Now, we need to Maintain a Vulnerability Management Program. This comes in two parts. First, we need to use and regularly update anti-virus software. Then, we have to develop and maintain secure systems and applications. I know what anti-virus software is, so let’s start there.

Before we look into AV software, I want to give one bit of basic Internet advice. If you don’t know/trust a person or site – don’t download ANYTHING they send you if you don’t have AV protection. The most common method of catching a computer virus is still from opened email attachments. Most people have some anti-virus (AV) protection for their computers, but to be PCI compliant, we need to look into software that will protect every computer and device connected to the Internet through our network.

There are a number of companies that make anti-virus software, compile virus databases, and offer frequent updates. Most of these companies have PCI compliant versions of their software. The standard single-PC software will cost $50 – $75 for a year’s worth of automatic updates. Unfortunately, this level of protection, while typically excellent for home users, will not meet PCI compliance. Part of the reason for this is that PCI compliance requires that your AV software be able to monitor and generate reports detailing what viruses it has caught/contained. We need to look at the more robust offerings for business networks. The range of prices in this field is vast from $350 – nearly $3,000 yearly. The top end software is really more of an anti-virus “system” that protects mainframes and large networks, so we can breathe a sigh of relief and look a little lower on the price points. For covering a network with a few devices for one year, including unlimited updates, and support, the average cost settles in at about $500-$700.

The next standard, “Develop and Maintain Secure Systems and Applications”, requires a little more than picking anti-virus software that will meet your needs. Looking at the requirements to meet this standard, it becomes obvious that we either need to know our way around a network, or we need to get our networking expert back to test our network after each update, make sure that we have a separate part of the network used only for testing applications, and system monitors that watch our network. Because of the scope of this requirement, the next article will be devoted to addressing the various aspects of maintaining the security of our systems and applications.

This updated list has improved readability and provides a greater level of detail about prohibited and restricted products.

If you have products or services you would like to sell online, and are considering 2Checkout for your e-commerce needs, please review our Prohibited Products List. If your products or services are listed as “restricted”, please contact our Risk department for more information.

Related Articles:

• Not sure if 2Checkout is right for you?
• 10 Questions Every 2Checkout.com Supplier Should Ask Themselves

Know your customer (KYC) is the due diligence that 2Checkout must perform to identify our vendors and to ascertain relevant information pertinent to doing financial business with them.

What does this mean for you? When you open a 2Checkout account, we will ask you for information that will allow us to identify you. This may include but is not limited to: requests for copies of your driver’s license, passport, or other identifying documents. We may also ask for you to complete a ‘risk document; a form that allows us to gather additional information about you and your business.

If you have been asked to provide us with such documentation, you may send them to us either by attaching them in response to our email request, or you may fax them to our secure machine at 614-921-2451 Attention: Risk.

2Checkout’s privacy policy assures the security of your information.

1. Am I selling a prohibited product?

This may seem like an obvious question but often it comes as a surprise to many when they are informed that the product they are selling via 2Checkout is actually prohibited. As an Authorized Retailer, 2checkout.com is actually reselling and accepting a degree of liability for the products you are supplying and therefore certain products, for various reasons, are not supportable.

To ensure the compliance of your services and/or products please take the time to review our Prohibited Product List.

Also please note that our Terms of Service has undergone many changes since the company’s formation in 1999. In many cases vendors whose accounts predate a given addition to the prohibited product list are considered “grandfathered” and permitted to continue sales provided that account does not attract an excessive amount of negative activity. Grandfathered status, however, does not apply to products or services that were prohibited due to issues of legality. If you have any questions concerning the acceptability of the products or services you sell please email risk@2co.com for evaluation by a risk analyst or investigator.

2. Is my website up and fully functional?

2Checkout.com Risk representatives must, at any given time, be able to review a vendor’s website and the services or products for sale. As such we require that websites be online, functional and available for review. If your website is not currently up and fully functional, your account could be subject to sales interruption at any moment. If you are experiencing downtime due to technical problems, scheduled maintenance or any other reason, please notify the 2Checkout.com Risk department at risk@2co.com.

3. Is my website meeting all 2Checkout.com requirements?

In order for a website to be considered a complete website by 2Checkout.com standards your site must contain a detailed description of the services that you offer along with their pricing structure and transaction process. It must also contain valid customer service information, a refund policy as well as a universally accepted privacy policy. If your website is not meeting any of the above requirements please make the appropriate updates to avoid sales interruption.

4. Do I have a “No Refund” policy?

2Checkout.com vendors are not permitted to have a “no refund” policy because, as 2Checkout.com is your authorized reseller, your refund policy must not conflict with our own. Please be advised that while we will make every effort to refer refund requests to the vendor, 2Checkout.com reserves the right to issue a refund at any time deemed appropriate by 2Checkout. It is understandable that, in the case of digital products this may pose some concern to vendors but please be advised that you may add additional terms to your policy for your protection. Also, there are many programs and cart systems available on the Internet which are able to track digital downloads and installations to prevent customer fraud.

