Artisan POS Software User`s Manual 3.0

Guide to Credit Card Processing in Artisan POS 3.5
PP
This document describes how Artisan POS Software works with credit cards, debit cards, and other
payment types that can be submitted for authorization and electronic processing, a.k.a. Payment
Processing, with particular emphasis on the changes introduced in Version 3.5.
Most of the information described here applies to Integrated Payment Processing, but External Payment
Processing, typically using standalone credit card terminals, is discussed briefly as well. Integrated
Payment Processing means that payment information is automatically sent from Artisan to third-party
software or a payment processing gateway on the Internet for processing. With External Payment
Processing, on the other hand, clerks must take the tender amounts from the Artisan payment screen and
key them into a standalone terminal or separate software, along with other payment details.
Integrated Payment Processing requires the Secure Payment Processing (SPP) module for Artisan, and
in some cases additional third-party software. The older pre-3.5 Credit Card Processing module is no
longer supported. Some advanced features (Tips and Cards On File, described below) require the
separate Advanced Billing Module, and FSA/HSA Healthcare Spending Card support requires an
Inventory Information Approval System (IIAS) module.
Figure PP-1 Integrated Payment Processing
Artisan
POS
Credit
Card
Reader
(MSR)
Manual
Keyboard
Entry
Debit/EBT
PIN
Pad
Processing
Company
Payment Processing
Software or Gateway
Credit Card
Network
Merchant’s
Bank
$
Customer’s
Bank
Warning – Before version 3.5, you switched to PCCharge to do Voids & Voice Authorizations.
Now you do these through Artisan and must NOT put any transactions into PCCharge directly.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-1
Credit Card Security & PCI DSS
Payment Processing
PP.1 Credit Card Security & PCI DSS
The main motivation for the payment processing changes in 3.5 were the increasingly stringent credit
card security regulations put out by Visa, MasterCard, and the other major credit card companies. These
companies have now formed the Payment Card Industry (PCI) Association and have published a set of
Data Security Standards (DSS) for all businesses that handle credit card data.
From the beginning, Artisan has used techniques like encryption of card data and password access
controls to keep your credit card info secure while helping you reliably and efficiently process credit
card payments. However, the PCI DSS requires specific techniques and policies for ensuring secure
handling of credit cards, and so the Secure Payment Processing (SPP) module was born, a complete
replacement for the older Integrated Credit Card Processing support in previous versions of Artisan.
PCI DSS refers to the requirements on the Merchant. PA-DSS refers to the requirements on Payment
Applications such as Artisan. A merchant can trust that if they use a PA-DSS compliant application
according to the instructions in its “PA-DSS Implementation Guide” (see page PP-23 for ours), then
the merchant will be PCI DSS compliant as long as they conform to other PCI DSS requirements
relating to network & physical security, password policies, etc.
Artisan 3.5 is fully PA-DSS compliant. Older versions are not, unless used only with external
payment processing and without putting any credit card numbers or “CVV” security codes into Artisan.
PP.1.1 Why Should I Care About PCI DSS?
By July 1, 2010 PCI requires all businesses that
process credit card transactions to use only PA-DSS
compliant payment applications.
Compliance with PCI standards is part of your contractual obligation with Visa and the other Payment
Brands, as covered by contracts you signed when you obtained your Merchant Account. Starting with
July 1, 2010, merchant account providers are going to get more and more strict about enforcing
compliance, especially if you do have a breach. You could be subject to fines of $10,000 or more, plus
the cost of replacing affected customers’ cards, and you could lose your merchant account.
PP.1.2 PCI and PIN Pads
Whether you’re using Integrated Payment Processing or Standalone Terminals, if you use a PIN Pad
device, it must use the newer “Triple DES” encryption rather than the older “DES”. You will usually be
able to find a sticker on the device that mentions “TDES”, “3DES”, or “Triple DES”.
By July 1, 2010 PCI requires that all cardholder PINs
be protected by end-to-end TDES encryption. All PIN
Pad devices must use TDES encryption.
If using Integrated Payment Processing with Artisan, the only supported PIN Pad device is:
Verifone PP1000se using DUKPT key management.
PP-2
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Using Artisan with Standalone
PP.2 Using Artisan with Standalone Terminals
If you’re using a standalone terminal, or other External Payment Processing, make sure your station’s
Payment Processing Method is set to “None”. (This is the default for new stations.) In this case, you’ll
get an error if you swipe a card in the Payments window, to remind you to use the separate terminal.
You can still swipe the card in the main Cash Register screen to collect the Customer Name, if you’re
willing to swipe the card twice. See Section PP.9, “Using Credit Cards for Customer Names”.
Previous versions of Artisan allowed you to optionally collect credit card info even if you were actually
processing externally, with standalone terminals. This is not DSS-compliant, and is no longer allowed.
However, there is one new feature that can be turned on as a reminder and double-check that the clerk
actually runs the card on the standalone terminal. This can be set individually for each payment type, in
the corresponding Payment Type record in your Configuration Settings. It’s called, “Require Approval
Code when NOT using Payment Processing”. When this is set, selecting the corresponding payment
type(s) will prompt for just the Approval Code and require a non-blank entry before continuing. If this
option is off, Artisan will not prompt for any credit card info when using External Payment Processing.
Even if you have Artisan collect the Approval Code when externally processing, it doesn’t print it on
receipts, since without the (partial) card number, it doesn’t qualify as an official credit card receipt and
would be misleading. The actual credit card receipt must come from the standalone terminal.
