Payment security and PCI

Card security sounds like an IT topic, but most of it comes down to a few choices you make when you set up your POS: which card readers, which network, who can do what. This guide explains the standard in plain terms, from the standards body's own documents, and the settings that matter. Your processor tells you which questionnaire applies to you and when it's due.

What PCI DSS is

The Payment Card Industry Data Security Standard is set by the PCI Security Standards Council. It applies to "entities that store, process, or transmit cardholder data", which includes merchants. Your POS vendor and processor cover much of it, but some of it is always yours: your network, your devices, your staff's logins.

Self-assessment questionnaires

Smaller merchants usually confirm compliance with a self-assessment questionnaire (SAQ). The Council describes SAQs as "validation tools intended to assist SAQ-eligible merchants and service providers in performing and reporting the results of their PCI DSS self-assessment." Which one you file depends on how you take cards. In the Council's version 4.0 documents:

These descriptions come from the version 4.0 questionnaires; the current version is 4.0.1, and its wording changed slightly for some types. The Council advises merchants to "first contact the entity to which the SAQ will be submitted to confirm they are eligible", which for a restaurant usually means your processor.

Encrypted card readers (P2PE)

The Council says a point-to-point encryption solution "cryptographically protects account data from the point where a merchant accepts the payment card to the secure point of decryption," and that "merchants using PCI-listed P2PE solutions also have fewer applicable PCI Data Security Standard (PCI DSS) requirements." Ask each vendor whether its card readers are part of a PCI-listed P2PE solution, and which SAQ its customers typically file.

Settings that matter in the POS

• Individual logins for every employee, never a shared PIN, so every void, refund and discount is recorded against a person.
• Permissions by role. Refunds, voids after payment, large discounts and cash-drawer opens without a sale should need a manager.
• No card numbers on paper. Don't write card numbers down for phone orders; use the POS's card-entry screen or a payment link.
• Keyed cards kept rare. Typed-in cards cost more to process than tapped or dipped ones and skip the card's chip. See the card processing guide.
• Software kept up to date, on terminals, tablets and the router.

The network

• Keep POS devices on a separate network from guest Wi-Fi.
• Change the router's default password, and keep its firmware up to date.
• Don't let staff use POS devices for personal browsing or email.

Card-not-present orders and chargebacks

Online and phone orders don't have the chip or tap protection of a card presented in person. A few habits help:

• Use your online ordering system's own checkout, so card details never pass through your hands.
• For large phone or catering orders, take payment through a secure payment link.
• Keep order records, delivery confirmations and signed receipts, which you'll need to answer a chargeback.
• Watch your chargeback reports; a sudden rise is worth a call to your processor.

Offline payments

When the internet is down, some POS systems store card payments and send them later. Those cards aren't approved until the device reconnects, and declined ones are usually the merchant's loss. Set an offline limit per transaction. The food truck guide quotes three vendors' offline rules.

Questions to ask a vendor

1. Are your card readers part of a PCI-listed P2PE solution?
2. Which SAQ do your restaurant customers usually file, and do you help with it?
3. Do you charge a PCI compliance or non-compliance fee?
4. Can permissions for refunds, voids and discounts be set by role?
5. Is card data ever stored on the device or in the restaurant?