(click logo to return to home page at anytime)
Stop Paying More
Products
Partners
Testimonials
Blog
About
Advance Funding
Contact

October 22, 2007

paper checks are decreasing while use of electronic checks is growing

Fewer checks, faster process

By Patti Murphy
The Takoma Group

A new report out of London shows check usage is declining rapidly in the United Kingdom. The report, prepared by APACS, the U.K. payments association, reveals that check writing in that country fell 8% during 2006. Over the past 10 years, APACS reports, check writing by individuals in the U.K. has been cut in half.

The Federal Reserve is slated to release results from its latest payments research later this fall. I'm betting that data will show check usage declining by about the same percentage. That may not seem like much, perhaps, until you consider that the vast majority of checks written in America today are cleared electronically.

They aren't electronic payments, but by using electronic clearing channels, it's now possible to clear a check in a day. It's not electronic funds transfer, but it's darn close. And it pretty much guarantees that checks will be changing hands in the United States for many more years to come.

Direct comparisons of check usage in the United States and the U.K. don't hold much certitude. After all, Brits wrote only 1 billion checks in 2006. Optimistic estimates place U.S. check writing at about 30 billion last year.

According to the Fed's number crunchers, America's love affair with the check peaked about a decade ago.

We know anecdotally that fewer checks are being written today in the United States. How many of your kids write checks? How many fewer checks do you write today compared with just a few years ago? And we know more Americans are using electronic methods of payment more than ever.

Data collected in 2005 by Dove Consulting Inc., a division of Hitachi Consulting, indicated Americans were using cards more often than cash or checks for in-store purchases by a margin of 12% (56% using cards; 44% with cash or checks).

Just four years earlier, cash and checks were more popular, accounting for 51% of in-store purchases (49% of purchases in 2001 were made using credit, debit or other payment cards), Dove said.

The U.K. seems to have had better luck weaning folks off of checks. According to the APACS survey, only 54% of adults wrote checks last year; just 47% received check payments in 2006. Checks written to retailers fell 48% between 1996 and 2006, APACS said.

"On average we now write 1.6 [checks] a month and receive just one every two months, with half of adults no longer receiving any," APACS reported in The Way We Pay 2007.

Plenty of checks, less paper

Americans write an average eight to 10 checks a month, based on currently available data. Yet paper processing workloads have fallen drastically, because for the Fed and banks, imaging is emerging as the de facto standard for processing checks.

It's not unusual for a paper check to be physically handled a dozen times or more during a multiday clearing process.

With imaging, checks are truncated as soon as possible after entering the collection stream, then get cleared and settled using electronic networks that mimic the land and air-based check collection process. The result is that checks can clear now as fast as some electronic payments.

"Image exchange continues to account for a larger share of check processing because it enables institutions to reduce costs and streamline operations," said Susan Long, Senior Vice President at The Clearing House, which operates the SVPCO Image Payments Network.

And it's not just a big-bank phenomenon. The Independent Community Bankers Association of America , a Washington-based trade association, reports that most small banks (86%) either have replaced paper check presentment with electronic clearing or are planning to do so within the next two years.

More than a third of the banks surveyed by ICBA this year (36%) are capturing check images at branch locations for centralized processing. An additional 39% expect to be imaging checks for branch-level truncation.

Fewer banks (21%) have rolled out remote deposit products to their business customers (another 45% expect to within the next two years).

In 2005, the last time ICBA queried its members about payments activities, only 4% had business customers transmitting check files instead of trundling paper checks to their local bank offices for deposit.

SVPCO is said to extend to more than 10,000 endpoints, which makes it accessible to nearly all banks (either directly or through compatible networks like the Fed's).

In August, SVPCO saw a 250% increase in image check exchanges, compared to August 2006. All told, the network said it handled 263.8 million checks worth $454.5 billion last month.

Extrapolating, it seems fair to predict that by year-end 2007, SVPCO's final tally will top 3 billion checks. To put this into perspective, that's about the same number of consumer checks that were converted to electronic payments last year and processed through the automated clearinghouse (ACH) using a process known as ACH check conversion.

(In fairness to the ACH, a new check conversion format, known as back office conversion and implemented this spring, makes it easier for merchants and other businesses to embrace ACH check conversion. So, overall conversion numbers should be much higher this year.)

Checks aren't going away; not in the United States or the U.K. "Although volumes will continue to fall, we forecast that there will still be around 840 million checks used in the U.K. in 2016," said Sandra Quinn, Director of Communications at APACS. "If you placed these checks end-to-end, they would stretch around the world two and half times."

At current rates, it will take much longer for check numbers in the United States to drop below a billion a year. But make no mistake about it: Check imaging is changing the nature of payments. Just ask the Fed, which has closed nearly two dozen check processing offices over the past few years.

Eventually (maybe even before 2016), the Fed expects to be processing checks through one centralized locale. At its peak, the Fed's check workload was handled through a network of about four dozen regional processing shops.



