You may have noticed a new option for credit card Record Types when you go to process a credit card.

gotoBilling is pleased to announce that we have added AVS Only as a transaction type to the gotoBilling application.  AVS is short for Address Verification System, which simply tries to map/match the the address given with the card holder’s address.  AVS Only transactions are $0.00 transactions and are currently supported on the credit card platforms listed below.  As other platforms make use of this transaction type, it will be made available to all gotoBilling customers.

VITAL/TYSYS
Cardnet (First Data North)
Global East

The AVS Only transaction will also make use of the CVV code to reduce fraudulent use of credit cards.  Visa® calls this code Card Verification Value (CVV); MasterCard® calls it Card Validation Code (CVC); Discover® calls it Card ID (CID).   Whichever term you use, gotoBilling will send it along with the transaction to help prevent losses to the merchant.  In many cases, merchants will  use the AVS Only transaction to validate identity without charging or pre-authorizing an amount on a customer’s card.

If you have any questions, please feel free to let us know.  If you are unsure if your credit card processor supports AVS Only transactions, contact the number on your credit card statement.

There have been a lot of emails and letters circulating around lately about PCI compliance–a set of standards that everyone who accepts credit card payments must adhere to.  In an effort to de-mystify the whole PCI issue, we have listed here some frequently asked questions about PCI compliance, what it means and how it is administered?  We hope this will help many of you understand the process and why it was put into place.

Q: What is PCI?

A: PCI stands for “Payment Card Industry”, but it usually means one or other of the following:

1. The Payment Card Industry Security Standards Council. This is an industry body made up of  organizations like Visa, MasterCard, American Express, Discover, etc. The Council is how these  companies cooperate to agree upon a single, common security standard that they insist merchants meet.

2. The actual security standard put together by the Council described in the first definition above. The real name for this standard is the Payment Card Industry ‘Data Security Standard’ (PCI DSS). Merchants must meet this set of security requirements if their business accepts, transmits, or processes customer payment cards (such as credit cards or debit cards).

Q: What is the ‘PCI DSS’?

A: PCI-DSS stands for ‘Payment Card Industry Data Security Standard’. This is a (quite technical and broad-ranging) set of security requirements created by the Payment Card Industry, laying out what Merchants need to do to protect customer information. The PCI Council requires that Merchants meet this set of security requirements if their business accepts, transmits, or processes customer payment cards (such as credit cards or debit cards). Merchants that do not comply with these requirements can be penalized in a number of ways, up and including having their card-processing privileges revoked, leaving them unable to accept customer payment cards. A copy of the PCI-DSS is available here. It should be noted that this site gives Merchants additional tools and advice to help them deal with the requirements of the PCI-DSS.

Q: To whom does PCI apply?

A: PCI applies to ALL organizations or Merchants, regardless of size, that accept, transmit, or store any payment card information. In other words, if any customer of that organization ever pays using a credit card or debit card, then the PCI-DSS requirements apply.

Q: What if a Merchant refuses to cooperate?

A: PCI is not, in itself, a law: the standard was put together by business organizations including Visa, MasterCard, and the other major card companies. Merchants that do not comply with PCI-DSS are not necessarily breaking any law, but they are probably violating their Terms of Service or contract with their acquiring bank and the card associations. This means that the Merchant might be penalized or sued, or  these companies might refuse to work with the Merchant. This would mean that the merchant would be unable to process credit or debit cards.

Q: What does a merchant have to do in order to satisfy the PCI requirements?

A: To satisfy the requirements of PCI, a Merchant must do two things:

1. Comply with the Data Security Standard (by meeting all of the requirements laid out in the Data Security Standard), and

2. Validate their compliance. This means the Merchant must SHOW (in a manner appropriate to their size and situation) that they are complying with the Data Security Standard. For some Merchants (those with a high volume of card transactions, or with a history of security problems) validation involves on-site audits by certified professionals, but for many Merchants the primary requirements are

   1. annual completion and submission by the merchant of a PCI Self-Assessment Questionnaire (the ‘SAQ’); and

   2. where appropriate, undertaking a quarterly network vulnerability scan undertaken by a certified scanning company.

More information is available in the FAQ sections on Compliance and Validation. It is important to note that being in Compliance does NOT automatically mean that the Merchant has met their Validation requirement (in the same way that individuals must comply with the  Tax Code by paying income tax, AND validate their compliance via the use of receipts and other  documents.)

