SlideShare a Scribd company logo
1 of 21
Download to read offline
Patricia O’Connor, Partner Account Manager
patricia.oconnor@iatspayments.com
PCI Compliance & Fraud
Prevention for Nonprofits
Don’t let the bad guys win!
Agenda
• The Harsh Reality:
Fraudsters
• First Step: PCI Compliance
• Tools for Fraud Prevention
• Resources
Who are they?
The Harsh Reality: Fraudsters
• Fraudsters are smart and dedicated
• Data breach vs. payment fraud
• Attack vulnerable websites
• Nonprofits have weaker security
• Nonprofits can lose both money and
reputation as a result of fraud
What do they do?
• Testing stolen card numbers
– $1.00 donations
• Card number tumbling
• Name tumbling
• Refund scam
• Creation of clone charities
Ways to STOP them
• Velocity checking
• Address verification (AVS)
• CVV2 capability
• IP blocking (high risk countries)
• Minimum transaction limit
• Payment Form
– iFrame (least risk)
– Direct Post (medium risk)
Fraud Tools
I
Quick Case Study
What is PCI?
• Payment Card Industry Data Security
Standard (PCI-DSS)
• All merchants (regardless of size)
must meet established standards of
security relating to how credit card data
is stored, processed, and transmitted
How PCI Helps
• Creates an actionable framework to
protect both nonprofits and donors
• Enables prevention, detection, and
mitigation of incidents
• Maintaining PCI certification helps build
donors’ trust
Becoming Compliant
• Identify level of compliance you need
• Complete either:
– Self Assessment Questionnaire (SAQ)
– Report on Compliance (ROC)
• Different types depending on systems
and processes
• Hire a security assessor
Compliance Levels
Level Description
1
Any merchant — regardless of acceptance channel — processing
over 6M Visa transactions per year. Any merchant that Visa, at
its sole discretion, determines should meet the Level 1 merchant
requirements to minimize risk to the Visa network
2 Any merchant — regardless of acceptance channel — processing
1M to 6M Visa transactions per year
3 Any merchant processing 20K to 1M Visa ecommerce
transactions per year
4
Any merchant processing fewer than 20K Visa ecommerce
transactions per year, and all other merchants — regardless of
acceptance channel — processing up to 1M Visa transactions per
year.
SAQ Types
SAQ Description
A Card-not-present (e-commerce or mail/telephone-order) merchants, all
cardholder data functions outsourced. This would never apply to face-to-face
merchants.
A-EP* E-commerce merchants who outsource all payment processing to PCI DSS
third parties and who have a website that doesn’t directly receive
cardholder data but can impact the security of the transaction.
B Imprint-only merchants with no electronic cardholder data storage, or
standalone, dial-out terminal merchants with no electronic cardholder data
storage
B-IP* Merchants using only standalone, PTS-approved payment terminals with an
IP connection to the processor and no electronic data storage.
C-VT Merchants using only web-based virtual terminals, no electronic cardholder
data storage
C* Merchants with payment application systems connected to the Internet, no
electronic cardholder data storage
P2PE-HW Merchants using only hardware payment terminals that are included in/managed
via a PCI SSC-listed P2PE solution. No card holder data storage.
D* All other merchants not included in descriptions for SAQ types A through C
above, and all service providers defined by a payment card brand as eligible to
complete an SAQ
Where Are You?
What to do…
• Achieve and maintain PCI compliance
• Talk to your merchant provider
– What tools are available?
– How to implement?
• Train your staff so they know what to
look for
– Refund policies, account patterns, etc.
Basic Strategy
As much as
possible to
someone else
Work hard to
only need to
follow SAQ-A or
SAQ-EP
Make sure you
understand
questions
But don’t totally avoid it
• PCI encourage useful habits
– Some of the policies are a
good idea anyway.
• Don’t sacrifice user experience
– Don’t outsource to a platform your users
will hate. That may cost you more than
compliance.
What Professional Vendors Do
• Scanning systems quarterly and annually
• Securing/removing direct access (physical and
software) to servers and networks
• Completely locking down direct access to all platform
APIs
• Fully logging every action taken on every server and
API
• Creating 2 factor authentication to all systems used
• Created strong internal processes and policies
around password strength/maximum allowed age,
SSL certificates, office access, and more…
Key Takeaways
• You must own the process
• PCI encourages useful habits
• Create a sustainable culture
• Don’t need to sacrifice user
experience
Resources from iATS
• White papers:
Credit Card Fraud
Prevention in Nonprofits
Payment processing 101
• Infographic:
Credit Card Fraud: How it
impacts nonprofits
• Infographic:
Why PCI-DSS Compliance
is a must have
General resources
• DrupalPCICompliance.org
• PCI Security standards
– https://www.pcisecuritystandards.org/s
ecurity_standards/documents.php

