Card Validation Code (CVC2):
The Card Validation security feature is
activated in all ANZ POS Terminals
when processing Mail Order and
Telephone Order Transactions. To
activate the CVC2 for other
Transactions please contact ANZ
Merchant Services on 1800 039 025.
If activated, a new screen will appear
when processing nancial
Transactions.
Card Validation Code.
Turn the cardholder’s credit card over and locate the last 3-digits of the number printed on
the signature panel. If the Transaction is initiated via mail, telephone or Internet, instruct
the cardholder to locate and quote the 3-digits on the signature panel.
Terminal Display
At this display screen, key in the Card Validation Code
then press ENTER.
NOTE: American Express cards have a four digit code located on the front of the card. Diners Club
cards have a three digit code on the reverse of the signature panel.
After Processing the Transaction:
• Check the card number details against those printed on the Transaction Record
• Ensure that ‘Approved’ or an approval number/code is printed on the Transaction
Record.
Fraud Minimisation for Debit Cards
The following procedures are vital in helping you identify and minimise fraudulent debit
card Transactions via your Merchant Facility.
Debit Transactions are to be processed by swiping the presented card and having the
customer enter their PIN or signature depending on the debit card type.
Cards Left at Premises
From time to time customers may accidentally leave their debit or credit cards behind at
your premises. To ensure any potential fraud is minimised and to better align with broader
industry practices, a change to existing handling process is required.
Upon discovering a card left at your premises, you are to perform the following tasks:
- Retain the card in a safe place for a period of up to two business days;
- Hand the card to the customer claiming the card only after having established the
claimant’s identity by comparing signatures; and
14–15
- If the requisite two business days have passed, destroy the card
Should the cardholder enquire about their missing card, instruct them to contact their
issuing institution.
PCI DSS and Data Storage
What is the Payment Card Industry Data Security Standard (PCI DSS)?
PCI DSS is a set of standards implemented by the Card Schemes, MasterCard – Site Data
Protection (SDP), and Visa – Account Information Security (AIS), to manage the risk to
merchants of data breaches or hacker access. The standards apply to all merchants who
store credit card data in any formation, have access to credit card details, or have systems
which enable internet access to their company by the public.
Benets to your business
• Ensuring the security of cardholder data can lessen the likelihood of a data breach
being traced back to your business
• Your business will experience continued patronage due to customers’ condence in the
secure storage of vital information
• Helps to identify potential vulnerabilities in your business and may reduce the
signicant penalties and costs that result from a data breach.
Failure to take appropriate steps to protect your customer’s payment card details means
you risk both nancial penalties and cancellation of your merchant facility in the event of a
data compromise.
Key areas of focus
PCI DSS covers the following six key principles:
• Build and maintain a secure network
• Protect cardholder data
• Maintain a vulnerability management program
• Implement strong access control measures
• Regularly monitor and test networks
• Maintain an information security policy
What you need to do
MasterCard and Visa have created a set of tools and resources to assist you to implement
the PCI DSS. Visa’s program is called Account Information Security (AIS). MasterCard’s
program is called Site Data Protection (SDP).
For more information on working towards PCI DSS compliance, visit the PCI Security
Standards Council website at: pcisecuritystandards.org/index.shtml
Storage of prohibited cardholder data
As a merchant, it is vital to protect your customers as well as your business against misuse
of credit & debit account information. It is essential that you do not store prohibited
cardholder data after a transaction is completed.
VERIFICATION NO?