10 Steps To Secure and PCI Compliant Credit Card Processing In Oracle Receivables
- 1. 10 Steps to Secure & PCI Compliant Credit Card Processing in Oracle Receivables Presenters: Anil Madhireddy, VeriSign Inc. Carol Gonzales, VeriSign Inc. Contributor: Praveen Akula, VeriSign Inc. NORCAL OAUG Training Day January 19 2010
- 2. About Us VeriSign, Inc. (NASDAQ: VRSN) is the trusted provider of Internet infrastructure services for the networked world. Billions of times each day, our SSL, identity and authentication, and domain name services allow companies and consumers all over the world to engage in trusted communications and commerce. Anil Madhireddy is a Senior Business Analyst in the Enterprise IT Division of VeriSign Inc Carol Gonzales is a Business Analyst with Financial Systems Division of VeriSign Inc Praveen Akula is Senior Developer with Enterprise IT Division of VeriSign Inc 2 2
- 3. Learning Objectives 1. Learn the credit card industry guidelines for security & compliance and industry operating model 2. Know how Oracle stores credit card data and the patches required for advanced security 3. Understand the zero-touch credit card processing features offered by Oracle Receivables and Payments 4. Case Study on how VeriSign Inc integrated its web stores with Oracle Payments and key lessons learnt 5. Learn how Advanced Collections could be integrated with Payments for real-time credit card authorizations. 6. Understand the 10 steps essential for secure & PCI compliant credit card processing model ** VeriSign is no longer a Credit Card Payment Gateway. VeriSign Payment Services was sold to PayPal in 2005 ** This presentation is a process oriented overview and configuration aspects are left to Q&A sessions 3 3
- 4. Credit Cards – Why a Preferred Receipt Method? With the recent tightening of credit markets, companies are increasingly moving toward credit cards to transfer substantial part of credit risk to card issuer. Accepting credit cards will often increase... even double your current sales Credit Checking is easy and instant Over 90% of web purchases on Credit Card transactions & so it are made using credit cards.. secures the purchase Greater scope for automation Credit Cards funds are generally of credit card receipt model (as settled in a couple of days – it against checks, wires etc) improves cash flow, helps slash credit to cash cycle and reduce the Your competition is already organization’s Days Sales accepting credit cards. You Outstanding (DSO) need to accept cards in order to survive 4 4
- 6. Credit Card Processing Models Processing Models VeriSign Portals Oracle Receivables Type 1 Authorization Funds Capture (Majority of VeriSign Portals Order & Authorization Info passed Refunds fall into this Category) to Oracle AR & Payments Chargeback Type 2 Orders processed without Authorize Authorization & Interfaced to (A few VeriSign Portals Oracle Receivables Funds Capture belong to this Category and are now converting to Type 1) Refunds Chargeback Type 3 Authorize @ Record Invoices & Receipts (Only one VeriSign Portal Funds Capture belong to this Category) Chargeback Refunds 6 6
- 7. Step1 – Understanding Payment Card Industry Guidelines The PCI Security Standards Council: – An open global forum for security standards for credit card data protection. – Founded by American Express, Discover, JCB, MasterCard Worldwide and Visa Inc. – facilitates broad adoption of consistent data security measures on a global basis. PCI Data Security Standard (PCI DSS): – is a multifaceted security standard – includes requirements for – security management, – policies, procedures, network architecture, – software design and other critical protective measures. – This comprehensive standard is intended to help organizations proactively protect customer account data. 7 7
- 8. PCI Data Security Guidelines at Glance (More info @ https://www.pcisecuritystandards.org/) Build and Maintain a Secure Network Implement Strong Access Control – Install and maintain a firewall configuration Measures to protect cardholder data – Restrict access to cardholder data by – Do not use vendor-supplied defaults for business need-to-know system passwords and other security parameters – Assign a unique ID to each person with computer access Protect Cardholder Data – Restrict physical access to cardholder – Protect stored cardholder data data – Encrypt transmission of cardholder data across open, public networks Regularly Monitor and Test Networks Maintain a Vulnerability Management Program – Track and monitor all access to network resources and cardholder data – Use and regularly update anti-virus software – Regularly test security systems and – Develop and maintain secure systems and processes applications Maintain an Information Security Policy – Maintain a policy that addresses information security 8 8
