The User's Edge : credit cards

News You Can Use: Planning and Preparing for The Raiser’s Edge 7.91 Update

Kevin Brunson — Wed, 23 Sep 2009 15:11:00 GMT

The Raiser’s Edge 7.91 is now available! Before you update, review the following important information and take time to plan, prepare, and inform all users at your organization about the changes in this version. Review Important Information about Version 7.91.

Also review The Raiser’s Edge 7.91 FAQs to view common questions other organizations have asked.

View a Recording of the Support Roundtable Webinar highlighting changes in version 7.91 or download a copy of the Powerpoint presentation.

Preparing for the update
The Raiser’s Edge 7.91 changes the way credit cards are stored in your database. This update removes full credit card numbers from the database and stores them in the Blackbaud Payment Service (BBPS). After the update, you will only see the last 4 digits of the credit card number on constituent and gift records.

Organizations that use IATS or ICVerify to authorize credit cards will continue processing as normal.

Organizations that authorize credit cards by printing or exporting credit card data will be unable to do so. You can create an account with IATS or ICVerify to enable credit card processing in version 7.91, or stay on your current version. If you stay on your current version, contact a Qualified Security Assessor for advice on how to secure your credit card data and authorize credit card transactions in accordance with PCI DSS.

Downloading the Update
When you download The Raiser's Edge 7.91, you are prompted to select whether or not to use BBPS to store credit card information.
• If you choose to use BBPS, you will be prompted to create an account. Make note of the account details; the first user that logs into the updated database will need to enter the account details. After creating the BBPS account, you will be able to download the update.
• If you choose not to use BBPS, you will be able to download The Raiser's Edge 7.91 without creating a BBPS account. For more information, review Knowledgebase solution BB700728.

Installing the Update
Before installing the update, we recommend you back up the database.
The first user to log into The Raiser's Edge is prompted to use BBPS to store credit card data or delete credit card data from the database. This prompt appears only once for the first user who logs into the database.
• If you use BBPS to store credit card numbers, you will receive the prompt: Is this a test conversion? Select Yes only if you are updating the database in a test environment. Your credit card numbers will be temporarily stored in BBPS and deleted after 14 days.
• If this is not a test conversion, click No.
If you do not use BBPS, The Raiser's Edge deletes all credit card data from the database. Your organization will no longer be able to enter, store, process, or transmit credit cards in The Raiser's Edge.
For instructions on downloading and installing this update, please see Knowledgebase solution BB700728.

Changes All Users should know about Before Updating
Password Changes – After you update to 7.91 or higher, you'll have to enter your password using all capital letters (e.g., ADMIN1 instead of admin1). After you log in using all capital letters, we recommend that you change your password by going to Edit, Change Password. If you don't change your password, you'll have to keep using all capital letters to log in." Read more about password changes.

Inactivity Lockout– The 15 minute inactivity setting is another change made in accordance with PCI DSS, which requires users to re-enter passwords when a session has been idle for more than 15 minutes. When someone is locked out due to inactivity, processes like reports, mailings, exports, and queries will continue to run, and the user license will still be used.

Changes in NetSolutions
Organizations that accept Recurring Credit Card donations must update to version 7.91 to continue downloading credit card numbers.
• One-time credit card gifts download into The Raiser’s Edge, but the full credit card number is not stored in BBPS. The credit card number displays as (????????????2468).
• Recurring Credit Card gifts download into The Raiser’s Edge and the full credit card number is stored in BBPS. The number appears as (************2468), which enables you to charge future transactions for the recurring gift.

If you stay on your current version of The Raiser’s Edge, you will no longer download credit card numbers. The credit card number field will be blank in The Raiser’s Edge. This means if you accept Recurring Credit Card donations, you will not be able to charge future transactions because you will not have the credit card number.

If you’ve already updated to 7.91, share your experience by leaving a comment below.

Support Roundtable: The Raiser's Edge 7.91: What You Need to Know Q&A (Part 9)

Douglas Clinton — Fri, 28 Aug 2009 13:27:00 GMT

Here's the last batch of questions generated in the Support Roundtable The Raiser’s Edge 7.91: What you need to know:

Q: Does the password policy enforce a complicated password?
A: Yes. New passwords require a strong, complex password. They must be at least 8 characters, a max of 33 characters, consist of letters and numbers, and must contain at least 1 capital letter. For more information, review BB608912.

Q: Do the features you've highlighted cover the new feature list for 7.91? If not, where can I find a more complete list?
A: Yes, the features covered in the 7.91 Support Roundtable cover all of the new features for 7.91.

Q: I looked in Config in the General tab but don't see where you enter the BBPS information. It just has address info, FY, Immediate destination and Company ID. Am I missing something?
A: In order to see the fields for BBPS information, you must be logged into RE as Supervisor.

Q: Does the use of a Citrix environment complicate the automatic log out process?
A: No.

Q: Passwords - When changing, can you just change one character or #?
A: Yes, but it also depends on what your password was before. Your password must meet the new password requirements, per BB608912.

Q: What is the deadline for the update on our side?
A: The deadline for the update is determined by the credit card companies, your bank, and your processing vendor. Blackbaud is not enforcing a deadline.

Q: If users are set up that they cannot change their settings, does this affect passwords too?
A: No. Changing user options does not impact users changing their own passwords.