However, the Approval Code, if collected, will be shown in the “External Tenders” section of the
Payment Processing Batch Reconciliation Report (see page PP-16). You can also view or change an
individual Approval Code at any time by recalling the sale in the Cash Register, pressing function key
F10 to open the Payments window, and then Ctrl-I to see the Credit Card Info (as above).
Note – Unlike payments processed with Integrated Payment Processing, externally-processed payments
can be voided or changed at any time. Artisan doesn’t know when or whether they’ve actually
been processed, so it does whatever you tell it to.
PP.2.1 PCI DSS and Standalone Terminals
If you only use External Payment Processing, using Dial-Up Standalone Terminals (not connected to the
Internet or any local computers), then you won’t have to worry about DSS, except to fill in and submit
the short-form “Self-Assessment Questionairre B” stating that’s what you’re doing. You should contact
your merchant account provider or DSS expert for assistance, but this form is available at:
https://www.pcisecuritystandards.org/saq/docs/aoc_saq_b.doc
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-3
Payment Processing Methods
Payment Processing
PP.3 Payment Processing Methods
In order to use Integrated Payment Processing, Artisan requires one of several third-party payment
processing programs or Internet gateways. Artisan does not communicate directly with processing
networks. In your Payment Processing Settings for each station you must indicate which of these
Processing Methods you’re using, and configure the corresponding settings presented on that screen.
Artisan 3.5 currently supports the following PA-DSS validated third-party Payment Processing Methods:
• PPI PayMover
• T-Gate PayLink
• PCCharge Payment Server 5.9.1 or later (by Verifone)
PayMover is a direct gateway solution, which requires no additional software to be installed. There is no
charge for PayMover, but you must use a merchant account from Payment Processing, Inc. (PPI).
PayLink has two components: a local “No-Touch” interface that collects the credit card payment info
and sends it out for processing without Artisan ever touching it, and a generic gateway that can be used
with your existing merchant account and just about any processing company. You have to buy PayLink
for each site, as well as additional station licenses if you’ll be processing cards on more than one station.
(However, PayLink is less expensive than PCCharge, and there’s no charge for upgrades or support.)
PCCharge is a local server that runs on one PC in your store, and communicates directly with just about
any processing company and merchant account. You have to buy PCCharge Payment Server for each
site, as well as additional user licenses if you’ll be processing cards on more than one station.
Table PP-1 Comparison of Payment Processing Methods
PayMover
PayLink
PCCharge 5.9.1
Local Software?
No
Each Station
One Station
Charged per Station?
No
Yes
Yes
Merchant Accounts
PPI Only
Any
Any
Secure Communications
Yes (SSL)
Yes (SSL)
Yes (SSL or Dial-Up)
Communication Method
Internet Only
Internet Only
Internet and/or Dial-Up
“No-Touch”
No
Yes
No
Encrypted MSR
Optional
Optional
No
“Card On File”
Optional
Optional
No
PIN Debit, EBT
Yes
Yes
Yes
FSA/HSA
No
No
Optional
Check Verification
No
No
Yes
Check Conversion
No
No
Yes
Dependent Credits
Yes
Yes
No
AVS Pre-Check Option
Yes
No
Yes
Note that Artisan now communicates even with PCCharge by secure SSL connections. We no longer use
the “File-Drop” method. This means you no longer need to share & map the PCCharge program folder.
PP-4
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Integrated Credit Card Processing
PP.4 Integrated Credit Card Processing Basics
Artisan no longer stores any Sensitive Authentication Data or full PANs (Primary Account Numbers;
that is, credit card numbers) in any database table or other disk file. All PANs that are stored, displayed,
or printed, are permanently truncated/masked with “*”s to leave only at most the first 6 and last 4 digits.
Artisan data files are therefore out of scope of the DSS and not covered by its requirements. However,
you should still exercise reasonable caution in allowing access to Artisan data files and backups, as they
may contain customers’ names and addresses, and other personally identifiable information.
It is important that you do not store credit card numbers (PANs) or other sensitive data in Artisan
general text fields, such as Pop-Up Notes and Memo fields. They are not encrypted or protected. If you
want to keep credit cards on file for repeat or recurring billing, you must use the Card-On-File feature
of the Advanced Billing Module to store the credit card details offsite on a secure, DSS-certified server.
(See Section PP.13.1, “Cards On File,” on page PP-18.)
For complete details on maintaining compliance with PCI DSS, see the “PA-DSS Implementation
Guide” on page PP-23.
PP.4.1 To Swipe or Not To Swipe
There are two ways you can enter credit card info into a sale for processing: After selecting a credit card
type from the Payment Type menu in the Payments window, you can manually type, or “key”, the
cardholder’s name, card number, and expiration date, into the Credit Card Info pop-up. Or, if you have
a Magnetic Stripe Reader (MSR), a.k.a. a Credit Card Reader or “swiper”, you can “swipe” the card in
the MSR, and that info will be entered for you, along with some hidden “track data” for extra security.
If you’re using a “No-Touch” Payment Processing Method like PayLink, you can only swipe a card in
the detailed card info pop-up window; otherwise you can swipe the card anywhere in the Payments
(or Credits) window, and Artisan will automatically select the appropriate Payment Type for you.
In general, if you explicitly pick
one credit card Payment Type, such
as Visa, and then put in a (keyed or
swiped) card number that’s for a
different card brand, Artisan will
automatically switch to the correct
Payment Type. This means you
don’t have to pay much attention to
which credit card Payment Type
you pick; any one will do the trick.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-5
To Swipe or Not To Swipe
Payment Processing
If you have a brick-and-mortar store, with a card present, you should usually swipe the card, not key it,
for better rates. You should only use Card Present keyed if the swipe fails to read after several tries.
