To: Deans, Directors and Department Chairs
From: Chandrika Rao, Director of Accounting Services
Note: This memo is of interest to departments that use a Point of Sale credit card terminal to collect receipts for the goods and services provided to customers.
On November 27, 2007, the Office of the State Controller issued a memorandum on Policy Regarding Truncation of Merchant Cardholder Account Numbers. Specifically, this policy addresses the printing of complete cardholder account numbers on the merchant’s copy of sales slips and credit vouchers at Point of Sale (POS) terminals. To summarize, departments that utilize POS terminals for face-to face transactions should determine if there is truly a business need for printing the complete cardholder account number on the merchant’s copy of sales slips and credit vouchers. If the business need does not outweigh the risks associated with storing the cardholder’s account numbers, the participant should take the appropriate steps to alter its procedures. The steps involve either:
- acquiring new POS terminals having the capability to truncate the cardholder account number, or
- reprogramming existing POS terminals to allow for the truncation.
Departments at the University utilizing any terminal that is not merchant copy truncation capable (i.e. – the terminal is not listed below) should
- purchase a new terminal or
- provide a business justification to the Cash Manager for approval to continue printing the full cardholder account number.
The business justification needs to be submitted by July 1, 2008. All new terminals need to be purchased and in use by December 31, 2008. For your information, terminals currently offered by SunTrust Merchant Services (STMS) and the State contract pricing can be found on schedule B, at the following link: http://www.ncosc.net/SECP/ScheduleB-ScheduleofFees.pdf
Departments should be aware that not all POS terminals are capable of the “merchant copy truncation.” The capability depends upon the make and model of the terminal. The following POS terminals are known to be terminals that are merchant copy truncation capable: Verifone Omni 3750, Hypercom T-4100, First Data FD-100, and Verify Software. To have one of the terminals identified above be converted to the “merchant copy truncation” mode please STMS Technical Support Services, Tel: (800) 654-8819 with the following information:
- outlet’s merchant number;
- terminal ID number;
- make and model of POS terminal; and
- terminal serial number.
Any new terminal purchased must be merchant copy truncation capable or double truncation capable, unless the merchant has an approved business justification. Departments that utilize POS terminal applications (i.e. POS Software) should contact the vendor that supplied the software to ascertain the steps required to modify the configuration to enable the merchant copy truncation feature (aka duplicate truncation).
To view the OSC policy, please visit the following link: http://www.ncosc.net/Credit_Card/SecurityandPrivacyofData.pdf.
Thank you in advance for your assistance in this important matter.