More Related Content

What's hot

How to test payment gateway functionality
How to test payment gateway functionalityHow to test payment gateway functionality
How to test payment gateway functionalityTrupti Jethva
 
Online payment gateway provider
Online payment gateway providerOnline payment gateway provider
Online payment gateway providerPayment Gateways
 
Pay Easy Solutions International
Pay Easy Solutions InternationalPay Easy Solutions International
Pay Easy Solutions Internationaljeanieaguilar
 
Trading Online – Getting started and how to grow your business
Trading Online – Getting started and how to grow your businessTrading Online – Getting started and how to grow your business
Trading Online – Getting started and how to grow your businessSecure Trading
 
Ccavenue presentation
Ccavenue presentationCcavenue presentation
Ccavenue presentationAnurag Vikram
 
Accepting payments online with BancNet Internet Payment Gateway
Accepting payments online with BancNet Internet Payment GatewayAccepting payments online with BancNet Internet Payment Gateway
Accepting payments online with BancNet Internet Payment GatewayJanette Toral
 
Payment Gateway
Payment GatewayPayment Gateway
Payment GatewayShujaShah
 
How to Start Payment Gateway Business in India
How to Start Payment Gateway Business in IndiaHow to Start Payment Gateway Business in India
How to Start Payment Gateway Business in IndiaMyOnlineCA.in
 
Webpay - Payment Gateway Business Plan
Webpay -  Payment Gateway Business PlanWebpay -  Payment Gateway Business Plan
Webpay - Payment Gateway Business PlanMufaddal Nullwala
 
Payments Testing @ Thinksoft
Payments Testing @ ThinksoftPayments Testing @ Thinksoft
Payments Testing @ ThinksoftThinksoft Global
 
Online Payment Transactions
Online Payment TransactionsOnline Payment Transactions
Online Payment Transactionspcomo2009
 
Boosting and securing online shopping - making PIN on phone a reality
Boosting and securing online shopping - making PIN on phone a realityBoosting and securing online shopping - making PIN on phone a reality
Boosting and securing online shopping - making PIN on phone a realityBSP Media Group
 
Semi-Integrated Payments / A Simplified Approach to EMV & PCI
Semi-Integrated Payments / A Simplified Approach to EMV & PCISemi-Integrated Payments / A Simplified Approach to EMV & PCI
Semi-Integrated Payments / A Simplified Approach to EMV & PCIIngenico Group
 
Small_Merchant_Guide_to_Safe_Payments
Small_Merchant_Guide_to_Safe_PaymentsSmall_Merchant_Guide_to_Safe_Payments
Small_Merchant_Guide_to_Safe_PaymentsSteve Abrams
 
Innovation led Digital payments Seminar
Innovation led Digital payments Seminar Innovation led Digital payments Seminar
Innovation led Digital payments Seminar TechXpla
 

What's hot (20)

How to test payment gateway functionality
How to test payment gateway functionalityHow to test payment gateway functionality
How to test payment gateway functionality
 
Netpay Presentation
Netpay PresentationNetpay Presentation
Netpay Presentation
 
Prepaid Payments License - Muds Management
Prepaid Payments License - Muds ManagementPrepaid Payments License - Muds Management
Prepaid Payments License - Muds Management
 
Online payment gateway provider
Online payment gateway providerOnline payment gateway provider
Online payment gateway provider
 
Pay Easy Solutions International
Pay Easy Solutions InternationalPay Easy Solutions International
Pay Easy Solutions International
 
Trading Online – Getting started and how to grow your business
Trading Online – Getting started and how to grow your businessTrading Online – Getting started and how to grow your business
Trading Online – Getting started and how to grow your business
 
PCI Compliance Process
PCI Compliance ProcessPCI Compliance Process
PCI Compliance Process
 
Ccavenue presentation
Ccavenue presentationCcavenue presentation
Ccavenue presentation
 
Accepting payments online with BancNet Internet Payment Gateway
Accepting payments online with BancNet Internet Payment GatewayAccepting payments online with BancNet Internet Payment Gateway
Accepting payments online with BancNet Internet Payment Gateway
 