Q: What is the ‘Self-Assessment Questionnaire’?

A: The Self-Assessment Questionnaire is a form that Merchants may be required to complete every year and submit to their Acquiring Bank. It was created by the PCI Council. Completing a Self-Assessment Questionnaire helps Merchants do two things:

1. Check their Compliance, by finding out for themselves if they are in compliance with the Data Security Standard; and

2. Complete part of their Validation, but giving others, such as their Acquiring Bank, evidence that they are in Compliance with the PCI Data Security Standard. As of February 2008, there is no longer a single ‘one size fits all’ Self-Assessment Questionnaire. Merchants now need to identify which of 5 ‘Validation Type’ categories they fit into, and then complete the appropriate Self-Assessment Questionnaire for their category.

For some Merchants, the appropriate Self-Assessment Questionnaire is short and simple, which for other merchants the appropriate Self-Assessment Questionnaire is long and extremely technical. Note that for all versions of the Self-Assessment Questionnaire, Merchants will only pass if they pass (or be able to say ‘Not Applicable’ to) ALL of  the questions in the Questionnaire. This web site gives Merchants access to free tools and services that make it much easier for them to identify the Self-Assessment Questionnaire that is appropriate for them, and complete it. In fact, the tools here do it for the Merchant, based on their answers to some much simpler questions that this web site asks. Where the questions are complicated or technical, the tools provide expert assistance and guidance. Merchants also have access through this site to a variety of tools and services to help them quickly and easily solve any Compliance  failures they might have.

Q: What is the ‘SAQ’?

A: ‘SAQ’ stands for the PCI ‘Self-Assessment Questionnaire’. See the above question and answer for more detail.

Q: What is meant by ‘Compliance’?

A: Being in Compliance means ‘meeting all of the requirements laid out in the Payment Card Industry Data Security Standard’.  The requirements for Compliance are the same for ALL Merchants, large or small.   (However, smaller Merchants typically avoid many of the Compliance problems that larger organizations face, because their systems and networks are usually simpler.)

Q: What is meant by ‘Validation’?

A: Validation means a Merchant’s ability to show, via standard documents and/or tests, that they are meeting the PCI-DSS requirements. The different types of Merchant face different levels of Validation  burden, depending on which of four levels they are assigned to. Merchants that were directed to this web site are, at the very least, required to complete the Self-Assessment Questionnaire.

Q: How are the different Merchant Levels defined?

A: The following table defines the levels:

1. Merchant

2. Description

3. Level

Any Merchant that processes over 6,000,000 Visa or MasterCard transactions per year (regardless of whether:

1. The transactions are e-commerce or not), OR

   1. Any Merchant that is declared to be Level 1 by any Card Association

   2. Any Merchant that has suffered a security incident or attack that resulted in an account data  compromise

2. Any Merchant processing 1,000,000 to 6,000,000 Visa or MasterCard transactions per year.

3. Any Merchant processing 20,000 to 1,000,000 Visa or Mastercard e-commerce transactions per year. Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants

4. Processing fewer than 1,000,000 transactions per year.

Q: What meant by ‘Remediation’?

A: Remediation means the process of fixing any Compliance failures. A Merchant who constructs an appropriate remediation program and completes it will be (by definition) in compliance with the PCI-DSS.

Q: Is PCI a government program? Is it a law?

A: No: PCI is not, in itself, a law.  The standard was put together by business organizations including Visa, MasterCard, and the other major card companies. Merchants that do not comply with PCI-DSS are not necessarily breaking any law, but they are probably violating their Terms of Service or contract with their acquiring bank and the card associations. This means that the Merchant might be penalized or sued, or these companies might refuse to work with the Merchant. This would mean that the merchant would be unable to process credit or debit cards.

Q: Are Merchants required to use the tools provided through this web site to fix any Compliance problems?

A: No: The tools provided through this web site are offered as a low-cost convenient way to fix problems, but Merchants are free to use any remediation tools they want to fix their Compliance problems.   Merchants who use other tools are then solely responsible for making sure that those tools are  appropriately selected and properly implemented, and are then responsible for re-taking the Self-Assessment Questionnaire.

