The Ultimate Online Payment Security Checklist by Invoice Cloud

This guest post is brought to you by Invoice Cloud.

With a growing number of customers opting for online payments, demand for digital payment channels is at an all-time high. According to a recent Invoice Cloud survey, online channels are the preferred method for making payments, with 43% of survey respondents preferring an online portal for payments and 34% of respondents preferring mobile device payments.

Providing these digital payment options is pivotal if you hope to keep pace with customer expectations – and driving payers to online channels only serves to benefit your organization. Encouraging online payment adoption is vital for saving organizational time and resources, accelerating collections, and increasing customer satisfaction.

But, despite the growing preference for online payments, there are still plenty of customers who would prefer to make payments offline (mailing a check, paying over the phone, etc.). While it’s necessary to assure that those offline payment channels are fully optimized for those users, it’s equally critical for your organization to convince those reluctant customers to make the switch to online services.

In The State of Online Payments, we explored why some payers are hesitant to use online payment channels. For some, sending in a monthly check or making an in-person payment is simply a preference or a habit – but others had serious concerns.

Thirty-two percent of respondents who prefer offline channels cited security concerns as their main reason for rejecting online payments — specifically, “the security of their payment information.”

Since digital security concerns are a major barrier to e-payment adoption, you need to understand the issue and evaluate how your online payment platform works to address these customer fears.

Don’t Ignore Online Payment Compliance

Clearly, customers have data security concerns – understandable, considering the sensitive nature of payment information. Not only can those concerns interfere with your organization’s online payment adoption, but lapses in security could also bring to light compliance issues that need to be addressed internally.

Compliance regulations can change frequently, depending on your industry, so your electronic bill presentment and payment (EBPP) solution must be able to keep pace with evolving security requirements. If it cannot, your organization could potentially be vulnerable to data breaches and the legal ramifications that follow.

Fortunately, EBPP providers prioritize data security in their products and offer utilities and municipalities like yours fully secure solutions.

The Online Payments Security Checklist

To ensure that your customer data is secure and that your organization is up to date with compliance regulations, you’ll want to keep a few things in mind when choosing an EBPP provider:

✅ SaaS model

The Software as a Service (SaaS) model is the ideal software solution for payments, particularly for security compliance. True SaaS delivers continuous improvement and requires no maintenance on your part. These updates guarantee your organization has the latest security patches to remain compliant with industry standards.

✅ Multi-tenant infrastructure

The SaaS multi-tenant architecture solution creates a single application that serves multiple customers, as opposed to a cloud-hosted single-tenant model. Client data is secured in individually partitioned databases, providing superior performance and maintenance while the entire application is wrapped and monitored in a secure environment.

✅ PCI Level 1 compliance

The Payment Card Industry Data Security Standard (or PCI DSS) is a set of six principles that are the standard framework, including “build and maintain a secure network” and “regularly monitor and test networks.” From there, 12 requirements exist for PCI compliance. PCI consists of six goals around the safety of payment information and includes four levels of PCI compliance. PCI Level 1 service provider indicates the most thorough and comprehensive guidelines and compliance audit requirements.

✅ Security assessments and certifications

When choosing an EBPP platform, you’ll want to confirm that your potential software providers follow the requirements outlined in PCI-DSS for security tests, typically conducted by an outside testing firm. Make sure any considered providers maintain annual security certifications, like SOC 1 and SOC 2 Type 2, and PCI-DSS Level 1 Service Provider certifications. These verify that the payment platform has implemented effective data security controls.

✅ Data privacy policies

Don’t be afraid to ask providers questions about their data privacy policies. If they are thorough, the providers should keep (and frequently review) audit logs to maintain checks and balances in security. They should also offer clear language confirming they do not sell customer data to any third parties, except for service providers deemed necessary to fulfill the requested services.

If your current online payment solution doesn’t check the boxes above, it may be time to consider an EBPP provider that has data security top of mind. Not only will you safeguard your organization against compliance liability, but enhancing security measures is also a necessary step to alleviating payer concerns and driving those worried customers to online payment routes.

For additional insights on payer preferences and concerns, download our free research report, The State of Online Payment.

Rob Chenault has been building state-of-the-art server and network systems in high-security environments for the last 25 years.  He spent 14 years with Sage, building and protecting large volume transaction processing systems and guiding the organization through numerous audits including the stringent Payment Card Industry (PCI) certification.