• Do not disclose or acquire any cardholder data without the cardholder’s consent.
• Keep all cardholder data secure and confidential.
• Limit access to cardholder data only to those employees who require access to do their job.
• Cardholder data cannot be stored in any fashion on UNLV computers, networks, or related media.
• Wireless networks cannot be used in the cardholder data environment.
• Cardholder data must never be transmitted via email and departments are prohibited from soliciting cardholder data via email.
• Cardholder data that is inadvertently received by email should be deleted immediately and should not be used for processing payments.
• Payment card authorization forms must not contain references to an email address.
• Payment card authorization forms must not contain a FAX number that refers to an unsecured FAX machine.
• Payment card authorization forms must clearly show the following warning, “Please do not email this authorization form. Email is not a secure way of transmitting your card information.”
• All documentation containing cardholder data must be destroyed in a manner that will render them unreadable (crosscut shredding or third party shred bin) after their useful life (180 days) has expired. All other departmental deposit and accounting records must be maintained for a period of seven (7) years.
• A report of activity (by day and in total) is to be generated each month. This report should include your merchant name and number, the daily totals by batch, sales distribution, and the total for the month.
• Reconcile daily activity to merchant statements at least monthly to ensure credit is received for all processed transactions. Verify amount to finance deposit postings. Documentation that a reconciliation was done should be retained by the department.
• All business accepting payment cards will be required to complete an annual self-assessment questionnaire (SAQ).
• Each department that processes payment card transactions must have written procedures specific to that organization. The procedures must include, but are not limited to, the following:
  • Segregation of duties
  • Reconciliation procedures – daily and monthly
  • Physical security
  • Disposal
  • Instructions for processing transactions through all accepted payment channels
• Departmental procedures should be reviewed, signed, and dated by the department head or business manager on an annual basis and submitted to the Controller’s Office along with other required PCI compliance documentation.

• Verify the signature of the cardholder at the time of the transaction.
• Obtain the signature of the cardholder on the receipt and provide the duplicate copy to the cardholder.
• Be sure only the last four digits of the card number are printed on the receipt.
• Store the departmental copy of the receipt safely until it is needed for end-of-day balancing.
• Keep all receipts for each day together. Compare them to daily totals and then group them with the daily batch settlement tape for storage/reference purposes.
• Record the batch total and batch number for each day in the monthly summary report.
• If the terminal is not functioning properly, use the One-Time Credit Card Authorization Form.
  • Type the merchant name and phone number in the header prior to utilizing the form.
  • Make sure all fields are filled out in legible handwriting.
  • Provide the bottom portion as the cardholder’s receipt.
  • Hand-enter the transaction when the terminal is running again.
  • Destroy the middle section that has cardholder information immediately after processing in a manner that will render it unreadable (crosscut shredding or third-party shred bin).
  • Keep the original copy of the top section with merchant record.
• Log and inspect the terminal or card swipe mechanism to ensure it has not been tampered with and is working properly:
  • Daily for publicly accessible readers or devices used infrequently.
  • Weekly for supervised readers that may have exposure to public or non-PCI staff.
  • Monthly for those located in a secure office.
• Terminal or card swipe mechanism must be stored securely overnight.

• Maintain a payment listing for balancing and accounting purposes. This listing should not contain the cardholder data – the last four digits of the card number may be listed.
• Fax machines must be secure analog standalone machines and should be located in a nonpublic area where access is limited to accountable, dependable, and trustworthy staff.
• Documents with the card number and other cardholder data should be processed promptly and then safely stored if needed for balancing the day’s transactions. Cardholder’s three (3) or four (4) digit validation code must be destroyed immediately after processing in a manner that will render them unreadable (crosscut shredding or third party shredding).
• Documents with the card number and other cardholder data should be destroyed after balancing the day’s transactions or after the transaction is submitted.
• Keep all receipts for each day together. Compare them to daily totals and then group them with the daily batch settlement tape for storage/reference purposes.
• Record the batch total and batch number for each day in the monthly summary report.

• All payment card transactions must be processed by a PCI DSS compliant third-party provider (such as Authorize.net)
  • The account must be opened by the Controller’s Office
  • Approved by Purchasing
  • Approved by “NSHE contracted PCI approved vendor”
• No cardholder data can be stored on UNLV servers or networks.
• Review and comply with UNLV’s “Computer Security Policy” and “Password Policy” available on the IT website.
• Periodic network vulnerability scans will be conducted and the department is responsible for timely remedy of deficiencies.
• Documented verification that systems and technology used to meet all required PCI DSS security protocols should be kept on file in the department.
  • Verification can be obtained by contacting pci@unlv.edu.
• Changes to electronic processing systems (departmental software, website, etc.) must be communicated to the Controller's Office and confirmed to maintain compliance with PCI DSS before changes are made.

A chargeback occurs when the customer or the customer’s bank challenges all or part of a payment card transaction. An adjustment may be applied to your account. A chargeback is a reduction of your revenue.

The department will submit the requested documentation showing the validity of the purchase. You should not issue a credit after you have received notification of a dispute because the customer’s bank may have applied a conditional credit to the customer’s account. You may not be able to recover a credit after a chargeback has been received if you issue a credit in these circumstances; in fact, you may be responsible for the credit and chargeback.

Chargeback forms from the bank should be maintained in the department and a note made in the customer’s file of the chargeback and the circumstances. Departments should periodically review their chargebacks to see if there are internal policies that need to be changed so that fewer transactions are disputed.

A First Notice Rule Set is a function done in the financial system that contains an ad hoc bank transaction template with the department’s accounting information linking to a conditional rule that searches the bank account specified in the conditions.

When the conditions are met (i.e. searching the bank addenda for the merchant account number), an ad hoc bank transaction is created. Workday finds bank statement items that don't have an accounting entry reconciled. With the First Notice Rule Set, a department’s accounting and banking are automatically reconciled within the financial system.

First Notice Rule Sets do not substitute or eliminate the business unit's need to perform their reconciliation process and to ensure all transactions have been received.