Collaborate Disseminate
I’m a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the developer of the software had created a … Continue reading PCI Compliance question from a merchant
I work for a company that sends out mail/telephone order goods. Some customers have orders they receive every day, with different amounts.
We have been asked a few times by various customers if we can store there card detail… Continue reading PCI – store card details offline
We provide a shopping cart service with integrations to multiple third party payment processors (PayPal, Authorize.net, etc.) where all payment processing happens on their networks (i.e., no CC data enters our networks). Some… Continue reading SAQ-D Service Provider without a CDE
I am just wonder if I have a mirror/identical (high availability server) server in my CDE segment, is that mirror server need be in scanning scope?
If it is not in the scope, in the scanning report do I need to have a specia… Continue reading PCI DSS: Is Mirror/ Identical Server in Pentest or Scanning Scope
Recently, some of our servers were being flagged for not implementing proper HTTP headers in a Qualys scan.
One of the sites that I visit regularly – http://pentestit.com has some good HTTP headers implemented:
HTTP/1.1 … Continue reading PCI Consideration for HTTP Headers?
We are going to develop an application for payment gateway which is already PCI DSS compliant,
This application will be handling the payment through the API.
My questions is is the application needs to be PA-DSS, P2PE, or P… Continue reading What compliance does my mobile application need?
This website does not have the ability to VERIFY your DMCA take down request, therefore we only base the Notice of DMCA removal from Google Search, all requested links shall be reviewed and removed. You may request Google to … Continue reading How to DMCA Remove ABS-CBN, GMA Network, Videos CopyRight
Suppose I have an ecommerce web site, hosted in Azure (or AWS). I will use a third party payment gateway that is fully certified as PCI level 1. All communication is done with TLS 1.1 or better.
Scenario A: During checkout, … Continue reading PCI scope when entering card details into browser
First of all, please accept my apology for being ingnorant to compliance/FCA regulations as I have been digging out everywhere to get the answer of a very specific question:
SCENARIO
I am planning to start an online business (lets say MYONLINEBUSINESS.COM) in UK where businesses would be able to sell their products to the customers using my web portal. The concept is exactly the same as ebay where ebay individual merchants/sellers run their shops online on ebay and sell their products to ebay customers.But instead of bidding, i am just providing only “buy product” functionality.
My idea is to provide similar service as ebay’s.
PROCESS
Here are more details:
1-Seller creates an online account, pays for my website’s annual account subscription and creates his eShop(same as ebay’s) on my web portal to sell products .e.g Light bulbs , Fans etc
2- website visitor /customer visit my web portal and look for “Light bulbs”.Once found,the customer purchases the item from the seller’s shop individually.
3- I send each and every order’s confirmation in email and hold all order amounts in my MYONLINEBUSINESS.COM ‘s business bank account and put in seller’s account after every 10 days (fortnightly as agreed on subscriber’s agreement/terms and condition document).
NOW my FEAR starts here:
i- I want to take online order payment (£20.00) directly into MYONLINEBUSINESS.COM ‘s business account and after deducting online card transaction charges of my merchant account provider(e.g WorldPay/Paypal) e.g (£0.55), i want to move the order amount indirectly to seller/light bulb eShop owner’s bank account.
QUESTIONS
If I do things this way, will i violate any of FCA/PCI regulation?????
Also, please note that i am clearly stating in seller’s agreement/terms and conditions document that MYONLINEBUSINESS.COM will hold all orders’s amount for 10 working days and it will be transferred into seller’s bank account soon after deducting transaction charges?
Do i need to provide a kind of guarantee/assurance to FCA that i would transfer funds into seller account???If yes then what and how can i do this?
2- If i clearly state about holding of seller’s funds for 10 days in agreement documents and terms and conditions and store only bank account and sort code in my database, would i be still be penalised for breaching any FCA regulation, providing strong SSL and fully PCI-DSS compliant payment gateway ??????
Please note i am not sotring and taking card details on my website but is done on my merchant gateway provider (WorldPay/Paypal).
I would appreciate your help in this regard.
Cheers
I’ve been searching for an answer to this question. According to PCI DSS Requirement 10.5.3, it asks for sending logs to a centralized secure internal log server.
Would we need to enable multi-factor auth into the internal l… Continue reading Multi-factor auth into centralized log server