- 9. Know the Credit Card Industry Operating Model For a typical ecommerce credit card transaction, a number of participants play key roles in the process. Those players include: 1. the customer, 2. the merchant, 3. the payment gateway, 4. the acquiring bank’s processor, 5. the credit card interchange, 6. the customer’s credit card issuer, (who has the final say to Approve or Decline) 9 9
- 10. Step 2: Decision to Go Via Payment Gateway or Go Direct to Payment Processor Payment Gateway Model (eg. Go Direct to Payment Processor PayPal, Authorize. net, Orbital) (Chase Paymentech, PayPal) Merits Merits – Acts as a Submitter – Go Direct Approach – Supports Real-Time Authorization – Better Reporting & Funds Capture Model – Better Implementation Support – Switching Back-End Processor is easy De-Merits – Integrates with all processors – Switching Processors becomes challenging, a big project in itself De-Merits – Each Portal need to write code to submit to the Processor – Basic Reporting only – Does not Support Real-Time – Adds another Layer to Credit Card Settlement Processing Processing 11i requires Batch Close, – Basic Support only – we need to Batch Query & Retry contact Payment Processor for Process for settlements further information on a R12: Create Settlement transaction. Batches concurrent program 10 10
- 11. Step 3: Secure Credit Card Transactions CVV2/CSC/CVC Validation The card security code is a 3- or 4- digit number (not part of the credit card number) that is printed on the credit Card. Provides some assurance that the physical card is in the possession of the buyer. Notes: DO NOT store the CVV2/CVS/CVC in Please be sure to read your database or log files regulations/guidelines provided by Card Issuers – VISA/Master/AMEX CVV2 code validation in sub ledgers is – on CVV2/CSC/CVC Validation only supported in R12 (not 11i). Address Verification Service is Address Verification Service supported only for select countries like US, Canada & UK…Please The address verification service result contact your processor for more is for advice only. Banks do not guidelines decline transactions based on the address verification service result Billing Zip Validation is leaner version of AVS where only the zip code is validated. Most merchants opt for billing zip validation instead of complete address verification 11 11
- 12. Step 4: Implement a Strong Encryption Model All Files that transmit credit card data should be secured & encrypted Credit Card Numbers are stored/referenced in Oracle in multiple Tables Must Apply PCI complaint Oracle Credit Card Data in Oracle EBS: Encryption Patch 4607647 to secure credit card data Patch provides: – Consolidation of primary account numbers from four tables to one – Encryption of primary account numbers, – Automatic masking of primary account numbers. The credit card encryption is only for the Credit Card Number – Cardholder name & expiration date remain as is in the existing tables. 12 12
- 13. Guide to Oracle Encryption Metalink Notes: Oracle Applications Credit Card Encryption – Oracle Metalink Note ID 338756.1, Oracle Corporation, 12 December 2006, Does The Credit Card Encryption Patch 4607647 Impact Internet Expenses? – Oracle Metalink Note ID 390032.1, Oracle Corporation, 22 January 2007, Where The Credit Card Numbers Are Must Read! Stored For iStore? – Oracle Metalink Note ID 376708.1, Oracle Applications 11i: Credit Oracle Corporation, 13 July 2006 Cards and PCI Compliance How To Encrypt Credit Card Data In Issues Release 12 – White Paper By Stephen Kost and – Oracle Metalink Note ID 863053.1, Jack Kantar, Integrigy Corporation Oracle Corporation, 05 October 2009 R12 Mandatory Wallet Patches – Oracle Metalink Note ID 737364.1, Oracle Corporation, 21-JAN-2009 13 13
- 14. Step 5: Setup Receipt Classes, Payment Methods & Bank Accounts 14 14