Payment Gateway
Payment GatewayPayment Gateway
Payment Gateway
 
How to Start Payment Gateway Business in India
How to Start Payment Gateway Business in IndiaHow to Start Payment Gateway Business in India
How to Start Payment Gateway Business in India
 
Payment card for dummies
Payment card for dummiesPayment card for dummies
Payment card for dummies
 
Webpay - Payment Gateway Business Plan
Webpay -  Payment Gateway Business PlanWebpay -  Payment Gateway Business Plan
Webpay - Payment Gateway Business Plan
 
Seamless payment integration with shopify (1)
Seamless payment integration with shopify (1)Seamless payment integration with shopify (1)
Seamless payment integration with shopify (1)
 
Payments Testing @ Thinksoft
Payments Testing @ ThinksoftPayments Testing @ Thinksoft
Payments Testing @ Thinksoft
 
Online Payment Transactions
Online Payment TransactionsOnline Payment Transactions
Online Payment Transactions
 
Boosting and securing online shopping - making PIN on phone a reality
Boosting and securing online shopping - making PIN on phone a realityBoosting and securing online shopping - making PIN on phone a reality
Boosting and securing online shopping - making PIN on phone a reality
 
Semi-Integrated Payments / A Simplified Approach to EMV & PCI
Semi-Integrated Payments / A Simplified Approach to EMV & PCISemi-Integrated Payments / A Simplified Approach to EMV & PCI
Semi-Integrated Payments / A Simplified Approach to EMV & PCI
 
Small_Merchant_Guide_to_Safe_Payments
Small_Merchant_Guide_to_Safe_PaymentsSmall_Merchant_Guide_to_Safe_Payments
Small_Merchant_Guide_to_Safe_Payments
 
Innovation led Digital payments Seminar
Innovation led Digital payments Seminar Innovation led Digital payments Seminar
Innovation led Digital payments Seminar
 

Similar to PCI compliance and fraud prevention for non profits

PCI Compliance 101
PCI Compliance 101PCI Compliance 101
PCI Compliance 101pgalletta
 
ECMTA 2009 PCI Compliance and the Ecommerce Merchant
ECMTA 2009 PCI Compliance and the Ecommerce MerchantECMTA 2009 PCI Compliance and the Ecommerce Merchant
ECMTA 2009 PCI Compliance and the Ecommerce MerchantMelanie Beam
 
eCommerce Summit Atlanta Mountain Media
eCommerce Summit Atlanta Mountain MediaeCommerce Summit Atlanta Mountain Media
eCommerce Summit Atlanta Mountain MediaeCommerce Merchants
 
PCI DSS: What it is, and why you should care
PCI DSS: What it is, and why you should carePCI DSS: What it is, and why you should care
PCI DSS: What it is, and why you should careSean D. Goodwin
 
Payment Card Industry Compliance for Local Governments CSMFO 2009
Payment Card Industry Compliance for Local Governments CSMFO 2009Payment Card Industry Compliance for Local Governments CSMFO 2009
Payment Card Industry Compliance for Local Governments CSMFO 2009Donald E. Hester
 
A practical guides to PCI compliance
A practical guides to PCI complianceA practical guides to PCI compliance
A practical guides to PCI complianceJisc
 
Introduction to PCI DSS
Introduction to PCI DSSIntroduction to PCI DSS
Introduction to PCI DSSSaumya Vishnoi
 
Adventures in PCI Wonderland
Adventures in PCI WonderlandAdventures in PCI Wonderland
Adventures in PCI WonderlandMichele Chubirka
 
PCI Compliance for Community Colleges @One CISOA 2011
PCI Compliance for Community Colleges @One CISOA 2011PCI Compliance for Community Colleges @One CISOA 2011
PCI Compliance for Community Colleges @One CISOA 2011Donald E. Hester
 
You Know You Need PCI Compliance Help When…
You Know You Need PCI Compliance Help When…You Know You Need PCI Compliance Help When…
You Know You Need PCI Compliance Help When…Rochester Security Summit
 
Educause+PCI+briefing+4-19-20162345.pptx
Educause+PCI+briefing+4-19-20162345.pptxEducause+PCI+briefing+4-19-20162345.pptx
Educause+PCI+briefing+4-19-20162345.pptxgealehegn
 
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)Miminten
 
Payment Card Industry Introduction 2010
Payment Card Industry Introduction 2010Payment Card Industry Introduction 2010
Payment Card Industry Introduction 2010Donald E. Hester
 
Introduction to PCI APR 2010
Introduction to PCI APR 2010Introduction to PCI APR 2010
Introduction to PCI APR 2010Donald E. Hester
 
