Acquiring ServicesCard Acceptance Manual

1

Contents

1. Methods of payment acceptance

2. Using the terminal2.1. How to start the terminal2.2. Network status2.3. Battery information2.4. Menus2.5. Terminal password2.6. Reports2.7. Send batch2.8. Reprint2.9. Software update2.10. Paper roll change2.11. Receipt information

3. Transaction process flows3.1. Sale3.2. Void3.3. Refund3.4. Preauthorization3.5. Pre-Auth Completion3.6. Offline sale3.7. Mail/Phone order (MoTo)

4. Warnings/Troubleshooting4.1. Non-approved transactions4.2. Non-supported transactions4.3. General/Error messages

5. Security and fraud prevention guidelines

5.1. Some basic rules5.2. Authorized technician visit5.3. Card identification5.4. Preventing fraud5.5. Chargebacks and

retrieval requests5.6. Terminal device safety

6. PCI - DSS merchant compliance program

7. Merchant information and payments

8. Glossary

02

0303 04040506060808080910

1111121213131415

16161819

2121212123

2425

27

30

33

2 3

2. Using the terminal

2.1. How to start the terminal

To SWITCH ON the terminal, press the “GREEN” button.

To SWITCH OFF the terminal, press the “YELLOW” and the “DOT” buttons at the same time for 2 seconds.

If the terminal is on the base or plugged in to the power outlet, it will always be powered on. To RESTART the terminal, press the “YELLOW” and the “DOT” buttons at the same time for 2 seconds.

Please, leave the terminal ON at all times as it will go to SLEEP when not in use.

1. Methods of payment acceptance RCB provides to its clients 2 types of Electronic Funds Transfer Point of Sale (EFT-POS) Terminals

A. Ingenico iCT 250 - Ethernet type (Internet TCP/IP)

B. Ingenico iWL 250 – GPRS/3G (SIM Card)

RCB terminal accepts

4 5

2.2. Network status

Green symbol: The terminal is connected to a network.

Battery status appears in the top right hand corner of the terminal display.

iWL 250 connected to 3G: iCT 250 connected to ethernet:

Red symbol: The terminal has an ethernet port but has not been assigned IP over DHCP.

The signal icon below represents the strength of the GSM mobile signal. The fewer bars indicated represents poorer network strength. If the signal is very poor, the terminal may not be able to communicate.

Please, leave the terminal CONNECTED at all times to ensure proper operation and updates.

2.3. Battery information

Terminal iWL 250 is supplied with a removable, rechargeable battery. This battery recharges when the terminal is connected to the charger unit.

Terminal is not connected to power: Charging base is connected:

Please, keep the terminal charged at all times for proper usage. Connect the terminal to the charging base whenever is not in use.

2.4. Menus

iWL 250: iCT 250:

In the menu, press numbers to go directly to your selection or use the arrow keys.

Use the coloured keys at the bottom of the keyboard for the necessary actions:

· RED: Cancel - press to immediately stop the current activity and return to the idle screen. · YELLOW: Clear/Back - press to stop the current activity and restart the current activity, such as entering a password.

· GREEN: Enter - press to confirm and continue with the activity in progress.

6 7

Merchant Menu can be accessed by selecting “F1” button. Through this menu, merchant may select one of the options below.

1-REPORTS: Report printing of current batch transactions.2-SEND BATCH: Batch close of current business day transactions.3-REPRINT: Reprint transactions from current batch.4-SETTINGS: Basic functions regarding language, contrast, keyboard sound and backlight.5-SUPPORT: Technical functions to test terminal status, connections and/or send logs.

Transactions Menu can be accessed by selecting “F4” button. Through this menu, merchant may select one of the transactions below.

1-PURCHASE: Standard sale2-VOID: Cancellation of a transaction within the same business day.3-REFUND: Credit to a cardholder for a valid transaction that was previously processed.4-MOTO: Transaction that is used to allow a sale when the card is not present.5-PREAUTH: Temporary holds a specific amount of the available balance on a card that is provided upon booking/reservation.6-OFFLINE: The offline sale transaction is used when a previous attempted transaction responded with network error or communication problem.

2.5. Terminal passwords

The Merchant password will be asked in order to access specific menus or transactions. The Merchant password is provided by RCB to the primary contact person during the installation process.

The Support password is required for certain menus/functions of the terminal that are only accessible by a technician. This one-time password may only be provided to you on special circumstances.

