Credit Card Security

Traditionally, small online store owners protected the security of their customer's credit card information by using SSL encryption so that the information cannot be intercepted by third parties during transmission, and limit access to their database to certain key employees.

However, as of 2008, after a significant rise in credit card fraud, the major credit card companies have decided that traditional security measures aren't enough, and have established new mandatory comprehensive security regulations called “PCI DSS”. These new regulations seek to ensure that any merchant handling or storing credit card information is certified as secure, through a detailed analysis eliminating all possible security breaches. This is a good thing for customers, but a significant new expense for online store owners, which may be out of reach for small online store owners. If you are required to meet PCI DSS regulations, you will have to spend at least a few hundred dollars per year (possibly much more) to prove you are in compliance.

High volume online stores may still find it cost-justifiable to use the traditional approach and pay PCI DSS compliance costs. However, small online stores are finding they can no longer do so. Instead, small online stores (in order to circumvent the prohibitive cost of PCI DSS compliance) are making themselves PCI DSS exempt by not handling or storing credit card information at all. However, you still need to accept credit card payments in real time in order to optimize your sales closing rate. If you don't, your competitor will. So how do small online stores circumvent the prohibitive cost while still remaining competitive?

One solution is to stop handling credit card information, and using payment gateways that don't require you to do so, such as Authorize.Net SIM API* and PayPal Express Checkout. Triskelon e-commerce modules support these payment gateways, which make you PCI DSS exempt, and therefore exempt from PCI DSS compliance costs.

*Site owners interested in using the Authorize.Net SIM API interface must have PHP version 5 running on their web server.