Credit risk: a few good methods for payment processing.

[ILLUSTRATION OMITTED]

Perhaps you're hoping to process credit card donations based on telephone calls from donors, or to allow on-site registration at your next conference. Perhaps you want to take credit card payments at a T-shirt booth at a concert, or at your organization's gift shop.

The world of credit cards is a complicated one. There are a number of different possible methods for taking credit cards, which might require different types of hardware, software and relationships. While it's beyond the scope of a single article to tell you everything you might want to know about every method, it can be useful simply to have a view of what's possible.

THREE STEPS TO PROCESSING A CREDIT CARD

Weighing your options requires a basic understanding of how credit card processing works. Unfortunately, this process isn't a simple one. It's a multi-step process that often involves a number of different vendors and entities.

1. Collect and enter credit card information. To process any payment, you'll obviously need to collect the credit card information from the person making the payment and transfer it--whether electronically or manually--to a service that can actually process the payment. This can involve anything from writing down the card information and mailing it to your bank, to typing it into an online system, to swiping the card through a specific kind of hardware.

2. Authorize and commit the charge. Once the payment information has been entered, it is transferred electronically to a payment processor, who checks to see that the credit card account exists and has enough money to cover the charge--a process called "authorizing"--and then actually charges the card.

[ILLUSTRATION OMITTED]

Regardless of the processing method you use, you'll have some kind of payment processing specialist in the mix. These payment processors manage the electronic flow of money for a credit card transaction But they typically do very little else, so they often work hand-in-hand with another system that provides the interface to enter information and handles any other needed functionality.

3. Deposit money to bank account. Once the card has been charged, you get to a critical step: actually receiving the money. The payment processor always deposits the money in a special kind of bank account called a merchant account. For most of the methods discussed in this article, you'll need to open your own merchant account, either through your own bank or one recommended by your payment processor.

Money is then automatically transferred (called "sweeping" funds) from your merchant account into a bank account, where you can withdraw the money within a few days. This transfer usually occurs on a nightly basis to facilitate reconciliation with bank statements.

Like any bank account, you'll want to shop around and look at rates for a merchant account. These accounts define the base amount you'll pay for each transaction. There will always be a fee involved, but the size and terms of these fees can vary substantially. For instance, you might have a merchant account that charges you $25 per month and 2.2 percent of each transaction. That is a good rate, applicable to an organization with a high volume of transaction. Or, the account might be one that charges a simple 2.8 percent of each transaction with no monthly fee, which might be more appealing if you'll have a low volume of transactions.

If you want to take online payments, make sure your merchant account allows them. You'll also need to make sure that the merchant account is compatible with your online payment method. So, you might want to choose an online payment vendor first and ask them for recommendations of appropriate merchant accounts.

There are a wide variety of methods for actually taking the card.

Credit Card Imprinting Machine. Have you ever been somewhere where a vendor takes your credit card and makes a print of it on purple carbon paper by dragging a bar over it in a little handheld machine? That machine is called an imprinter--it essentially makes a quick copy of the credit card information to allow you to process it later.

It serves the same function as writing down the information, except that it allows you to copy it more quickly and accurately. You might be able to get an imprinting machine free from your bank, or you can buy one for $20 to $40.

An imprinter is an easy and inexpensive way to collect information on-site. It's small and doesn't require any electricity or connectivity, so it can be taken anywhere. However, it's really only half a processing method. You still need to process the charges later using one of the other methods.

Separating the collection of information from the processing also introduces a number of risks. If you process the card with the person standing there, you can always let them know the card wouldn't go through and ask for another method of payment. But if you run it afterwards and the card is declined you're likely simply out of luck.

There's also a substantial risk inherent in carrying imprinting slips around. You're essentially carrying a stack of credit cards. If you lose the slips, in the best case, you're out of a bunch of payments. At worst, you may have just funded some nefarious person's taste for expensive electronics and exotic trips.

If you've collected credit card information--via an imprinter or through mailed-in donation-via-credit-card forms--one of the most straightforward ways (although likely not the cheapest way) to process the charges is to ask your bank to do it. Many banks will run these payments through for an organization that has a merchant account. The bank will also take charge of destroying the paper forms, and thus reduce the risk of having paper-based credit card information lying around.

Credit Card Terminal If you need to take a higher volume of payments in onsite situations, it might make sense to invest in a credit card terminal, also called a "swipe terminal." These small machines allow you to swipe a credit card, enter the payment amount on a keypad and then process the payment--and might even print out a receipt. You can often purchase a terminal from the bank that offers your merchant account (generally for a couple of hundred dollars), or you can rent one for a particular event.

Terminals generally require power, although specialized ones might run on batteries. They also require connectivity--usually a telephone line--to process credit cards in real time. Some terminals might allow you to store transaction information without connectivity and then process the cards later. Like an imprinter machine, running the cards later means that you likely won't be able to get payment from any transaction for which the card is declined. However, the terminal saves you the time of re-entering the payment information later, and stores the payment information more securely than imprinter slips.