2.6. Reports

A report with the transactions of current business day (batch) can be generated at any time in the following ways:

Analytical:Report of all individual transactions that are included in the current batch and a summary report of the totals per transaction type.

Brief:Summary report of the totals per transaction type included in the current batch.

The report printing process is as follows:1. Press button “F1”, select “1-REPORTS” and press the “GREEN” button.2. Type the merchant password given by RCB and press the “GREEN” button.3. Select “1-ANALYTICAL” or “2-BRIEF”.4. Printing the report in the format selected.

8 9

2.7. Send batch

Closing the batch is the process of finalizing current business day’s transactions. It consists of the following steps:

1. Press button “F1”, select “2-SEND BATCH” and press the “GREEN” button.2. Type the merchant password given by RCB and press the “GREEN” button.3. Select “1-ANALYTICAL PRINT” or “2-BRIEF PRINT”.

4. The terminal starts the reconciliation with the Bank.5. Printing the report of all transactions performed during the day.

If the batch has not been closed manually, then the terminal will try to close the batch automatically on a daily basis. Please, ensure that the batch is closed each day for proper reconciliation of your transaction activities.

2.8. Reprint

The terminal allows reprinting a transaction that is on the same batch of the day. The reprinting process is as follows:

1. Press button “F1”, select “4-REPRINT” and press the “GREEN” button.2. Select “1-REPRINT LAST TRANSACTION” or “2-SELECT FROM LIST” or “3-REPRINT BATCH”.3. Select the transaction you need to reprint from the list based on the receipt no. (TR) and

corresponding AMT.

2.9. Software update

The terminal is updated daily with no interruption of normal operation using an automated call to the Terminal Management System in order to download any new parameters or software.

In case you need to update parameters manually, the process is as follows:

Update parameters1. Press button “F1”, select “5-SUPPORT” and press the “GREEN” button. 2. Type the merchant password given by RCB and press the “GREEN” button. 3. Select “2-UPDATE”.4. Wait for the terminal to connect and print the report of successful update.

2.10. Paper roll change

When the red warning lines appear on the receipt paper, it is an indication that the terminal is running out of paper.

How to change the paper roll:1. To open the terminal cover, lift the tab with the blue sticker and push back the lid.2. Remove the empty paper roll if any.3. Insert the new paper roll as indicated in the picture. Pull the paper up approximately 2-3cm

beyond the serrated tear bar.4. Push the cover down to close it properly.

10 11

2.11. Receipt information

3. Transaction process flows

3.1. Sale

Use these steps to make a standard sale transaction.

Contactless sale1. Type the amount and press the “GREEN” button;2. Place the card on top of the screen;3. If amount is greater than 20 EUR, cardholder must enter his/her PIN, then press the “GREEN”

button;4. Processing for approval and printing the receipt.

Sale with chip card1. Type the amount and press the “GREEN” button;2. Insert the card through the slot in front of the terminal;3. Cardholder must enter his/her PIN, then press the “GREEN” button;4. Processing for approval and printing the receipt;5. If the message “USE MAGNETIC READER” displayed on the screen, follow the process with

magnetic reader.

Sale with magnetic card1. Type the amount and press the “GREEN” button;2. Swipe the card through the slot on the side of the terminal;3. If PIN is asked, cardholder must enter his/her PIN, then press the “GREEN” button;4. Processing for approval and printing receipt;5. If the message “USE CHIP READER” displayed on the screen, follow the process with chip

reader. Cardholder must sign the merchant’s copy of the receipt.

Sale with tip1. Type the amount and press the “GREEN” button;2. When asked for tip, select “YES/NO”:

· If yes, enter tip and proceed with step 2 of any standard sale; · Otherwise press the “RED” button and proceed with step 2 of any standard sale.

12 13

3.2. Void

This transaction flow process voids an earlier transaction that is within the same daily batch. Void can be performed on any type of transaction and for all entry modes, except contactless. To conduct a purchase return for a contactless transaction, use Refund.

Void transaction “Cancellation of a transaction before the batch close”1. Press button “F4” and then select “2-VOID”2. Type the merchant password given by RCB and press the “GREEN” button;3. Enter card by using chip/magnetic stripe or type the card PAN number (if enabled);4. Type the 4-digits receipt number of the transaction and then press the “GREEN” button;

5. Type the amount and press the “GREEN” button;6. Processing for approval and printing receipt.

3.3. Refund

This transaction flow process is used to conduct a sale return in order to refund the customer. It is different from void in the sense that a refund transaction is not coupled to a previous sale transaction and can happen any time later and not necessarily within the same batch.

