Today, it’s never been easier to make a charitable donation using your credit card which is why in some cases charities have seen donations increase four-fold in just ten years.
Whilst more money means greater aid, services and support for those that need it most, in many cases the cost of handling calls and processing payments can be extremely expensive; meaning a significant percentage of each donation is taking to cover these costs.

What’s more, credit card details are now hot property in the criminal underworld and if your charities network is attacked by hackers and credit card data is stolen then the results could be devastating.
As you would imagine, the Payment Card Industry (PCI) has been eager to reduce credit card fraud and in 2007 launched its Data Security Standard (DSS), which in short is a set of 16 security measures companies should adhere to ensure that they are adequately protected from hackers.

Whilst PCI DSS was initially voluntary, from the 1st July 2010 it becomes mandatory for every tier 1 business and organisation, with failure to comply resulting in significant fines and in extreme cases the loss of merchant codes.

The main issue addressed by PCI compliance is data storage, making it an offence to store both the credit card numbers and three-digit security codes on your premises, which together could be used to make fraudulent transactions. 

Becoming compliant will depend entirely on whether your charity handles its calls and credit card processing in-house or chooses to outsource, both have pro’s and cons and affect the amount of each donation which actually goes to the charity.
Doing it in-house

The biggest factor with building and maintaining your own internal call handling and payment solution are the upfront capital costs, even though IP telephony has really driven down the costs of a managed telephony system.

How ever expensive the costs of an in-house solution, charities need to take the bigger picture into account and look at the amount charged for call handling and credit card clearing for both in-house and outsourced models.

For example, outsourcing your donation lines to a call centre which answers these calls manually will cost you around £5 per call.  In addition, outsourcing the card processing means you’ll be hit with clearing rates of around 6-7 percent per transaction.

So for a £20 donation the charity might only see about £13.60.  Doing it in-house will void the £5 call handling fee and see clearing rates drop to just a few pence per donation.  Over the cost of a year, the savings made can go a long way to off-setting the initial costs of your system.

These costs can be off-set further by automating some or all of the lines used to receive donations, by replacing manual call centre agents with an automated IVR (interactive voice response) system, capable of receiving hundreds of calls and donations simultaneously.

Of course, given the choice anyone would prefer the human touch over an IVR platform, but using PCI compliant IVR ensures that every call is handled first time and processed in a compliant environment.

The truth about outsourcing

Outsourcing offers perhaps a safer option for charities as costs are more controllable and capacity can be scaled up as and when required.

It also eliminates the costs of management, recruitment, HR issues and the need for additional office space, enabling charities to focus on core your core business, raising funds and providing a service.

One other thing to consider with outsourcing is that the technology landscape is constantly evolving and by outsourcing you always have access to the latest technology.

However, charities are in a unique position where every penny lost through operational expenses actually affects the lives of individuals, so making the right decisions are
important.

The dilemma of whether to in-source or outsource, or have calls automated or answered manually has been recognised by the Charity Technology Trust (CTT), the specialist, independent and impartial organisation which provides technology solutions to the charity sector.
To help charities in this situation the CTT has partnered with BT to launch BT Safe Pay, a dedicated interactive voice response (IVR) system which works with CTT’s CP Terminal card payment processing system and which is fully compliant with these guidelines.

Safe Pay enables charities and other organisations to avoid the expense of using call centres and guarantees that every call is answered, allowing donors to register for gift aid and ensures that once money is pledged, the payment is authorised and deposited with the charity within 48 hours.

Becoming PCI Compliant

Unfortunately achieving compliance isn’t as simple as renewing the car tax or TV license and takes time and resource to complete.  Every charity which hasn’t yet got its house in order needs to start the ball rolling now, not only to protect customers from fraud but also to avoid any applicable fines which may come with the passing of the 1st July deadline.

The costs involved with becoming compliant depend entirely on the reach of your scope, namely the number of contention points in your network where a data breach might occur, so If you handle your donations internally then your scope will be much larger that if you simply outsource. 

First off you need to get yourself a good Qualified Security Assessor (QSA), who can hold your hand through every stage in the compliance process. QSA’s are trained in the latest compliance legislation and will work through every aspect and contention point within your network and premises.

If you visit the official PCI website you find advice on finding a QSA plus a list of approved assessors https://www.pcisecuritystandards.org/qsa_asv/find_one.shtml, or you can contact C3 which offers a free consultation service to charities on how best to begin there road to compliance.

Any charity which is concerned about the costs and what level of compliance they require should take the self assessment questionnaire found of the office PCI website https://www.pcisecuritystandards.org/saq/instructions_dss.shtml#instructions. 
Understanding the process

To become compliant your QSA will want to work through the following aspects of your operation:

Is your network well protected?
Without an adequate or updated firewall wall in place, your network is going to be wide open to attack from cyber criminals.  Once inside, hackers will look to gain access to password protected areas of your system in search of stored credit card data.  Are all areas password protected?  Are you still using the default vendor supplied passwords or using obvious passwords which could be easily cracked?

What about your’ Voice Network?
One of the areas often overlooked is the telecoms’ network that can carry an awful lot of customer payment card information. Many organisations have managed to remove the Call Recording of payment card details but have they considered the telephony based automated services as this also has to be PCI compliant.

What about other systems or applications?
There are various ways to gain access to your computer system and extract data such infection from a Trojan horse virus embedded in an email.  This is why the QSA will look to ensure you have a rigorous process in place for checking that antivirus software is updated and all your call centres systems and applications are as secure as they can be.