Icp Introduction To E Commerce Merchants September2009 Slide Share
Icp Introduction To E Commerce Merchants September2009 Slide ShareIcp Introduction To E Commerce Merchants September2009 Slide Share
Icp Introduction To E Commerce Merchants September2009 Slide Sharemattmullen
 
Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...
Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...
Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...Rapid7
 
Payment Card Industry CMTA NOV 2010
Payment Card Industry CMTA NOV 2010Payment Card Industry CMTA NOV 2010
Payment Card Industry CMTA NOV 2010Donald E. Hester
 

Similar to PCI compliance and fraud prevention for non profits (20)

PCI Compliance 101
PCI Compliance 101PCI Compliance 101
PCI Compliance 101
 
ECMTA 2009 PCI Compliance and the Ecommerce Merchant
ECMTA 2009 PCI Compliance and the Ecommerce MerchantECMTA 2009 PCI Compliance and the Ecommerce Merchant
ECMTA 2009 PCI Compliance and the Ecommerce Merchant
 
eCommerce Summit Atlanta Mountain Media
eCommerce Summit Atlanta Mountain MediaeCommerce Summit Atlanta Mountain Media
eCommerce Summit Atlanta Mountain Media
 
PCI DSS: What it is, and why you should care
PCI DSS: What it is, and why you should carePCI DSS: What it is, and why you should care
PCI DSS: What it is, and why you should care
 
Payment Card Industry Compliance for Local Governments CSMFO 2009
Payment Card Industry Compliance for Local Governments CSMFO 2009Payment Card Industry Compliance for Local Governments CSMFO 2009
Payment Card Industry Compliance for Local Governments CSMFO 2009
 
A practical guides to PCI compliance
A practical guides to PCI complianceA practical guides to PCI compliance
A practical guides to PCI compliance
 
Introduction to PCI DSS
Introduction to PCI DSSIntroduction to PCI DSS
Introduction to PCI DSS
 
Adventures in PCI Wonderland
Adventures in PCI WonderlandAdventures in PCI Wonderland
Adventures in PCI Wonderland
 
PCI Compliance for Community Colleges @One CISOA 2011
PCI Compliance for Community Colleges @One CISOA 2011PCI Compliance for Community Colleges @One CISOA 2011
PCI Compliance for Community Colleges @One CISOA 2011
 
You Know You Need PCI Compliance Help When…
You Know You Need PCI Compliance Help When…You Know You Need PCI Compliance Help When…
You Know You Need PCI Compliance Help When…
 
Educause+PCI+briefing+4-19-20162345.pptx
Educause+PCI+briefing+4-19-20162345.pptxEducause+PCI+briefing+4-19-20162345.pptx
Educause+PCI+briefing+4-19-20162345.pptx
 
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
PCI Compliance—Love It, Hate It, But Don’t Ignore It (11NTCpci)
 
Payment Card Industry Introduction 2010
Payment Card Industry Introduction 2010Payment Card Industry Introduction 2010
Payment Card Industry Introduction 2010
 
Introduction to PCI APR 2010
Introduction to PCI APR 2010Introduction to PCI APR 2010
Introduction to PCI APR 2010
 
PCI DSS
PCI DSSPCI DSS
PCI DSS
 
Icp Introduction To E Commerce Merchants September2009 Slide Share
Icp Introduction To E Commerce Merchants September2009 Slide ShareIcp Introduction To E Commerce Merchants September2009 Slide Share
Icp Introduction To E Commerce Merchants September2009 Slide Share
 
Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...
Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...
Demystifying PCI DSS: Expert Tips and Explanations to Help You Gain PCI DSS C...
 
PCI FAQs and Myths
PCI FAQs and MythsPCI FAQs and Myths
PCI FAQs and Myths
 
E commerce overview
E commerce overviewE commerce overview
E commerce overview
 
Payment Card Industry CMTA NOV 2010
Payment Card Industry CMTA NOV 2010Payment Card Industry CMTA NOV 2010
Payment Card Industry CMTA NOV 2010
 

More from NetSquared Vancouver

TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...
TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...
TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...NetSquared Vancouver
 
How to Make Your Donors’ Dollars Go Even Further
How to Make Your Donors’ Dollars Go Even FurtherHow to Make Your Donors’ Dollars Go Even Further
How to Make Your Donors’ Dollars Go Even FurtherNetSquared Vancouver
 