Refunds shall be in line with the merchant’s refund policy and in compliance with the RCB Acquiring Services Terms and Conditions.

Refund (Purchase return) “Cancellation of transaction after the batch close”1. Press button “F4”, select “3-REFUND” and then press the “GREEN” button;2. Type the merchant password given by RCB and press the “GREEN” button;3. Type the amount and press the “GREEN” button;4. Enter card by using chip/magnetic stripe or type the card PAN number (if enabled);5. Processing for approval and printing receipt.

3.4. Preauthorization

The transaction process flow of Preauthorization is used in order to engage and hold funds from the cardholder’s bank account without debiting the cardholder. For the cardholder to be debited (thus the merchant to be credited) for the completion of the sale, it requires to conduct a Preauthorization Completion Transaction. Please, see Preauthorization Completion.

The Preauthorization transaction can be voided on the same day using the Preauth VOID transaction under Preauth Menu.

Note: In case batch is closed, refund does not apply and the transaction will drop after 30 days.

Preauthorization1. Press button “F4”, select “5-PREAUTHORIZATION” and then press the “GREEN” button;2. Type the merchant password given by RCB and press the “GREEN” button;3. On the next screen, select “1-PREAUTHORIZATION” and press the “GREEN” button;4. Type the amount and press the “GREEN” button;5. Enter card by using chip/magnetic stripe or type the card PAN number (if enabled);6. If PIN is asked, cardholder must enter his/her PIN, then press the “GREEN” button;7. Processing for approval and printing receipt. Please, keep the receipt with the preauthorization

number on it.

3.5. Preauthorization completion

The transaction process flow is used to complete a Preauthorized sale for the customer to be debited and the merchant to be credited.

This transaction will require entering the correct Preauthorization approval number to match the transaction that needs to be completed.

Note: Preauthorization completion transactions can only be made in the presence of the cardholder, as the PIN number of the card is required for the completion of the transaction.

Preauthorization completion1. Press button “F4”, select “5-PREAUTHORIZATION” and then press the “GREEN” button”;2. Type the merchant password given by RCB and press the “GREEN” button;3. On the next screen, select “3-PREAUTH.COMPL.” and press the “GREEN” button;

14 15

4. Type the amount and press the “GREEN” button;5. Enter card by using chip/magnetic stripe or type the card PAN number (if enabled);6. If PIN is asked, cardholder must enter his/her PIN, then press the “GREEN” button;

Type the 6-digits authorization code given on Preauthorization process receipt and then press the “GREEN” button;

7. Type the 13-digits retrieval reference number (RRN) given on Preauthorization process receipt and then press the “GREEN” button;

8. Processing for approval and printing receipt.

3.6. Offline sale

The offline sale transaction process flow is used when a previous attempted transaction responded with a network error or communication problem and an RCB banking representative (Customer Support Operator) has assisted you with voice authorization.

The offline sale transaction may also be used when a previous transaction responded with Refer to issuing bank. Contact RCB POS Terminal Support for further assistance.

To perform this transaction, you are required to use your merchant password and the correct approval number provided during the voice authorization process.

Offline purchase with voice authorization (call RCB POS Terminal Support)1. Call RCB POS Terminal Support at 800 00 722, and press 4 for support;2. Inform the operator about the reason why you need to conduct an offline purchase;3. Give all the necessary details for voice authorization and get the approval code; 4. Press button “F4” on the terminal, select “6-OFFLINE”;5. Type the amount and press the “GREEN” button;6. Type the card PAN number and press the “GREEN” button;7. Type the 6-digits approval code given by RCB POS Terminal Support and then press the

“GREEN” button;8. Printing receipt.

3.7. Mail/Phone order (MoTo)

Mail/Phone order transaction is used to allow a sale when the card is not present. If your business conducts sales by mail or telephone without the cardholder being present, then the “Mail order” function is enabled on your terminal.

MoTo transactions shall be used in line with the merchants business policy and in compliance with the RCB Acquiring Services Terms and Conditions.

MoTo transaction 1. Press button “F4” and select “4-MOTO”;2. Type the amount and press the “GREEN” button;3. Type the card PAN number and the expiration date;4. Processing for approval and printing receipt.

16 17

4. Warnings/Troubleshooting - Terminal response messages

4.1. Non-approved transactions

Response Reason/Description Action to be taken

1 - REFER TO CARD ISSUER

Requires further authorization by the issuing bank.

