Loading...
HomeMy WebLinkAboutCredit Card Acceptance Policy 10.17.2109Kittitas County,Washington Credit Card Acceptance Policy and Procedures Approved by the County Finance Committee 2019 Approved by the Board of County Commissioners ,2019 Table of Contents Page Section 1:Purpose ..........................................................................................................................3 Section 2:Policy ..............................................................................................................:.............................3 Section 3:Specific Policy Provisions ..................................................................................................3 Section 4:Responsibilites of Departments ........................................................................................................3 Section 5:Processing Procedures ............................................................................................................4 Section 6:Accounting Procedures....................................................................................................................5 Section 7:Cardholder Problems,Refunds and/or Disputed Items................................................5 Section 8:Confidentiality and Security of Account Information ...................................................5 Section 9:Process for Responding to a Security Breach...................................................................................6 Section 10:Glossary ...................................................................................................................................6 Page 2 of 8 Pages Effective .2019 Section 1:Purpose The purpose of this policy is to establish guidelines to ensure safe handling and processing of debit/credit cards for security and compliance with the Payment Card Industry Data Security Standard (PCI DSS). In response to increasing incidents of identity theft,the five major payment card companies (American Express, Discover,JCB,Master Card,and Visa)formed the PCI Security Standards Council,an internally created organization that dictates data security standards by which merchants must adhere to when accepting credit cards. The PCI DSS was enacted to help identify and prevent theft of customer data,and is applicable to all businesses that accept payment cards to procure goods or services.Merchant compliance with this Standard is required and enforced by the payment card companies and generally,noncompliance is discovered when an organization experiences a security breach that includes cardholder data.Security breaches can result in serious consequences,including release of confidential information,damage to reputation,the assessment of substantial fines,possible legal liability,and the potential loss of the ability to accept credit card payments. Section 2:Policy The County has adopted the following policy and departmental procedures for all types of credit card activity transacted in-person where the County appears as the merchant.Individual departments may determine if it is necessary or feasible to accept payments via credit/debit cards by considering the volume and frequency of payments received. All transactions that involve the transfer of credit card information must be performed on systems that are hosted by a PCI compliant provider. Section 3:Specific Policy Provisions 1)Types of cards accepted.Departments may only accept merchant cards from credit card associations that have agreements with the vendor(s)utilized by the County. 2)Transaction or convenience fees.A transaction fee (convenience/processing fee)shall be charged to cover the cost of permitting a person to complete a credit card transaction and is paid to the vendor,not the county.Pursuant to RCW 36.29.190,a payer desiring to pay by a credit card,charge card,debit card,smart card,stored value card,federal wire,automatic clearinghouse system,or other electronic communication shall bear the cost of processing the transaction as a nominal fee set forth by the vendor.This fee is typically assessed as a percentage of the transaction amount. Section 4:Responsibilities of Departments Departmental responsibilities in the acceptance of the credit/debit cards include the following: 1)Funding the initial equipment lease. 2)Installation of equipment and training of employees. 3)Management of the system,including the following:required receipting,procedures,reconciliation,charge- backs,and communication with the processor. 4)Credit card transactions shall only be performed by authorized staff. 5)The employee handling the credit card transaction must verify the signature on the card or observe a picture ID. 6)An authorization approval code must be obtained from the merchant card processor,with real time authorization being the preferred method or telephone authorization as an alternative. 7)If authorization is not received the card cannot be accepted and an alternative means of payment will be required. 8)If fraud is suspected the procedures in County Policy 17 Identity Theft Prevention Program shall be followed. Page 3 of8 Pages Effective ,2019 9)Refunds or credits are to be pre-approved by management.They are to be processed to the original credit card number charged.Any exceptions are to be made by the Department Head.Refunds and credits are allowed under a reasonable time period established in advance by the department. 10)Departments may have more specific processes for accepting credit cards. 11)It is highly recommended that departments and offices utilize the same processor as the Treasurer. Section 5:Processing Procedures 1)Transmission of Credit Card Information a.Credit card information shall only be accepted in person,and the card must be present. 2)Card Present Transactions (Point of Sale) a.Verifying identity through a picture ID is compulsory. b.A receipt is provided to the customer. c.The credit card receipt will show no more than the last four digits of the credit card number. 3)Retention &Destruction a.All retention and destruction of shall be handled by the department receiving the payment. b.There shall be no physical retention of the credit card data. c.All transaction documentation and merchant receipts shall be stored in a secure (locked)area onlyforaslongasisnecessaryforproperrecordingofthetransaction. d.All transaction documentation and merchant receipts shall be shredded when the retention period has expired. The following procedures should be followed in accepting credit/debit cards in the course of business: 1)Processing equipment should be procured to allow customer data entry,swiping/insertion of cards,and automatic verification/approvalby the processing company. 2)Two receipts must be printed,one must be maintained by the County that is an original signed copy and the other is the customer receipt. 3)For credit/debit card payments,the application must validate the credit card number and the expiration date. As added measures of protection against fraud,unless impossible or unfeasible,the application should also validate the Card Verification Value (CVV)and/or verify that the billing address (AVS)matches that of the cardholder. 