Accepting Payment (Credit/Debit) Card and eCommerce Payments

  • Issue Date: February 2009
  • Revision Date: January 2020
  • Expiration Date: N/A

  1. Purpose

    The purpose of this policy is to establish business processes and procedures for accepting payment cards at California State University Long Beach that will minimize risk and provide the greatest value, security of data, and availability of services to each university merchant account within the rules and regulations established by the Payment Card Industry (PCI) and articulated in the PCI Data Security Standards (DSS). Additionally, these processes are intended to ensure that payment card acceptance procedures are appropriately integrated with the University’s financial and other systems.

  2. Background

    In response to increasing incidents of identity theft, the major payment card companies created the Payment Card Industry Data Security Standard (PCI DSS) to help prevent theft of customer data.  PCI DSS applies to all businesses that accept payment cards to procure goods or services.  Compliance with this Standard is enforced by the payment card companies and generally, non-compliance is discovered when an organization experiences a security breach that includes cardholder data.

    Security breaches can result in serious consequences for the University, including release of confidential information, damage to reputation, the assessment of substantial fines, possible legal liability and the potential loss of the ability to accept payment card and eCommerce payments.

  3. Definitions

    Cardholder

    The customer to whom a payment card has been issued or the individual authorized to use the card.

    Cardholder Data

    All personally identifiable data associated with the cardholder (i.e., account number, expiration date, cardholder name.

    Student Financial Services

    University office that approves all third-party service providers and coordinates the policies and procedures for accepting payment cards at CSU Long Beach (Brotman Hall BH-155).

    Encryption

    The process of converting information into an unintelligible form to anyone except holders of a specific cryptographic key. Use of encryption protects information between the encryption process and the decryption process against unauthorized disclosure.

    Merchant or Merchant Department

    For the purposes of the PCI DSS and this policy, a merchant is defined as any university department or other entity that accepts payment cards bearing the logos of any of the five members of the Payment Card Industry Security Standards Council (American Express, Discover, JCB, MasterCard or VISA) as payment for goods and/or services, or to accept donations.

    Merchant Department Responsible Person (MDRP)

    A management employee who has authority to approve payment card account acquisition/change within a department. (Per CSULB signature authority guidelines this would be an individual with Level 4 signature authority)

    Payment Card

    Any payment card/device that bears the logo of American Express, Discover Financial Services, JCB International, MasterCard Worldwide, or VISA, Inc.

    Payment Card Account Change

    Any change in the payment account including, but not limited to:

    • the use of existing payment card accounts for new purposes;
    • the alteration of business processes that involve payment card processing activities;
    • the addition or alteration of payment systems;
    • the addition or alteration of relationships with third-party payment card service providers, and
    • the addition or alteration of payment card processing technologies or channels

    Payment Card Industry (PCI) Data Security Standard (DSS)

    A multi-faceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures.

    Sensitive Authentication Data

    Security-related information (card validation codes/values, full magnetic-stripe data, or personal identification number (PIN)) used to authenticate cardholders, appearing in plain-text or otherwise unprotected form.

  4. Applicability

    This policy applies to all California State University, Long Beach (CSULB) employees, contractors, consultants or agents and auxiliary organizations who, in the course of doing business on behalf of the University, accept, process, transmit, or otherwise handle cardholder information in physical or electronic format. For the sections within this policy that refer to specific campus procedures, Auxiliaries are required to adopt similar processes to fit their operational needs.

    This policy applies to all University departments and administrative areas which accept payment cards regardless of whether revenue is deposited in a University or Auxiliary financial account.

  5. Acceptable Payment Cards

    California State University, Long Beach currently accepts VISA, MasterCard, Discover and American Express Card and has negotiated contracts for processing payment card transactions.  Individual University units may not negotiate individual contracts with these or other payment card companies or processors.  All individual University units must use the campus negotiated contracts.

  6. Prohibited Payment Card Activities

    California State University prohibits certain credit card activities that include, but are not limited to:

    • accepting payment cards for cash advances
    • discounting a good or service based on the method of payment
    • adding a surcharge or additional fee to payment card transactions
    • using a paper imprinting system unless approval is granted by Student Financial Services

  7. Payment Card Fees

    Each payment card transaction will have an associated fee charged by the credit card company. Payment card fees will be allocated to the PeopleSoft general ledger account identified by the Merchant Department.

  8. Refunds and Chargebacks

    When a good or service is purchased using a payment card and a refund is necessary, the refund must be credited back to the account that was originally charged. Refunds in excess of the original sale amount or cash refunds are prohibited.

    Occasionally a customer will dispute a payment card transaction, ultimately leading to a chargeback (refund of the customer by the bank charging the university for the item). In the case of a chargeback, the merchant department initiating the original transaction is responsible for providing appropriate supporting documentation to Student Financial Services to assist in fighting the case and receiving reimbursement from the bank for the chargeback.

  9. Maintaining Security

    • PCI compliance is required at all times and is assured through annual completion of PCI SAQs that have been independently reviewed for completeness and accuracy.
    • Departments and administrative areas accepting payment cards on behalf of the University are subject to the Payment Card Industry Data Security Standards (PCI DSS).
    • The University prohibits the transmission of cardholder data or sensitive authentication data via e-mail or unsealed envelopes through campus mail as these are not secure.
    • The University requires that all external services providers that handle payment card information be PCI compliant.
    • The University restricts access to cardholder data to those with a business “need to know.”
    • For electronic media, cardholder data shall not be stored on servers, local hard drives, or external (removable) media including floppy discs, CDs or thumb (flash) drives unless encrypted and otherwise in full compliance with PCI DSS.
    • For paper media, cardholder data shall not be stored unless approved for legitimate business purposes.