- 15. Step 6: Define Payee, Payment System & Routing Rules Payment System – Third party payment processor or gateway that you want Payments to send credit card processing requests. – Examples: Paymetech, FirstDataNorth, PayPal, Cybercash Payee: – Entity that will receive funds in an e-Commerce transaction. – Generally this is: – a merchant identifier (like PayPal USD) or – an accounting rollup organization of a merchant (like 011-USD-vsxxxx) – Payee is tied to a AR Receipt Method using Merchant ref (in 11i) and Routing rules (in R12) Routing Rules – Routing Rules are used by Oracle Payments to route the payment transactions to the right Payment System accounts (merchant accounts) – You can route by currency, operating unit, receipt method, card type, amount, org id 15 15
- 16. Step 7: Define CC Error Handling Model Oracle provides ability to manage CC Error Handling via application setup – you can instruct the application what action to perform if it hits a specific error during authorization or funds capture Options Include – Retry of Authorization or Settlement Request – Clear Payment Information – Reverse Receipt (For Funds Capture Request only) – Reverse Receipt or Re-authorize Receipt (Funds Capture Requests only) After Retry for set number of days, AR flags the receipt with error code. – Error Receipts/Invoices are available in Correct Funds Transfer Errors Form for manual remediation. 16 16
- 17. Oracle Terms and Definitions Term Definition Authorization Third Party payment processor verifying your credit card and reserving payment from your credit card Funds Capture Credit card issuer (e.g. Visa or Master card) has reserved the receipt amount and has agreed to remit this amount to the payee’s (merchant’s) bank PSON – Payment A unique number that is used to identify the receipt that closes a Server ID transaction. Appears in the receipt after successful CC authorization e.g. AR_1166 Approval Code A unique number (e.g.223132883) generated by a third party payment processor to indicate that the credit card authorization is successful 17 17
- 18. Credit Card Payment Processing in AR VISA Database Error Error Master Card Database Payments(R12) / 3rd Party Payment Processor Receivables - Invoices with Credit Card Payments iPayments (11i) ( Cyber cash, PaymentTech) Correct CC errors Correct CC errors automatically manually 18 18
- 19. Credit Card Authorization Process Credit Card Approved Error Invoice in AR with CC Create and Approve Receipt Payment – CC Payment Method (Create Auto Receipt Batch) Authorization CC authorization successful CC authorization failed Receipt created with PSON Receipt NOT Created and Approval Code Use Credit Card / Funds Transfer Error Handling feature to correct errors – Retry 19 – Clear Payment Information 19
- 20. Credit Card Funds Capture Process Funds Captured Error Receipt with PSON Create and Approve Remittances Payment CC and Approval Code Capture (Authorized CC) CC capture successful CC capture failed Payment Captured Receipt remittance failed Receipt status = Remitted Use Credit Card / Funds Transfer Error Handling feature to correct errors –Retry (Clear errors) – Reauthorize Receipts – Reverse Receipts 20 20
- 21. Step 8: Define Decline Management Model Be Realistic : Expect some Credit Cards to get declined Separate the wheat from the chaff – Technical Errors Vs Real Declines – Network Not Available Vs Insufficient Funds Define an Automated Decline Management Model – Automatically Retry Declined Cards (for a define time period) – Notify Customers of (real) declines – Decide whether to provide customers with a reason code for decline – Have a process to accept new cards or retry existing credit cards – Integrate Declines Management Strategy with Dunning & Collections Process – Enable Credit Card Integration in Advanced Collections so Collectors can do real-time authorizations when in contact with customers. 21 21
- 22. 22 22
- 23. Step 9 Refund & Chargeback Processing Refunds Submitted in Oracle AR Refund Requests Interfaced to Oracle – Identify Receipt to be Refunded from Portals/Store Fronts or OM – Un Apply Receipt from Invoice – Refund request interfaced through Auto – Apply to ‘Credit Card Refund’ Invoice as a Credit Memo Receivable Activity – Transaction Source needs to be set to process Automatic handling of credits The Auto Invoice process will: – Oracle AR Auto-Creates a Negative – Create a Credit Memo Miscellaneous Receipt – Un Apply the Original Invoice from the – Remittance process will select the Receipt Negative Receipt to process refunds – Apply the Credit Memo to the Original with Payment System Invoice – Apply a Credit Card Refund Activity to Chargeback Processing the Original Receipt – Identify Receipt to be charged back – Create a Miscellaneous Receipt for the – Reverse Receipt negative amount. – Clear Credit Card Information on the Original Invoice so the invoice is not picked up for Auto Receipts Program again 23 23