4)In order to avoid costly attempts at authorization and for fraud prevention,the application should release the session from memory after three failed attempts at authorization. Section 6:Accounting Procedures Reconciliation shall be done by the department on a daily basis,and all credit card information will be handed over to the Treasurer's office with the same frequency as any cash collected.Departments shall establish written procedures related to daily processes for reconciliation. 1)A daily accounting process must be established to reconcile and record credit/debit card receipts. 2)The Treasurer requests that your daily credit card deposit be reflected on your receipt (along with other currency types),and include a scan of your daily settlement when submitting your receipt on-line. 3)Refer to your merchant services provider for acquisition of reports,or to the Treasurer if you are partnered with their services. Section 7:Cardholder Problems and Disputed ltems 1)Departments are responsible for resolving and/or collecting on disputed or returned items that may occur. In the event that items remain unresolved after departmental efforts with cardholders or other processing Page 4 of 8 Pages Effective ,2019 problems,departments should notify the Treasurer of problems within a reasonable amount of time in order to obtain assistance in a resolution and satisfy accounting requirements. 2)If a customer files a chargeback,the department from which the original charge was initiated will research and dispute the charge in a timely manner.Hopefully,it was not a fraudulent charge and the customer seeking the refund simply does not recognize the charge and may need more documentation. Section 8:Confidentiality and Security of Account Information In order to maintain confidentiality of data the following processes must be abided by: 1)Credit card information shall not be stored for future use such as periodic billing or partial payments.The County shall not store credit card account numbers. 2)Only the last four digits of any credit card shall appear on a receipt or document where credit card informationis displayed. 3)Any electronic media containing cardholder information shall be securely collected and held as confidential. 4)The three digit card validation code printed on the signature panel of a credit card is never to be stored in any form. 5)All transactions shall occur at workstations that have antivirus software installed and updated regularly. 6)Terminals shall be located in secure area during and after work hours to prevent unauthorized access. Employees shall ensure logging off at the conclusion of the workday. 7)Background checks shall be performed prior to hiring or promoting any position with unrestricted access to credit cardholder information. Section 9:Process for Responding to a Security Breach In the event of a security breach or suspected security breach the Department must do the following: 1)Comply with County Policy 17 Identity Theft Prevention Program. 2)Contact the IT Director to assure the preservation of any electronic evidence and remediation. 3)Alert the merchant bank,payment card association and Sheriff's office.The Department Head will notify the Treasurer who will in turn notify the appropriate officials of any suspected breaches. 4)Within 48 hours of the breach the Department Head will provide the affected credit card association with proof of PCI compliance. 5)Within 4 business days of the breach the Department Head will provide the affected credit card association with an incident report. 6)At the request of the credit card association or depending on the level of risk and data elements compromised the IT Director will arrange for a network system vulnerability scan. 7)In the event that personal data is exposed the department shall comply with County Policy 17 Identity Theft Prevention Program. Page 5 of 8 Pages Effective ,2019 Approved by the Finance Committee on ,2019 Finance Committee Kittitas County,Washjngton A Approved as to Form: County Treasurer County Prosecutor Chairman Board of County Commissioners Approved on this date,,2019 by Resolution No. Board of County Commissioners Kittitas County,Washington air Commissioner Commissioner Attest Clerk of the Board Page 6 of8 Pages Effective ,2019 Section 10:Glossary Credit Cards-A plastic card used to initiate a credit transaction for the purchase of goods and services. Debit Cards-A plastic card used to initiate a debit transaction from a bank account for the purchase of goods and services. Receipt-A verification document to be printed duplicate and presented to the customer before credit card payment can be accepted. Address Verification Service (AVS)-A risk management tool that enables the County to verify the billing address of a customer presenting a credit/debit card for payment.An AVS request is included with the transaction authorization request.A code is returned by the Issuers indicating whether the address given by the cardholder matches the address in the Issuers file.A partial or no-match indicates a fraud risk. Card Verification Value (CVV)-A unique value calculated from the data encoded on the magnetic strip on a credit/debit card,validating card information during the authorization process.The 3 digit,non-embossed number printed on the signature panel on the back of the card immediately following the last four digits of the credit/debit card account number. Issuer-Financial institution that issues credit/debit cards to cardholders and with which each cardholder has an agreement to repay the outstanding debt on the card. Chargeback-A processed transaction that is later rejected by the customer and returned to the Acquirer. Page 7 of 8 Pages Effective ,2019 Exhibit 1 Payment Card Industry Data Security Confidentiality /Non-DisclosureStatement -Processors As a member of the staff of Kittitas County I acknowledge that in the course of my employment I may have access to personal,proprietary,transaction-specific,and /or otherwise confidential data through the processing of credit card transactions. As an individual with responsibilities for processing,storing and/or transmitting credit card data,I may have direct access to sensitive and confidential information in paper or electronic format.To protect the integrity and the security of the systems and processes as well as the personal and proprietary data of those to whom the County provides service,and to preserve and maximize the effectiveness of County's resources,I agree to the following: I will maintain the confidentiality of my password and will not disclose it to anyone. I will utilize credit card data for payment processing purposes only. I have been provided a written copy regarding the proper storing,protection,and disposal of such confidential data and I will ensure that any such data is shredded or otherwise disposed of as per approved office policy when no longer needed. I have read,understand,and agree to abide by Kittitas County Credit Card Policy. The use of sensitive credit card data for personal purposes is illegal and is grounds for termination.The abuse of systems access or unauthorized disclosure or distribution of any customer's credit card data may result in prosecution. Name (Print): Signature/Date: Department: Manager/Supervisor: Page 8 of 8 Pages Effective ,2019