When you swipe the card, Artisan will display the card info, ready to Process by pressing Enter or the
Process buton, with nothing else to fill in (unless you use the “Verify Last 4 Digits” option, described
in Section PP.8.1 on page PP-11, or the card is a Purchasing Card; see Section PP.8.4 on page PP-12.)
If you do manually key in the card info, there are several other fields to fill in. Some of these are
described in Section PP.4.2, “CVV & AVS for Manually-Keyed Cards”, below. The other is “Card Info
Source”, which lets you tell Artisan (and the credit card processor) whether the Card is Present
(physically in hand), is being read to you on a Phone Order, or sent via Mail Order or Web Order.
Note that some of the info is automatically filled in from the Customer Record, if you have selected
one before picking a credit card payment type. If the name and address for the card differ from the
corresponding Customer Record fields, you can change the values here. For details on the CVV and
Address fields, see Section PP.4.2, “CVV & AVS for Manually-Keyed Cards” on the next page.
PP-6
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
CVV & AVS for Manually-Keyed Cards
PP.4.2 CVV & AVS for Manually-Keyed Cards
When you manually key in credit card info, there are three additional security fields you can fill in.
These are optional, but recommended. Your store may have specific policies about when to use them.
These fields are not used for Debit or EBT transactions, just basic credit cards.
While they have some subtle impacts on the actual processing of the transaction, as described below,
these fields are primarily intended for the benefit of you, the Merchant, to help you decide if you can
trust a remote customer, especially a new customer, and help you to be aware of possible fraud. Correct
matches on these fields may also help you recover your funds in Chargeback cases.
PP.4.2.1 CVV Security Code
The first of these fields is the “CVV” card security code, also known as CID, CVV2, etc; for most card
types, this is a 3-digit code on the back of the card, printed on the signature strip, either by itself or as
the last group of digits. For American Express, it’s a 4-digit code printed on the front of the card, nonembossed, above the credit card number. Type in “NONE” in the unusual case that there really is no
security code on the card; use “???” if the code is there, but is wholly or partly illegible (unreadable).
If you don’t fill in CVV at all, no attempt to match it against the cardholder’s records will be done. The
presence or absence of CVV, and whether it matches or not, does not usually affect the rate of the
transaction, but for some cards, a missing or incorrect CVV code may result in a Declined transaction.
It’s up to the bank or company that issued the card, so you may get different results for different cards.
If the CVV code you enter does not match the expected code, but the card is not declined, you will get
a “CVV: No Match” message. In this case, the transaction has been authorized and the money will be
transfered. It is up to you whether to leave it that way, or to void the transaction. A CVV mismatch is a
possible indication that the customer doesn’t have the real card, and is a fraud. After verifying that it
wasn’t mis-keyed or misread, you may decide that you don’t trust this customer and then void & refuse
the entire order. (Contact your credit card company if you think a fraud investigation is appropriate.)
PP.4.2.2 AVS Address Verification
Next are the Street Address and Zip/Postal Code fields used for “AVS” (Address Verification Service).
These should match the Statement Billing Address for this credit card (which may differ from the billing
address the customer has given you for their Artisan Customer Record). If you have already selected a
Customer Record for this sale, these will default to values from the Customer Record’s billing address.
Note that only the numeric part of the Street Address is checked. You can leave off the street name.
If both AVS fields are blank, no attempt to match them against the cardholder’s records will be done.
The presence or absence of AVS info, and whether it matches or not, will not affect whether the
transaction is Approved or Declined, but will likely affect the rate of the transaction. Note that this is
essentially the reverse of the CVV case. For best rates on a keyed transaction, include the AVS info
(Street Number and Zip/Postal Code). For Card Present cases, the Street Number doesn’t usually
affect the rates, but a Zip/Postal Code match is required for the best rates. For Card Not Present, you
will usually get better rates as long as the full AVS info is present, whether or not it matches.
The matching for AVS is more complicated than for CVV, since it can match one or both fields, or
neither, and in some cases you can get a partial match on 5 digits of a 9-digit Zip Code. Any partial or
full match failure will be displayed with a successful transaction, and you will have to decide on a
corresponding level of trust. Void and refuse the order if you don’t trust it.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-7
Card Info Source
Payment Processing
PP.4.3 Card Info Source
Artisan keeps track of the source of the card
info for each payment. This is filled in for you
when the card is swiped, but if you manually
key in the card info, you’ll have to select the
Card Info Source from the pop-up menu.
In some cases, this information is also sent to
the Payment Processor. Selecting the wrong
Card Info Source could impact your ability to
have chargebacks reversed.
If you’re using PayLink, the card source
prompt will instead appear as a single
“Card Present” check box. When this is not
checked, it will be treated as Phone Order
(Card Not Present).
PP.4.4 Processing a Credit Card Transaction
Once the credit card info is entered, manually or by swiping, click on the Process button to begin
processing (sending the info to the credit card company or bank for authorization). In PayLink, you can
also press the Enter key to begin processing. In Artisan’s own Credit Card Info pop-up, you can use
Enter if the Process button is highlighted, or key combination Alt-P at any time.