Show, Don’t Tell: How Your Data Can Reveal Your Impact Story
Show, Don’t Tell: How Your Data Can Reveal Your Impact StoryShow, Don’t Tell: How Your Data Can Reveal Your Impact Story
Show, Don’t Tell: How Your Data Can Reveal Your Impact StoryNetSquared Vancouver
 
Most Digital Transformations Fail – Make Yours Succeed - with Kevin Christop...
Most Digital Transformations Fail –  Make Yours Succeed - with Kevin Christop...Most Digital Transformations Fail –  Make Yours Succeed - with Kevin Christop...
Most Digital Transformations Fail – Make Yours Succeed - with Kevin Christop...NetSquared Vancouver
 
What is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime Value
What is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime ValueWhat is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime Value
What is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime ValueNetSquared Vancouver
 
Digital Marketing Diagnostics Part 1
Digital Marketing Diagnostics Part 1Digital Marketing Diagnostics Part 1
Digital Marketing Diagnostics Part 1NetSquared Vancouver
 
Digital Marketing Diagnostics pt. 2.pdf
Digital Marketing Diagnostics pt. 2.pdfDigital Marketing Diagnostics pt. 2.pdf
Digital Marketing Diagnostics pt. 2.pdfNetSquared Vancouver
 
Improve Your Event Marketing Strategies by Leveraging What Already Works
Improve Your Event Marketing Strategies by Leveraging What Already WorksImprove Your Event Marketing Strategies by Leveraging What Already Works
Improve Your Event Marketing Strategies by Leveraging What Already WorksNetSquared Vancouver
 
Sara Hoshooley — Building donor relationships in 2022
Sara Hoshooley — Building donor relationships in 2022Sara Hoshooley — Building donor relationships in 2022
Sara Hoshooley — Building donor relationships in 2022NetSquared Vancouver
 
Shelina Dilgir — Learning the latest trends in individual giving and donor st...
Shelina Dilgir — Learning the latest trends in individual giving and donor st...Shelina Dilgir — Learning the latest trends in individual giving and donor st...
Shelina Dilgir — Learning the latest trends in individual giving and donor st...NetSquared Vancouver
 
Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...
Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...
Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...NetSquared Vancouver
 
Meaningful Work: Building Resilience and Capacity through Skilled Volunteering
Meaningful Work: Building Resilience and Capacity through Skilled VolunteeringMeaningful Work: Building Resilience and Capacity through Skilled Volunteering
Meaningful Work: Building Resilience and Capacity through Skilled VolunteeringNetSquared Vancouver
 
Demo Event: Four Innovative Apps for Food Pantries and Food Banks
Demo Event: Four Innovative Apps for Food Pantries and Food BanksDemo Event: Four Innovative Apps for Food Pantries and Food Banks
Demo Event: Four Innovative Apps for Food Pantries and Food BanksNetSquared Vancouver
 
Measuring the Impact of Your Nonprofit
Measuring the Impact of Your NonprofitMeasuring the Impact of Your Nonprofit
Measuring the Impact of Your NonprofitNetSquared Vancouver
 
Measuring the Impact of Your Nonprofit
Measuring the Impact of Your NonprofitMeasuring the Impact of Your Nonprofit
Measuring the Impact of Your NonprofitNetSquared Vancouver
 
How Nonprofits Can Create 10x the Content Without More Work
How Nonprofits Can Create 10x the Content Without More WorkHow Nonprofits Can Create 10x the Content Without More Work
How Nonprofits Can Create 10x the Content Without More WorkNetSquared Vancouver
 
Leah Chang — E-tapestry lingo bingo worksheet
Leah Chang —  E-tapestry lingo bingo worksheetLeah Chang —  E-tapestry lingo bingo worksheet
Leah Chang — E-tapestry lingo bingo worksheetNetSquared Vancouver
 
Leah Chang — CRM naming poll sample
Leah Chang —  CRM naming poll sampleLeah Chang —  CRM naming poll sample
Leah Chang — CRM naming poll sampleNetSquared Vancouver
 

More from NetSquared Vancouver (20)

TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...
TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...
TechSoup Connect Western Canada: Data To Action: Making Your Data Visible and...
 
How to Make Your Donors’ Dollars Go Even Further
How to Make Your Donors’ Dollars Go Even FurtherHow to Make Your Donors’ Dollars Go Even Further
How to Make Your Donors’ Dollars Go Even Further
 
Show, Don’t Tell: How Your Data Can Reveal Your Impact Story
Show, Don’t Tell: How Your Data Can Reveal Your Impact StoryShow, Don’t Tell: How Your Data Can Reveal Your Impact Story
Show, Don’t Tell: How Your Data Can Reveal Your Impact Story
 
Most Digital Transformations Fail – Make Yours Succeed - with Kevin Christop...
Most Digital Transformations Fail –  Make Yours Succeed - with Kevin Christop...Most Digital Transformations Fail –  Make Yours Succeed - with Kevin Christop...
Most Digital Transformations Fail – Make Yours Succeed - with Kevin Christop...
 
