The 7 most important security features to look for in a payment provider
Your payment provider handles most of the money moving between you and your customers. Use this seven-point checklist to make sure it protects your financial information and personal details from cyber attacks.
Short answer: a secure payment provider (1) does not collect or store your card data, (2) tokenises card details, (3) is PCI DSS compliant, (4) uses SSL (https), (5) works with trustworthy merchant facilities, (6) encrypts data, and (7) is ideally Australian owned and operated. Use the checklist below before you choose one.
Do not put your business or your customers at risk
Cybersecurity has never been a more pressing topic for business owners, with increasingly sophisticated attacks now happening regularly. The 2022 Optus breach alone exposed the personal details of more than a million Australians.
Since the Australian Government introduced the Notifiable Data Breaches scheme in 2018, there has been a reported 712% increase in cyberattacks.
Many businesses only think about the security of their financial information and personal details once it is too late. A few simple precautions can protect you and your finances from being exposed.
Your payment provider is one of the most important choices to get right. It is where most of the financial transactions between you and your customers take place, so any compromised information can be extremely costly. Use the seven points below as a checklist to make sure the provider you choose puts real emphasis on cybersecurity.
The checklist at a glance
| Feature | What to look for | Warning sign |
|---|---|---|
| 1. No stored card data | A clear statement on how card data is encrypted and where it is stored | No mention of encryption or of where card information is kept |
| 2. Card tokenisation | Card details replaced by random tokens | Tokenisation is not mandatory, so check it is offered |
| 3. PCI DSS compliance | The words "PCI compliant" or "PCI DSS compliant" on the provider's website | No reference to PCI DSS |
| 4. SSL (https) | "https" and a padlock in the browser address bar | A web address starting with "http" only |
| 5. Trustworthy merchant facilities | A named, large, security-focused bank or merchant provider | No mention of who handles merchant facilities |
| 6. Data encryption | Encryption used alongside the other six features | Encryption offered as the only form of protection |
| 7. Australian owned and operated | Local ownership, local support and Australian law | No local support if something goes wrong |
1Does not collect or store credit card data
Any cardholder data a company collects and stores is at risk of exposure, whether from malicious third parties or disgruntled insiders. Keeping this sort of sensitive data in an accessible database is a recipe for disaster.
Storing unencrypted credit card information is quickly being outlawed under new and improved cybersecurity regulation, but some lesser-known and offshore payment providers still do it.
If you cannot find any mention of a provider's data encryption, or a clear statement of where it stores your credit card information, that is a clear sign to avoid working with them.
2Uses card tokenisation for maximum security
Card tokenisation converts important cardholder data, such as personal identifying information, card numbers and CVVs, into randomly generated numbers called tokens.
If there is a data breach, hackers only get unusable tokens rather than data they can use for credit card fraud or identity theft. Tokenisation is not mandatory, which is why it is an important feature to look for.
3Is PCI Data Security Standard compliant
Perhaps the most important, and easiest to recognise, security feature is compliance with the Payment Card Industry Data Security Standard (PCI DSS): the card industry's set of requirements for organisations that handle credit card information.
Companies must meet twelve stringent technical requirements to be approved as compliant. Without going into too much detail, the standard requires the technical infrastructure to:
- Build and maintain a secure network and systems
- Protect cardholder data
- Maintain a vulnerability management program
- Implement strong access control measures
- Regularly monitor and test networks
- Maintain an information security policy
The PCI Security Standards Council is independent and highly respected, so a statement on a payment provider's website that it is "PCI compliant" is a big tick of approval.
4Uses SSL (Secure Sockets Layer, https)
This feature relates to the provider's website. SSL has become standard practice for websites, but a few businesses have still not implemented it.
The easiest check is the web address: it should start with "https:" rather than "http:". In most browsers, such as Chrome and Safari, you will also see a small padlock next to the site name in the address bar.
SSL protects the connection between you and a website, which secures online transactions and keeps your data confidential.
5Uses trustworthy merchant facilities
Merchant facilities are the services that process credit cards and other key payment transactions. Unless you are dealing directly with a reputable bank or merchant provider, your payment provider is most likely partnering with another company for its merchant technology.
Make sure the provider you work with in Australia is partnered with one of the large, security-focused banks or providers, rather than handling everything in-house. You can usually find this with a little research on its website or in its terms and conditions.
If there is no mention of who handles its merchant facilities, contact the provider or do more due diligence before you commit.
6Encrypts data
Like tokenisation, data encryption translates data into another randomly generated string of numbers or characters. A provider that uses both tokenisation and encryption gives customers two layers of security.
Encryption is what lets sensitive information pass safely from your customers to your payment provider. Without it, anyone with access to where sensitive information is stored can easily use it to commit fraud.
Encryption comes in many levels of sophistication, and nearly every payment provider says it uses some form of it. So do not accept encryption on its own as total protection: make sure your provider uses it alongside the other features in this guide.
7Is Australian owned and operated
We are not suggesting only Australian payment providers are secure enough, but local ownership brings real benefits.
Australia has some of the most stringent cybersecurity laws in the world, and in the rare event of an attack you want local support and assistance. Government bodies such as the ACCC also regularly check company websites to make sure claims are not deceptive or misleading.
With a reputable Australian owned and operated company, you can be confident it actually delivers the security features it describes.
How B2Bpay measures up
If you are looking for a secure payment provider, B2Bpay covers every feature on this checklist, along with a range of other benefits for your business.
- No stored card numbers and tokenisation: card details are tokenised, so full card numbers are not stored in B2Bpay's systems.
- PCI DSS compliant: B2Bpay meets the card industry's security standard.
- SSL: the B2Bpay website and payment portals use https.
- Trusted merchant facilities: payment processing is provided by Westpac, American Express and other institutions.
- Encrypted: data is encrypted in transit and at rest.
- Australian owned and operated: by Zenith Payments Pty Ltd in Mascot, NSW, with data held onshore and an Australian-based team on 1300 205 575.
Read more in Is B2Bpay safe?, or see how it works for your business:
First published 13 October 2022. Statistics are as reported at the time; follow the linked source for current figures.
Frequently asked questions
What is card tokenisation?
Tokenisation replaces cardholder data such as the card number and CVV with a randomly generated token. If there is a data breach, attackers only get tokens they cannot use for fraud or identity theft.
What does PCI DSS compliant mean?
PCI DSS is the Payment Card Industry Data Security Standard. A compliant organisation has met twelve technical requirements covering secure networks, protecting cardholder data, vulnerability management, access control, monitoring and testing, and an information security policy.
How can I tell if a payment website uses SSL?
Check the web address. It should start with https rather than http, and most browsers show a small padlock next to the site name in the address bar.
Is B2Bpay PCI DSS compliant?
Yes. B2Bpay is PCI DSS compliant, card details are tokenised so full card numbers are not stored, and data is encrypted and held onshore. B2Bpay is owned and operated by Zenith Payments Pty Ltd in Mascot, NSW.
Pay and get paid securely
PCI DSS compliant, tokenised and Australian owned. Set up takes minutes.