Case Study: Convention Center with Large Parking Facility Reduces PCI DSS Scope

Integrating a variety of payment methods, our client keeps sensitive payment data out of their environment and protects payments from swipe to settlement.

The Client

World-class Convention Center located in a major metropolitan area, attracting more than 2 million visitors annually
Features exhibit hall space, meeting space, food service, and more
On-site parking for 5,000+ vehicles

The Situation

With a commitment to payment security and customer convenience, the Convention Center wanted to leverage multiple payment methods while ensuring customer payments were protected at all points. In addition, they wanted to reduce PCI DSS scope to ease compliance efforts and costs.

Objectives:

Accept payments securely in a variety of ways
Integrate with existing software systems, including Ungerboeck conference management software
Use solutions that may help reduce PCI DSS Scope

Client Snapshot

Client
Convention Center located in a major metropolitan area

Challenges

Accept payments online, onsite, and via mobile device
Address PCI DSS compliance
Required an API to integrate with existing software

Solutions

TC Vault® Virtual Terminal
TC Trustee® API
PayWithIt® Mobile Application

Results

PCI compliance was made easier
Cost savings because client was able to use existing hardware and software.
Payment data is protected using Point-to-Point Encryption (P2PE).

The Solution

In order to meet the needs of the Convention Center, TrustCommerce implemented multiple products and features that are standard with a TrustCommerce account.

Convention Services
Convention Services take payments both onsite and online. Online payments are received from customers prior to an event to purchase booth space as well as convention services. The Convention Center utilizes Ungerboeck Exhibition Management Software integrated with TrustCommerce’s TC Trustee® API to securely pass payment information for processing. TC Trustee API is an embedded API with Direct Post solution, often called transparent redirect.

From the Ungerboeck interface, exhibitors make their selections. Using TC Trustee API for payment entry during checkout, the Convention Center is able to accept online payments securely because the card holder data posts directly to TrustCommerce at the point of entry. This method ensures a seamless customer experience while keeping sensitive payment information out of their environment. Because sensitive payment data does not enter their systems, they are able to reduce PCI DSS scope and liability.

In addition to online payments, our client uses PayWithIt®, mobile payment app, to accept payments onsite securely using an encrypted mobile reader. For example, if an exhibitor has reserved exhibit space, but has not paid for it online, our client can walk the show floor and collect payment by swiping the credit card using an encrypted card swipe attached to their mobile device.

Parking
For their parking structure and lots, the Convention Center accepts payments via the TC Vault® Virtual Terminal using encrypting card swipe devices. By encrypting credit card data at the point of entry, the Convention Center protects customer information from the initial card swipe, while in transit, all the way through to settlement. They also use the PayWithIt mobile app with encrypted mobile magstripe reader for parking payments. It features the same robust security as TC Vault, with the convenience of mobile.

User Management
With employees at different levels of the organization and different departments taking payments, our client leverages the roles and permissions within the TC Vault Virtual Terminal to define specific access control levels to individual users. For example, the Convention Center can define full, limited, or no access for credit card processing and reporting functions.

Because sensitive payment data does not enter their systems, the Convention Center is able to reduce PCI DSS scope and liability.

The Results

Our client was able to achieve their goal of reducing PCI DSS scope with each of its preferred payment acceptance methods. Utilizing TC Vault Virtual Terminal with encrypted devices for face to face payments, TC Trustee API for online payments, and PayWithIt for mobile payments makes our client more secure.

TrustCommerce supports a wide variety of hardware and software. This resulted in a significant cost savings for the Convention Center as they were able to utilize existing equipment as well as work with existing software partners and banking relationships. This also saved development time.

Accepting payments in a variety of ways—online, face-to-face, and mobile—has increased their flexibility in how payments are taken adding customer convenience and improving on-time payments.