What is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime Value
What is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime ValueWhat is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime Value
What is a New Member Worth? A Guide to Acquisition Costs + Member Lifetime Value
 
Digital Marketing Diagnostics Part 1
Digital Marketing Diagnostics Part 1Digital Marketing Diagnostics Part 1
Digital Marketing Diagnostics Part 1
 
Digital Marketing Diagnostics pt. 2.pdf
Digital Marketing Diagnostics pt. 2.pdfDigital Marketing Diagnostics pt. 2.pdf
Digital Marketing Diagnostics pt. 2.pdf
 
Improve Your Event Marketing Strategies by Leveraging What Already Works
Improve Your Event Marketing Strategies by Leveraging What Already WorksImprove Your Event Marketing Strategies by Leveraging What Already Works
Improve Your Event Marketing Strategies by Leveraging What Already Works
 
Jai Djwa — User Experience FTW
Jai Djwa — User Experience FTWJai Djwa — User Experience FTW
Jai Djwa — User Experience FTW
 
Sara Hoshooley — Building donor relationships in 2022
Sara Hoshooley — Building donor relationships in 2022Sara Hoshooley — Building donor relationships in 2022
Sara Hoshooley — Building donor relationships in 2022
 
Shelina Dilgir — Learning the latest trends in individual giving and donor st...
Shelina Dilgir — Learning the latest trends in individual giving and donor st...Shelina Dilgir — Learning the latest trends in individual giving and donor st...
Shelina Dilgir — Learning the latest trends in individual giving and donor st...
 
Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...
Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...
Kevin Christopher-George - Quantifying Your Desired Outcomes from Investments...
 
Meaningful Work: Building Resilience and Capacity through Skilled Volunteering
Meaningful Work: Building Resilience and Capacity through Skilled VolunteeringMeaningful Work: Building Resilience and Capacity through Skilled Volunteering
Meaningful Work: Building Resilience and Capacity through Skilled Volunteering
 
Demo Event: Four Innovative Apps for Food Pantries and Food Banks
Demo Event: Four Innovative Apps for Food Pantries and Food BanksDemo Event: Four Innovative Apps for Food Pantries and Food Banks
Demo Event: Four Innovative Apps for Food Pantries and Food Banks
 
Motivating Group Leaders
Motivating Group LeadersMotivating Group Leaders
Motivating Group Leaders
 
Measuring the Impact of Your Nonprofit
Measuring the Impact of Your NonprofitMeasuring the Impact of Your Nonprofit
Measuring the Impact of Your Nonprofit
 
Measuring the Impact of Your Nonprofit
Measuring the Impact of Your NonprofitMeasuring the Impact of Your Nonprofit
Measuring the Impact of Your Nonprofit
 
How Nonprofits Can Create 10x the Content Without More Work
How Nonprofits Can Create 10x the Content Without More WorkHow Nonprofits Can Create 10x the Content Without More Work
How Nonprofits Can Create 10x the Content Without More Work
 
Leah Chang — E-tapestry lingo bingo worksheet
Leah Chang —  E-tapestry lingo bingo worksheetLeah Chang —  E-tapestry lingo bingo worksheet
Leah Chang — E-tapestry lingo bingo worksheet
 
Leah Chang — CRM naming poll sample
Leah Chang —  CRM naming poll sampleLeah Chang —  CRM naming poll sample
Leah Chang — CRM naming poll sample
 

Recently uploaded

call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdf2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdfilocosnortegovph
 
call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...saminamagar
 
NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...
NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...
NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...Amil baba
 
(格鲁斯特大学毕业证学位证成绩单-烫金工艺)
(格鲁斯特大学毕业证学位证成绩单-烫金工艺)(格鲁斯特大学毕业证学位证成绩单-烫金工艺)
(格鲁斯特大学毕业证学位证成绩单-烫金工艺)twfkn8xj
 
Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...
Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...
Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...Christina Parmionova
 
Stop throwing your old clothes and start donating
Stop throwing your old clothes and start donatingStop throwing your old clothes and start donating
Stop throwing your old clothes and start donatingSERUDS INDIA
 
call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
Angels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptxAngels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptxLizelle Coombs
 