5. Do I enter my customers’ orders, use my 2Checkout.com account for phone orders or allow customers to place orders on my computer at a trade show or at my store?

2Checkout.com vendors are not permitted to enter orders on their own accounts. This applies to orders taken from customers over the phone and use of a 2Checkout.com account as an in-store Point Of Sale terminal or public use at a trade show or convention. The reason for this is that, as an Internet reseller 2Checkout.com must ensure that buyers are placing orders from their own computers via the vendor’s website or emailed invoice. The origin of any order you place on your own account is impossible to determine and therefore not permitted. In addition, accepting customers’ credit card information directly is in violation of Credit Card Association regulations. Please see Question 7 for a detailed explanation of this regulation.

6. Are all of my products in stock at the time they are ordered?

2Checkout.com requires all products be in stock at the time of order. As 2Checkout.com’s terms state that vendors should not receive payment for undelivered items, purchases for pre-orders or out of stock items are not permitted. Also, unless in the very specific cases of web or software design or development, the use of a 2Checkout.com account to receive “deposits” or “down payments” on work yet to be completed is also prohibited. The reason for this is that, as an Authorized Retailer, every transaction must be for a product or service that has been supplied by the vendor before they are paid. The vendor receiving payment for items or services that have not been delivered increases the risk of the refund of funds already paid out to the vendor, which could result in a negative balance in your 2Checkout.com account.

7. Are my buyers being prompted for credit card info BEFORE being directed to 2Checkout.com?

Credit Card Association regulations state that only authorized merchant account holders are to directly accept credit card information from customers. Because your 2Checkout.com account is an Authorized Reseller account and not a merchant account, directly accepting a buyer’s credit card information is prohibited. This includes but is not limited to using your 2Checkout.com account as an in-store point of sale, accepting 2Checkout.com orders via phone or placing orders on behalf of your customers.

Many 3rd party cart systems are configured by default to prompt buyers for their credit card information before they are directed to 2Checkout.com. Because of this, some new suppliers/vendors may violate this important regulation without their knowledge. Due to the seriousness of this issue, this can often lead to the immediate disabling of sales ability on an account, until credit card information is no longer collected.

If your 3rd party cart is accepting credit cards and you need assistance removing this input you will want to contact that 3rd party cart’s support team. One of the most popular on line cart systems is osCommerce. By default, this cart will often prompt buyers for credit card information. If you wish to use osCommerce with your 2Checkout.com account, you will need to download and install the “pm2checkout” module that was created for OSC. More information about setting up osCommerce to work with your 2CO account can be found in the Knowledge Base article How can we set up the osCommerce Shopping Cart?

8. Have I provided complete and valid contact, identity and security information for myself and my business?

Please verify that you have supplied a valid phone number, address and email address for both the Business Contact Information and Username sections of your 2Checkout.com account. For the security of your account and any earned funds, also please ensure that you have specified an “Identity Number” for all usernames. In addition, please make sure that the “Payee” field of your Banking Details reflects the name of the person or business payments are being issued to. The name of your bank, for example, is not compliant, and could result in suspension of payment until the field is corrected.

9. Am I using my 2Checkout.com account to sell from multiple websites?

The 2Checkout.com license is for one URL only. Accounts are monitored and maintained on a per domain basis. Regardless of the products sold or ownership of alternate domains, if you sell from multiple URLs, you are required to open multiple accounts. For the opening of each additional account a $19 USD rebate is issued. To receive your rebate, please contact 2Checkout.com with the new account number and any previous accounts you may have. The $19 USD rebate will be applied to the oldest account.

10. Is 2Checkout.com properly represented on my website?

One of the most common misconceptions about 2Checkout.com is that 2Checkout.com is a Payment Gateway, Merchant Account Provider or Payment Processor. In actuality, 2Checkout.com is an Authorized Reseller and should be referenced as such on your website. This pertains to the verbiage used to describe 2Checkout.com, any credit card logos you may have on your site and the verbiage on your purchase links or buy buttons. Information on Acceptable Language compliance can be found in the Knowledge Base article What type of compliance disclaimer must I put on my site?.

As our business depends on your ability to sell, it is never desirable to disable a vendor’s sales ability due to compliance issues. Hopefully, this article will provide you with the information needed to address any issues before they result in an interruption of sales. Please reply to this blog with any questions or concerns that you may have regarding the policies referenced in this article. Please address any account or site-specific inquiries or compliance questions to risk@2co.com where your issue will be addressed by a risk analyst or investigator.

Related Articles:

• 2CO To Stop Selling Term Papers

A key aspect of this information is active tracking of refund and bank dispute amounts and percentages. These percentages play a key role in 2Checkout account evaluations, as well as determining the level of the rolling reserve that is applied to accounts.

