Best Practices for Payment Card Activities

Understand Policies and Procedures

Merchants must understand Longwood University’s policy and applicable procedures.  Compliance with the PCI standards at www.pcisecuritystandards.org is mandatory.

Protect Cardholder Data

• In order to mitigate the risks of accepting credit cards as a method of payment, departments should consider using TouchNet Marketplace when practical.
• Do not store credit card data unless required to conduct departmental business. Never store credit card numbers electronically in a database or spreadsheet, on portable media or on share drives.

• Never store sensitive authentication data - magnetic stripe data, chip data, the CAV2/CVC2/CVV2/CID, or the PIN/PIN block - under any circumstances.
• Do not store the full cardholder account number (PAN) with expiration date.  Mask all but the last 4 digits of the credit card number.

• Crossing through the primary account number (PAN) is not an acceptable means of securing the data on paper. Instead, remove the portion of the document containing cardholder data and shred. 
• Departments may not negotiate contracts with credit card processing companies or companies accepting credit card payments. All merchant accounts for accepting credit cards must be approved by the Bursar.

• Maintain up-to-date policies and procedures, including departmental desktop procedures.
• Ensure computers handling credit card data possess updated versions of University recommended antivirus and spyware detection software.
• Do not request, send or accept payment card information by email.  If you receive cardholder data via email, do not process the transaction.  Make the sender aware that, for their safety, they should never email credit card information.  Remove the cardholder data when responding and direct them to an approved processing method.  Delete the email containing cardholder data completely from your email account.
• Complete annual credit card security training upon hire and at least annually.
• Any confirmed or suspected breach should be reported immediately to the Information Security Office.

Implement Strong Access Control Measures

• Permit only those employees with a legitimate “need to know” access to cardholder data.
• Limit user access to specified privileges.

• Each employee with access to payment card information via computer should have a unique login or password. Log out of computer when unattended.  Never share passwords or user IDs.
• Never use vendor supplied default passwords.
• Passwords should be changed regularly – at least every 90 days.

Restrict Physical Access to Cardholder Data

• Always protect cardholder data against unauthorized access. Keep credit card information locked in a secure location (locked drawer, file cabinet, office or safe).
• Do not allow unauthorized persons access to areas where credit card data is stored.
• Restrict physical access to computer workstations and other equipment used in credit card payment processing. Physical space can be secured through the use of employee badges, swipe card or key access, or video camera monitoring.
• Destroy documentation containing credit card information when no longer needed for business or legal reasons. Approved destruction methods for hard-copy materials include shredding (via cross-cut shredder), incinerating or pulping. 

Best Practices for a “Card Present” Transaction

• Inspect card processing devices daily (prior to transaction processing) to ensure they have not been replaced, that no attachments have been installed, and that no tampering has occurred.
• Swipe and retain the card only until the transaction is authorized.
• The credit card number should be masked – only the last 4 digits of the credit card number should be printed on the receipt.
• Give the customer their receipt to sign, if applicable. Compare the signature on the receipt to the one on the card.
• The university does not recommend accepting unsigned cards. Departments accepting unsigned cards must require a second form of picture ID prior to completing the transaction.

Best Practices for a “Card Not Present” Transaction

• Direct cardholder to complete transaction through the department’s online payment system.
• Do not offer to enter payment card data into a third party website on behalf of a customer. The act of entering a payment on another’s behalf increases risks associated with credit card acceptance. Instead, direct customers to any internet enabled computer to complete their transaction.
• If departmental procedures permit the entering of payment card data on behalf of a customer, transactions must be conducted on a separate, secured payment terminal.
• If your department accepts credit cards in paper format (via mail), we recommend that you structure the form so that the credit card data can be removed (i.e. perforation at bottom of page) and shredded immediately following processing. This allows you to retain other information needed for business purposes without storing cardholder data.
• If card data is accepted by phone, develop a standard form (preferably on color paper) that is easily identifiable as containing credit card data and which can be shredded after the transaction is authorized.