Navigating "PCI Compliance"

[Mike Blakesley]

Back when credit cards were starting to be a big thing in theaters, I signed up for NATO's program through Vantiv, which was going to combine all of the NATO theaters under one flag, thereby getting lower rates. We got set up with Vantiv through RTS, added a couple of card swipers to our terminals and life was good. Currently we are handled through Worldpay, which has been working fine.

Fast-forward to 2022. I started getting phone messages a few weeks ago saying that we needed to "update our PCI compliance" or words to that effect. Since I have a pretty strict rule against responding to phone messages that I didn't originate, I forgot about them. Write me a letter, I thought. Then a few days ago I got an email from Worldpay about the same thing, saying if we weren't "PCI compliant" we would start seeing extra charges on our processing.

So, I went to the website cited in the email and wound up at the Worldpay site, which is called saferpayments.com and started through the process. It got more and more complicated to where eventually there were so many questions I didn't understand, or terminology I had no idea what it meant, that I just gave up. Such as, "Is your payment application certified as compliant in line with the requirements of the Payment Application Data Security Standard (PA DSS) as set out by the PCI Security Standard Council?" How the "F" do I know this? I assume it is. But how do I find it out?

All of our credit card transactions run through RTS, so

There are over 200 questions like this sample:
"Is all non-console administrative access encrypted with strong cryptography, and is a strong encryption method invoked before the administrator's password is requested?"

I have a hard time believing all the other businesses in town have a person on their staff who can answer questions like this... has anybody else dealt with this? Is there a workaround for regular human beings?

[Frank Cox]

If all of your transactions run through RTS then they would be the ones who would know the answers to those questions and should probably be the ones who answer them on that worldpay website, as well.

The one-and-only time that I set up an online credit card payment system (for someone else, I don't take credit cards here) I quickly found out that doing all of the payments through the credit card processor's online payment form because trying to do it using my own form and meeting those PCI Compliance requirements was going to be a nightmare, whereas using the processor's payment form merely required me to create a url in the form of processor.com/payments/client=x;amount=y;ordernumber=z and that was literally all there was to it.

If you're using an online payment from from a credit card processor, which I guess you are, then they handle all of that stuff for you and you should be able to just forward that data request to them and call it done.

[Mike Blakesley]

Well I admit I didn't think of that... I will call RTS in the morning and find out. I like taking cards because the customers like it, but this is turning into a bit of a dumpster fire.

[Marcel Birgelen]

Over here, most POS software doesn't handle any payment card data, that's entirely up to the processor. The POS software just exchanges a transaction ID, the amount to be charged and waits for an OK from the payment terminal. That way, no credit or debit card information or any other personal information is ever stored on the POS system and as such, the POS system also doesn't need to be "PCI compliant".

If RTS shares payment information like credit/debit card numbers, or even personal information like card-holder name, then RTS needs to be PCI compliant. But it's up to RTS to provide this compliancy...

[Rusty Gordon]

Rusty from Sensible Cinema Software here chiming in. Sensible Cinema (and RTS) have versions that are out of scope of PCI, meaning our software doesn't handle card data but rather exchanges tokens back and forth from the processor and the POS using tokens via a "secure device". A secure device is a chip reader or PIN Pad which is end to end encrypted. Both Sensible and RTS have had these out of scope versions since at least 2015.

If you are using one of these "out of scope" versions then these compliance audit programs like Saferpayments (and Omnishield before that) are simply programs Worldpay/FIS use to pad your bill. Making compliance confusing and time consuming makes you throw your hands up and become so frustrated that paying the $25/month and non-compliance penalties is a lot less daunting. Essentially, if your software is out of scope and every bit and byte of data is encrypted end to end then your risk for a breach is negligible and all of these questions are merely theater.

There are some RTS (and other software including Veezi) users who are continuing to use swipers without encryption and software that is in scope of PCI compliance and those legacy systems require a higher threshold of compliance on the part of the POS, the theater costing you a lost of extra time and money avoided by upgrading to current software versions and modern hardware. Some converting from older software versions of Veezi and RTS to Sensible are entirely taken aback when told this legacy hardware cannot be used. Using unencrypted card swipers is a huge risk regardless of software brand you use because a virus or other malware can capture card swipe data as easily as keystrokes---because that's exactly what a magnetic stripe reader is doing--typing in card number data.

[Darin Steffl]

The questions are definitely crazy but just give them the answers they're looking for. Answer yes or no to what makes them happy so you're in compliance. As others have said, you should be using POS systems that are tokenized nowadays so the POS never handles the actual card number.

At our local MN theater, credit card sales are important because younger people don't carry much cash anymore. For any kid movie we show, about 70-80% of transactions pay by card. A family of 4 or 5 people easily spend $50-80 for tickets and concessions and they don't always carry that amount of cash. For movies PG-13 or R where fewer families come and it skews to older people, it's 80% cash usually and they spend much less because it's 1 or 2 people and they purchase fewer/small concessions than families do. For us, we show as many kid movies as possible because the per cap is highest as is the attendance. Older people tell us how much they love the theater but they sure hate spending money here, at least on concessions. We tailor to our best customers like families who spend the most money here which means offering credit/debit payment methods is a must. We also have tap to pay, apple, google, samsung pay. The young people love it!

Once we add our second screen, we'll be adding reserved seating which pretty much requires offering credit payments online.

[Mike Blakesley]

From this thread it really appears that we just need to upgrade our equipment. I've known that for a long time but I hate to spend the money. Normally I don't mind spending money on equipment we need but credit card readers are just a huge annoyance because all they are is a terminal with a keypad on it. They should cost about $79.99 but last time I bought one (for our parts store) it was over $600. But, time to bite the bullet I guess.

[Rusty Gordon]

From this thread it really appears that we just need to upgrade our equipment. I've known that for a long time but I hate to spend the money. Normally I don't mind spending money on equipment we need but credit card readers are just a huge annoyance because all they are is a terminal with a keypad on it. They should cost about $79.99 but last time I bought one (for our parts store) it was over $600. But, time to bite the bullet I guess.

If you can find them. Almost all of the low end models have been backordered nearly all the time for at least a year. None are as inexpensive as the Verifone VX805 or the Ingenico IPP320. If you need just a chip reader/swiper combo with no contactless, the IDTech Augusta has been available most all the time for around $200. PIN Pads though start at around $400 each... and again, IF you can find them.

[Mike Blakesley]

I would love to find a wireless solution - there are a couple of those in the compatibles list that RTS provides. I'm scared to ask what they might cost though!

[Rusty Gordon]

I would love to find a wireless solution - there are a couple of those in the compatibles list that RTS provides. I'm scared to ask what they might cost though!

Get me a list and I'll quote the equipment for you as well.

[Mike Blakesley]

To update this thread, we are now set up with a different card processor (Heartland), we have new machinery and can accept all the currently available forms of payment and we're PCI compliant, whatever that means! I need to go have a beer or something to celebrate, I guess!