- November 8, 2021
- Posted by: Contego Inc.
- Category: Running Your Business
Even way before the pandemic hit the world, a massive number of Canadians who own credit or debit cards preferred to make purchases using them. With the “new normal” life firmly in place, cashless payments have never been this important, both to businesses and customers.
Nevertheless, the proverbial elephant in the room for many businesses is finding a way to secure clientele card details from the prying eyes of cybersecurity criminals. Corporate data breaches and attacks are on the rise. For instance, ransomware attacks targeting corporates are happening every 11 seconds in 2021.
Therefore, whether you have just started processing credit card purchases or you’re a seasoned player in the industry, you need to tighten your cybersecurity belt. Besides, many businesses that previously dealt with cards only at point-of-sale and are now expanding to eCommerce need to know that these are two different areas that require a different set of security protocols.
In this article, we’re going to deal with why protecting customer credit card info is a do-or-do thing and best practices to achieve that. Let’s go!
Why Should You Protect Credit Card Data?
- Reputation: Each day, customers are becoming more sensitive to online privacy regarding their personal data, such as credit card numbers. Therefore, you might lose a business deal if potential conversions hear of a data breach history in your company. Protecting your face is crucial in the current competitive market.
- Compliance: By accepting payments through cards, you automatically put yourself in the net of Payment Card Industry Data Security Standard (PCI DSS). In case of an assessment or unfortunate event of a security breach, your organization might be slapped with hefty fines if it’s not compliant, not to mention the risk of getting your merchant account banned. You’d want to evade this at all costs, since the latter can completely crumble your business as customers who were paying using cards will be forced to decamp.
- Recovery Costs: The old golden rule of “prevention is better than cure” applies everywhere. Downtime and recovery costs can be extraordinarily unpredictable and high. Coupled with high ransoms cybercriminals demand, seeing your startup going down the drain to bankruptcy is something no one wishes to even dream of.
Well, as technology advances, so do the best security practices evolve. Let’s look specifically at the best ways you can secure client credit card data.
6 Ways You Can Securely Guard Credit Card Data at Your Business
1. Is it a Must You Store the Card Data?
If you deal with recurring sales or regular clients, storing the credit card data, including card number, the owner name, is vital for a quality customer experience. However, if this is not you, you might find out that you will have less PCI obligation by doing away with storing at all. But this doesn’t mean you ignore the security of the channels/network you use to process and transmit data during transactions. As a rule, don’t ask clients to send card details or photos via unsecured mail, text SMSs or other doubtful means.
2. Use Secure Hardware and Software
You have a variety of ways you can accept credit cards, including POS card readers, mobile payment devices, and software attached to your eCommerce site or third-party service providers. Unfortunately, criminals are constantly discovering new loopholes in hardware and bugs in software that they use as a gateway to your network. Therefore, it’s essential to continually update your system by removing susceptible hardware and patching software to eliminate bugs. You can keep in touch with a managed IT security provider who can monitor this for your organization.
3. Get a PCI DSS Compliance Assessment
Before and after you start accepting credit cards, your first line of defence is always to be sure you’re compliant with PCI DSS. When acquiring a merchant account, one of the rules you’ll find in the contract is that “I agree that my business is PCI Compliant.” The basis of Payment Card Industry regulation is that you should protect card details at rest and when in transit through encryption, hashing, tokenization, or truncation. The intensity of audit you need is purely determined by the size of your business and the systems that interact with the payment process. If you’re handling payment through a third party, be sure they are also compliant (the next point).
4. Use Approved Third-Party Credit Card Processors
In this era of SaaS (Software as a Service), you don’t have to run an in-house payment processing program. Nevertheless, it’s vital to be keen on who and where you’re outsourcing your software. For your company to remain PCI-compliant, you’ll also need to use only PCI DSS compliant vendors. Why should you pay for something that puts your business at risk?
5. Don’t Store CVV or Card Tracking Data
Card Verification Value, also designated as CVV2, CID, or CSC, is a 3-digit or 4-digit number found on the credit card’s back (or in front, as the case with American Express Cards). It is used to authenticate that the user initiating the transaction has the card at hand. On the other hand, the card track data is not visible to the naked eye but can be read by card readers popularly used in POS terminals.
With reports showing an increase of 87% of card frauds since 2010, you must never store this security number nor the track data, no matter what. In the event the card number and owner data get exposed, you’re sure no fraudulent transactions can happen without the CVV at least.
6. Be Wary of Where You Store Credit Card Numbers
It’s tempting to tie payment information to the customer by storing their credit card numbers within the CRM profile. This goes against the popular recommendation to never hold the client card details on your site or software.
The best way to store this sensitive information is to use secure “vaults” in the cloud, which is sometimes offered by the service provider you’re using. And if it is a must you store within the premises, then ensure the files are kept in an encrypted directory to deter any unauthorized person from accessing them. For physical files containing card data, keep them in safe drawers accessible only by a few people with that privilege.
On the other hand, you might be vulnerable without knowing if you receive orders via phone calls. Many businesses automatically record phone calls for use during service improvement strategies. Therefore, you should devise a way to immediately encrypt any phone recording that mentions a credit number by the buyer and move it to a password-protected directory. In addition, be sure your employees know that they shouldn’t write down credit card data on a piece of paper, and if they do, the paper should be shredded ASAP.
Do You Have the Right IT Partner?
Preventive measures are important, but proactive monitoring of your IT infrastructure for any changes that may indicate vulnerability is critical for your business to stay protected and resilient in case of an attack. Contact us to learn more about the benefits of consulting experts to prevent cyberattacks, or what to do after one occurs. You can also arrange a free threat assessment for your business.