In 2006, the major credit card brands (American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc.) joined forces to form PCI Security Standards Council. The council educates and creates security recommendations for merchants, software developers, service providers and anyone involved in the processing of credit cards. The goal – to ensure better protection and security for credit card holders. They began working with merchants who process a high volume of transactions and now, they are focusing on what the industry terms as level 4 merchants which mean anyone processing between 1 to 20,000 credit card transactions a year. Apparently, the major cards are going to start revoking certification for merchants considered vulnerable (or non compliant) beginning Oct 1st, 2009.

If you have a merchant account and process even one credit card transaction – that could mean you.

What should you do? That is the big question and it all depends on what and how your process credit cards. In my research, I’ve found the answers may not always be clear for Internet Marketers who usually choose a third party shopping cart and PayPal so I hope to simplify it for you here.

If you use your merchant account with third party shopping cart like 1ShoppingCart and you do not save or store credit card information on your own web site, anywhere online or offline:

You’re in luck. You have the least to do. You should complete the self assessment questionnaire (SAQ). Chances are, you do not need to do PCI compliance scanning of your web site but you should confirm this with your merchant account provider or bank if you obtained your merchant account via your bank.

If you use your merchant account with your own shopping cart but do not store credit card data – meaning the actually entering and processing of the card, people are taken to example Authorize.net:

You too have to complete the SAQ and check with your merchant account provider to see if you need to do a quarterly scan on your web site.

If you use your merchant account through your shopping cart and also store and process the payment on your site – note, if you accept credit cards via aMember, chances are this is you because aMember does store data on your web site:

Then, you will in all likelihood need to do both scanning and the questionnaire.

If you use PayPal:

As we understand, you probably won’t need to do anything IF you use Website Payment Standard. If you use other PayPal products like Website Payments Pro, Payflow Pro, or Virtual Terminal, then you may have to do either the questionnaire or both. Either way, please check with PayPal.

If you use Clickbank:

Please check with Clickbank because I don’t seem to be able to locate this information on their web site.

If you use 2Checkout:

You only need to complete the SAQ. For more complete answer straight from the horses’ mouth, please see 2CO’s blog post.

Even after all my research, I’m still getting mixed signals and a little confused at times. Do not rely on this blog post only as the bible truth. Your best resource is always your own merchant account provider.