Q&A With Fidelity’s Director of I.T., Aron Pollak

As a leading provider of payment processing solutions for many businesses in the tri-state area, Fidelity keeps a close watch on emerging security threats—and unfortunately, in recent months, ransomware has been attacking businesses at growing rates. In our community alone, over a dozen companies have been targeted by this malicious software that locks the victim out of their files until a ransom is paid. 

Ransomware attacks can be incredibly costly for businesses, and more often than not, businesses are left on their own to pick up the pieces (even government agencies like the FBI are unable to help). That’s why our Director of I.T., Aron Pollak, took it upon himself to volunteer his expertise—alongside a group of technicians within the I.T. community—to assist many of the victims whose businesses were brought to a complete shutdown by ransomware.

Aron sat down for a brief interview with Fidelity’s Security Manager, Zalman Miller, to share some insights into the nature of these attacks, as well as some advice on what organizations can do to protect themselves.

As contactless payments explode in popularity (purchases made with mobile wallets grew by 82% this past Black Friday as compared to 2018!), we’d like to provide you with a brief overview of how contactless payments work and what their unique advantages are.

As a business owner, you are no doubt aware that accepting credit cards is a key component of doing business. Hardly anyone carries cash or checks anymore, so a business that does not accept cards is likely to lose customers to other businesses that do. However, opting to accept credit cards meaning paying processing fees for those transactions.  In a business with a tight profit margin, like a coffee shop where most transactions are $10 or less, those fees can add up over the course of a month and take a big chunk out of profits.

Many businesses simply accept these fees as a cost of doing business, and customers are unaware as they casually swipe their cards. But a growing number of merchants are frustrated to keep paying credit card processing fees and are looking at ways to pass them onto their customers.

If you’re processing credit cards, you’ve most likely heard of PCI compliance. What is it and how do you become compliant? We’ll walk you through it.

What is PCI?

The Payment Card Industry Security Standard is a set of guidelines that protect merchant and cardholder security.  If a merchant intends to accept card payments, the data must be hosted securely with an approved provider.

Online merchants become more at-risk for online fraud each year, making fraud detection and prevention a vital component of successful business.

The average number of successful fraudulent transactions grew 32.1% in 2015, with retailers reporting an average of 206 fraudulent transactions per month compared to 156 in 2014. Retailer’s prevention efforts simply aren’t keeping up with the growth in fraud.

What most merchants don’t know is that there are some powerful tools that come with most payment gateways. These tools can be used to gather information about an order to make an informed decision about whether or not to process the payment and ship an orders that may be potentially fraudulent.

You’ve no doubt had this experience: you’re checking out at a store and are asked for your ID at checkout when you use a credit card, perhaps if the purchase is over a certain amount. You might even have a policy about this at your own store.

Is it legal for businesses to ask for ID?

Yes, it is absolutely legal. However, card networks have rules that stores must abide by when it comes to dealing with verification. These rules vary depending on whether or not a signature appears on the back of the card.

Visa & Mastercard’s policy is that if the card is unsigned, the merchant must ask that the card be signed and that the customer provide government ID. If the card is signed, the merchant is not allowed to require ID.

Visa’s policy is that “merchants cannot as part of their regular card acceptance procedures refuse to complete a purchase transaction because a cardholder refuses to provide ID.”  Visa’s advice to merchants: if a cardholder looks suspicious, the merchant should make a Code 10 authorization request call that alerts the card issuer to suspicious activity without alerting the customer.

“A merchant must not refuse to complete a transaction solely because a cardholder refuses to provide additional identification information,” says MasterCard.  It even has a special page on its website that cardholders can report to them when merchants do this.

Impulse buys account for more than half of retail sales. While not all impulse buys are at checkout, it’s certainly the easiest place to implement them. Successful impulse sales are achieved by understanding the mindset of the customer.  By paying attention to placement, item size and the customer’s’ immediate needs, a successful impulse purchase strategy can be implemented.

Summer camps, snow removal and vacation services are only active for a small portion of the year. They require the ability to accept payments during those few months, but most processors  will charge them a monthly fee or have the merchant reapply each year. Is there a better option?

Come the seasonal merchant account, which is custom-made for this purpose. There is no need to pay unnecessary fees or waste time on the application process each year. Credit checks, which potentially lower one’s credit score, do not have to performed each year. Additionally, if a merchant had credit problems during the year, it could prevent the merchant account from being opened entirely, or force them to get set up with a more expensive service. Unfortunately, past processing history does not entitle a merchant to the same service in the future. A seasonal account prevents these issues entirely.

The seasonal account allows a merchant to “press pause” on their account as opposed to a “hard stop”.  This way, the account is ready whenever the business needs it and all that needs to be done is send the processor a re-opening letter.

However, there are several things to keep in mind:

An article by American Express offers some solid advice on precautions retailers should take to prevent losing business if unscrupulous customers claim they never received delivered orders.

Small businesses are generally hit hard by chargeback fraud. Aaron Press, Director, Payments & eCommerce for LexisNexis said, “We do know that small merchants invest less in fraud protection and are more likely to be defrauded because they have fewer ways to catch things in the process, And fraudsters know this.”

If your business receives too many chargebacks, aside from losing valuable, you can potentially damage your standing with the processing bank. If the chargebacks continue, you may even lose your merchant account and face difficulties finding another service provider.

Here are some tips on how to avoid chargebacks altogether:

A billing descriptor is the way your business name appears on your customer’s monthly credit card statement. This may seem simple, but there’s a lot to know about choosing your billing descriptor, and what you don’t know could cost you.

The job of a descriptor is to describe the product or service purchased by the customer to explain a charge or refund.  These descriptors are fixed in length; standard credit card transaction descriptor length is 22 characters max. It will generally include the DBA name of the merchant and the name of the product or service, separated by an asterisk. Some processors allow for the merchant’s telephone number or website as well.

The billing descriptor is important because it reminds a customer what the transaction was, and helps avoid groundless chargebacks. Therefore it is critical that these descriptors be as specific and informative as possible. For this reason, merchants have several options on how they may choose to appear on customer statements.

The basic information about your company can be presented in two ways: