In recent years, the electronic payments industry has become highly regulated, which only makes sense as it manages and transmits sensitive personal and financial data. The purpose of the imposed regulations is to protect all parties in the electronic payments chain, (i.e., cardholders, merchants, processors and banks) from breaches that can result in identity theft and fraud. CMS makes it a priority to maintain the highest level of security measures and controls to protect sensitive data and we are diligent in remaining compliant with all government and industry regulations.

We strive to assist all of our merchants to do the same. The CMS Security & Compliance Center provides you with resources to help you maintain strong security controls as well. We believe knowledge is power. Look around and learn how you can ensure a safer experience.

Card Brand Compliance

Please see the below links for the latest Visa and MasterCard rules and regulations:

American Express

Fraud Prevention

Individuals seeking to steal credit/ debit card data are increasingly targeting point-of-sale terminals and computer equipment. They will either replace your existing equipment with an identical looking machine or insert micro readers into your equipment that skims or reproduces cardholder data and even PIN numbers which they will in turn use themselves or sell to fraud rings.

Below are some tips to help protect you from such tactics:

TERMINAL OR EQUIPMENT PROTECTION

•  Verify and track all service and repair technicians that handle your point-of-sale equipment.
•  Make a record of the serial numbers on your equipment and inspect your equipment on a regular basis to confirm the serial numbers haven’t changed and ensure there are no signs of tampering.
•  Ensure that your point-of-sale zone has security cameras to record all activity.
•  Periodically inspect your countertop or point-of-sale area for hidden recording devices.
•  Utilize security cables or some type of tether to prevent your equipment from being exchanged.
•  Train your staff to be aware of strange behavior from customers (as well as other employees). Breaches are often the result of employee abuse.

PAYMENT GATEWAY OR SOFTWARE PROTECTION

• Ensure your provider maintains the proper SSL certifications and is PCIDSS Level 1 compliant.
• Disable remote access from the Internet.
• Ensure you are using the most current version of the software or gateway.
• Always change the system default passwords.
• Restrict access to as few employees as possible.
• Enable data encryption and login features.
• Implement a hardware-based firewall with advance security features.

VISA

• Visa offers a variety of materials to support your fraud prevention, security and risk management efforts.

Security Tips

Keeping your computer and network safe is one of the most important steps in protecting sensitive information. Using the resources provided here can help you keep your system up to date and your digital resources safe.

If you don’t currently have Anti-Virus and Anti-Malware software on your computer, we recommend installing a free product from each category:

VULNERABILITY SCANNING

Vulnerability Scanning is a method of scanning your computer and/or network for any vulnerabilities, included un-patched operating systems, programs, ports, and any many other flaws in a secure system.

• Secunia Online Software Inspector: Fast, easy web-based scanner.
• OpenVAS: Full Featured, programmable, open source vulnerability scanning.

MALWARE SCANS

Malware is short for Malicious Software. It is any software designed to secretly access a computer without the owner’s consent. Malware includes viruses, trojans, worms, spyware, adware, rootkits, crime-ware, and any other hostile, intrusive, or annoying software or code.

• Malwarebytes’ Anti-Malware: Powerful malware removal scanner
• Spybot Search & Destroy: Spyware and Malware removal with real-time protection
• SUPERAntiSpyware: Powerful Spyware and Malware removal (Recommended only if above two fail to remove malware and spyware)

REAL-TIME VIRUS SCANS

A Computer Virus is a malicious program that can copy itself and infect other computers, similar to natural viruses. Computers connected to networks and the Internet are all high targets for virus attacks.

• Avast! Anti-Virus: Powerful, lightweight Anti-Virus
• AVG Anti-Virus: Full Featured Anti-Virus
• Microsoft Security Essentials: Powerful Microsoft-based realtime scanner

* Complete Merchant Solutions is NOT responsible for your computer security, data integrity, or software. Use of any software or information found on this page is your own responsibility. Complete Merchant Solutions shall not be liable for any data loss, system failure, data corruption, inadequate protection, identity fraud, infections, hacking, or any other form of malicious issues.

PCI DSS Compliance

WHAT IS PCI DSS?

PCI DSS stands for ‘Payment Card Industry Data Security Standard’. This is a set of security requirements created by the Payment Card Industry, laying out what Merchants need to do to protect customer information. The PCI Council (which is an industry body made up of organizations like Visa, MasterCard, American Express, Discover, etc.) requires that Merchants meet this set of security requirements if their business accepts, transmits, or processes customer payment cards (such as credit cards or debit cards). Merchants that do not comply with these requirements can be penalized in a number of ways, up and including having their card-processing privileges revoked, leaving them unable to accept customer payment cards.

Get a copy of the PCI DSS. It should be noted that this site gives Merchants additional tools and advice to help them deal with the requirements of the PCI DSS.

WHAT IS A DATA COMPROMISE?

A data compromise or breach occurs when cardholder data has been lost or stolen. The most common breaches occur by:

• Theft of property which included cardholder data
• Stolen laptop or computer files
• Missing or stolen reports that may contain cardholder data
• Unlawful theft of cardholder data by an employee

HOW YOU CAN PROTECT YOURSELF

As a business, your customers and employees trust you with sensitive information. Learn more about what you can do to keep their data safe by visiting the FAQ section or contact our PCI Compliance department at 1-877-267-4324 (option 8) for assistance.

 Frequently Asked Questions  Glossary of Technical Terms

PCI Level Requirements

View Here: PCI Level Requirements

IRS Reporting and TIN Validation

OVERVIEW

On January 1, 2011, the IRS enacted section 6050W, an amendment to the Federal Housing Assistance Tax Act of 2008. This IRS mandate requires all merchant service providers to validate the legal name and Tax Identification Number (TIN) for every merchant in their portfolio, and report to the IRS all annual revenues associated with these accounts. At the onset of 2012 and each year thereafter, merchants will receive form 1099-K reporting their total gross sales of credit card transactions for the previous year.

HOW DOES 6050W AFFECT ME?

Section 6050W of the IRS Code requires reporting of all payment card and third party network transactions. Reporting entities will be required to file an annual information return with the IRS and provide all merchants with form 1099-K, reporting monthly and annual gross sales. To comply with this new law, it is critical that we have your correct taxpayer ID number (TIN) and business tax filing name. For additional details regarding this reporting and the validation of your tax information, contact us at 1-877-267-4324.

WHAT HAPPENS IF I DO NOT PROVIDE THE REQUESTED INFORMATION?

As an IRS requirement, effective 2013, merchants who have not provided their correct and matching Tax Identification Number (TIN) will incur a 28% withholding tax, from their gross credit card sales, for the previous year (2012). The 28% withholding tax will be held by our Sponsor Bank(s) and released only when notified by the IRS to do so or if not rectified, ultimately submitted to the IRS. CMS has no access to or control over these withheld funds. CMS has and will continue to attempt to reach each merchant to verify this information but it is ultimately the merchant’s responsibility to furnish the required information to avoid backup withholding tax and/or penalties.

To correct missing or unmatched Tax ID information, call CMS Customer Service at 1-877-267-4324