There are many ways to become compliant.  One is by using a service like www.getPCICertified.com that will help you through the process and will coordinate system scanning and policy generation.  Another is by going to the PCI-DSS website and following the instructions on the site itself.  Although this method is cheaper (it’s free for the SAQ) it may take more time to decipher the standard and put everything into place that it would take to have experts help you.  You would also have to obtain scanning elsewhere.  However,  if you only use PayPal or Google Checkout to process your transactions,  I recommend not using a service at all.  In this case the added expense simply isn’t worth it.  A simple SAQ A will do the trick.

PCI Security Standards

Understanding PCI compliance can make a person’s head spin.  Having never heard of PCI compliance myself, I headed to the internet to try and get the answers.  The Payment Card Industry Data Security Standard (PCI DSS) is a great resource but can also be confusing.

The PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. International, was founded to help facilitate the broad adoption of consistent data security measures on a global basis.  The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures network architecture, software design and other critical protective measures.  These standards are intended to help organizations protect customer account data.

I think in this day and age, we are all concerned about the security of our credit card numbers and someone stealing this sensitive information.  Well, PCI compliance is designed to make sure merchants handle any and all credit card numbers in a secure fashion.  Whether a merchant does one credit card transaction every six months or thousands in a year, ANYONE who takes credit cards as a form of payment needs to be PCI compliant.

PCI compliance is obtained by the merchant answering a standardized series of questions about the method in which they process credit card numbers.  The merchant’s responses to those questions and the company from whom the merchant purchases their PCI compliance will determine what happens next.  If you use a company like getpcicertified, you may receive policies and scanning in order to fulfill your PCI compliance.

So, if you are shopping for PCI compliance, make sure you know what you are shopping for and make sure you are treating credit card numbers as top secret ~ or you may leave yourself open for a data breach that could cost you your business.

PCI Security Standards

gotoBilling is happy to announce the installation of our new live support engine. The new format, admittedly different from our previous model, will result in faster support resolution times and greater transparency during the support process.

The next time you have a support issue, click the ‘Need Help?’.  You will be given the following screen.

Fill out the ’support ticket.’  The more information you provide, the quicker we can respond to your question and/or issue.  Simply Submit a Request to get the ball rolling.

You will receive updates on the progress of your ticket as your issue is being solved, so be sure to check you in-box.

The new engine also houses self help video tutorials and support articles related to most of the common support topics. The self help libraries are designed to provide you with quick answers to common issues and training aids.

We have also added a Feedback forum where registered users can submit ideas and suggestions for new features or how we can improve to better serve your business needs.  We welcome your feedback.  We do take into account all input we receive from you, our valued customers.

Great News!  You can now have all of your NSF and Uncollected Funds returns re-presented automatically, saving you both time and money.  gotoBilling can handle this step for you and take one more item off of your to-do list.

Here’s how the process works:

First, an ACH item is returned for either NSF or Uncollected Funds (R01 and R09 return codes).

Next, gotoBilling will automatically schedule the transaction to process again according to the schedule you choose.

The ACH Settlement Report will show the date that the transaction will be represented and the new transaction will appear in the Transactions tab and in the Customer Profile page along with the other pending transactions.

The Quick Stats on the Home Page will display that you have re-presentments scheduled and will provide you a link to view all re-presentments in queue.  The transaction details are listed including effective date, dollar amount and the presentment number.

The new transaction will appear in the Transactions tab and in the Customer Profile page along with the other pending transactions as well.  You will be able to delete or edit the re-presentment transaction in the same way you would edit any other transaction.

Once processed, the Settlement Report will display the 2nd and 3rd Presentments in their own sections for easy viewing.

Now–how do you set up your account for automatic re-presentments?  Easy, just email support@gotobilling.com or come into live support.  We will set up your account with the parameters you request.  Here are your options:

# of Presentments: 1, 2 or 3
You can choose to have a transaction only submit one time, or you can select the transactions to be submitted two or three times.  After 3 presentments, a transaction will be considered ineligible to re-present.  A new transaction must be started from scratch.

Timing of 2nd and 3rd presentments
Second and third presentments can occur according to predetermined schedules.  You can choose to have them scheduled for a certain number of business days following the return (such as 2, 3 or 4 days later).  You can opt to have them re-present on a given day of the week (the Friday following a return for example) or you can have them scheduled for common paydays of the 1st and 15th.