Terminals are widely used and effective in a number of different situations. For instance, they can be useful for on-site events, a development office that needs to process a lot of phone credit card donations or even for basic office use. It can be difficult, however, to integrate a terminal with another database, for instance, to process a donation and record it to a constituent record at the same time. If you'll be processing a large number of transactions that also need to be recorded in another database, one of the methods described next might work better.

Virtual Terminal The Internet has opened up a new world of credit card-processing possibilities. The most straightforward of these options is called a "virtual terminal," which allows you to enter credit card and payment information into a form online and process it over the Internet. You can "rent" a virtual terminal from an online payment-processing specialist, usually for some combination of a monthly fee and a percentage of the transactions.

A virtual terminal requires you to take the time to type in--as opposed to swipe--credit card information, and provides only stripped-down payment processing features. With these limitations, it's probably not the best solution for processing a lot of payments. However, it can be a convenient option for processing a few payments from any location with an Internet connection. Payments can typically be exported in order to load them into your constituent database.

Online Payment Processor. There arc a huge number of online payment vendors, many of whom specialize in specific types of online payments. For instance, it's easy to find vendors who support online donations, event registration or purchases of items. While these vendors typically provide an interface that's optimized for your constituents to submit payments on their own, most of these interfaces work perfectly well to allow your staff to process payments.

If your staff gets registration requests by telephone, there's no reason they can't enter credit card information into the same interface a registrant would use to register. You just need to make sure that any automatic emails that are sent out to the registrant make sense for both scenarios. They might even work for in-person scenarios. However, you'll generally need to type in the credit card information by hand--which takes longer than swiping and might seem odd to the person paying, as it's more typical to swipe a card in this situation--or invest in a keyboard with a credit card swipe ability. You'll likely need a printer to print receipts.

These online payment specialists often offer a number of features specific to their focus area, such as an event registration tool that might allow you to easily track lunch requests and print name tags, while online donation software might support pledges and tribute gifts. Like virtual terminals, online payment processors typically allow you to export the payment entries so you can load them into your constituent database.

Payment-Enabled Software. If you're processing payments that need to interface directly with constituent management software many mid-tier and advanced software packages will allow you to process payments directly from that software. Some donor management systems allows you to enter payment information into the software, process the payment and create a record for it in one step.

Point-of-Sale Solutions. If you want to take credit cards in a permanent physical location such as a gift shop, a registration desk or a cashier to pay for services you'll likely want to think through more hardware-intensive options.

In this scenario, you'll want a way to swipe cards and print receipts. These functions could be handled by a credit card terminal, or you can purchase a separate swipe keyboard and a receipt printer. You might also want the ability to add the prices of a number of items and calculate tax, which isn't typically done by a terminal. If you often sell a number of items to one person, you might want to consider a price scanner and a display pole, the price display on a stick that shows the customer what you're ringing up.

As you go down this path, consider purchasing point-of-sale (POS) software. Point-of-sale software integrates with all of the hardware mentioned previously, and offers reporting and analysis functions that help you measure the effectiveness of your sales operations. They're also helpful in managing an inventory.

Taking credit card payments requires you to sign an agreement to uphold the Payment Card Industry Data Security Standard, commonly known as PCI (or PCI DSS) requirements. (See the related story "States Push To Encrypt Personal Data" starting on Page 1) Any method will require some vigilance, but some methods will be more security-intensive than others. For instance, using an imprinter will require documented and enforced procedures as to how imprinter slips are handled, used and destroyed, while a terminal or online payment method makes it harder for anyone to get at credit card information and thus require less security effort.

Storing credit card numbers in any format requires strict and specific security measures under the PCI requirements. Violation of this agreement can cause a substantial fine, the loss of your ability to take credit cards and a breach of your constituents' trust if the wrong person gets hold of credit card numbers. Many nonprofits that store credit card numbers are in substantial violation of the PCI agreement and run dangerous risks because of it.

Unless you have a thorough understanding of the PCI regulations and have spent time and money to create a system that is in compliance, you'll likely want to use an online payment processor or payment-enabled software to handle recurring transactions.

As you consider your options, don't forget one of the most important considerations: What are your constituents likely to expect? Be careful of methods that require you to gather someone's life story to run a simple payment, or require your staff to go through strange and time-consuming machinations with a constituent standing in front of them.

Laura S. Quinn is founder and director of Idealware in Portland, Me. Thanks to TecbSoup, Peter Campbell at EarthJustice, Paula Pruett at YMCA of Roanoke Valley, Patrick Shaw of NPower Seattle, Dan Shenk-Evans of the Community IT Innovators, Judith Sol-Dyess of the YMCA of Metropolitan Chicago and Robert Weiner of Strategic Technology Advisors.