2Checkout maintains the following criteria for acceptable refund and bank dispute percentages:

• Refund amounts should not exceed our acceptable limit of 10%.
• Bank Assisted dispute levels should not exceed our acceptable limit of 1%.

Percentages above these levels may lead to reserve increases, and can be detrimental to the overall profitability of your company.

Refunds and Bank Assisted Disputes that are deemed fraud related are weighted differently than those issued for service related issues, yet these stats should be monitored as well.

2Checkout encourages all vendors stay current on their account statistics and are proactive in using these tools to ensure the overall health and good standing of their accounts.

• Missed payments due to inaccurate bank information,
• Lost sales from customers unable to contact you for additional information,
• Missed contacts from 2Checkout.com regarding sales, payments, refunds or bank assisted disputes.

Additionally, 2Checkout’s Supplier Agreement states:

B. Truthful Information.
All information and data Supplier provides to 2CO, or for which it engages a third party to provide to 2CO is complete, truthful, accurate, valid, the lawful property of the Supplier, and Supplier has the right to communicate such information.

C. Verification
All email, domain, URL, physical address and telephone information provided by Supplier is complete and correct.

Information that is invalid or that presents excessive discrepancies may cause brief interruptions in your account status as we attempt to resolve them.

Taking a proactive role in the maintenance of your account information can help insure smooth, consistent daily operations for your account.

Before continuing further, please be aware that services of this type are restricted to US based operations only. The item must be shipped to, and serviced from, locations within the continental United States.

The Risk Management department of 2CO is prepared to allow repair/data transfer/maintenance services to be accepted with a 10% rolling reserve per the “Restricted Product” guidelines of our Allowed Products list, based on the following conditions:

1. The supplier must supply proof of a surety bond in an amount equal to 8x the approximate value of the items that would be shipped serviced. 2Checkout does not supply or facilitate bonding services, we would recommend you contact either your insurance company or http://www.nasbp.org for assistance in obtaining the bond. The bond must list the supplier as the principal for the bond, with 2Checkout.com as the obligee. The bond shall state the vendor will perform the contracted service on the product and return it to the customer in a condition equivalent to or better than it’s original condition. This would insure the funds to cover any losses 2Checkout may incur from loss of customer property due to negligence or loss on the part of the supplier.
2. Both purchasers and supplier must provide shipping insurance/delivery confirmation for the packages sent. We recommend the usage of DHL, Fed/Ex, USPS, or UPS shipping to ensure transparency of the timeframe in which the item(s) shipment was initiated/received. Your site must state this requirement to the customer clearly before the transaction takes place.
3. 2CO will require a guarantee that will protect us from the possibility of the service not being rendered through supplier inability, or other circumstances that may result in large numbers of cancellations or refunds of funds that we would have paid out to you before the service was completed. This should be a written statement, signed by the account holder, specifically stating 2Checkout bears no responsibility for reimbursement of repair/transfer/service for which the vendor has already been paid in the case of inability to service the request.
4. All products within the account must be listed as tangible, and no order may be marked as shipped until the merchandise has been shipped by the supplier. Valid tracking information must be entered at the time of delivery.
5. 2CO will also require a completed copy of the Risk Form and a record of your business history faxed to 614-921-2451 ATTN: Risk.

If you agree to these conditions, please respond with the requested paperwork and completed Risk Form.

There is a reasonable risk that an account may be used to avoid Venezuelan currency restrictions or to convert Venezuelan Bolivars (VEB) into U.S. dollars.

This decision is made only with regard to our reasonable uncertainty to the use of the account, and is not an accusation of wrongdoing on the supplier’s part.

The following conditions will apply to Venezuelan suppliers:

• Orders must be marked shipped only when they are indeed shipped. Orders must have verifiable tracking numbers. We can only accept tracking numbers from DHL, UPS, or FedEx transactions. Grupo Zoom, CopaCourier, MRW, and similar services are not acceptable shipping methods. We unfortunately cannot accept the sale if it is delivered via in-store pick up. Shipping information and tracking numbers must be provided for all orders in order for you to be paid for them. If an order is shipped without verifiable tracking numbers, we will have to refund the sale.
• Further documentation may be required by the fraud department prior to approving the sale. Once the Fraud Department has confirmed the sale with the card holder; the order can then be Passed and is ready to be shipped to the customer.
• Your account will go through a verifications process. Please see What is the Verifications Process? All orders must be voice verified received before the funds are released to you. It is important for customers to enter valid phone numbers to avoid any delays of the verifications process.
• Please be aware that any account that is found to be converting currency, or commiting other ToS violations in an attempt to circumvent our restrictions, will be assessed a fine equaling no less than 25% of it’s sales total. This penalty will be assessed at the time of account closure, prior to any funds releasing for completed transactions.