMV, including a training vide. Discver Netwrk als ffers in-stre signage t place n EMVenabled terminals, windws, and cunters. T view this signage, visit the Merchant Resurces Center at Remind emplyees abut the pwer f friendly custmer service A trained staff, sme patience, and friendly custmer interactin can g a lng way as the industry cllectively migrates t new and safer payments technlgy. Encurage emplyees t be attentive t each custmer and each transactin, especially as cnsumers have varying degrees f knwledge abut chip cards. By prviding an exceptinal level f custmer service, yu can truly make yur business stand ut frm the rest, gain cmpetitive advantage, and keep custmers cming back. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 18

19 Despite best effrts, fraud can happen s merchants shuld cntinue t be vigilant. Belw are sme suspicius behavirs by in-stre custmers that may indicate a fraud attempt. Makes randm purchases withut paying attentin t size, value r price Presents yu with a card taken frm a pcket instead f a wallet When asked, claims t have left pht identificatin at hme r in the car Arrives at r abut clsing time and tries t hurry yu thrugh the sale Purchases a large item and refuses delivery Displays n interest in the warranty n expensive items Is verly slw and deliberate when signing the sales draft, perhaps because the signature is being frged Attempts multiple cards in a shrt time perid CONCLUSION This guide t mdernize payment systems fcused n supprt fr chip cards acceptance and card transactin data security risks. Many imprtant steps and useful links were included t help yu build a slid payment system fundatin and prepare fr the future. Select yur needed partners carefully using this infrmatin t facilitate discussins which will help ensure an effective transitin t a mdernized payment system. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 19

20 Appendix A Glssary f Terms Acquirer Acquirer Prcessr Cardhlder Chip Card Chip Card Transactin CVM EMV EMVC Merchant MSP Payment Netwrk PTPE Payment Device Term Definitin An entity that is permitted by the payment netwrk t ffer acceptance f credit, debit and prepaid cards t Merchant. A third-party entity perating as agent f an Acquirer fr the purpse f perfrming certain Acquirer bligatins in cnnectin with card transactin. A persn t whm a credit, debit r prepaid payment card prduct is issued r an authrized user f such card. A card with an embedded integrated chip that is a cntact chip payment device, a cntactless chip payment device r a dual interface payment device. A card transactin that takes place with a chip card at a chip card terminal that cmplies with relevant perating regulatins and technical specificatins. Cardhlder Validatin Methd used t ensure that the persn presenting the card is the persn t whm the applicatin in the card was issued. The glbal standard fr credit and debit payment cards based n chip card technlgy. EMV is a trademark wned by EMVC, LLC. The crpratin that manages, maintains and enhances the EMV ICC specificatins fr chip-based payment cards and acceptance devices, including POS terminals and ATMs. An entity engaged in cmmercial peratins that cmply with the requirements set ut in the Discver Operating Regulatins and ther prgram dcuments. Merchant Services Prvider. An rganizatin that manages a netwrk t facilitate payments between Cardhlders and Merchants. Pint-t-Pint Encryptin. A slutin prvided by a third party slutin prvider, and is a cmbinatin f secure devices, applicatins and prcesses that encrypt data frm the pint f interactin until the data reaches the slutin prvider s secure decryptin envirnment. Cntactless D-PAS prducts can be issued in many different frms such as key fbs, stickers r mbile phnes. These devices are cllectively knwn as cntactless payment devices. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 20

21 PCI PIN POS Device Terminal Tkenized VAR Payment Card Industry Security Standards Cuncil. A glbal frum fr the nging develpment, enhancement, strage, disseminatin and implementatin f security standards fr accunt data prtectin. The persnal identificatin number r cde assigned by an Issuer that may be used by the Cardhlder t facilitate a card sale r cash advance n a POS device. An electrnic card reader, chip card terminal, cash register r terminal and any necessary sftware, lcated at the physical premises f a Merchant that is capable f electrnically capturing data frm cards and receiving electrnic evidence f authrizatin respnses and which may als be capable f transmitting electrnic evidence f sales data. An electrnic device that accepts and prcesses payment transactins. Substituting a sensitive data element with a nnsensitive equivalent, referred t as a tken. An entity that adds features r services t an existing prduct, then resells it (usually t end-users) as an integrated prduct r cmplete turnkey slutin. Merchant Guide t Mdernizing Yur Payment System ETA Discver Bmtwn 21