Try the transaction again or callRCB POS Terminal Support.

3 - FORMAT ERROR

Technical issue. Transaction message protocol is not valid.

Call RCB POS Terminal Support to inform about the issue. Customer support will liaise with technical team and revert back to you.

5 - EXTERNAL DECLINE

Do not honour the transaction. Transaction was declined by the issuing bank.

The transaction is NOT approved. Try again the transaction with another card or contact the issuing bank.

10 - PARTIAL AUTHORIZATION

The transaction was authorized only for the available funds.

Follow instructions provided by the terminal to continue for final approval for the amount available in the card account. Use other method of payment for the remaining amount.

12 - INVALID TRANSACTION

Technical issue. Transaction is not supported by the payment system.

Try again with the same or a different card.

13 - MERCHANT LIMIT EXCEEDED

Exceeded maximum allowable amount for card system. Merchant is not allowed to accept this amount.

Call RCB POS Terminal Support to discuss your required business thresholds.

14 - INVALID TRACK 2

Invalid card number or chip cannot be read. Transaction may be suspicious.

Do not proceed with further authorisation, or try another card with proper validation of the cardholder.

30 - INVALID FORMAT

Technical issue. Transaction message protocol is not valid.

Call RCB POS Terminal Support to inform about the issue. Customer support will liaise with technical team and revert back to you.

41 - LOST CARD The card was marked as lost by the issuing bank.

Transaction may be suspicious. Do not proceed with the card again. If possible, send it to RCB.

43 - STOLEN CARD The card was marked as stolen by the issuing bank.

Transaction may be suspicious. Do not proceed with the card again. If possible, send it to RCB.

51 - INSUFFICIENT FUNDS

Issuing bank declined the transaction as available funds are not sufficient for authorization.

Try again with a different card.

54 - EXPIRED CARD The card has expired and cannot be processed. Try again with a different card.

55 - INCORRECT PIN Invalid PIN entered or PIN tries exceeded.

Ask the cardholder to re-enter the PIN or try another card.

58 - INVALID PROCESSING CODE

Transaction not allowed at terminal.

Call RCB POS Terminal Support to inform about the issue.

65 - HOST DECLINEUsers limit exceeded. No more transactions are allowed for this cardholder.

Call the issuing bank or ask to try another card.

78 - TRANSACTION NOT FOUND

Original request was not found.

In order to complete the Preauthorization, nsure that the correct Preauthorization number and approval code is has been used.

79 - HOST DECLINE The CVV2 entered is invalid. Try again with the correct CVV2, otherwise contact the cardholder.

89 - INVALID TERMINAL ID

The terminal No. has been changed or cannot be validated.

Call RCB Telephone Banking.

91 - DESTINATION NOT AVAILABLE

Issuer is unavailable or the payment system switch is not in operation.

Try again after some time and/or call RCB POS Terminal Support.

94 - DUPLICATED TRANSACTION

The transaction was sent twice with the same transaction ID number.

Call RCB POS Terminal Support.

96 - SYSTEM MALFUNCTION

Technical issue from the card payment system or the issuing bank.

Perform a handshake to validate connection to RCB systems. Then try the transaction again. If the problem persists, call the issuing bank or try another card.

18 19

4.2. Non-supported transactions

Response Reason/Description Action to be taken

TRANSACTION NOT ALLOWED

The terminal does not allow this type of transaction.

Contact RCB POS Terminal Support to check the Terminal Management System if transaction is supported for this terminal/merchant.

KEY ENTRY NOT ALLOWED

Key entry is blocked for this terminal. Keyboard closed.

Try using another method or a different card.

USE SMART CARD READER TRANSACTION NOT ALLOWED

Possible problem with the magnetic stripe of the card and terminal requires to use the chip through smart card reader. Or the card does not support or not allows the use of magnetic stripe. Also, is possible that a contactless card/device is not correctly read by terminal.

Try again to enter card by using chip reader for chip and pin validation or try with a different card.

OFFLINE TRANSACTION NOT ALLOWED

Local sale (forced offline) transaction is not allowed for this terminal.

Contact RCB POS Terminal Support to report the issue and if deemed necessary to allow any offline transactions to your terminal.

CARD EXPIRED TRANSACTION NOT ALLOWED

The card is most likely expired and is no longer valid.

Check if card is expired and “CHECK EXPIRATION DATE” selected. Or use a different card.

