Credit Card Acceptance & PCI Compliance

Ball State University only has one payment processor that is supported and properly vetted for PCI Compliance, CASHNet. You can create e-commerce sites directly in CASHNet (Storefront or Checkout); or we can integrate with third party vendors to accommodate specialized needs. Some examples of CASHNet integrations include: Tix.com to manage seating for our theater, StarRez manages student housing information, and T2 assigns parking permits/citations. These third party vendors start the transaction with the customer, then redirect the customer to CASHNet for payment collection. Once the payment has been received, CASHNet will send a response back to the vendor system to reconcile records. This ensures that all of the burden of security resides solely within CASHNet. No department is permitted to use any external payment processors (like PayPal or Square) without the expressed consent from view email.

All credit card transactions will incur fees from the credit card companies. When we create e-commerce sites, we must decide whether we want to absorb those fees or pass them off to the customers. For domestic credit cards, the online credit card processing charge is 2.85% (with a minimum of $3.00) when you pass fees and 2.4% when you absorb fees. International credit cards are charged 4.25% in both methods. If you decide to absorb the fees, there will be a chargeback assessed against your revenue account at the beginning of each month (for the previous month's purchases). If your department is not able to absorb any costs, Transact Payments can be configured to pass those fees onto the customer. Your accounts will not show the fees passed to the customers, but they will display on your Transact Payments reports (as CONVFEE) and on the customer's credit card statements. If your department utilizes a third party vendor as a front-end of an e-commerce transaction, they may charge additional fees for their service.

Another consideration when dealing with credit card transactions, is the cost of data breaches. If there is a case of fraud in which Ball State University is found to be guilty of poorly handling credit card data, we could incur fees of up to $200 per breached card number. This includes forensic investigations ($50,000 - $100,000), repairs, new software/hardware/personnel investments, victim communication and credit monitoring, legal expenses, bank reimbursements, bank and card brand fines (up to $500,000 from each card brand). We would have to hire an external investigator for at least one year (approx. $50,000). We may also get penalized by our acquirer in the form of increased credit card processing fees, or even the cancellation of our contracts entirely. This is why it is very important that Ball State University is never found to be in the "scope" of a credit card data violation. If we utilize only approved payment processors, like CASHNet, and follow the procedures outlined in the Credit/Debit Card Handling Procedure, we should be safe from such litigation.

E-commerce dos and don'ts are similar to the normal Credit Card Dos and Don'ts (tab above), except for these additional concerns:

Dos

• Review the Credit/Debit Card Handling Procedure document carefully.
• Create a link on your departmental website that points to either a CASHNet eMarket, or a vendor's portal website.
• You can create index cards with the URL, or QR code, that directs customers to the appropriate website for payment.
• You can instruct customers to find a random computer for payment (do not point to any specific computer); or better yet, ask them to use their own personal device (like a cell phone, tablet, or laptop).
• Review the PCI-DSS training (PDF) document, then ensure that you and your relevant staff members complete the annual PCI Training (Requirements tab above) online.

Don'ts

• If you have a user account in a system that collects, stores, and/or processes credit card data (like CASHNet); you must not share your username/password with anyone else.
• You must not enter any credit card data into the credit card processing system on behalf of a customer. Doing so places your computer in scope of PCI compliance because it would be considered a "Virtual Terminal" for payments. Hackers could target your computer with key logging software that can look for credit card numbers that are entered and send them to an external server for storage without your knowledge. The only way to ensure this never happens is to never enter credit card data from a Ball State computer.
• Along those same lines, you cannot designate a bank of computers for customers to use on-site. In doing so, you would make those computers "Virtual Terminals," which is prohibited by the Credit/Debit Card Handling Procedure

Sales of tangible personal property as part of a proprietary activity by the University are generally subject to sales tax. Please see the Sales Tax Collection Matrix (PDF) for a complete breakdown of collection responsibilities based on the purchaser.

A large exception to the proprietary activities rule is the sale of food directly to or for the primary benefit of students. Such sales may take place on an exempt basis as long as certain conditions are met.

For more information please see the Procedure for Collecting, Paying and Reimbursing Sales Tax.

The following documents will explain how to perform common functions in CASHNet. Feel free to download and disperse them to all relevant staff members.

• Processing Credit Card Refunds
• Running Reports
• Fulfilling Orders

Once you have read and understand all of the materials presented above, you will need to download the following forms. You are not required to make any changes or submit these forms to the PCI Committee. Just be aware of how credit card data is handled by CASHNet and make sure you are not circumventing the security provided by the system.

• Credit Card Procedures (PDF)
• Data Flow Diagram (PDF)

When you are ready to start your new site, please fill out the following questionnaire to the best of your ability. Someone from the PCI Committee will contact you within 3-5 business days with more information. From there we will need to request all necessary Detail Codes in Banner and create a test site for you in CASHNet. Please allow up to two weeks for the site to be live and accepting payments.

• eMarket Questionnaire

After your site has been moved to the production server you will need at least one employee to have access to Cashnet. This will allow your department to run reports, fulfill orders, and process refunds. To gain access to Cashnet, you will need to do the following:

1. Complete the PCI Compliance Training by clicking on the link below.
2. Login tobsu.edu/helpdesk
3. Navigate to: Request Services > Security Access > CASHNet (you may need to click the Show More button to expand the list).
4. After you fill out the first few boxes you will be asked to select the appropriate security class(es). Select eMarket Access (Reporting & Refunds).
5. In the eMarket Site (ex. EMS123 or ESS123) field, type in the site name that was given to you when your site went live. If you are unsure of the site name, please enter the URL of your site.
6. Your request will be sent to us automatically and we will e-mail you if we have any questions.
7. Once you have access to Cashnet, please download the documents in the Instructional Documents section above.