PCI Compliance

Options
Michelle Harper
Michelle Harper ✭
Sixth Anniversary Facilitator 1 Name Dropper Photogenic
in Blackbaud Raiser's Edge NXT®: General Discussion

When a donor calls to update their cc or bank info for a recurring gift, the fundraising office currently writes the information down and takes it to the accounting office to update in RE or RENXT. When appeal cards come in through the mail, they are also taken to the accounting office to enter and then have the cc info blacked out.

I understand that this is not PCI compliant, but I am not sure exactly how to change it to be compliant. How does everyone else handle this? Do you enter the information directly into RE? If so, who does this? Do you use a third-party software to safely transfer this information from the person answering the call to the person who has access to edit the information on the constituent record?

I have read about people using a small portable white board to write down the info instead of paper, but I fail to see how that is any better.

Thank you in advance for your help!

Tagged:

Comments

  • Dariel Dixon 2
    Dariel Dixon 2 ✭✭✭✭✭
    Seventh Anniversary Facilitator 4 Name Dropper Photogenic

    @Michelle Harper So are you stating that no one in your fundraising office has access to gifts in RE? That seems very strange to me. If that is the case, why not just forward the calls to the accounting office?

    In regards to the appeal cards, it makes sense that there needs to be should be a way to process these things in the office. I've seen times where these cards are simply typed into the online donation forms to process so there is no longer any need for the card number to be visible.

  • Austen Brown
    Austen Brown ✭✭✭✭✭
    Ninth Anniversary Facilitator 4 Name Dropper Photogenic

    @Michelle Harper - Every org is set up differently, but in my experience DBAs and other data entry support staff have permissions to directly update payment information within RE NXT. This eliminates the need to write down sensitive information, as it is going directly into the system where it is immediately encrypted.

  • Michelle Harper
    Michelle Harper ✭
    Sixth Anniversary Facilitator 1 Name Dropper Photogenic

    @Dariel Dixon the fundraising office enters gifts, but they do not have access to credit card and bank account information. They do not process the payments, jut entered them into RE. This is something that has been done this way for many years, but I think this is something we need to change.

  • Alex Wong
    Alex Wong ✭✭✭✭✭
    Ninth Anniversary Facilitator 4 Name Dropper Photogenic

    @Michelle Harper
    It does depend on your finance/accounting processes and how they charge these “offline” credit card. If everything is to go through BBMS, You can have the credit card info stored in RE constituent record, but a PROCESS must be define so that your finance/accounting team know what to do to charge AND record the gift in RE constituent record. If they don't use BBMS and use something else, then this won't work as credit card info stored in RE cannot be retrieved for outside use.

    @Dariel Dixon sometime the issue is that online donation form (almost all) requires email addresses, and there are going to be donor that do not have or do not give you their email address.

  • Dariel Dixon 2
    Dariel Dixon 2 ✭✭✭✭✭
    Seventh Anniversary Facilitator 4 Name Dropper Photogenic

    @Michelle Harper: It's not surprising that the fundraising office doesn't process the payments, but the fact that they don't have access to entering the information seems like a disconnect between departments. By this definition, this is a massive security red flag. Even if you use a third party processor there has to be a better way, but both the accounting department and the fundraising office have to agree that things must change.

    @Dariel Dixon the fundraising office enters gifts, but they do not have access to credit card and bank account information. They do not process the payments, jut entered them into RE. This is something that has been done this way for many years, but I think this is something we need to change.

    There's more here to unpack, but this is a change that needs to happen as soon as possible.

  • Alex Wong
    Alex Wong ✭✭✭✭✭
    Ninth Anniversary Facilitator 4 Name Dropper Photogenic

    @Michelle Harper:

    the fundraising office enters gifts, but they do not have access to credit card and bank account information. They do not process the payments, jut entered them into RE. This is something that has been done this way for many years, but I think this is something we need to change.

    in our org, that's a huge no-no. we do not let fundraising staff entering gift for 2 reasons (1) they have a hard time learning how to handle constituent info, let alone learning how to enter gifts and all its rule around it so it post properly in FE (2) we have 25 fundraising chapters, we do not want one chapter “taking” credit where not appropreiate due to their rights to enter and edit gifts.

    Also, I think entering gift record before the actual transaction happens is a problem in itself

  • JoAnn Strommen
    JoAnn Strommen ✭✭✭✭✭
    Ancient Membership Facilitator 4 Name Dropper Photogenic

    @Michelle Harper Though card # being send by mail is decreasing, there are still the calls when a donor wants to give by credit card. I may be totally off base here but I was not under the impression it is not PCI compliant to write a card # down. Is is more about what happens to that document. Is it left on a desk? Put in a mail slot? Is it handled securely, stored securely when necessary and protected? Those are the policies that are required as I understood the requirements.

    From the 12 PCI Compliance Requirements summary:

    072ce6e19402b5fed5b6d2583035558e-huge-im

  • Michelle Harper
    Michelle Harper ✭
    Sixth Anniversary Facilitator 1 Name Dropper Photogenic

    @Alex Wong
    We are a small organization with only one fundraising office. There is one person in that office that enters gifts after the accounting office has deposited the checks. I (the accountant) look at all gifts before I post them in both RE and FE.

  • Michelle Harper
    Michelle Harper ✭
    Sixth Anniversary Facilitator 1 Name Dropper Photogenic

    @JoAnn Strommen
    I read online (and heard at a recent conference) that writing the CC or bank info down is not PCI compliant and that we have to be cautious with this because your writing can leave an impression on anything underneath it, especially notebooks or sticky notes.

  • Dariel Dixon 2
    Dariel Dixon 2 ✭✭✭✭✭
    Seventh Anniversary Facilitator 4 Name Dropper Photogenic

    @Michelle Harper The biggest thing is to have a good checks and balances. Right now, you're entering all credit card gifts and posting those same gifts. That's not cool at all. I'd say that your organization should consider all of these things with all the changes you're considering. I would consider having someone in the gift entry side enter ALL GIFTS, and another person posting ALL GIFTS. When in a small shop, that's the biggest thing you can do. If the fundraising office received the mail and were able to enter the gifts, and you were able to post them or process the credit cards, you could potentially resolve both issues.

  • Jeannie Goings 2
    Jeannie Goings 2 ✭
    Second Anniversary Facilitator 1 Name Dropper 2024 Product Update Briefings

    More to think about… What I am not seeing anywhere in this thread is having a PCI compliant keyboard. At a former organization the auditors insisted that we have PCI compliant hardware for entering cc information.

Categories