- What are the first steps in becoming a Credit Card Merchant?
- Do I have to do anything different to process Web based transactions (e-commerce)?
- What do you mean by PCI compliant?
- How long does the process take to get my merchant number and my equipment/software?
- What if I want to change my processing method (example: from card present to mail/phone orders)?
- If I have problems with my equipment or software, what should I do?
- How will my revenue and fees be reported?
- What if there is a discrepancy on my Statement of Activity?
- What if I want to change my chartfields for either sales or fees?
- Do I have to batch out my merchant terminal every day?
- How long do I have to keep the sales receipts on file?
- What is a Chargeback?
- What do I do if I get a Chargeback notice from one of the Credit Card Associations?
- If an individual processes a sales transaction, can that same individual process a credit for that transaction (e.g. returned merchandise or cancellation of service)?
- Should a Merchant provide a cash refund for returned merchandise that was originally purchased with a credit card?
- What are the rules for processing credit refunds for returned merchandise?
- As a Merchant, what should I do if I suspect that my credit card operation has experienced a “hacking” incident?
- How long do I need to keep my credit card receipts?
- What is the required retention period for other University business and financial documents (excluding credit card receipts)?
- Why are internal controls important and where can I find more information about them?
What are the first steps in becoming a Credit Card Merchant?
The first steps are to complete the Merchant Card Policy document (sections 7-10) and the Merchant Registration Form and forward them to the Treasurer's Office.
Do I have to do anything different to process Web based transactions (e-commerce)?
Yes, you need to contact the Treasurer’s Office first before completing any Merchant Registration Forms. The Treasurer’s Office needs to verify that the third party gateway provider that you selected for Web based transactions is PCI compliant and is compatible with our Processor (TSYS).
What do you mean by PCI compliant?
Visa and Mastercard collaborated to create common industry security requirements that each Merchant must comply with. These requirements are referred to in the Payment Card Industry as the PCI Data Security Standard. The standard applies to all payment methods, including retail (brick and mortar), mail/telephone order, and e-commerce.
And, the standard is also applicable to non-university entities that are using the University systems to process transactions. The PCI Data Security Standard offers a single approach to safeguarding sensitive data for all card brands (including American Express and Discover). Refer to “Complying with the Payment Card Industry Data Security Standard” for further information on the security requirements.
How long does the process take to get my merchant number and my equipment/software?
It usually takes between 2-3 weeks to get your merchant number and equipment.
What if I want to change my processing method (example: from card present to mail/phone orders)?
Changing the processing method requires that the Merchant complete a Change/Termination Form (Web Merchant version) and submit it to the Treasurer’s Office for approval.
If I have problems with my equipment or software, what should I do?
You should contact the Treasurer’s Office at 615-6123 and tell them what problems you are experiencing. We will assess the problem and if necessary replace the equipment. There is a reduced charge for replacement equipment if the malfunctioning equipment is returned to the Treasurer’s Office.
How will my revenue and fees be reported?
You will receive a monthly statement from the Merchant Acquirer Bank (Fifth Third Bank) detailing your sales and your fees. Also, all Merchants are set up with an automatic feed into the University’s General Ledger. Merchant sales and fees will be posted to the chartfields that were provided on the Merchant Registration Form and will appear on your University Statement of Activity.
What if there is a discrepancy on my Statement of Activity?
Merchants will need to contact Financial Operations/Transaction Services at 647-3767 for assistance in resolving the discrepancy.
What if I want to change my chartfields for either sales or fees?
You need to complete a Change/Termination Form (Web Merchant version) and submit it to the Treasurer’s Office.
Do I have to batch out my merchant terminal every day?
Yes, you must complete batch processing of all sales receipts at the end of each business day.
How long do I have to keep the sales receipts on file?
Visa and MasterCard rules require that you retain legible copies of all sales drafts for up to 18 months in order to satisfy any disputes/chargebacks. After the 18 month period is up, you should shred the sales drafts in order to protect cardholder information.
What is a Chargeback?
If a customer disputes a sales transaction with the card issuer, the Merchant will receive paperwork requiring them to respond within a specific period of time.
What do I do if I get a Chargeback notice from one of the Credit Card Associations?
You must respond within the timeframe specified on the notification with proof of cardholder authorization for that transaction. Otherwise, the customer will be issued a credit on their card and you will be debited the disputed amount.
If an individual processes a sales transaction, can that same individual process a credit for that transaction (e.g. returned merchandise or cancellation of service)?
No, the person who processes the sale cannot process the return. The merchant must designate an individual in section 7 of the Merchant Card Policy document to process credit refunds. Supervisory approval of all credit refunds is required. A common form of fraud is for an employee to process credits to their own personal credit card(s).
Should a Merchant provide a cash refund for returned merchandise that was originally purchased with a credit card?
No. The card associations do not normally permit cash refunds for any credit card transactions. The only exception to this rule is if the purchase was made with a prepaid card (e.g. Visa or Mastercard gift card) and the cardholder is returning items, but has discarded this card, you may give a cash refund or in-store credit.
What are the rules for processing credit refunds for returned merchandise?
A Merchant shall not process a credit transaction without having completed a previous purchase transaction with the same cardholder and the same credit card and paid related fees with such transaction to the Merchant Acquirer (Fifth Third Bank).
As a Merchant, what should I do if I suspect that my credit card operation has experienced a “hacking” incident?
Notify the Treasurer’s Office immediately at (734) 615-6123 and tell them what you suspect. Also, refer to Standard Practice Guide 601.25 which outlines the incident reporting policy for all University units.
How long do I need to keep my credit card receipts?
A merchant is required to retain legible copies of sales receipts for up to 18 months in order to satisfy any disputes/chargebacks. These receipts should be kept in a locked file cabinet or safe. After the 18 month period has expired, the sales receipts should be shredded in order to protect cardholder information (refer to PCI 9.1).
What is the required retention period for other University business and financial documents (excluding credit card receipts)?
Please refer to SPG 604.1 as the required retention period is dependent upon the source of funds supporting the activity (e.g. sponsored programs retention period is different from non-sponsored programs).
Why are internal controls important and where can I find more information about them?
Internal controls provide important benefits to your department and to the University as a whole by improving the quality of accounting information, and it reduces the possibility of mismanagement, error and fraud. Segregation of duties is the cornerstone of internal control. It is a coordinated system of checks and balances in which tasks necessary to complete a transaction either are performed by different individuals, two or more individuals working in tandem, or the tasks are independently reviewed. No one individual should control all aspects of processing a credit/debit card transaction or refund (i.e., reviewing daily batches, reconciling the Statement of Activity and Monthly Merchant Statement from Fifth Third Bank).
For further information on internal controls, please see SPG 500.1 Fiscal Responsibilities or University Audits Web site: (http://www.umich.edu/~uaudits/internalcontrol/financial.internal.html).
Copyright © 2008
Regents of the University of Michigan
Ann Arbor, MI 48109 USA
+1 734 764-1817