New MasterCard POS standards

I wasn't sure where to post this. This doesn't concern any particular payment module, just ones that use a Point of Sale (POS) system, like Authorize.net. The website of one of my company's clients uses Zen Cart, and they recently received this message from MasterCard:

Your Point of Sale (POS) system must be upgraded

Your business has been identified as using a POS system that utilizes an integrated POS software application such as Aloha, Counterpoint, or Squirrel or an E-payment/Gateway application such as
Authorize.Net, Cybersource, and First Data Global Gateway. To be compliant with this new MasterCard
mandate, your POS system will need to be updated with new transaction specifications.

If your system is not compliant by May 1, 2010, you may be subject to a per transaction compliance fee
by MasterCard. To avoid MasterCard compliance fees associated with these new procedures, these new
specifications must be implemented on your POS system. You will want to contact your application
software vendor directly to find out what updates are available. Your vendor is responsible for updating
your application software.

Ensure you are PA-DSS compliant

When you contact your vendor we recommend you also confirm that your software is Payment Application
Data Security Standard (PA-DSS) compliant. Visa has mandated that merchants using POS software
applications will need to be compliant with the PA-DSS by July 1, 2010. To view an updated list of
compliant payment applications, please visit https://www.pcisecuritystundords.org/security_standczrds/vpa/

I know nothing about this stuff. I couldn't find Authorize.net in the list of compliant applications that they link to. Should I be concerned? This particular website uses the iTransact (RediCharge) module, but several other clients have websites that use Authorize.net. Can anyone who's an expert on this stuff tell me if these modules are compliant with these new standards? What about PayPal/PayFlow modules?

I apologize upfront for my ignorance about payment gateways. My expertise is with the aspects of Zen Cart that take place entirely on the website; I don't know much about the parts that involve communication with outside gateways.

Does this customer also have a physical store? Are they using their Zen Cart as a Point of Sale system in the brick and mortar?

Kim:

Does this customer also have a physical store? Are they using their Zen Cart as a Point of Sale system in the brick and mortar?

I don't think so. Can you explain how that would work, and why it makes a difference?

Can you explain how that would work, and why it makes a difference?
I see where MC is using the acronym POS as the same as a gateway

POS is normally associated with "Point of Sale" or just like when you pay at a department store with a CC...
You and the card are physically present

Using a gateway you or your card are not present

Look at the site they linked to for the "Self Evaluation" thing
If one answers these questions correctly they should fall into level/class 4 - and personally be compliant

I have not re-read it recently but there may be items your host must comply with as in possibly subscribing to a PCI Scanning service.
The gateway provider will have some responsibilitirs also

:oops:
By the way, the URL in the message should be https://www.pcisecuritystandards.org/security_standards/vpa/. The message came in a PDF and for some reason I couldn't copy the text as text, only as an image. I had to use OCR software to convert it to text.

The only self-assessment questionnaire I see on pcisecuritystandards.org is for PCI-DSS, not PA-DSS. Are these the same thing, or what's the difference?

PA-DSS if for the payment application (the program) - PCI is for the merchant.

Haven't looked and might be the same...
Also, see if you can finf a def of what constitutes being compliant

Kim:

PA-DSS if for the payment application (the program) - PCI is for the merchant
So this is the gateway application?

OK, so the message the client received included instructions to contact the application software vendor to find out if the latest version of the software complies with these new MasterCard standards. Again, their website uses the iTransact payment module, which I got from here: modyourzencart.com/free-of-charge/payment-modules

So I suppose I have to contact that website and find out if the latest version of their module is compliant.

KoBra:

The gateway provider will have some responsibilitirs also
LosAngelesZCUser:

So I suppose I have to contact that website and find out if the latest version of their module is compliant.
I think you answered your own question and suppose if they are not now that they are working to be

The iTransact module download on ModYourZenCart doesn't even work anymore. I've contacted them just to make sure they still support it, but I doubt it. Does anyone have any suggestions about alternative iTransact modules? Or am I out of luck and should just switch to a different gateway?