If the transaction is declined, or there is some other error during processing, you’ll get a message to that
effect. If there’s no error, but there’s an AVS or CVV mismatch, you’ll see a message like this:
AVS/CVV matching is described in Section PP.4.2. Even if the AVS info or CVV do not match, the
transaction will usually still be approved and processed. If you want to cancel a charge that had an
AVS/CVV mismatch, you will have to void it explicitly. (See “Voids and Returns” on page PP-9.)
If the transaction was successfully approved, with or without an AVS/CVV mismatch, Artisan will
continue processing the sale. If the exact amount due has been paid, the sale will be saved and printed,
as if you had pressed the SAVE button; otherwise, the cursor will move to the next tender line.
PP-8
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Voids and Returns
PP.5 Voids and Returns
If you want to cancel a sale or deposit entered in error or cancelled, Artisan allows you to void it.
(Ctrl-V in the Cash Register, then select “Void Entire Sale”.)
Unlike with older versions of Artisan, voiding a sale now voids any credit card tenders on that sale. It’s
no longer necessary to switch to PCCharge and process the void there. (In fact, you should not do voids
in PCCharge anymore.) Before voiding the whole sale, Artisan sends a Void request for each tender that
was previously processed and approved. If all these Voids succeed, then Artisan voids the sale; if not,
the sale is left intact. The most common reason for a Void failure is that the corresponding batch has
already been settled (closed); you can only void payment transactions in the current open batch.
You can also void individual tenders in the Payments (or Credits) window by using key combination
Ctrl-V on the corresponding tender line, or by using the Void button in the Ctrl-I Tender Info box.
If you can’t void a payment transaction, you will have to refund it instead. Start by creating a new sale
in Artisan, and enter a merchandise return corresponding to the original sale. If “Smart Returns” are
enabled (using the Merchandise Return Mode setting in your Miscellaneous Program Options), you’ll be
prompted to indicate which original sale the item(s) are being returned from:
The easiest way to issue a credit card refund–if your Payment Processing Method supports it–is with a
“Dependent Credit”, so called because it’s based on, or “depends on”, an original payment for its credit
card info instead of re-entering it. You must use a Smart Return, and the original payment must have
been processed with Integrated Payment Processing. As soon as you enter the Payments window to
finalize the sale, you’ll be offered the choice to (partially or wholly) refund those original payments
without having to enter the credit card details again.
This lets you issue a refund without having the card present and without knowing the full card number.
Note – To enable Dependent Credits, go to the More Info area of your Payment Processing Settings, and
turn on the option to “Offer to Put Refunds on Original Payment Cards for Smart Returns”.
If you don’t use Smart Returns or Dependent Credits, you can still issue a credit card refund by swiping
the card or manually entering all of the credit card info. This is called an “Independent Credit”, which
you enter just like a credit card payment, except that it’s in the Credits window for a negative sale.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-9
Voice Authorizations
Payment Processing
PP.6 Voice Authorizations
Occasionally, your computer, Internet access, or payment processing software may be down when a
customer wants to pay by credit card. You can take an imprint of the card and get a signature, then enter
the card info later when the system is available again. However, to make sure the card is valid and has
funds available, while the customer is still present, you must also obtain a Voice Authorization.
To get a Voice Authorization for a transaction, call your Voice Authorization Center and give the card
details and transaction information to the operator or automated system. (Your merchant account
provider should have given you the phone number(s) and instructions.) You will get an Approval Code;
write this down along with the imprint.
Once your system and Internet access are working again, enter or recall the original sale in Artisan,
press function key F10 to get into the Payments window, then press F8 or click on the Voice Auth
button. Finally, select the appropriate payment type. Enter all of the credit card information as usual,
along with the Approval Code you received from the Voice Authorization.
Warning – A Voice Authorization only gives you an approval for the transaction. In order to
actually receive funds, you must enter it into Artisan as described above.
PP.7 Partial Approvals
If you attempt to charge a higher amount than is available on a payment card, it may get declined, or it
may be approved for a lesser amount. If it’s approved for less than the original amount, this is called a
partial approval (or partial authorization). Partial approvals are most likely with prepaid debit cards
(card-brand “gift” cards), but whether you get a decline or a partial approval may vary from card to
card, and also depends on the processing method you’re using. (PPI PayMover always declines rather
than returning a partial approvals.) When Artisan receives a partial approval, it will reduce the amount
of the tender to match the approved amount, and notify you that the amount has changed.
PP-10
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Advanced Payment Processing Options
PP.8 Advanced Payment Processing Options
PP.8.1 Option to Verify Last 4 Digits
For swiped cards, there’s an additional security option called “Verify Last 4 Digits”, in the More Info
area of your Payment Processing Settings (for each station). If set, then whenever a card is swiped in the
Payments window the clerk will be asked to type in the last 4 digits of the card number. If they don’t
match the card number read from the magnetic stripe, the card will not be processed.
This option helps catch a type of credit card fraud where the magnetic stripe is reprogrammed with a
different card number. If you get a mismatch after double-checking the number, you should call in for a
“Code 10” voice authorization, to alert the credit card company of the possible fraud.
Note – For T-Gate PayLink, this option is set in the separate PayLink Settings program. Please contact
Artisan tech support for help in changing this setting for PayLink.
PP.8.2 AVS Pre-Check Option
This option runs a separate transaction before each charge transaction, if AVS and/or CVV info are
provided, to check for AVS/CVV matches without putting a (large) hold on a customer’s account. This
extra transaction is processed as a Zero Dollar Authorization, if supported; otherwise it’s done as a
dollar authorization. That way, if you get a full or partial mismatch and decide to re-enter the transaction
after making corrections, you won’t have to Void an actual charge. In most cases, Voids do not release
the hold on the customer’s account. See the next section for more on Zero Dollar Authorizations.