Call Girls Near Surya International Hotel New Delhi 9873777170
Call Girls Near Surya International Hotel New Delhi 9873777170Call Girls Near Surya International Hotel New Delhi 9873777170
Call Girls Near Surya International Hotel New Delhi 9873777170Sonam Pathan
 
call girls in Model Town DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Model Town  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Model Town  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Model Town DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
How to design healthy team dynamics to deliver successful digital projects.pptx
How to design healthy team dynamics to deliver successful digital projects.pptxHow to design healthy team dynamics to deliver successful digital projects.pptx
How to design healthy team dynamics to deliver successful digital projects.pptxTechSoupConnectLondo
 
call girls in DLF Phase 1 gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in DLF Phase 1  gurgaon  🔝 >༒9540349809 🔝 genuine Escort Service 🔝...call girls in DLF Phase 1  gurgaon  🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in DLF Phase 1 gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...saminamagar
 
call girls in Mehrauli DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Mehrauli  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Mehrauli  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Mehrauli DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️saminamagar
 
ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.
ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.
ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.Christina Parmionova
 
办理约克大学毕业证成绩单|购买加拿大文凭证书
办理约克大学毕业证成绩单|购买加拿大文凭证书办理约克大学毕业证成绩单|购买加拿大文凭证书
办理约克大学毕业证成绩单|购买加拿大文凭证书zdzoqco
 
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information -  United Nations Economic an...2024 ECOSOC YOUTH FORUM -logistical information -  United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...Christina Parmionova
 
2024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 252024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 25JSchaus & Associates
 

Recently uploaded (20)

call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in moti bagh DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Narela DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdf2023 Ecological Profile of Ilocos Norte.pdf
2023 Ecological Profile of Ilocos Norte.pdf
 
call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Kirti Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in Mukherjee Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
 
NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...
NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...
NO1 Certified kala jadu Love Marriage Black Magic Punjab Powerful Black Magic...
 
(格鲁斯特大学毕业证学位证成绩单-烫金工艺)
(格鲁斯特大学毕业证学位证成绩单-烫金工艺)(格鲁斯特大学毕业证学位证成绩单-烫金工艺)
(格鲁斯特大学毕业证学位证成绩单-烫金工艺)
 
Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...
Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...
Youth shaping sustainable and innovative solution - Reinforcing the 2030 agen...
 
Stop throwing your old clothes and start donating
Stop throwing your old clothes and start donatingStop throwing your old clothes and start donating
Stop throwing your old clothes and start donating
 
call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Laxmi Nagar DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
Angels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptxAngels_EDProgrammes & Services 2024.pptx
Angels_EDProgrammes & Services 2024.pptx
 
Call Girls Near Surya International Hotel New Delhi 9873777170
Call Girls Near Surya International Hotel New Delhi 9873777170Call Girls Near Surya International Hotel New Delhi 9873777170
Call Girls Near Surya International Hotel New Delhi 9873777170
 
call girls in Model Town DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Model Town  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Model Town  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Model Town DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
How to design healthy team dynamics to deliver successful digital projects.pptx
How to design healthy team dynamics to deliver successful digital projects.pptxHow to design healthy team dynamics to deliver successful digital projects.pptx
How to design healthy team dynamics to deliver successful digital projects.pptx
 
call girls in DLF Phase 1 gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in DLF Phase 1  gurgaon  🔝 >༒9540349809 🔝 genuine Escort Service 🔝...call girls in DLF Phase 1  gurgaon  🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
call girls in DLF Phase 1 gurgaon 🔝 >༒9540349809 🔝 genuine Escort Service 🔝...
 
call girls in Mehrauli DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Mehrauli  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️call girls in Mehrauli  DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
call girls in Mehrauli DELHI 🔝 >༒9540349809 🔝 genuine Escort Service 🔝✔️✔️
 
ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.
ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.
ECOSOC YOUTH FORUM 2024 - Side Events Schedule -16 April.
 
办理约克大学毕业证成绩单|购买加拿大文凭证书
办理约克大学毕业证成绩单|购买加拿大文凭证书办理约克大学毕业证成绩单|购买加拿大文凭证书
办理约克大学毕业证成绩单|购买加拿大文凭证书
 
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information -  United Nations Economic an...2024 ECOSOC YOUTH FORUM -logistical information -  United Nations Economic an...
2024 ECOSOC YOUTH FORUM -logistical information - United Nations Economic an...
 
