Announcement

**Golf Tee Warehouse** · 26-Mar-2010, 08:48 AM

As you are using a PSP a scan of your website is not required for PCI-DSS compliance. This has been discussed before so probably worth reading through a couple of the large threads on the forum related to this topic as I am sure this exact same issue has been brought up particularly in relation to Security Metrics, along with suggestions on how to approach SM on the matter.

Actinics advice on PCIDSS can be found at http://www.actinic.co.uk/services/pci-dss.htm

**Duncan Rounding** · 26-Mar-2010, 09:00 AM

You are using Actinic Payments - you do not need to pass security checks on your site.

**Andy M** · 26-Mar-2010, 09:46 AM

Thankyou for the reply's.

From what I understand Meechs falls under SAQ validation type 4 as we take telephone orders and process them through the Actinic PSP.

Under Actinic guidlines it states we need to fill out SAQ C form and have an external scan carried out.

The scan we have paid for and had carried out has failed. But as far as I can see the points mentioned in earlier post are not things we can sort from this end.

I am also still a little confused as to why we would fall under SAQ type 4 becuase we do not process the telephone orders via PDQ we process them through Actinic PSP thus negating our responsiblilty for being compliant with payments.

Andy

**Golf Tee Warehouse** · 26-Mar-2010, 10:02 AM

If you take telephone orders you require a scan of your office network and NOT your website, which is much easier to pass, providing you have decent firewalls, etc.

If you take telephone orders, you need to comply with the extra requirements because although you process the card details through Actinic Payments you may be writing the details down on paper and you will be typing the details into your computer to transmit them to AP and are therefore vulnerable to keyloggers, etc hence the requirements relating to Anti-Virus/Anti-Malware software etc and having procedures to ensure card details are not stored and anyhting written down is shredded, etc.

**Andy M** · 26-Mar-2010, 10:41 AM

Thankyou so much for that advice. Have been on the phone to securitymetrics and explained and they are now rescanning my network not my website.

Thanks again
Andy♠

**The Baby Studio** · 28-Nov-2010, 11:34 PM

Our bank HSBC has written advising of compliance requirements - however they require proof we are compliant otherwise they will apply a �20 per month non compliance fee. :-(

We use PSP. Although we have the capability to accept telephone orders we have never had any. If we simply deactivate that option in our checkout will that be enough to ignore that side of it or do we need to do something i else?

D

**saucysal** · 01-Dec-2010, 10:10 AM

Only online

Hello D. We only accept orders placed by the customers online through SagePay. This way we just had to fill in a self-certifiing form for pci compliance with no fees to pay anyone. We considered it not worthwhile, as we received so few telephone orders anyway, to pay every year for an audit of our systems and the hassle involved. We also found that people wanting to place telephone orders, having been on our website as that is our only shop-front, were usually trying to avoid the 3D-Secure system, which is there to protect cardholders against fraud and to protect ourselves. Accepting payments by telephone to avoid this made nonsence of the 3D-Secure, and as well as the Third Man fraud checks. In addition to this, there was extra work in processing the telephone orders, though this was a comparatively minor consideration. We have found that as people have become more accustomed to 3D-Secure, now on most shopping websites, they are getting more adept at it and we can fewer requests to order by telephone.
Sarah

**The Baby Studio** · 01-Dec-2010, 08:33 PM

Thanks Sarah. I think we will take the same approach. Did you have to delist from taking phone payments with the bank or did you just stop taking those orders by removing the option from checkout?

Derwent

**pinbrook** · 02-Dec-2010, 08:40 AM

You will have to contact the bank to let them know what you do, they have asked you for proof of compliance. As others have said if you now only do online payment via psp then you can self certify .

But the bank won't know this until you tell them.

Announcement

PCI DSS Compliance

PCI DSS Compliance

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment