Now, we need to Maintain a Vulnerability Management Program. This comes in two parts. First, we need to use and regularly update anti-virus software. Then, we have to develop and maintain secure systems and applications. I know what anti-virus software is, so let’s start there.

Before we look into AV software, I want to give one bit of basic Internet advice. If you don’t know/trust a person or site – don’t download ANYTHING they send you if you don’t have AV protection. The most common method of catching a computer virus is still from opened email attachments. Most people have some anti-virus (AV) protection for their computers, but to be PCI compliant, we need to look into software that will protect every computer and device connected to the Internet through our network.

There are a number of companies that make anti-virus software, compile virus databases, and offer frequent updates. Most of these companies have PCI compliant versions of their software. The standard single-PC software will cost $50 – $75 for a year’s worth of automatic updates. Unfortunately, this level of protection, while typically excellent for home users, will not meet PCI compliance. Part of the reason for this is that PCI compliance requires that your AV software be able to monitor and generate reports detailing what viruses it has caught/contained. We need to look at the more robust offerings for business networks. The range of prices in this field is vast from $350 – nearly $3,000 yearly. The top end software is really more of an anti-virus “system” that protects mainframes and large networks, so we can breathe a sigh of relief and look a little lower on the price points. For covering a network with a few devices for one year, including unlimited updates, and support, the average cost settles in at about $500-$700.

The next standard, “Develop and Maintain Secure Systems and Applications”, requires a little more than picking anti-virus software that will meet your needs. Looking at the requirements to meet this standard, it becomes obvious that we either need to know our way around a network, or we need to get our networking expert back to test our network after each update, make sure that we have a separate part of the network used only for testing applications, and system monitors that watch our network. Because of the scope of this requirement, the next article will be devoted to addressing the various aspects of maintaining the security of our systems and applications.

Further Reading:

Clearing the Mystery of PCI Compliance (Part 1)
Clearing the Mystery of PCI Compliance (Part 2)
Clearing the Mystery of PCI Compliance (Part 4)
Clearing the Mystery of PCI Compliance (Part 5)
Clearing the Mystery of PCI Compliance (Part 6)
Clearing the Mystery of PCI Compliance (Part 7)

1. Am I selling a prohibited product?

This may seem like an obvious question but often it comes as a surprise to many when they are informed that the product they are selling via 2Checkout is actually prohibited. As an Authorized Retailer, 2checkout.com is actually reselling and accepting a degree of liability for the products you are supplying and therefore certain products, for various reasons, are not supportable.

To ensure the compliance of your services and/or products please take the time to review our Prohibited Product List.

Also please note that our Terms of Service has undergone many changes since the company’s formation in 1999. In many cases merchants whose accounts predate a given addition to the prohibited product list are considered “grandfathered” and permitted to continue sales provided that account does not attract an excessive amount of negative activity. Grandfathered status, however, does not apply to products or services that were prohibited due to issues of legality. If you have any questions concerning the acceptability of the products or services you sell please email risk@2co.com for evaluation by a risk analyst or investigator.

2. Is my website up and fully functional?

2Checkout.com Risk representatives must, at any given time, be able to review a website and the services or products for sale. As such we require that websites be online, functional and available for review. If your website is not currently up and fully functional, your account could be subject to sales interruption at any moment. If you are experiencing downtime due to technical problems, scheduled maintenance or any other reason, please notify the 2Checkout.com Risk department at risk@2co.com.

3. Is my website meeting all 2Checkout.com requirements?

In order for a website to be considered a complete website by 2Checkout.com standards your site must contain a detailed description of the services that you offer along with their pricing structure and transaction process. It must also contain valid customer service information, a refund policy as well as a universally accepted privacy policy. If your website is not meeting any of the above requirements please make the appropriate updates to avoid sales interruption.

4. Do I have a “No Refund” policy?

2Checkout.com merchants are not permitted to have a “no refund” policy because, as 2Checkout.com is your authorized reseller, your refund policy must not conflict with our own. Please be advised that while we will make every effort to refer refund requests to the merchant, 2Checkout.com reserves the right to issue a refund at any time deemed appropriate by 2Checkout. It is understandable that, in the case of digital products this may pose some concern to merchants but please be advised that you may add additional terms to your policy for your protection. Also, there are many programs and cart systems available on the Internet which are able to track digital downloads and installations to prevent customer fraud.

5. Do I enter my customers’ orders, use my 2Checkout.com account for phone orders or allow customers to place orders on my computer at a trade show or at my store?

2Checkout.com merchants are not permitted to enter orders on their own accounts. This applies to orders taken from customers over the phone and use of a 2Checkout.com account as an in-store Point Of Sale terminal or public use at a trade show or convention. The reason for this is that, as an Internet reseller 2Checkout.com must ensure that buyers are placing orders from their own computers via the merchant’s website or emailed invoice. The origin of any order you place on your own account is impossible to determine and therefore not permitted. In addition, accepting customers’ credit card information directly is in violation of Credit Card Association regulations. Please see Question 7 for a detailed explanation of this regulation.

6. Are all of my products in stock at the time they are ordered?

2Checkout.com requires all products be in stock at the time of order. As 2Checkout.com’s terms state that accounts should not receive payment for undelivered items, purchases for pre-orders or out of stock items are not permitted. Also, unless in the very specific cases of web or software design or development, the use of a 2Checkout.com account to receive “deposits” or “down payments” on work yet to be completed is also prohibited. The reason for this is that, as an Authorized Retailer, every transaction must be for a product or service that has been supplied before they are paid. Receiving payment for items or services that have not been delivered increases the risk of the refund of funds already paid out, which could result in a negative balance in your 2Checkout.com account.

7. Are my buyers being prompted for credit card info BEFORE being directed to 2Checkout.com?

Credit Card Association regulations state that only authorized merchant account holders are to directly accept credit card information from customers. Because your 2Checkout.com account is an Authorized Reseller account and not a merchant account, directly accepting a buyer’s credit card information is prohibited. This includes but is not limited to using your 2Checkout.com account as an in-store point of sale, accepting 2Checkout.com orders via phone or placing orders on behalf of your customers.

Many 3rd party cart systems are configured by default to prompt buyers for their credit card information before they are directed to 2Checkout.com. Because of this, some new accounts may violate this important regulation without their knowledge. Due to the seriousness of this issue, this can often lead to the immediate disabling of sales ability on an account, until credit card information is no longer collected.

If your 3rd party cart is accepting credit cards and you need assistance removing this input you will want to contact that 3rd party cart’s support team. One of the most popular on line cart systems is osCommerce. By default, this cart will often prompt buyers for credit card information. If you wish to use osCommerce with your 2Checkout.com account, you will need to download and install the “pm2checkout” module that was created for OSC. More information about setting up osCommerce to work with your 2CO account can be found in the Knowledge Base article How can we set up the osCommerce Shopping Cart?

8. Have I provided complete and valid contact, identity and security information for myself and my business?

Please verify that you have supplied a valid phone number, address and email address for both the Business Contact Information and Username sections of your 2Checkout.com account. For the security of your account and any earned funds, also please ensure that you have specified an “Identity Number” for all usernames. In addition, please make sure that the “Payee” field of your Banking Details reflects the name of the person or business payments are being issued to. The name of your bank, for example, is not compliant, and could result in suspension of payment until the field is corrected.

9. Am I using my 2Checkout.com account to sell from multiple websites?

The 2Checkout.com license is for one URL only. Accounts are monitored and maintained on a per domain basis. Regardless of the products sold or ownership of alternate domains, if you sell from multiple URLs, you are required to open multiple accounts. For the opening of each additional account a $19 USD rebate is issued. To receive your rebate, please contact 2Checkout.com with the new account number and any previous accounts you may have. The $19 USD rebate will be applied to the oldest account.

10. Is 2Checkout.com properly represented on my website?

One of the most common misconceptions about 2Checkout.com is that 2Checkout.com is a Payment Gateway, Merchant Account Provider or Payment Processor. In actuality, 2Checkout.com is an Authorized Reseller and should be referenced as such on your website. This pertains to the verbiage used to describe 2Checkout.com, any credit card logos you may have on your site and the verbiage on your purchase links or buy buttons. Information on Acceptable Language compliance can be found in the Knowledge Base article What type of compliance disclaimer must I put on my site?.