--
Bill Hoidas
District Sales Manager
Larger B2B/MOTO/Internet Accounts
Product Development Manager
Matrix Payment Systems
(847) 381-3482 office
(847) 381-4289 fax
http://paymentconsulting.net
John 3:16 For God so loved the world, that he gave his only begotten Son, that whosoever believeth in him should not perish, but have everlasting life.

// posted by Bill Hoidas @ 2:24 PM 0 comments

October 08, 2007

Terms on your statement/application translated to English

Interchange-based fees (discount rate)

Authorization and other fees

Hopefully, this will be a useful guide to the various charges associated with merchant accounts. If you have any questions or comments, please contact me directly.

Let's build that million dollar portfolio.


// posted by Bill Hoidas @ 12:23 PM 0 comments

October 01, 2007

Your responsibilities as a merchant in preventing credit card theft & fraud-PCI compliance

PCI DDS 101

A Journey, Not A Destination


by Brett Callow and Rhonda Turner


Almost everybody has a credit card, and most people have more than one card. Between 1995 and 2006, the number of cards in circulation almost doubled. Unfortunately, credit card fraud has increased just as rapidly. In the U.S. alone, card issuers lost $1.24 billion to fraud in 2006, up 9.3% from $1.14 billion in 2005. Globally, fraud costs card issuers an enormous $48 billion. To put that amount in perspective, it’s more than the GDP of the oil- rich Gulf state of Oman.

Real world. Real cases.

High-profile cases from recent years include:

Credit card fraud harms consumers, it harms card issuers and it harms businesses. While consumers can normally recover their losses from card issuers and card issuers can pass their losses onto consumers, businesses have no such get-out-of-jail-free card. And, as demonstrated by the CardSystems case, credit card fraud can have catastrophic consequences for a business.
Such high profile cases have propelled security matters to center stage and brought about a new industry-wide global security program: the Payment Card Industry Data Security Standard (PCI DSS).

PCI DSS: history and background

In 2004, American Express, Discover, JBC, MasterCard and Visa joined forces to form the Payment Card Industry Security Standard Council (PCI SSC) with a mission to “enhance payment account security by fostering broad adoption of the PCI Security Standard.” To this end, Visa’s AIS and CISP programs and MasterCard’s SDP program were consolidated and updated to form the PCI DSS. The DSS provides a common framework intended to enhance the security of cardholder information throughout its lifecycle. Any business which stores, processes or transmits Primary Account Numbers (PAN’s) must comply with PCI DSS. The PCI SSC does not enforce compliance, instead that responsibility rests with the individual card issuers. While all businesses must comply with the PCI DSS, compliance requirements and the date by which compliance must be achieved vary according to the card issuer and the “Merchant Level” (see chart, following page). For most businesses, compliance is already mandatory. For all others, the compliance dates are fast approaching.
Non-compliance with PCI DSS can be extremely costly: a non-compliant businesses may incur a substantial fine and/or be prohibited from processing card transactions. Either could have a considerable impact on a business.
The SSC will monitor trends and emerging threats and update the DSS as necessary, so businesses must stay abreast of the latest requirements. That said, the non-static nature of the DSS should not present businesses with too much of a problem as the SSC anticipate that the DSS shall be amended only once per year.
The SSC is pushing hard to raise awareness of PCI DSS requirements. “The SSC is driving an aggressive program of educational activities around the Data Security Standard. We are participating in industry events, speaking at panels and conferences. Council leaders are meeting one on one with trade groups and industry associations, participating in webinars and evangelizing through the media,” said spokesperson Ella Nevill. But despite the efforts of the PCI SSC, many businesses have yet to validate their compliance. Recent surveys have shown that only about 50% of businesses currently comply with the DSS. Small businesses have been the slowest to react with only around 20% having so far achieved compliance.
To date, credit card issuers have been reasonably tolerant of the situation. The deadlines for compliance have been extended and only relatively few businesses have been subject to sanctions. But with fraud costing $48 billion per year, card issuers are likely to become increasingly insistent on compliance and increasingly likely to impose sanctions on businesses which do not comply.
So, what must a business do in order to comply with the PCI DSS?

The anatomy of the PCI DSS

The PCI DSS comprises 12 security requirements, subdivided into 6 categories:

Build and Maintain a Secure Network

Maintain a vulnerability management program

Maintain an information security policy

This represents only an overview of the PCI DSS requirements. For more detailed information, go to https://www.pcisecuritystandards.org/pdfs/pci_audit_procedures_v1-1.pdf

Merchant Levels and validation requirements

While all businesses must comply with the PCI DSS, it is important to note that the requirements for validation vary according to “Merchant Level”. The “Merchant Level” is determined by the number of transactions which a business processes during a year and by its exposure to risk. To complicate matters, the “Merchant Level” is not consistently defined across all card brands, but can be summarized as follows:

