4 Best Practices for Secure Online Payment Processing

Merchants who build any kind of payment system must manage payments securely for a range of reasons. Beyond the somewhat obvious reality that protecting the details and finances of their customers is a key element of building a long-term business relationship, there are very real consequences to security failures. In the most extreme cases, merchants can suffer crippling fines, and, ultimately, lose the ability to accept credit card payments at all. In addition, an insecure payment system can lead to damaging data breaches, exposing customers to identity theft and fraud, and creating significant legal liability for the merchant.

Here are four tips and methods for securely managing payments.

Tip 1: Keep PII outside your security perimeter

Hackers and thieves can’t steal what you don’t have! As a bonus, if you keep users’ personally identifiable information (PII) outside your IT environment, you can avoid most of the requirements to adhere to the PCI-DSS standard. 

So how do you avoid the PCI-DSS requirement?

There are a number of ways to do it, including signing on with full-service payment service provider (PSP), also known as a hosted gateway, These providers allow you to secure your online payment processing by actually receiving and storing all personal and credit card information into their own secure vault, and providing you with only a token. This keeps you out of the scope of PCI-DSS, although it does mean both paying relatively high transaction fees, and giving up control of those customer details, so that moving to a different PSP may make it impossible, or at least very expensive, to retain access.

Tip 2: Don’t rely on encryption alone for stored data

For those merchants who do choose to store PII within their own environment, it is important to go beyond encryption in building a payment process that is truly secure. The challenge with encryption is simple: it is simply a scrambled version of the real data. Thus, if someone can get access to the decryption key (or can crack it with a sophisticated computer program), they can gain access to the original data.

To avoid this, it is important to go beyond encryption and take on tokenization. In a nutshell, tokenization is a process of exchanging underlying data for an unrelated string, which acts as a reference to a place where the real data is stored, known as a token vault. This way, even if someone decrypts the stored token, it still isn’t the information they need.

Tip 3: Don’t let employees have access to data they can carry out of the building

If there’s one thing any security expert will tell you, it is that the weakest link in substantially any security scheme is the people. So building a secure payment system needs to take into account ensuring that employees can’t extract information to use for unapproved purposes.

This is another situation where tokenization can make the difference. Employees should have access to only the data they need when they need it (i.e. bring up the payment details of one transaction at a time, not search for a group of related sales), and it should not be in a form that is easily copied to electronic media. For instance, providing a browser-based interface, where only the necessary information for a given transaction is shared on screen is highly secure. Using a token vault to store this information delivers ultimate security, as there is no way for an employee to do a search on internal systems; instead, they simply bring up screens that are fed by information called on an as-needed basis from the token vault.

Tip 4: Select a reliable tokenization service provider

The best way to create a secure payment process, while avoiding PCI-DSS requirements, and securing customer PII against breach, is to select a reliable tokenization service provider (TSP), like Basis Theory. Your TSP will provide APIs that ensure PII never enters your environment, and is therefore unavailable to be breached; will deliver a token vault that is PCI-DSS Level One certified, and can only be accessed by designated entities; and will help you to build employee interfaces that repel efforts to collect, store, and remove customer PII.

For more information, take a look through the Payment Orchestration use case on our website, or contact us here.