It’s just that easy.  Feel free to let us know if you have any questions.  We hope you enjoy the new feature and take advantage to all that gotoBilling has to offer.

gotoBilling Login |   PCI Standard

The PCI Standard is a mandatory global standard established by the Card Associations to ensure the protection of cardholder data. Based on twelve guidelines (PCI Security Standards Council), PCI requires merchants to make their physical and virtual environments secure. All merchants accepting credit cards as a form of payment are required by the Card Associations to adhere to the PCI Standard, which encompasses the security programs from Visa and MasterCard: CISP and SDP, respectively.

What Exactly Does This Mean?

Simply put, it means that every merchant that accepts credit card payments (and soon ACH  payments) from their clients must prove that their establishment is PCI compliant and has established procedures and policies in place to insure the security of their client payment information.

For most merchants, PCI compliance is an easy process and gotoBilling has provided the tools necessary to help each of our customers easily and painlessly comply with PCI requirements.

How Do I Get Started?

Easy! gotoBilling has provided a PCI ToolKit that will automatically guide you through the process. Don’t panic. It really is easy to comply with the PCI requirements using gotoBilling’s PCI Compliance Toolkit. In addition, gotoBilling has a PCI compliance specialist on staff that can assist you with compliance questions and issues if necessary. To get started, follow the instructions below.

1.)   Log into your gotoBilling Account.

2.)   Click the “Profile” link at the top of the page.

3.)   In the PCI box, click “Register”.

4.)   Complete the questionnaire  and click “Submit”
5.)   Check your email for a user name and password
6.)   Use your user name and password to log into the PCI Toolkit.

Your PCI ToolKit is customized exclusively for you depending on the level of compliance required for your establishment. Simply walk through the questions and follow all instructions. The PCI ToolKit will guide you through and, at the end, will produce all of the required compliance documentation necessary for your location and payment activities.

More To Come

gotoBilling will be sending out additional information and resources to help each of our customers understand the process and activate the ToolKit to insure compliance.  PCI compliance, at first, seems inconvenient to all of us. But it is a necessary and welcome measure to insure that each of us can be comfortable purchasing from any business knowing that steps have been taken to secure our personal information as much as possible. PCI really is good for consumers and businesses alike.

For more information, please contact pam@getpcicertified.com.

gotoBilling Login |   PCI Standard

gotoBilling Login |  Daily Report

ACH Settlement Reports are one of the most important tools for a merchant that processes ACH transactions.   The Daily Reports show what transactions processed on a given day but the ACH Settlement Reports contain the most critical piece of information: whether or not the transaction settled or returned.  Let’s take a look at how the process works.

When the merchant processes an ACH transaction, the transaction is moved to the daily report where it shows as processing.  (A more in-depth look at Daily Report is available in another article.)  However, the Settlement Report will show the result of that transaction and how it will show up in your checking account

.

Upon clicking “View” for the ACH Settlement Reports, the screen opens to reveal the date, number of checks, the check total, number of returns, return total, fee total and net deposit.  An important piece of information to note here is that fees from the ACH processor always show up in the ACH Settlement Reports on the first business day of the month located on the bottom left of the screen.

Click on a specific date that you want to view and it opens up to reveal a detailed view of the successful settlements and returns which are posted by batch number.

On both the batches and returns you will notice the Sent and Settle Dates located on the left hand side, which is an indication of how long it takes for the money to deposit into your account.  For example, this account is set up with overnight settlement timing as it was sent to the bank on the 4th and settled on the 7th. (The 5th and 6th were on a weekend.) If you have questions about what your settlement timing is, please contact your sales rep or log into support.

A concise view of the Net Deposit can be found on the  bottom right.  This will sum up the check total, fees and returns.

If you have any further questions on Settlement Reports please login to live support or email us at support@gotobilling.com.

gotoBilling Login |  Daily Report

gotoBilling website | How to Use Invoicing | Uploading Custom Headers and Logos

Did you know that invoicing is now free for all gotoBilling application users?

Check out this list of great features:

* Easy to use
* Can be sent automatically on a specific date or reoccurs on regular predetermined cycles you set
* Allows you to customize your freight and tax charges
* Reminds your customers that a payment is due
* Receives that payment electronically and deposits it directly into your checking account
* Enables you to put your logo on it
* Allows you to edit even after you’ve sent it out
* Can be done from your computer screen
* Involves not one sheet of paper!

