IndiaPay is Recognized by Visa for CISP Compliance

IndiaPay is excited to announce our certification of compliancy with Visa's Cardholder Information Security Program (CISP). This program establishes a set of 12 requirements for safeguarding sensitive information and controlling data access.

To become certified, organizations must submit to an independent security audit to verify compliance with all twelve requirements. This recognition by Visa underscores our commitment to provide the highest level of security to our merchants and their customers for their card processing needs CISP Requirements:

• Install and maintain a working firewall to protect data
• Keep security patches up-to-date
• Protect stored data
• Encrypt data sent across public networks
• Use and regularly update anti-virus software
• Restrict access by "need to know"
• Assign unique ID to each person with computer access
• Don't use vendor-supplied defaults for passwords and security parameters
• Track all access to data by unique ID
• Regularly test security systems and processes
• Implement and maintain an information security policy
• Restrict physical access to data

CISP defines a standard of due care for securing Visa cardholder data, wherever it is located. CISP compliance has been required of all entities storing, processing, or transmitting Visa cardholder data.

Members must comply with CISP and are responsible for ensuring the compliance of their merchants and Agents—whether they support Issuing or Acquiring activity—for all payment channels, including retail (brick-and-mortar), mail/telephone-order, and e-commerce.

Secure Online Transactions

The Fraud Protection utility within the IndiaPay system allows you implement safety precautions when accepting mail order/telephone orders (MO/TO) or Internet transactions. Due to the inherent risk associated with these transaction types, it is recommended that you begin to develop a negative database to help you identify and prevent high-risk transactions.

This feature works with the automated Address Verification System (AVS) to help you avoid charge backs and fraudulent transactions. High-risk Customers can be disallowed from purchasing items based on credit card number, name, and country.

Select the fraud protection tool you wish to use from the main console. The first screen you see is a report of all data you are currently blocking for the fraud protection tool you selected.

When you determine that you would like to add specific information to this negative database, select the appropriate tool from the drop down menu and you will be presented with a report screen that has a data entry box labeled Add at both ends. Enter the type of data that corresponds with your selection as described below.

• Credit Card Numbers - You may block any credit card you wish. You may look up credit card numbers of problem clients with the Account Management and Reports tools. Enter the credit card number exactly as it appears on the card or in a report. Click Add and the credit card will be added to your negative database and will be prevented from making future purchases.
• Name - Adding a customer name to your database is performed in the same manner as adding credit card numbers. Occasionally you may wish to add the name of a problematic company or customer to your list, so that they will be prevented from purchasing regardless of form of payment.
• Country - You can enable the blocking of orders from certain countries to which you do not wish to ship or accept credit cards. This feature may be very useful due to the limited recourse you may have legally and with credit card disputes originating from purchases made by foreign customers. To enable the blocking of a specific Country simply select that feature from the bottom of the Fraud Protection console and then use the arrow to the right of the entry box to scroll through the list of countries. When you have found the country you wish to block simply click on it. You may also type the abbreviations if necessary.

In addition to the merchant-initiated protection mechanisms described in this section, several automatic features have been incorporated into the Merchant Fraud Protection module to block out customers exhibiting suspicious buying behaviors, including:

• A feature to block a credit card that is submitted and declined twice within 24 hours using different expiration dates.
• A feature to check City and State entries for validity against the zip code entered.
• A feature to check area codes for validity against the zip code entered.

Secure Sockets Layer (SSL) technology is the industry-standard method for protecting web communications developed by Netscape Communications Corporation.

The SSL security protocol provides data encryption, server authentication, message integrity, and optional client authentication for a TCP/IP connection. Because SSL is built into all major browsers and web servers, simply installing a digital certificate turns on their SSL capabilities.

SSL comes in two strengths, 40-bit and 128-bit, which refer to the length of the "session key" generated by every encrypted transaction. The longer the key, the more difficult it is to break the encryption code.

Most browsers support 40-bit SSL sessions, and the latest browsers, including Netscape Communicator 4.0, enable users to encrypt transactions in 128-bit sessions - trillions of times stronger than 40-bit sessions.

The proprietary FRISK risk management system from IndiaPay Software provides a sophisticated suite of fraud detection and prevention options. Each transaction submitted can be filtered through a comprehensive series of fraud detection rules to determine potential risk.

Configuration of these rules is under your complete control using our user-friendly