NO BIN MATCHED [CARD PAN] TRANSACTION DECLINED

The card bin did not match on Terminal Management System. This card is not yet supported by RCB.

Try a different card or contact RCB POS Terminal Support.

VOID IS NOT ALLOWED SELECT REFUND

If the initial transaction that is needed to be cancelled was contactless, then void is not allowed.

Use refund option to return the money to the customer.

UNKNOWN CARD TRANSACTION NOT ALLOWED

· The card PAN has been entered or read incorrectly. (Luhn Digit Failure)

· The terminal may not support/accept the PAN length of the card presented.

· The Card Payment Scheme used may not yet be supported by RCB.

Retry the transaction or select another card, or call RCB POS Terminal Support to check with the Terminal Management System parameters for your terminal.

4.3. General error messages

Response Reason/Description Action to be taken

CARD PROBLEM USE MAGNETIC READER

Possible problem with the chip of the card and terminal fallback is activated to allow the use of magnetic stripe. Or the card does not support chip and only allows magnetic swipe.

Try again by swiping the card to the magnetic reader or try with a different card.

LOCKED TERMINAL CLOSE BATCH

The terminal has been locked and cannot accept transactions due to full batch file memory.

Close batch manually and continue with transactions.

TRANS NOT FOUND

Possible mistype of the transaction number during the process or the transaction is from a previous batch. If the initial transaction that is needed to be cancelled was from a different batch, then void is not allowed.

Use refund option to return money to the customer.

INVALID TRACK 2 TRANSACTION NOT ALLOWED

The card’s data parameters cannot be read correctly.

Retry with the same card or select another card.

CANCELLED Transaction is cancelled No further action is needed. Try another transaction.

MULTIPLE CARDS DETECTED

Multiple cards were presented or another NFC device/card is interfering.

Check with all NFC available points and disable what is not necessary, and try again.

CHARGE THE BATTERY BATCH CLOSING INTERRUPTED

Low battery (during batch close)

Connect the terminal to the power supply.

· LL: NETWORK ERROR

· LL: SOCKET IN CONNECT

· LL: SOCKET ERROR · LL: NETWRK NOT READY

Network related errors. This may be due to: · Failure to establish a connection to the internet;

· Network cable is not plugged in correctly;

· Low signal of GPRS network.

Try one of the following to resolve the issue or call RCB POS Terminal Support: · Check the network status; · Check network cabling; · Check SIM card; · Restart the terminal.

20 21

PPP ERROR/NO SIM Connection issue with the GPRS network.

Check the SIM card and restart the terminal or call RCB POS Terminal Support.

NO RESPONSE

Connection has timeout. Unable to reach the bank for authorization. This seems to be a network related issue.

Try again to perform the transaction or call RCB POS Terminal Support.

ERROR IN CONNECTION

The connection has timeout (Communication issue).

Check your network connection or contact RCB POS Terminal Support.

NO SIM The SIM card is missing or not inserted properly.

Make sure that the SIM card is properly inserted.

ETHERNET CABLE NOT CONNECTED

The terminal is not connected to the network.

Check the ethernet cable to ensure that it is connected to the terminal.

MELLON 45RCB APPL Upgrade software. No further action is needed.

95 RECONCILE ERROR BATCH UPLOAD.

The batch is unable to reconcile with the bank’s systems.

Try again to close the batch or call RCB POS Terminal Support.

PIN ERROR An error related to PIN verification has occurred. Try again or use a different card.

ALERT IRRUPTION The terminal can no longer be used to accept transactions.

The terminal will need to be sent back for repair. Contact RCB POS Terminal Support.

NETWORK PROBLEM PLEASE SEND BATCH MANUALLY

Network related error. The terminal could not send the batch automatically due to network communication issue.

Use F1 menu and select option 2 to send the batch manually or contact RCB POS Terminal Support.

UPDATE FAILED

Network related error. The terminal could not connect to the Terminal Management System in order to update its configuration parameters.

Ensure that the terminal is properly connected to the network and try again to update parameters.

5. Security and fraud prevention guidelines

5.1. Basic rules

To get the most out of your service, it is important to follow some basic rules:

You must · Honour all valid cards without discrimination when properly presented; · Check the card’s unique design features and security elements; · Always be on alert for any suspicious behavior transactions.

You cannot · Accept card transactions on behalf of third parties; · Require a minimum transaction amount to accept a valid and properly presented card; · Process card not present transaction without prior notice from the cardholder; · Store sensitive card data.