Note – With PPI PayMover and an FDMS merchant account, most Voids will release the hold on the
customer’s funds. If so, the Payment Processing Log will show “Void & Release” instead of
“Void”. In that case, the AVS Pre-Check option isn’t really necessary.
To turn on this option, go to the More Info area of your Payment Processing Settings (for each station),
and set “Check AVS & CVV First” to “Y”. This option is currently only supported for PPI PayMover.
PP.8.3 Zero Dollar Authorizations
If you're putting Cards On File or using the “Check AVS & CVV First” option, Artisan submits an
“Authorization-Only” transaction, which is never Captured, so no money is actually charged. For
historical reasons, this is normally done with an amount of one dollar ($1.00) and called a One Dollar
Authorization (ODA). This does however put a hold on the customer's account for this amount, until it
eventually expires after a week or more.
As a result, Visa now offers a Zero Dollar Authorization (ZDA) option, which avoids the hold, but some
processing companies and gateways don't support it yet. Also, MasterCard still expects ODAs not
ZDAs, but this may change in the future. Because of this, Artisan uses only ODAs by default.
However, there is a configuration setting in the More Info area of your Payment Processing Settings (for
each station) to “Use Zero Dollar Auth”. If you enable this option, a ZDA will be used if the card type
is Visa. In all other cases, an ODA will be used. There may be additional fees involved with either ZDA
or ODA transactions; check with your Merchant Account Provider.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-11
Commercial Cards (Level 2 Data)
Payment Processing
PP.8.4 Commercial Cards (Level 2 Data)
Most credit cards are individual Personal cards, but businesses can obtain credit cards for their
employees, in the company name. These are called Commercial Cards, and come in several flavors:
Table PP-2 Commercial Card Types
Prompt for
Customer Code?
Card Type
Typical Usage
Business Card
A general-use credit card with little or no restrictions on the types of
purchases. Typically for smaller businesses.
No
Corporate Card
Commonly used by organizations for employee travel and
entertainment (T&E) expenses; also referred to as a Travel Card.
No
Purchasing Card
Purchasing Cards replace traditional Purchase Orders while allowing
the Accounting Department to cross-check and control purchases.
Yes
Government
Purchasing Card
A Purchasing Card issued by a Government Agency rather than a
corporation.
Yes
Fleet Card
Used by organizations to pay for fuel, maintenance, repair and
related expenses on company vehicles.
No
To get the best rates on commercial cards you need to send “Level 2” data (a.k.a. “Level II”). Artisan
handles the sales tax part for you automatically. If a Purchasing Card is used, the clerk will also be
prompted to enter the “Customer-Supplied Code or PO #” (a.k.a. “Customer Code”), which is an
accounting number that the customer may tell you to use. This Customer Code gets sent to their
company's accounting department along with the other Level 2 Data. If they don't give you a code to
use, just leave it blank and Artisan will send the Sales Slip #. Either way, you'll get the better rates.
If you don’t expect to get many Commercial Cards, and don’t want your clerks to be bothered with these
details, you can disable the detection and prompting for Commercial Cards entirely. This is controlled
by the “Commercial Card Data” setting in your Payment Processing Settings. Higher rates may apply.
PP.9 Using Credit Cards for Customer Names
Whether or not you use Payment Processing, if you have a Magnetic Stripe Reader (MSR), you can
collect the customer’s name from a credit card to use for a Customer Record. In the main Cash Register
screen, or any Customer Record Search, swiping a credit card takes the name from the card and starts a
search for that customer name. The search option is automatically switched to a search by Last Name.
If you swipe a credit card in the F4 detail of a Customer Record itself, the First and Last Name fields
will be replaced with the name from the card. All other information from the credit card is discarded.
If you’re using Integrated Payment Processing and swipe a card in the Payments window, the name from
the card is not used for a Customer Record, unless you set the configuration setting, “Use Name from
Credit Card Payment to Select Customer”, located in the Device Configuration for your Magnetic Card
Reader (MSR), to “Yes”. If set, then whenever a credit card payment is processed successfully, and no
Customer has yet been selected, the name from the card will be used to select a Customer Record. If you
don’t want a Customer Record for that sale, press the Escape key to skip it and continue.
Using this setting allows you to collect payment and identify the Customer with a single swipe, but
unlike previous versions, that swipe must be in the Payments window not the main Cash Register.
PP-12
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Debit Cards and PIN Pads
PP.10 Debit Cards and PIN Pads
If your merchant account is set up to accept PIN Debit, and you have a supported PIN Pad with a USB
or serial cable, you can process Debit Card payment transactions using Artisan’s built-in “Debit Card”
payment type. If not, you can process most debit cards as regular credit cards; though you would not
then get the PIN Debit rate, which is often lower than the processing fee for credit cards.
Note – In order to use Debit Cards, they must be enabled in your Payment Processing Settings. Also, the
corresponding Payment Type must be turned on, by giving it a non-zero Menu Order.
You must also configure the PIN Pad in your Artisan Device Configuration Settings.
You must select the Debit Card payment type in the Artisan Payments window before swiping the card,
or it will be treated as a normal credit card. Debit Cards must be swiped; they can’t be manually entered.
After you swipe the card, you may be prompted for a Cash-Back Amount, if so configured:
(If you are using a “No-Touch” processing method, like PayLink, these screens will look different.)