Is the actual cardholder data secure?
During the course of a credit card payment the customers’ details may have to cross multiple open networks before the transaction is complete.  The QSA will want to see robust encryption measures are in use to protect data across the entirety of the transaction. If you are re-billing using existing credit card details then this has to be dealt with in a secure indirect method to be compliant.

The enemy within – protection against internal fraud
Last year a BBC News investigation uncovered a criminal gang selling UK credit card details stolen from Indian call centres, highlighting the risks of fraud posed by staff and individuals within your call centre.

Whilst you might think you know and trust your staff, the QSA will be less accommodating, requiring that a broad range of measures are in place to restrict employee fraud.
The QSA will look to restrict access to the data to only a few employees, assigning every employee a unique ID for computer access, the installation of security cameras and general processes of monitoring who has access the your premises.

Be the fraudster – test your own security measures
The QSA will know what is secure today, may not be secure tomorrow so will be looking to ensure that you call centre has processes in place to ensure that your systems and access to cardholder data is regularly tested for flaws.

Make sure you have an Information Security Policy in place
Staff move on and positions get refilled so it’s important that your call centre produces a clear document outlining the Information Security Policy. This will be a mandatory requirement for compliance.
Summary
Whilst the decision to in-source or outsource is down to the individual charity, PCI compliance applies universally, and from 1st July any charity which hasn’t yet acted may find themselves in trouble. The scope of compliance will vary between organisations and the chosen technology will have to be scalable to meet current and future applications.
As every charity will need to make at least some operational changes, perhaps now’s a good time to look at the bigger picture and bring in changes which not only ensure that your charity can focus on its core business, but may actually increase the amount of money you have to help those that need it most.
John Wood is Sales & Marketing Director at C3, which provides PCI compliant IVR systems to call centres and has worked with companies achieve all levels of compliance.

www.c3.co.uk

Last week we witnessed the highest electoral turnout for more than a decade. As a result of various initiatives (TV debates, social media campaigns and adverts in publications like Heat Magazine), undertaken by the Electoral Commission in an effort to persuade Britons to exercise their right to vote, a significant proportion of the population did indeed do their bit for democracy. But despite their efforts, when the big day finally arrived, at 10.00 p.m. thousands of people were turned away from polling stations up and down the country and denied their right to vote, because councils were unable to cope with the increased turnout.
 

A variety of different excuses were used: constituencies running out of ballot papers, out-of-date polling lists, people turning up at the wrong polling stations or turning up without their polling cards. Granted, voters themselves need to take some of the blame – there isn’t really an excuse for turning up without your polling card or going to the wrong place, is there? But after so much campaigning, one would have hoped that the different councils would have been slightly better prepared and had enough reserve staff and desks etc. at their disposal to have coped with the situation.

Under European law, everyone has the legal right to vote and if you are denied this right, you are entitled to sue and claim compensation – in this case the amount could be as high as £760 per person. If all those people who did not manage to vote decide to exercise this right and take further action, it could cost the country a lot of money – as if it isn’t facing enough financial problems already.

This latest cycle of misdemeanours further highlighted the need for modernising our entire voting system, which has been described as being “Victorian” by the media. The Times commented last weekend that our voting procedures are worse than those of many African countries.

When I went along to my local polling station, it struck me how archaic the whole process was. I am amazed that our registration processes still involve pens and papers – I thought we lived in a digital age. Is not quicker to use computers for cross reference purposes?  The electoral register does exist in electronic format after all. What about adding bar codes to polling cards?  They seem to work in supermarkets very well. 
Modernising administration processes is one thing, but adding more modern voting methods; telephone, text and e-voting also need to be considered, especially if politicians want to engage the younger generation. Figures have shown that during the 2005 election, less than 38% of 18 – 24 year-olds voted. There are even case studies that suggest that over half of these young people are not even registered to vote. This is a generation which readily engages with TV voting, so why not adopt similar methods available at polling time? If we did, electoral outcomes could well be comparable to those of the 1970s and 80s – when turnout regularly exceeded 70%.

Take, for example, all those people that queued outside the various polling stations; if phone, SMS or e-voting had been an option, they would have been able to vote. Who knows, the results may even have been slightly different in some marginal areas. People doubt the security of e-voting and phone voting, but let’s face it how secure is our existing system? When you go along to vote, you are not required to show any sort of ID, you could be anyone – and what about postal votes? Incidents of fraud are already being investigated.

Anyway, now we’ve got our Coalition Government we will hopefully see changes to the voting system in this country. Let us also hope that the new powers that be see fit to modernise voting processes at the same time.

Following an assessment by an independent body, QMS, Quality Management Systems, C3 is pleased to announce it has been awarded ISO 14001 certification. Only one percent of businesses in the UK have been successful in obtaining ISO 14001 certification to date. This prestigious award is supported by Government and is recognized in over 150 countries world-wide.

Said John Wood, Joint Owner of C3: “We are delighted with the result. We have always been very proud of the products and services we offer our clients and the way we conduct our business with regard to environmental matters. We make every effort to ensure we supply eco-friendly solutions that will help our customers reduce their carbon footprint. Our efforts have finally been recognized by independent experts who are used to judging ISO standards on a daily basis in a wide variety of trades and industries.

For the third year running we’ve been given a Gold award by BenchmarQ for providing excellent quality of service and customer care to our customers, so to be granted ISO 14001 certification as well is a real honour.

 
Peter Gamble, who undertook the assessment for QMS Quality Management Systems, paid particular tribute to “the investment in people and training that enables C3 to provide an efficient and environmentally friendly service to its customers.