5.2. Authorized technician visit

RCB Bank Ltd issues an Authorized POS Technician Identification Card for all designated technical support personnel. During the visit of such personnel at your premises, you are strongly advised to request and verify their identification card prior to granting access for modifying or troubleshooting a device. You are advised to perform this verification, even if you have previously submitted a request for technical support or if you received support from the same technician in the past. In case of any suspicions in relation to this matter, contact RCB POS Terminal Support that is available 24/7 at 800 00 722.

5.3. Card identification

Every card contains a set of unique design features and security elements to help merchants verify card’s legitimacy. By knowing what to look for, you can avoid accepting a counterfeit card or processing a fraudulent transaction.

22 23

Visa card characteristics

MasterCard card characteristics

5.4. Preventing fraud

You need to be aware of fraud to avoid it, same as your employees. Train your employees to know the signs of potential fraud and remind them periodically to always stay on alert.

Card present transactionsWhen accepting payment cards, look out for the following security features:

· 3 dimension holograms · All card characteristics are clearly visible as defined in section 5.3. · Signature on the card should match the signature on the slip (if signature is required)

If the card is unsigned, you should check the cardholder’s ID and ask the customer to sign the card. If refused to do so, then you may ask for a different card.

Card not present transactionsCard not present transactions represent the higher risk in payment processing. Validation can sometimes be tricky and in all cases your business is 100% liable to any chargebacks.

Transactions such as the below are performed at your own risk:

· Card number is key-entered on the terminal · The card and the cardholder are not present during the transaction (mail/phone order transactions)

Signs of fraud - suspicious behaviour transactionsIt is important that your business minimizes fraud risk, therefore, training and on-going education efforts are vital to ensure that your employees understand and continue to follow appropriate card acceptance and data security procedures for all transactions.

It is important to: · Thoroughly check the card details presented to you to help guard against fraud and always be on alert for suspicious behaviors.

Watch out for customers who: · Purchase a large amount of merchandise without regard to size, style, color, or price. · Try to distract or rush you during the sale. · Make purchases and leave your store, but then return to make more purchases. · Make large purchases just after your store opening or closing.

24 25

Code 10: Code 10 is a voice authorization request during a card present transaction that alerts the card issuer about a suspicious activity, without alerting the customer. Whenever a merchant doubts the validity of the card or the legitimacy of the cardholder, he or she should make a Code 10 call to RCB POS Terminal Support.

RCB will then route the call to the card issuer. An operator will pick it up and ask a series of “YES” and “NO” questions to determine the validity of the transaction. Once a conclusion is reached, the merchant will be given instructions on how to proceed.

When to make a Code 10 call?There are multiple reasons to make a Code 10 authorization request, including:

· The terminal displays a “LOST/STOLEN/PICK UP CARD”, or a similar message. · During the inspection of the card the merchant discovers that its security features have been altered or tampered with in some way.

· The signature on the transaction receipt does not match the one on the back of the card. · The customer behaves in a suspicious or unusual manner (May be a perfectly legitimate explanation for your customer’s behavior).

5.5. Chargebacks and retrieval requests

What is chargeback?A chargeback is the reversal of a transaction and occurs when a customer contacts the Bank to dispute a transaction. Common reasons for disputes include:

· The transaction was made fraudulently and the cardholder denies participation. · The transaction was duplicated and the cardholder was charged more than once. · The goods or services ordered have not been received. · Credit which was expected was not processed.

Responding to chargebackYou have 14 days from the date of the chargeback request to respond back with relevant proof and information to support the validity of the transaction. Upon receipt of your documentation, we will assist you in defending the chargeback by gathering required evidence (i.e. sale slip/receipt).

Preventing chargebacksIn accordance with the merchant agreement, you have acknowledged that your chargeback-to-sales ratio will be kept below 1%.

The following steps will help you prevent chargebacks:

· Authorizations are ALWAYS required; · Offline transactions are NOT permitted; · DO NOT complete a transaction if the authorization request was declined; · NEVER split the sale into smaller amounts; · ALWAYS obtain the cardholder signature if the sale slip/receipt requires to (signature line is present) and check if the signature on the slip matches the signature on the back of the card;

· AVOID duplicate processing; · When a customer is due a refund, you shall credit back to the original card. DO NOT refund in cash; · Have your refund/return policy clearly stated on the receipt or at checkout point; · ALWAYS void incorrect sales receipts immediately; · ALWAYS retain copies of all sales slips and invoices for 13 months in case you are requested to provide them.