If you enter a Cash-Back amount, it will be added to the total charge on the card and then taken out as
a cash refund at the end of the sale; as a reminder, you will receive a “Change Due” prompt. If you want
to skip the Cash-Back Amount, press Tab or Enter, or just click on Process.
Next, the PIN Pad will show the total tender amount (including Cash Back, if any), and prompt the
customer to enter their PIN. Once the PIN is entered, processing will continue as for credit cards.
Note – Voice Authorizations are not supported for Debit Cards (since PIN Pad verification would not be
available). However, you can process them as standard Credit Card Voice Authorizations.
The Cash-Back Limit can be changed in the More Info area of your Payment Processing Settings
(unless you use PayLink). If set to zero, then the Cash-Back prompt won’t appear at all.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-13
EBT Food Stamps and Cash Benefits
Payment Processing
PP.11 EBT Food Stamps and Cash Benefits
Artisan now lets you process Electronic Benefits Transactions (EBT), if your merchant account supports
them and you have a supported PIN Pad with a USB or serial cable.
EBT Cards can be used in the US for the Supplemental Nutritional Assistance Program (SNAP),
formerly known as Food Stamps, or other government-issued Cash Benefits.
There are two separate payment types for EBT, one for EBT Cash Benefits and one for EBT SNAP
(Food Stamps), depending on the type of card used. Your store might accept one or the other, or both.
You must select the appropriate EBT payment type in the Artisan Payments window before swiping or
manually entering the card number, or it will be treated as a normal credit card.
Receipts for EBT payments show the Remaining Balance on the card, as mandated by EBT regulations.
Note – In order to use EBT Cards, they must be enabled in your Payment Processing Settings. Also, the
corresponding Payment Types must be turned on, by giving them non-zero Menu Orders.
You must also configure the PIN Pad in your Artisan Device Configuration Settings.
PP.11.1 EBT SNAP
EBT SNAP can only be used to purchase non-taxable food items (including any associated bottle
deposits). This restriction is enforced by the “Valid Categories” setting in the More Info area of the
corresponding Payment Type settings. This is initially set to “FOOD,BOTTLE-DEP”, but you can
change it to match your Category names. All subcategories of the listed categories are allowed as well.
If the sale includes other types of merchandise, the tender amount for the EBT SNAP card will be
reduced to the eligible amount. You will then have to select another Payment Type for the balance.
EBT SNAP transactions can be manually-keyed, if the swipe won’t read, but only if the card is present.
EBT SNAP uses a special form of Voice Authorization when you need to accept a payment while your
system is down or unable to reach the Internet. These are called “Paper Vouchers”, and are handled just
like normal Voice Authorizations, as described in Section PP.6 on page PP-10, but in addition to an
Approval Code, you will receive a Voucher Number from the EBT Voice Authorization Center. Artisan
will recognize that the Voice Auth is for an EBT SNAP payment and prompt for the Voucher Number.
Cash Back amounts are not allowed for EBT SNAP cards.
PP.11.2 EBT Cash Benefits
EBT Cash Benefits cards act like Debit Cards: they must be swiped, not manually-keyed, and the
customer must enter their PIN using a secure PIN Pad.
As with Debit Cards, you can optionally enter a Cash Back amount for an EBT Cash Benefits card.
There are no restrictions on the type of merchandise that can be purchased with EBT Cash Benefits.
Voice Authorizations and Refunds are not supported for EBT Cash Benefits. If you want to refund an
EBT Cash purchase, you’ll have to use Cash or Store Credit.
PP-14
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Payment Processing Reports
PP.12 Payment Processing Reports
There are several new reports in Artisan version 3.5 relating to Integrated Payment Processing. These
have been combined with the existing Automatic Billing reports into a new Reports => Payment
Processing & Auto Billing menu. These are also available from the Main Menu under Accounting =>
Payment Processing & ABT.
PP.12.1 Payment Processing Log
This searchable report lists the details of ALL payment processing transactions, including errors and
declines. The most recent is listed first. (In a multi-store environment, you’ll be asked to pick a site to
report on, or to show all sites).
You can use function key F4 to see the details of any entry, or you can use the Enter key to recall the
corresponding sale in the Cash Register. See the next section for an example of the F4 detail screen.
PP.12.1.1 Recovering Orphan Tenders
In the rare case that Artisan crashes after processing a tender, but before finalizing the sale, then that
tender will end up as an “orphan” tender, w/o a corrresponding sale. If you leave it in this state, the
money will be transfered but it won’t correspond to any sale in Artisan. To fix this, click on the “Add
Missing Sale” button next to the Sales Slip # in the Payment Processing Log F4 detail.
“Add Missing Sale” will only be displayed for orphan tenders. Selecting it will create a new sale in the
Cash Register screen, using the original Sales Slip #, with the already-processed tender filled in and the
Customer selected. You will have to enter the remaining details of the sale (primarily the line items).
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-15
Payment Processing Batch Detail Report Payment Processing
PP.12.2 Payment Processing Batch Detail Report
This report lets you see a list of all Integrated Payment Processing transactions for a single day (or a
range of dates), grouped and subtotalled by Payment Type. This report has several options, including:
Show Detail? — If you change this to No, the report will only include subtotals by
Payment Type, and the Grand Total, and not the lists of individual transactions.
Include Voids? — Set to Yes to include voided transactions, too.
Include Declines? — Set to Yes to include transactions declined by the customer’s bank
(but not processing errors).
