More and more I run into merchants who are using a dial-only terminal through an internet-based “phone line”. These lines are called VOIP (Voice-over-internet-protocol). The problem in doing so is that you are immediately putting yourself in a non-compliant status with PCI DSS (aka PCI Compliance). And here’s why you should care…
- Fines start at $10,000 and up.
- Your processor can be fined and this will be passed on to you.
- You could be breached. In this scenario the fines, fees, lawsuits, & bad press are often so great that the small/medium-sized business cannot survive.
Some Internet Service Providers claim their VOIP network is secure. This is absolutely irrelevant. Until the merchant can PROVE that the data is secured via security protocols, the merchant is still non-compliant. The rules are what they are. And just in case you don’t believe me…
Payment Application Data Security Standard 11.1 reads:
If the payment application sends, or facilitates sending, cardholder data over public networks, the payment application must support use of strong cryptography and security protocols (for example, SSL/TLS, Internet protocol security (IPSEC), SSH, etc.) to safeguard sensitive cardholder data during transmission over open,
public networks. Examples of open, public networks that are in scope of the PCI DSS are:
The Internet
Wireless technologies
Global System for Mobile Communications (GSM)
General Packet Radio Service (GPRS)
Translation:
If your terminal/POS is sending credit card data over the internet, the terminal/POS must encrypt and/or secure that information.
The problem is that a terminal/POS using a phone/dial connection DOES NOT DO THIS (unless it’s Heartland’s E3 terminal). And you cannot rely on your ISP’s promise of security… that’s just not good enough.
Another issue with this setup is communication problems. Sometimes dial terminals work fine over a VOIP connection. Other times downloads fail, batches fail, and/or transactions fail. This can lead to duplicate transactions (which usually angers customers), frequent calls to customer service to delete batches (which takes up your time), and a host of other problems. These terminals were designed to work over an analog phone line (landline). Digital lines like VOIP operate in a different fashion, and often a terminal will have difficulty with this. Communication issues could be sporadic, frequent, or non-existent one day and unbearable the next. 
The solution? Upgrade to an IP capable terminal… these terminals are designed to operate via the internet using SSL technology (Secure Socket Layer… the same security used for online banking). Better yet, contact me for Heartland’s E3 terminal… not only is this terminal IP capable, but it includes the industry’s only End-to-End Encryption solution for an added layer of security at no additional cost. And it’s very reasonably priced.