What is a retrieval?A retrieval request is raised by an issuer when a cardholder disputes a transaction on the statement. This usually occurs when the cardholder does not recognize the transaction and needs information to work out whether he/she did in fact did the transaction or if it was fraudulent or unauthorized.

Under the card scheme regulations, you must provide detailed information on a transaction if you receive a retrieval request. A large number of chargebacks are the result of retrieval requests which have not been fulfilled. It is of great importance that you respond to these requests to prevent chargebacks. You must to store all transaction information for 13 months.

5.6. Terminal device safety

Keeping your terminal device safe from criminals is also very important to prevent fraud.

Do not allow anyone other than a LEGITIMATE ENGINEER that is an RCB PARTNER or a direct employee of the Bank to remove your terminal from your premises.

26 27

Staff should be trained regularly on POS security and must report any incident they feel is a threat to the device.

You should carry out some simple checks on a daily basis to ensure that your terminal has not been tampered with:

· Is there any physical damage to your terminal? · Are the security seals on the terminal voided or removed? · Are there any stickers on the terminal that were not attached during the installation? · Does your terminal appear to have been modified or are there any additional components that were not there?

Authorized POS Technician Identification Card:

6. PCI - DSS merchant compliance programWhat is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a comprehensive set of international security requirements for protecting cardholder data. It consists of technical and operational guidelines with the aim to prevent fraud and hacking, enhance payment account security and provide a level of comfort when handling the card to a third party for a payment.

Who needs to comply?All acquirers and issuers must comply, and must also ensure the compliance of their merchants and service providers who store, process, or transmit cardholder data, e.g. card number, CVV2/CVC2, cardholder name or other cardholder data.

This program applies to all payment channels including card present, mail/telephone order, and e-commerce.

Why is it important?By complying with the PCI DSS, merchants can protect their business and their customers while building a culture of security that benefits all parties in the payment system.

Benefits of being PCI compliant · Compliance with PCI means that your information systems are

- secure at the highest possible level and - customers can trust you with their sensitive payment card information when paying for goods or services.

· In addition, it improves your reputation with the acquirers and payment brands (Card Schemes) that you rely upon when carrying your business through payment card methods of payments.

· Furthermore, since this is an on-going process, it helps prevent security breaches and theft of payment card data.

Consequences of not being compliant · Non-Compliance with PCI is a reason that your business revenues may drop or even keep you out of business.

· A security breach may have severe impact for your business.

28 29

How to complyMerchants who store, process, or transmit Visa, MasterCard, or other card brand cardholder data generally fall into one of four merchant levels based on card transaction volume over a 12-month period.

Level 1 Level 2 Level 3 Level 4 Level 4

Count of transactions

>6 million annually >1 million >20.000 <20.000 <1 million

Channel All All Ecommerce Ecommerce All channels

Validation criteria

Self-assessment questionnaire - Required

annuallyRequired annually

Required annually

Required annually

On-site security assessment

Required annually - - - -

ASV network scan Required quarterly

Required quarterly

Required quarterly

Required quarterly

Required quarterly

RCB realizes the importance of cardholder data security and wants to help you avoid fines, fees and other costs associated with a breach. RCB’s PCI Compliance program will provide you with the tools and guidance to complete the necessary validation actions in order to achieve compliance, while protecting your reputation and your business. Contact your account manager to determine which actions apply to your business.

For more informationThe PCI security standards can be found at:https://www.pcisecuritystandards.org/security_standards/index.php

In addition, Visa and MasterCard publish data security alerts, bulletins and webinar presentations available for download: http://www.mastercard.com/us/company/en/whatwedo/determine_merchant.htmlhttp://www.visaeurope.com/en/businesses__retailers/payment_security/merchants.aspx

Knowledge base - https://www.pcisecuritystandards.org/faq/FAQ and myths - https://www.pcicomplianceguide.org/pci-faqs-2/Glossary - https://www.pcisecuritystandards.org/pci_security/glossary

What to do if compromisedIn the event of a security incident, Visa and MasterCard acquirers, issuers, merchants, and service providers must take immediate action to investigate the incident, limit the exposure of cardholder data, notify the card payment brand and acquirer, and report investigation findings. Visa’s data breach guidelines can be found online at www.visa.com/cisp, contains step-by-step mannual to assist clients, merchants, and service providers through a security incident.