Log into your gotoBilling account and click on the Invoices tab:

Click on the “Add” button:

Once there you can:

* Add or select a customer
* Select the effective (invoice date) and due dates
* Set your own shipping and tax rates

You can also:

* Select your occurrence: single or recurring by week, month, etc.
* Categorize your itemized invoice as a Service, Product or period of time
* Add another item

The below screen-shot shows you what an e-Invoice looks like with all fields filled out and other
items added:

And finally, here’s what you can do with the invoice once it is created:

* Send it
* Edit it (even after sending)
* Print it
* Receive automatic or external payments
* Delete it or
* Duplicate it

When you click on “Send Invoice”, the customer will receive a copy of the invoice in their email, as in the example below.   The customer simply needs to click on the invoice to pay it.  I’ve highlighted some of the features below in blue.  You can even customize the invoice with your own logo. (Please see the Customizing Logo tutorial for instructions.)

To view the Invoice’s status, you can click on the Invoices tab once again and there will
be a list of all of the invoices you have created.  One glance is all it takes to see who has paid and who hasn’t.

When the customer receives the invoice in their email, they will simply click on the “Pay, Print & View Online” button where they will get a detail of the current invoice.  From here, they can

* Print it
* Schedule a Payment
* See all of their Open, Past-Due and Closed Invoices

When they click on “Schedule Payment”:

They can choose to pay by check or credit card (subject to your processing parameters):

Clicking on the “Next” button will take them to a confirmation and agreement page.

Then upon clicking “Send Payment,” a confirmation page appears that will be followed by an emailed receipt.

To get started, simply log in to your gotoBilling account and click on the Invoices tab.  Also check out the online video-tutorials:  How to Use Invoicing and Uploading Custom Headers and Logos.  Watching these informative video tutorials will make you smarter and you’ll spend a lot less time than you would sending out those old tree-eating paper invoices your great, great, great-grandparents used to use.

So, get on board with us. Save a tree (or least a few twigs) and send your invoices the easy, convenient and environmentally-friendly way.  Even Spock would say it’s the logical thing to do.

gotoBilling website | How to Use Invoicing | Uploading Custom Headers and Logos

Custom Header Video Tutorial

Want to customize your gotoBilling e-invoices by adding your corporate logo?

Good. Here’s how you add your own special touch…

Once logged into your gotoBilling account:

1. Click on the ‘Resources’ link
2. Click the ‘View’ button in the My Settings panel

Once on the Merchant Settings page, scroll to the bottom:

Here you will see the function to find and upload your logo. Click on the ‘Browse’ button to locate
your logo. Note: as stated, optimal dimensions are 660×96 pixels, however, feel free
to experiment.

Once found, the field to the left of the Browse button will be populated with the path. Then
click the ‘Finish’ button.

To verify, once again click on the View button:

Scroll down:

Click the ‘Show’ link:

And your logo (hopefully better than this one) will display:

Note the file types that are accepted. Most likely yours will be just fine.

To see what your logo actually looks like in the invoice, you will need need to send yourself a test invoice that you can then delete later.

And that’s all there is to it!  Feel free to review the video tutorial.

Custom Header Video Tutorial

gotoBilling | gotoBilling Login

So, you have a customer that needs to change his or her banking information. Maybe his credit card was updated or he wants you to use another credit card. Or, maybe she is a first time customer and you need to add it to her profile.  No matter, it’s all really easy to do. Here’s how.

First, log in to your gotoBilling account and click on your Customers tab. When you find your specific customer you can either:

1. Select it and click edit, or
2. Right click on the name and select edit

Once there, scroll down until you see this section:

From here you can either:

1. Add a new banking account or
2. Edit an existing one

Let’s start with adding either a credit card or checking (ACH) account. Obviously, we need to click ‘Add Account’ and select an account type.  Here we’ll select ACH.

This takes you to this screen where you will fill out the appropriate information.

*Note: Routing numbers need to be nine digits long. Account numbers have no requirement but are usually over six digits. Enabled is automatically selected.

Here we can see that the account has been successfully added to the available bank accounts.

Now, if we want to edit or delete the account, just click on the account record and the window will open again. Edit as needed and click Save to commit the changes. You can also delete the account from here as well.

*Note: For security purposes the account field, once entered and saved, is truncated.

Now, let’s see the new bank account in action. Just select the customer, and then select the new account you just created.

gotoBilling provides an easy way to add, edit or delete bank account information for your customers with just a few clicks.

gotoBilling | gotoBilling Login