PCI Complience - thread of a 'charge' for non-compliance I do not need.

[pinkypie]

I have not been around here much - for reason's I'll explain shortly.

I have done a search and found one thread on here but it is not much help so thought I would ask the question. I am with Barclays and her 3 Merchant Bank Accounts. I only use one - but the use of that has declined by a lot, the fees I paid SagePay and Barclays last month was more than any profit I made on the goods I sold. I have been considering for a while that I no longer need these accounts.

I see on another thread that someone has said that if I do not hold any cardholder data then I do not need to be scanned but, when Security Metrics called me wanting £180 a year, I told them I was not paying it as I did not see any card holder data, I even reverted my screen back to the SagePay screen so they could not say I was not being redirected - this was 18 months ago.

So, how did everyone else get out of not having to pay, please. It's a complete joke as they do not listen, people say that as it via the bank there should not be issue but the bank and merchant account is the same. I've had 3 letters today, threatening me with a charge - 2 of them for accounts not been used for 3-5 years, each time I get a different chip & pin machine they insist on giving me a new merchant account.

Can anyone help, is it better to just close it and be done with it, the accounts are costing me money and I'll just stick with Paypal.

I've been selling on eBay and it has just been immense, the busiest I have been for many years and, some days, do not have time to breathe so I am not even getting the sales on the website since Google started charging for ads so the site is for Special Orders, the stuff I have in stock is now sold on eBay.

[Deefer]

I just did my forms again for this year actually. I emailed them to Security Metrics as per usual and they said there is a change. They said they don't deal with anyone anymore who fill the forms out themselves (DIY I think they called me - too right I am). They told me to send my forms directly to Barclays myself, so I did.

I don't have a card machine though. Not sure if that changes anything but just thought I better say that.

[Terry]

I use virtual terminal to process payments via sage pay - and unfortunately, I also have to pay an annual fee to secure metrics

[ThomasMurray]

I use SagePay with Lloyds TSB & have never had any of these issues.

Lloyds TSB Cardnet let you complete the forms online, quick & easy. No questions asked.

I'd either consider moving banks or simply moving to PayPal only, you can still take card payments using PayPal express.

[Deefer]

I use virtual terminal to process payments via sage pay - and unfortunately, I also have to pay an annual fee to secure metrics

What do you have to pay a fee for Terry? As long as you are not seeing or storing or processing any card details (on your own system) you don't need a scan I don't think, so can't you just fill in the compliance forms yourself. Or am I misunderstanding what a virtual terminal is?

I only ask cos I think Security Metrics have conned a lot of people into thinking they have to pay for PCI compliance. They did the same to me until I realised it was bull shit, in my case anyway.

[Terry]

What do you have to pay a fee for Terry? As long as you are not seeing or storing or processing any card details (on your own system) you don't need a scan I don't think, so can't you just fill in the compliance forms yourself. Or am I misunderstanding what a virtual terminal is?

I only ask cos I think Security Metrics have conned a lot of people into thinking they have to pay for PCI compliance. They did the same to me until I realised it was bull shit, in my case anyway.

When you use Virtual Terminal, you actually enter all of the persons details, name, address, payment type, card details, etc. So, I do get to see and record peoples personal data :-(

I didnt renew this year, and Security Metrics informed my bank, and I got a swift letter from them telling me that there will be a monthly non compliance charge until I renew..so..I renewed!! I still think its a con tho

[Deefer]

Hum... I still think you could do the forms yourself for free. In the questions that ask if you take card details you will of course say yes and then all you have to do is confirm that you have systems in place for the safe deletion/removal of the card details once you are done with them.

Its not a case of not complying. You still have to but this thing where Security Metrics pretend they have to have a fee to file it for you is total rubbish and that is what I am seeing - so many people being conned into paying them. I know from when I first said I wasn't paying because I had completed the forms myself, they were totally taken aback, so I am sure not many people have done it that way i.e. not paid them. I simply said here are my forms, I have filled them in myself so I don't need your help thanks, just my compliance to be renewed. I have done the last 3 years that way

[Terry]

Hum... I still think you could do the forms yourself for free. In the questions that ask if you take card details you will of course say yes and then all you have to do is confirm that you have systems in place for the safe deletion/removal of the card details once you are done with them.