2024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 252024: The FAR, Federal Acquisition Regulations - Part 25
2024: The FAR, Federal Acquisition Regulations - Part 25
 

PCI compliance and fraud prevention for non profits

  • 1. Patricia O’Connor, Partner Account Manager patricia.oconnor@iatspayments.com PCI Compliance & Fraud Prevention for Nonprofits Don’t let the bad guys win!
  • 2. Agenda • The Harsh Reality: Fraudsters • First Step: PCI Compliance • Tools for Fraud Prevention • Resources
  • 4. The Harsh Reality: Fraudsters • Fraudsters are smart and dedicated • Data breach vs. payment fraud • Attack vulnerable websites • Nonprofits have weaker security • Nonprofits can lose both money and reputation as a result of fraud
  • 5. What do they do? • Testing stolen card numbers – $1.00 donations • Card number tumbling • Name tumbling • Refund scam • Creation of clone charities
  • 6. Ways to STOP them • Velocity checking • Address verification (AVS) • CVV2 capability • IP blocking (high risk countries) • Minimum transaction limit • Payment Form – iFrame (least risk) – Direct Post (medium risk)
  • 9. What is PCI? • Payment Card Industry Data Security Standard (PCI-DSS) • All merchants (regardless of size) must meet established standards of security relating to how credit card data is stored, processed, and transmitted
  • 10. How PCI Helps • Creates an actionable framework to protect both nonprofits and donors • Enables prevention, detection, and mitigation of incidents • Maintaining PCI certification helps build donors’ trust
  • 11. Becoming Compliant • Identify level of compliance you need • Complete either: – Self Assessment Questionnaire (SAQ) – Report on Compliance (ROC) • Different types depending on systems and processes • Hire a security assessor
  • 12. Compliance Levels Level Description 1 Any merchant — regardless of acceptance channel — processing over 6M Visa transactions per year. Any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa network 2 Any merchant — regardless of acceptance channel — processing 1M to 6M Visa transactions per year 3 Any merchant processing 20K to 1M Visa ecommerce transactions per year 4 Any merchant processing fewer than 20K Visa ecommerce transactions per year, and all other merchants — regardless of acceptance channel — processing up to 1M Visa transactions per year.
  • 13. SAQ Types SAQ Description A Card-not-present (e-commerce or mail/telephone-order) merchants, all cardholder data functions outsourced. This would never apply to face-to-face merchants. A-EP* E-commerce merchants who outsource all payment processing to PCI DSS third parties and who have a website that doesn’t directly receive cardholder data but can impact the security of the transaction. B Imprint-only merchants with no electronic cardholder data storage, or standalone, dial-out terminal merchants with no electronic cardholder data storage B-IP* Merchants using only standalone, PTS-approved payment terminals with an IP connection to the processor and no electronic data storage. C-VT Merchants using only web-based virtual terminals, no electronic cardholder data storage C* Merchants with payment application systems connected to the Internet, no electronic cardholder data storage P2PE-HW Merchants using only hardware payment terminals that are included in/managed via a PCI SSC-listed P2PE solution. No card holder data storage. D* All other merchants not included in descriptions for SAQ types A through C above, and all service providers defined by a payment card brand as eligible to complete an SAQ
  • 15. What to do… • Achieve and maintain PCI compliance • Talk to your merchant provider – What tools are available? – How to implement? • Train your staff so they know what to look for – Refund policies, account patterns, etc.
  • 16. Basic Strategy As much as possible to someone else Work hard to only need to follow SAQ-A or SAQ-EP Make sure you understand questions
  • 17. But don’t totally avoid it • PCI encourage useful habits – Some of the policies are a good idea anyway. • Don’t sacrifice user experience – Don’t outsource to a platform your users will hate. That may cost you more than compliance.
  • 18. What Professional Vendors Do • Scanning systems quarterly and annually • Securing/removing direct access (physical and software) to servers and networks • Completely locking down direct access to all platform APIs • Fully logging every action taken on every server and API • Creating 2 factor authentication to all systems used • Created strong internal processes and policies around password strength/maximum allowed age, SSL certificates, office access, and more…
  • 19. Key Takeaways • You must own the process • PCI encourages useful habits • Create a sustainable culture • Don’t need to sacrifice user experience
  • 20. Resources from iATS • White papers: Credit Card Fraud Prevention in Nonprofits Payment processing 101 • Infographic: Credit Card Fraud: How it impacts nonprofits • Infographic: Why PCI-DSS Compliance is a must have
  • 21. General resources • DrupalPCICompliance.org • PCI Security standards – https://www.pcisecuritystandards.org/s ecurity_standards/documents.php