- 24. Refund Accounting Overview 24 24
- 25. T – Account Representation (XXX – denotes Original Receipt Amount ; YYY denotes Refund Amount) 25 25
- 26. Step 10: Implement Daily Transaction Monitor A well automated credit card processing model requires a good monitoring tool to ensure that the zero-touch process is working fine Pre-requisites of Monitoring Report – Transaction Report per Payee – Daily (end of business day report) – Actionable – Preferably as a Email Notification – Transaction Summary (Authorizations / Settlement Processed) – Summary of Credit Card Errors/Declines – Card Type Transaction Breakup Tip: Watch out for Unknown Errors (AR Flags Invoices Receipt as Error with no error-code or description – Requires log file reviews to debug) – 3 Types of Unknown Errors – Inbound Communication Cut-offs – Outbound Communication Cut-off – Internal AR Validation (Capture Amount cannot exceed Auth Amount) – Oracle Patches Available for some of the above errors. 26 26
- 27. VeriSign Daily Transaction Report 27 27
- 28. Real Time Authorizations from Advanced Collections VeriSign has enabled Advanced Collections Integration with Oracle Payments that has real time Integration with BEPs like PayPal, Paymentech, Citibank etc Thanks to the above Integration, Collection Agent can process real time credit card authorizations from Advanced Collections and process payment immediately 28 28
- 29. VeriSign Implementation Overview (Review) 29 29
- 30. VeriSign Implementation – Lessons Learned Portal Integrations – CVV2/CID/CSC validations responses differs across different card providers. Some issuing banks do not support CVV2 /CSC validation. Strategy for handle Neutral responses – Given the global nature of the web stores, we needed to regulate input values for Billing Zip – some cases the customer did not enter valid zip codes that caused delays in credit card processing Oracle EBS (contd.) – Contact American Express to switch on – Inbound Communication from payment ‘CSC’ validation for AMEX cards. For system Cut-off due to "ECServlet security VISA & Master, Discover, this was not token rejected" - May lead to double required. authorization or settlements – Oracle did not identify Purchase Cards Oracle EBS – Correct Credit Card Errors Form unstable – Automatic Remittance Program causes and not user friendly receipt remittance to error internally if – Testing Credit Card Transactions will be capture amount > authorized amount, challenge requiring manual intervention. Oracle Patch available to remove this – as tests are based on test credit validation. cards and set of simulated rules like Amount < 1000 for approvals; Amount > 1000 for declines 30 30
- 31. VeriSign Implementation – Benefits CVV2/CSC validation helps filter credit card fraud Zero Touch, secure & PCI compliant credit card processing model Pre-authorization of credit cards lead to substantial reduction in bad debt write-off Credit Card funds are settled in a couple of days – improves cash flow, helps slash credit to cash cycle and reduce the organization’s Days Sales Outstanding (DSO) Zero Touch Declines Management contributes to better & more efficient collections process One-Touch Refund Process led to better efficiency Daily Transaction Monitor helped trouble-shooting easier Excel Friendly Credit Card Reporting & Oracle’s Unique Payment Server ID helps Receipt Tracking and Receipts Reconciliation user- friendly and efficient. 31 31
- 32. 10 Essential Steps to Credit Card Processing 1. Understand PCI Compliant Credit Card Guidelines 2. Decision on Payment Gateway vs. Payment Processor Model 3. Define Security Model – CSC/CVV2 & Billing Zip Validations 4. Implement a Strong Encryption Model 5. Setup Receipt Class, Payment Method & Bank Accounts 6. Setup Payment System, Payee & Routing Rules 7. Setup Credit Cards Error Handling Model 8. Define Declines Management Model 9. Understand Refund & Chargeback Processing 10. Daily Transaction Monitor & Reporting 32 32
- 33. Q&A 33 33