Level Level Description Validation Requirements Validation Due Date
1
  • Any business processing 6,000,000 or more transactions per year.
  • Any business which has suffered an intrusion which has resulted in data being compromised
  • Any business which a card Issuer decides should meet Level 1 requirements
  • Annual on-site assessment by a Qualified Secuirty Assessor (QSA) or internal audit (if signed by an officer of the company)
  • Quarterly network scan by an Approved Scanning Vendor (ASV)
 September 30, 2004 (Visa) or June 30, 2005 (Mastercard)
2
  • Any business processing between 1,000,000 and 6,000,000 transactions per year (or between 150,000 and 6,000,000 e-commerce transactions for MasterCard)
  • Annual PCI self-assessment questionnaire
  • Quarterly network scan by an ASV
 September 30, 2007 (Visa) or June 30, 2004 (MasterCard)
3
  • Any business processing between 20,000 and 1,000,000 e-commerce transactions per year (or between 20,000 and 150,000 e-commerce transactions for MasterCard)
  • Annual PCI self-assessment questionnaire
  • Quarterly network scan by an ASV
 June 30, 2005
4
  • Any business processing less than 20,000 e-commerce transactions and less than 1,000,000 other transactions per year (or less than 20,000 e-commerce transactions and less than 6,000,000 other transactions for MasterCard)
  • Annual PCI self-assessment questionnaire
  • Quarterly network scan by an ASV
 Discretionary


For detailed and specific information in relation to “Merchant Levels” and validation dates, businesses should consult with the relevant card issuer or acquiring bank.
Businesses must meet the expense of validation themselves; it’s not an expense which is covered by the credit card issuers. Should a QSA identify a problem which results in non-compliance, a business will need to remedy that problem before the QSA will reassess and confirm compliance. It is, therefore, in businesses best interests to ensure compliance in advance of the QSA conducting the initial assessment. For each day that a business is not validated as DSS-compliant, it is exposed to the risk of sanctions by card issuers – and, of course, to the risk of the data which it processes and holds being compromised.
For a list of PCI-approved QSA’s and NSV’s, see www.pcisecuritystandards.org
DSS-compliance is not only mandatory for retailers; it’s mandatory for third party service providers and acquiring banks must be compliant too. In fact, it is the responsibility of acquiring banks to ensure the businesses that they represent are DSS-compliant.
The importance of compliance

The PCI DSS is not a new concept. For years, card issuers have operated and enforced their own codes of conduct. Visa had the Cardholder Information Security Program (CISP), American Express had the Data Security Operating Program (DSOP), MasterCard had the Site Data Protection (SDP) program and Discover had the Discover Card Information and Security Compliance (DISC) program. While compliance with these programs was mandatory, many businesses remained non- compliant. This was partly due to the fact that card issuers were reluctant to take enforcement action as this would invariably have a negative impact on business relationships.
So, what’s different about the PCI DSS? Why should a business which failed to comply with the CISP, DSOP, SDP or DISC programs expend the time and resources necessary to become DSS-compliant? There are actually a number of reasons. Firstly, compliance makes good businesses sense. The loss of data can be exceptionally damaging, but proactively implementing a solid set of security protocols can prevent it from happening. Secondly, the marketplace and political climate have changed. In Minnesota, a bill was recently passed which put the requirements of the PCI DSS into law. Texas and other states are considering similar enactments. And credit unions and non-profits are lobbying for legislation which will enable them to recover the cost of issuing replacement credit cards from the retailer whose systems were breached. Thirdly, the cost of fraud is reaching an unbearable level and both consumers and legislators are demanding that credit card companies take action. The likely result of all this? Card issuers will probably now be far more inclined to impose sanctions in order to force businesses to comply.

Easing the pain of compliance

Ensuring the security of customer data can both enhance customer confidence and help maintain bottom line. The PCI DSS was introduced in order to raise the bar for cardholder data security, and achieving compliance should be high on the agenda of organizations that carry out business transactions involving the use of credit cards.
Implementing software tools for log management, vulnerability management, security scanning and endpoint security will go a long way towards helping you achieve compliance. However, the story does not end there. Just because a merchant receives a PCI stamp of approval, he simply cannot sit back and relax.
PCI compliance is but the beginning of a continuous process that requires regular monitoring of the security health status of the merchant’s network. PCI DSS is not a one-off certification that stops with the Qualified Security Assessor (QSA) confirming you are compliant, as some merchants may think. Becoming PCI compliant means that you have reached an acceptable level of security on your network but it does not mean that from then onwards your network is secure and cannot be breached. Maintaining PCI DSS compliancy status is just as, if not more, important.
PCI DSS compliance is a long-term journey, not a destination. And this is something that all merchants need to understand irrespective of size or business.
It is a cost of doing business, granted. Yet, the cost of compliance is lower than having to pay $500,000 in fines and losing your goodwill and credibility if your network is breached!


// posted by Bill Hoidas @ 7:42 PM 0 comments
http://www.blogcatalog.com/directory/business