  10. Responsibilities

    Merchant Department Responsible Persons (MDRPs) are responsible for:

    • Executing on behalf of the relevant Merchant Department, Payment Card Account Acquisition or Change Procedures.
    • Ensuring that all employees (including the MDRP), contractors and agents with access to payment card data within the relative Merchant Department acknowledge on an annual basis and in writing that they have read and understood this Policy. These acknowledgements should be submitted, as requested, to the Director, Student Financial Services.
    • Ensuring that all payment card data collected by the relevant Merchant Department in the course of performing University business, regardless of whether the data is stored physically or electronically is secured. Data is considered to be secured only if all of the following criteria are met:
      • Only those with a “need to know” are granted access to payment card and electronic payment data;
      • Email is not to be used to transmit credit card or personal payment information. If it should be necessary to transmit credit card information via email only the last four digits of the credit card number can be displayed;
      • Credit card or personal information is never downloaded onto any portable devices or media such as USB flash drives, compact disks, laptop computers or personal digital assistants;
      • Fax transmissions (both sending and receiving) of credit card and electronic payment information occurs using only fax machines that are attended by those individuals who must have contact with payment card data to do their jobs;
      • The processing and storage of personally identifiable credit card or payment information on University computers and servers is prohibited;
      • Only secure communication protocols and/or encrypted connections to the authorized vendor are used during the processing of eCommerce transactions;
      • The three or four digit validation code printed on the payment card is never stored in any form;
      • The full contents of any track data from the magnetic stripe are never stored in any form;
      • The personal identification number (PIN) or encrypted PIN block are never stored in any form;
      • The primary account number (PAN) is rendered unreadable anywhere it is stored;
      • All but the last four digits of any credit card account number are masked when it is necessary to display credit card data;
      • All media containing payment card or personal payment data is retained no longer than a maximum of six (6) months and then destroyed or rendered unreadable according to campus electronic media sanitization procedures; and
      • Notifying the Information Security Officer (562-985 4818) in the event of suspected or confirmed loss of cardholder data. Details of any suspected or confirmed breach should not be disclosed in any email correspondence. After normal business hours, notification shall be made to the University Police, (562) 985-4101.

    Division of Information Technology shall:

    Regularly monitor and test the University Network and coordinate the University’s compliance with the PCI Standard’s technical requirements and verify the security controls of systems authorized to process credit cards.

    Information Security Officer shall:

    Coordinate and lead any campus response to a security breach involving cardholder data.

    The Director, Student Financial Services shall:

    • Provide training to ensure that university merchants are trained in accepting and processing payment cards in compliance with this policy;
    • Work with external vendors and coordinate payment card policies, standards, and procedures;
    • Serve as liaison between Financial Management Services, Information Technology Services, and the university unit for Payment Card account acquisition or change procedures; and
    • Review and modify the Application for Payment Card Account Acquisition or Change as necessary.

    Audit under Budget and University Services shall:

    • Collaborate with university management and stakeholders in developing policies and practices to achieve Payment Card Industry Data Security Standard compliance.
    • Assist in the development and maintenance of university and auxiliary compliance assessments.
    • Periodically review university merchant compliance with this policy and the Payment Card Industry (PCI) Data Security Standards (DSS); and
    • When required, conduct the University PCI DSS Self-Assessment and complete the University’s Attestation of Compliance for the campus and its auxiliaries.

    Vice President for Administration and Finance shall:

    • Ensure that the business processes (i.e., non-technology aspects) described in this PCI policy will be maintained.

  11. Payment Card Account Acquisition or Change Procedures

    To acquire or change a payment card account, the MDRP or his/her designee must submit a request to the Student Financial Services Office at cashiers@csulb.edu. The application must be approved by the MDRP and appropriate Associate Vice President or Dean. Applications that request eCommerce activities must also be signed by the Information Security Officer. All eCommerce activities shall be processed by a third-party vendor authorized by the University.

    All requests shall be reviewed by the Director, Student Financial Services. PCI data environment compliance questions may require additional consultation with Division of Information Technology Services. The Director, Student Financial Services shall respond to all applications. When an application to acquire a payment card account is approved, the Director, Student Financial Services will assist the MDRP in establishing the new merchant account activity. All card processing terminals shall be obtained through Student Financial Services.

    The MDRP may appeal a decision to deny an application to acquire or change a payment card account to the Associate Vice President, Financial Management.

    Each auxiliary organization shall develop procedures for payment card account acquisition or change within their organization.

  12. Sanctions

    The Associate Vice President, Financial Services may suspend credit card account privileges of any department or administrative unit not in compliance with this policy or that places the University at risk.

    Any department or administrative unit engaged in payment card activities will be responsible for any financial loss due to inadequate internal controls or negligence in adhering to the PCI Data Security Standard.

  13. Training

    Employees who are expected to be given access to cardholder data shall be required to complete upon hire, and at least annually thereafter, security awareness training focused on cardholder data security. Employees shall be required to acknowledge at least annually that they have received training, understand cardholder security requirements, and agree to comply with these requirements.