PP.12.3 Payment Processing Batch Reconciliation
This report is similar to the Batch Detail Report (without the Voids & Declines options), but lists the
processed payments side by side with the saved tenders for completed sales and highlights any that don’t
match up. Normally, this should not happen, but it lets you catch and track down any discrepancies, such
as might happen if your computer crashes after processing a payment but before saving the sale.
This report has several options, including:
Show Detail? — If you change this to No, the report will only include subtotals by
Payment Type, and the Grand Total, and not the lists of individual transactions.
Exceptions Only? — This only lists and/or totals the “exceptions”; that is, the transactions that
do not match.
If you have any check or credit card tenders that were externally processed (including checks that are
just entered without processing, to be deposited later) the Batch Reconciliation report will include a
separate section at the end, listing these External Tenders with their Approval Codes, if any.
PP-16
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Advanced Billing Module
PP.13 Advanced Billing Module
The separately-purchased Advanced Billing Module includes some advanced Payment Processing
features as well as some other advanced payment options:
• Automatic Billing (recurring and/or scheduled payments and invoices).
(Described in the Artisan POS Plus 3.5 Upgrade Manual.)
• Third-Party Billing (charges on account where one customer buys items & another is billed)
(Described in the Accounting chapter of the main Artisan POS Plus User’s Manual.)
• Cards On File (credit card info stored securely off-site for later re-use w/o card present)
• Tips (Gratuities)
Note – If credit cards are used with Automatic Billing, they must now use Cards On File.
Cards On File and Tips (Gratuities) are described on the following pages.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-17
Cards On File
Payment Processing
PP.13.1 Cards On File
(This feature requires both the Secure Payment Processing and Advanced Billing modules.)
If you take phone or mail orders from repeat customers, or you want to use recurring billing for
installment payments or periodic charges, then you need to use Cards On File. This lets you keep a
customer's credit card details on file for later charges without storing any sensitive information locally.
Actual credit card details are stored offsite on a secure, DSS-certified server. Keep multiple cards on file
for each customer, and add or remove them from the list at any time.
PP.13.1.1 Putting Credit Cards On File
You can manage the list of Cards On File for each customer from either their Customer Record or the
Payments window in the Cash Register. In either case, you use function key F7 or the Cards On File
button to bring up the list of all cards for that customer. (The Payments window will prompt you for a
Customer if you haven’t already selected one.)
In the Payments window, you’ll first get a menu of non-expired cards to use for the current sale, if any.
From the menu, you can select Search/Scroll Full List to get the full list.
Press function key F3 to Add a New Record, then swipe or type the credit card like usual. When you
select the Process button, Artisan will process a “Get Token” transaction to put the card on file.
PP-18
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Cards On File
Note – If you add a Card On File from the Payments window (via F7), then Artisan will assume you
also want to use that card for the current sale, and will immediately process a payment
transaction as well. (You can Void the resulting tender if that wasn’t intended, but it’s better to
add the card via the Customer Record if you don’t want to use it right away.)
PP.13.1.2 Using Credit Cards On File for New Charges
To use an On-File Card as a payment for a new sale (or in an Auto-Billing Template), use function key
F7 or the Cards On File button from the Payments window.
If you want to force all credit cards to be put on file before they can be used, you can enable the option
to “Put All Cards On File”, in the More Info area of your Payment Processing Settings. With this setting,
selecting any credit card Payment Type will act as if you had pressed F7.
PP.13.1.3 Using Credit Cards On File for Refunds
If you’re using Smart Returns and you’re refunding a prior payment, you can use a Dependent Credit as
described in Section PP.5, “Voids and Returns,” on page PP-9, whether or not the original payment was
made with an On-File Card.
Alternatively, you can put an Independent Credit on an existing Card On File, by using function key F7
in the Credits window just as you would for Payments, described above. However, this is currently only
supported with PPI PayMover. For other Processing Methods, if you can’t use a Dependent Credit you’ll
have to obtain the customer’s credit card info again, and use a manually-keyed credit card refund.
PP.13.1.4 Updating Cards On File
At any time, you can go back into a customer’s Cards On File list as descibed in Section PP.13.1.1, and
add or delete cards from the list. Expired cards will stay on the list until you delete them, as a reminder
that they need to be replaced, but they won’t appear in the menu for selecting a card to use on a sale.
PP.13.1.5 Expiring Credit Card Reports
These reports list On-File credit cards that are due to expire in the next month or so. One of them lists
All Cards On File (including Automatic Billing). The other lists Auto Billing Only.
These allow you to contact your customers for new card info before the current cards expire. You can
then replace them in the customers’ Card On File lists.
You can find these reports under Reports => Payment Processing & Auto Billing, or from the
Main Menu under Accounting => Payment Processing & ABT.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-19
Tips (Gratuities)
Payment Processing
PP.13.2 Tips (Gratuities)
With the Advanced Billing module, Artisan now optionally supports Cash Tips (Gratuities). If you also
have the Secure Payment Processing module, you can also put Tips on Credit Cards.
Note – To turn on the Tips feature, go to the More Info area of your Payment Processing Settings (even
if it’s only for Cash Tips), and set “Allow Tips (Gratuities)” to “Y”.
Artisan allows you to add a tip to a sale before you finalize it or add tips to an already-finalized sale.
This allows for any of the following typical scenarios:
1. The customer gives you a credit card for payment. You run the card, save the sale, and
print the receipt, including a signature copy. The customer adds a tip amount when they
sign the signature copy, so you go back in and add the tip to the previously-saved sale. The
tip is charged to the same credit card even though you’ve given it back to the customer.