Its not a case of not complying. You still have to but this thing where Security Metrics pretend they have to have a fee to file it for you is total rubbish and that is what I am seeing - so many people being conned into paying them. I know from when I first said I wasn't paying because I had completed the forms myself, they were totally taken aback, so I am sure not many people have done it that way i.e. not paid them. I simply said here are my forms, I have filled them in myself so I don't need your help thanks, just my compliance to be renewed. I have done the last 3 years that way

Thanks for that - certainly food for thought. They say that I need a scan though???
I may try filling in the forms and sending them to my bank, and copying into security metrics and see what happens...what do you think? Where can I get hold of the forms? Are they easy to understand and complete?

Bet you think I'm a real numpty with this haha

I take customer information and security very serious, as i would not like my information to be used in any corrupt way - so, its not that I dont think I should pay if I need to...but it is so annoying when there are people out there like security metrics who dominate this, and seem to enforce it on you. They are extremely unhelpful when contacted

so, if I can avoid paying them, then i certainly would like to...every penny counts in this climate!
T

[pinkypie]

Thanks for the replies, the hassle of changing banks has always been just that - hassle - I have been with Barclays 10 years or so. I guess I could keep this account running while I get everything moved over to another - so who would you recommend? I am just using Paypal really.

As an afterthought, I recently applied for Worldpay Zinc the handheld terminal that is a chip & PIN machine and the money goes straight into my bank account, no merchant account required. Do I need to be PCI Compliant for that??

Do you also think it is worth speaking to the small business manager at Barlcays. SM used to bully me all time, calling me several times a day asking me for money then I told them I would not be paying them and I would email the forms. They told me that I could not do this and so I just said I was not going to pay. I have not had any scans for ages.

I think it is one huge con to get money out of people. My friend takes Face to face payments and payments over the phone and she pays £30 a year - they wanted £180 off me. They told me that because the page redirected out of Sagepay and stayed on my own site I would have to pay more. I did it for 2 years - mind you, on the 2nd year they tried to make the money and Barclays did not authorise it so they never took it. Shame, LOL.

I am not going to be bullied by them though, I will stop using them if need me.

[Deefer]

They told me I needed scans too, which is crazy. I take any card data. I don't even take phone orders. So yeah, it was all really bad advice from some monkey barely trained there, I am guessing... or just one big con. I don't think anyone is a numpty for falling for their lines, no. We trust them. We have all been told they are in charge of this scheme, so we do as we are told.

You can do the forms yourself and not pay them. I promise. If they say you can't that is a lie. I am living proof, lol.

OK, so assuming you don't need an on-site assessment (you'll have to delve further into the PCI site to check that cos I can only say what I do for my business) you go to the Self-Assessment Questionnaire (SAQ) page https://www.pcisecuritystandards.org...sment_form.php

There are guidelines etc.. which you ought to read I suppose. Ah yes, I think you have to in order to work out which of the SAQs are relevant to you, cos there are a few. Ultimately you end up at the documents library and I always go straight to the SAQs tab https://www.pcisecuritystandards.org...?category=saqs

You pick the Self Assessment Questionnaire relevant to you and also there is a Attestations of Compliance too (scroll down a little).

The forms look scary at first but the long and short of it is that they are expecting to see 'yes' or 'n/a' for everything in order to pass. Keep that in mind, without lying of course, and you can't go far wrong.

I then sign it, scan it in and email a copy of the whole thing to Barclays and wait to hear from them.

The first time you do it you may spend ages reading the form and sweating over it and wondering if you should just pay SM but trust me, once you have done it once it is a breeze the following years.

[Terry]

right...thanks for that Deefer...im on a mission with this now..well, when i get an hour or three in the next few days

ill keep you posted how i get on
T

[Work-wearUK]

to be honest is a load of rubbish! it is the only supplier we have that makes it harder for us each year! I was just going to pay the £50 a month as really couldn't be bothered doing it. Just answer everything YES and when they did a system test we just turned our server off, PASS!