Third party merchant agentsMerchants must also report all third party merchant agents to the acquirer (RCB) in order to be registered as service providers with Visa and MasterCard.

30 31

7. Merchant information and paymentsMerchant monthly statementOn a monthly basis merchants receive a transactions activity statement in a format designed to facilitate account reconciliation.

Summary report:

A. Each statement represents acquiring transactions that have been processed within the specified date range.

B. Transactional fees are separated into 3 type of charges as specified in the agreement.

C. Summary report is separated in two tables per card brand.D. Transactions summary are separated by region of card issuance exept for RCB cards.

Analytical report:

A. Posting date represents the settlement date to your bank account.B. Each batch is usually a day’s worth of transactions processed on your terminal.C. Each line represents the total activity per transaction type (Sales, Refunds, MoTo).D. The analytical report is separated per terminal and displays posting transactions per Batch ID.E. Aggregated total amounts per transaction type and overall transactional fees.

32 33

8. Glossary

Batch settlement This process is necessary in order to settle the transactions and receive money for the day's sales. This process can be configured to execute automatically at the end of the day, however, it can also run manually as often as you wish.

CVV2-CVC2These are the last 3-digits number at the back of Visa and MasterCard cards respectively. These numbers provide an extra level of security against fraudulent use and may used for Mail order/Telephone order sales or sales where the card is key entered (instead of being swiped/inserted) into the terminal.

Chip cardsThese are cards of latest technology and can be recognized by the embedded chip on the surface. In most cases of sales with Chip cards, the terminal will ask for the PIN of the cardholder. If the PIN is not requested, then the cardholder is required to sign the receipt and the merchant is required to check the authenticity by comparing the signature on the receipt with the one on the back of the card.

Contactless Contactless payment is a secure method for consumers to purchase products or services via debit, credit or smartcards (also known as chip cards), by using RFID technology. To make a contactless payment, a person simply needs to tap their card near a point-of-sale terminal.

Magnetic stripeThese cards are of older technology than chip cards. They have a magnetic stripe on the reverse side and no chip. For transactions with magnetic stripe cards, the cardholder is required to sign the receipt and the merchant is required to check the authenticity by comparing the signature on the receipt with the one on the back of the card.

Mail/Phone order (MoTo) transactionThis process is used for sales initiated from mail or telephone orders (Card not present).

Offline saleOffline sale is used in cases where a previous attempted transaction responded with “referral to the issuing bank” and an authorization was obtained from the issuing bank.

· Terminal ID · Terminal location · Batch number · Transaction time · Approval code · Transaction type · Card brand

· Card type · Card origin · Transaction amount · Interchange fee · Scheme fee · Acquirer fee · Net amount

Transactional details electronic reportIn addition to the standard monthly statements and upon request, merchants conducting thousands of card transactions on a monthly basis are offered the possibility of receiving a daily statement in a format than can be imported and processed by financial software (CSV file). This option is independent from analytical and summary report.

The report will be generated based on a range of different categories mentioned below:

B

C

M

O

34 35

Preauthorization The process of Preauthorization is used in order to engage funds from the cardholder without actually debiting the cardholder. For the cardholder to be debited (thus the merchant will be credited), the sale should be completed.

Preauthorization completion This process is used for “capturing” preauthorized funds, so that the cardholder will be debited (and the merchant credited).

ReprintThis process reprints a specific or the last transaction receipt.

Refund This process refunds the cardholder. It is different from void in the sense that a refund is not coupled with a previous transaction. Please, note that this process may be disabled on your terminal.

Sale This process is used to make a sale when a card is present.

Void This process voids an earlier transaction that has not yet been settled. Please, note that this process maybe disabled on your terminal.

P

R

S

V

Notes

36

800 00722 | +357 25 355 722 | www.rcbcy.com

The data presented in this brochure is for information only and has been prepared exclusively for the purpose of providing information to the recipients. The said data should not be interpreted as an offer, or solicitation to buy or sell any financial instrument. All data is valid as of 17th of November 2017 and may be changed by RCB Bank Ltd at its sole discretion at any time. Neither RCB Bank Ltd nor its affiliated companies, employees or representatives of RCB Bank Ltd or of its affiliated companies will be liable in connection with any direct or circumstantial loss or damage arising out of the use of all or part of the information contained in this brochure. RCB Bank Ltd. Private Company. Registration number: 72376. Registered office: 2, Amathountos street, 3105 Limassol, Cyprus.