For what its worth, I called authorize.net today and asked specifically about the zen-cart / aim integration as it relates to pa-dss.

Their reply was that to continue using the aim integration method, zen-cart users would need to "upgrade" (their word, not mine) before july 1, to a pa-dss compliant shopping cart, or use the sim integration method, or an alternative like paypal, google checkout, or other off-site gateway.

kiddo:

For what its worth, I called authorize.net today and asked specifically about the zen-cart / aim integration as it relates to pa-dss.

Their reply was that to continue using the aim integration method, zen-cart users would need to "upgrade" (their word, not mine) before july 1, to a pa-dss compliant shopping cart, or use the sim integration method, or an alternative like paypal, google checkout, or other off-site gateway.

So what do AIM users have to do to "upgrade"?

I hope someone else in the ZC community has been notified about this and has more information about it, because it seems like a real pain to try to code for this new MC requirement.

I received a notice from my Merchant account processor (WellsFargo Merchant Services) telling me that MasterCard has announced changes to the way an "E-payment/Gateway application" ( I am assuming ZenCart is this type of application) handles customers that pay with a MasterCard debit card or a Pre-paid MasterCard. I don't know if this will affect my zencart store or not and wanted to see if anyone else has additional information about this new requirement. I am currently using PayPal PayFlow Pro to handle credit card transactions, but when I called them they said that it would be the Merchant account processor who would require this. I very confused about this new requirement.

Here is an excerpt from the Letter, there are more details in the letter I received about why MC wants this done, but i'm only putting a few paragraphs here :

*"MasterCard has announced mandatory changes to its debit and prepaid card authorization procedures that require an update to your Point of Sale (pos) system. Beginning May 1, 2011 MasterCard will require merchants to perform partial authorizations and real-time authorization reversals for debit and prepaid card transactions, in addition, merchants will be required to support available balance responses for prepaid card transactions. New data elements will need to be passed between MasterCard and your pos system which will require you to make programming enhancements.

Your Point of Sale (POS) system must be upgraded
Your business has been identified as using a POS system that utilizes an integrated POS software application such as Aloha, Counterpoint, or Squirrel or an E-payment/Gateway application such as Authorize.Net, Cybersource, and First Data Global Gateway. To be compliant with this new MasterCard mandate, your POS system will need to be updated with new transaction specifications. If your system is not compliant by May 1. 2011, you may be subject to a per transaction compliance fee by MasterCard. To avoid MasterCard compliance fees associated with these new procedures, these new specifications must be implemented on your POS system. You will want to contact your application software vendor directly to find out what updates are available. Your vendor is responsible for updating your application software."*

Any information about whether our ZenCart stores need to be upgraded to handle this mandate would be appreciated.

http://www.zen-cart.com/forum/showthread.php?t=148457

Great, thanks for the link. I'll read and follow there.

Would this also affect zencart users who have PayPal's PayFlowPro payment module integrated?

Since the customer isn't taken off of the zencart shopping site, then I am assuming it would be up to me to code for this requirement.

Would you please get your provider to clarify exactly what they are considering as a POS?

Kim:

Would you please get your provider to clarify exactly what they are considering as a POS?
Having read this at least twice I would think that it is apparent that it is not the "provider" as you are using this and only a poorly written message from the MC group copied and forwarded to users...
MC contact:

Your business has been identified as using a POS system that utilizes an integrated POS software application such as Aloha, Counterpoint, or Squirrel or an E-payment/Gateway application such as Authorize.Net, Cybersource, and First Data Global Gateway
Point of sale system that uses an E-payment system...
The real question is is ZenCart already a secure platform from which to conduct secure transmission to/through a compliant gateway or not.

I believe that what ever the requirements are should be reviewed by the Dev Team

I suspect that it is, but am only a volunteer poster here...