2. The customer hands you cash (or even a credit card) and tells you to include a certain
amount as a tip (or you ask them first). You add the tip to the sale before you finalize it.
3. The customer pays in cash, receiving their receipt and change, then hands you back a cash
tip. You add the cash tip to the previously-saved sale just like in the credit card case.
In all of these cases, you add a tip by using key combination Ctrl-G (for Gratuity) in either the main
Cash Register screen or the Payments window. If you’ve already started a sale (or recalled a previouslysaved sale), Ctrl-G will take you to the Payments window and prompt for a tip amount:
If you use Ctrl-G in a blank Cash Register screen, it will first recall the last sale saved or printed on this
station, as with Ctrl-Shift-P, then prompt for the tip amount. You don’t have to explicitly recall the sale.
If you are not using Integrated Payment Processing, Artisan will add a Cash Tip to the sale for the
entered amount. If you use a Cash Tip (in general) and there’s also still money due on the sale, the
balance due will also be paid, in Cash, along with the tip. This simplifies the process, by saving steps.
Finally, whichever payment method you use, the tip amount will be added to the sale as a “TIP” Item
line (combined with previous tips, if any), and added to the appropriate tender in the Payments window.
PP-20
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
Tips (Gratuities)
If you are using Integrated Payment Processing, you’ll have to choose between Credit Card(s) and Cash.
This menu includes a list of previous credit cards on this sale that haven’t already been used for a tip.
Whichever one you select will have a tip added to it, or you can select a Cash Tip.
If there aren’t any useable credit cards on the sale already, and there is a balance due, you’ll get a choice
to add a new one instead, to use for both the balance and the tip amount:
PP.13.2.1 Sales Slip Styles for Tips
If you want customers to be able to add a tip amount when signing for a credit card payment, you should
use one of the new Credit Card Signature receipts with a Tip line that can be filled in.
Go to System Administration => Configuration Settings => Customizing Forms & Sales Slips => Sales
Slip Styles. With a Search by Slip Description, type “TIP”. You’ll see all of the sales slip styles that
have tip lines, such as “Credit Card Signature Copy w/Tip - 40-Column“.
Pick the one you want and edit it (with function key F4). Change the “Default # of Copies” to one, or
two if you want a copy for the customer to keep. (Menu Order can be zero if you don’t want to be able
to print this slip individually. It will print whenever a “Main Receipt” is printed.) Don’t forget to disable
the regular Credit Card Signature slip(s) by setting them to have Menu Order and # of Copies zero.
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-21
Tips (Gratuities)
PP-22
Payment Processing
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
Payment Processing
PA-DSS Implementation Guide
PP.14 PA-DSS Implementation Guide
The PA-DSS Implementation Guide for Artisan POS is
still in review. A few key points are included below.
In order to be compliant with the PCI DSS Data Security Standards, you must follow the guidelines in
this section when using Artisan POS Software. These guidelines apply to Artisan POS Version 3.5;
earlier versions are not DSS-compliant. Make sure you also read and comply with the PA-DSS
Implementation Guides for any other payment processing software components you will be using in
conjunction with Artisan, such as PCCharge Payment Server.
Artisan no longer stores any Sensitive Authentication Data or full PANs (Primary Account Numbers;
that is, credit card numbers) in any database table or other disk file. All PANs that are stored, displayed,
or printed, are permanently truncated/masked with “*”s to leave only at most the first 6 and last 4 digits.
Artisan data files are therefore out of scope of the DSS and not covered by its requirements. But you
should still exercise reasonable caution in allowing access to Artisan data files and backups, as they may
contain customers’ names and addresses, and other personally identifiable information.
It is important that you do not store credit card numbers (PANs) or other sensitive data in Artisan
general text fields, such as Pop-Up Notes and Memo fields. They are not encrypted or protected. If you
want to keep credit cards on file for repeat or recurring billing, you must use the Cards-On-File
feature of the Advanced Billing Module to store the credit card details offsite on a secure, DSScertified server.
Pre-3.5 versions of Artisan POS stored magnetic stripe data and card validation codes temporarily, until
each payment transaction was authorized. This information is automatically wiped from your main data
when it is upgraded to 3.5, but older backup files could include small amounts of such information for
transactions that were put on hold, or otherwise not yet finalized.
While this information was always encrypted when it was stored, it does represent a small potential
exposure, and should be deleted. Please note, though, that simply deleting a file in Windows, even after
emptying the Recycle Bin, does not really wipe out the information; a determined hacker could recover
sensitive data from deleted files.
To ensure that this older data is securely deleted, you should use a program such as “File
Shredder”—available for free from http://www.fileshredder.org --to “shred” any pre-3.5 backup files and
any extra copies of Artisan data you may have, and make sure to use the option to “Shred Free Disk
Space” to wipe any previously-deleted files on any disk drive or flash drive that ever held Artisan data
or backup files.
However, we recommend that you temporarily keep copies of a few pre-3.5 backup files, especially one
from just before the 3.5 upgrade, for about 3 weeks, while you make sure there are no unexpected issues
with the upgrade. Preferably, you should keep these on a USB flash disk, disconnected from the
computer. Also, make a backup of the 3.5 data right away, and on a regular basis going forward.
[MORE TO COME]
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10
PP-23
PA-DSS Implementation Guide
PP-24
Payment Processing
Guide to Credit Card Processing in Artisan POS - Version 3.5 - 6/8/10