PCI Compliance PCI DSS

PCI compliance is a set of rules every business must follow if it accepts card payments. The card companies wrote them together, and the full name is PCI DSS. No government inspector turns up to check them. Your bank or your payment provider does the checking, and the punishment they hold is simple, they can stop you taking cards at all.

The rules sound heavier than they are. Most of them are ordinary habits. Do not write card numbers in a notebook by the till. Do not let five people share one login. Keep the software on the payment machine updated. Change the password that came printed in the box. Lock the room where the server sits. The one Linkysoft finds broken most often is the shared login behind the counter.

The most useful rule is the one that makes the rest easy. A good system never keeps the card number at all. The number goes straight from the customer to the payment gateway, and the gateway sends back a short code that stands in for that card, called a token. Your system stores the token. It can charge the same customer again next month with it, and it is worth nothing to a thief, because it only works from your account. That is how Storek handles repeat card payments.

The part nobody expects is who pays when card details are stolen from a shop. The bill is not only the money taken. There are fines from the card schemes, an investigation you have to pay for, the cost of telling every affected customer, and higher card fees for years afterwards. Small businesses have closed over a few hundred stolen cards. Read your merchant agreement, because it almost certainly puts all of that on you and not on the bank.

Most small businesses only fill in a short yearly questionnaire about themselves, and the questions get much shorter once the card number never reaches your server. Ask any supplier one plain question. Does your system ever see the full card number? If the answer is yes, ask why. When Linkysoft builds a web application that takes money, the payment step is handed to the gateway on purpose, so the shop keeps the sale record and never the card.