Do You Process Credit Cards? Read This Now

If your business accepts credit or debit cards, you have agreed to follow a set of security rules, even if nobody ever explained them to you.

Those rules are the Payment Card Industry Data Security Standard, or PCI DSS. They are set by the major card brands and enforced through your merchant bank or payment processor. The standard applies to every business that stores, processes or transmits cardholder data, from global retailers to the neighborhood contractor who takes cards over the phone.

What it means for you

Why it matters to a small business

If card data is stolen from your systems, you can face fines passed down from the card brands, the cost of a forensic investigation, fraud losses, higher processing fees and, in the worst cases, losing the ability to accept cards at all. Small businesses are frequent targets precisely because their payment setups are often informal.

The safest card number is the one your business never sees or stores.

Common risky practices

• Writing card numbers down: On order forms, sticky notes or in notebooks.
• Emailing or texting card details: Messages sit in inboxes and backups for years.
• Storing numbers in spreadsheets or CRMs: “So we can charge them again next month.”
• Old or unpatched card terminals: Especially ones connected to the same network as everything else.
• Shared logins on payment portals: No way to know who did what.

How to reduce your burden

The easiest way to simplify compliance is to keep card data out of your environment. Use your processor’s hosted payment pages, point-to-point encrypted card readers and tokenization, so your systems never touch full card numbers. For recurring billing, let the processor store the card and give you a token.

Know your paperwork: Most small merchants complete a yearly Self-Assessment Questionnaire (SAQ). Ask your processor which SAQ type applies to you. The answer depends on how you take payments, and the right setup can shrink the questionnaire dramatically.

Take ten minutes this week

Walk through how you take payments: in person, online, over the phone and by invoice. For each one, ask where card numbers might be written, stored or sent. Every place you remove is one less place for a breach to start.