As our business depends on your ability to sell, it is never desirable to disable an account’s sales ability due to compliance issues. Hopefully, this article will provide you with the information needed to address any issues before they result in an interruption of sales. Please reply to this blog with any questions or concerns that you may have regarding the policies referenced in this article. Please address any account or site-specific inquiries or compliance questions to risk@2co.com where your issue will be addressed by a risk analyst or investigator.

A key aspect of this information is active tracking of refund and bank dispute amounts and percentages. These percentages play a key role in 2Checkout account evaluations, as well as determining the level of the rolling reserve that is applied to accounts.

2Checkout maintains the following criteria for acceptable refund and bank dispute percentages:

• Refund amounts should not exceed our acceptable limit of 10%.
• Bank Assisted dispute levels should not exceed our acceptable limit of 1%.

Percentages above these levels may lead to reserve increases, and can be detrimental to the overall profitability of your company.

Refunds and Bank Assisted Disputes that are deemed fraud related are weighted differently than those issued for service related issues, yet these stats should be monitored as well.

2Checkout encourages all vendors stay current on their account statistics and are proactive in using these tools to ensure the overall health and good standing of their accounts.

Why 2Checkout?

You have choices, compare our service with everyone else.
Show me.

Policy

All the legalese you need to know
Read the fine print.

Problems

We’ll solve them.
Feel Better.

Signup/Account Establishment Fee:

There is a one-time set-up fee of $49 USD.

Transaction Fees:

2CO applies a 5.5% commission on each transaction, plus a $0.45 USD charge per transaction.

Additional Penalties and Fees:

If you elect to pay the sign up fee via the check or PayPal method and we do not receive the funds, a manual adjustment can be made for the $49.00 USD plus a $25.00 USD manual processing fee from the current balance on the account.

Depending upon your funding selection, you can experience wire transfer costs. Additional fees can be applied for unsuccessful funding transfers, should the information provided to 2CO prove to be erroneous.

Should you elect to be paid by check, and fail to receive one via first-class mail, you can elect to pay applicable stop-payment fees in order to have the payment reissued in advance.

Chargeback experience can also result in fees passed along to you. We strongly encourage all contracted suppliers to assist in combating credit card fraud in order to minimize or eliminate fees of this type. Fees can vary depending upon utilization experienced by various suppliers.

Please review the Supplier Agreement, Operating Guidelines, and Fee Schedule for specifics regarding these fees.

Supplier Agreement:
https://www.2checkout.com/documentation/supplier_agreement.html

Operating Guidelines:
https://www.2checkout.com/documentation/op_regs.html

Fee Schedule:
https://www.2checkout.com/documentation/op_regs_a.html

2CO requires all accounts to clearly and concisely post the terms under which a product can be returned for full credit or a recurring billing cycle can be terminated. The policy should be clearly posted, easy-to-understand and provided to our Customer Care team for posting on your account. Only by requesting that the policy terms be included in our internal administration system can we be assured of notifying any customers as to terms that may be specific to a product or service supplied to us.

In most instances you will be notified as to any inquiry or complaint associated with the product you are supplying. If, however, 2CO determines that a failure to quickly cancel or refund a transaction would result in more harmful and costly chargeback procedures than it is likely that a refund or cancellation with be immediately transacted.

A chargeback is a forced refund from a bank/credit card provider. Each credit card provider has different policies and regulations regarding chargebacks. Please contact 2Checkout.com’s Dispute Department at chargeback@2CO.com for further assistance or review the chargeback articles for additional information on chargebacks and tools that can be used to minimize disputes.

1) Stop payments can be done upon your authorization. It will take 7-14 business days to void and invalidate the original check payment issued. The fee for this service is $30.00 USD. Funds will then be credited to the account balance and will be reissued as part of your next payment.

2) Check payments not received after 60 days from issue date can be voided per your request, at no additional fee. If the check has been cashed then the check can not be voided and a 2Checkout.com representative will contact you with the appropriate bank documents that will need to be completed. If the check has not been cashed it will take 7-14 business days for the funds to be credited back to the account balance and reissued as part of your next payment.

We can service merchants from almost anywhere in the world.

Merchants from Venezuela must meet certain conditions.

Merchants or banking institutions from the following countries are currently EXCLUDED from any type of operating arrangement with 2CO:

• North Korea
• Cuba
• Iran
• Sudan
• Syria
• Myanmar (Burma)