Q: I have a recurring batch that contains credit card numbers that I manually process. I currently have these numbers stored in RE. How will I be able to process these after upgrading? Will I have access to the full number?
A: After updating to RE, if you select to use the BBPS, then those credit card numbers will be uploaded to BBPS so you can continue to use and process them from RE. The procedure for processing those cards will not change. You will not be able to see or access the full credit card number, but you will still be able to process those credit cards from your Recurring Batch.

Support Roundtable: The Raiser's Edge 7.91: View a Recording!

Kevin Brunson — Wed, 26 Aug 2009 19:51:00 GMT

If you haven’t been able to attend one of the webinars for The Raiser's Edge 7.91, view a recording of a previous webinar.

You can also download a copy of the PowerPoint presentation; please be sure to share this with other users at your organization.

Support Roundtable: The Raiser's Edge 7.91: What You Need to Know Q&A (Part 8)

Douglas Clinton — Tue, 25 Aug 2009 20:17:00 GMT

Here's the last batch of questions generated in the Support Roundtable The Raiser’s Edge 7.91: What you need to know:

Q: We have been "masking" our own CC numbers on gift records for about a year now, only recording the last 4 digits of the CC. (We don't run CCs from RE.) When these are "masked" with the 7.91 upgrade, will these 4 digits disappear?
A: The 4 digits will appear in RE, but they will not upload to the BBPS. They will appear in RE with question marks preceding the numbers (e.g., ????????????1234).

Q: If we're hosted, do we have to do the download?
A: No, your database will be updated by our OnDemand team, who will schedule the update with you prior.

Q: Can we turn off the lockout feature?
A: No, since this was implemented because of a PCI rule, it is mandatory. For more information, review BB700189.

Q: Will reports still run and complete if locked out of RE?
A: Yes. At the time of the lockout, any processes that were running previously will continue to run while the user is locked out - for this reason, a user license will be used. For more information, review BB700189.

Q: I have already installed 7.91. Attached it to the sample database and said yes for the BBPS. Will credit cards be stored for my sample database now forever, or can we change to the 14 day limit? What kind of problems will this cause?
A: Credit cards from the sample database will be stored in BBPS until they become 60 days expired. The only way to change that is by attaching a new sample database, this time opting not to use the BBPS for it.

Q: The query folders drag and drop capability that you mentioned... is that on the homepage only or are you also referring to the query folders now available on the Query page in version 7.85?
A: The drag and drop feature for Query folders was designed to be used for the Query folders in the Query module only.

Q: Is there an associated upgrade to BBNC? If so, do both upgrades have to happen at the same time?
A: Yes, the version of BBNC that is required to be updated to FIRST before updating to RE 7.91 is BBNC 6.10. We recommend that BBNC be updated first, and then RE be updated immediately afterwards.

Q: If a credit card number is stored on the Pledge gift, will it be saved into the BBPS, and how do we change credit card numbers and expiration dates?
A: Yes, credit card numbers stored on Pledges and Recurring Gifts will be uploaded to BBPS if they are less than 60 days expired. In order to change credit card numbers and expiration dates, either type over what already exists, or delete the number you will no longer be using and type in the correct values.

Q: NetSolutions: you mentioned we have to go to 7.91 to continue to download credit cards from there. We plan to install/upgrade to 7.91 - is there a "have to upgrade date" for 7.91 to continue to use NetSolutions?
A: There is no specific date set by Blackbaud or The Raiser's Edge by which you need to update to 7.91. NetSolutions has already been updated, so currently if you have not updated to 7.91 you will not be able to download full credit card numbers into RE from NetSolutions, even for Recurring Gifts and Pledges.

Support Roundtable: The Raiser's Edge 7.91: What You Need to Know Q&A (Part 6)

Douglas Clinton — Thu, 06 Aug 2009 20:40:00 GMT

The Support Roundtable The Raiser’s Edge 7.91: What you need to know has been very popular. More sessions lead to more questions, and more questions lead to more answers, and here is another round of questions and answers.

Q: Once we update, will we be able to see expiration dates for credit cards?
A: Yes. For more information, review Knowledgebase solution BB700778.

Q: Are IATS and ICVerify still the only processors for 7.91?
A: Yes. We are working on incorporating compatibility with other processors, which will hopefully be available later this year or early next year. For more information, review Knowledgebase solution BB143499.

Q: Is there an additional cost associated with BBPS?
A: No, this is included as part of your annual maintenance. For more information, review Knowledgebase solution BB700828.

Q: Is the 15 minutes lock based on activity in RE, or per workstation?
A: It is based on activity within the Raiser's Edge program.

Q: How will the lockout affect Membership scanning?
A: If there is no activity in 15 minutes, then users will be locked out of RE. They will need to log back in if they have not had any RE activity in 15+ minutes and need to scan a membership card (or do anything else in The Raiser's Edge).

Q: What is considered 'activity' in RE? If you are typing a LONG notepad note, is that still registered as activity if it takes 15 minutes to type without saving? Is navingating and saving the records the only activity?
A: 'Activity' in RE includes mouse clicks and/or movements, keyboard strokes, and any other type of movement in The Raiser's Edge. If you are typing in a Notepad in RE, this is considered as 'activity'. If you have RE minimized and have not even looked at it in 30 minutes, then this is considered inactivity and you will be locked out.

Q: Can you explain further what you said about using the F7 key to pull in credit card numbers in a Recurring Batch when we upgrade to 7.91?
A: You can still use the F7 key to retrieve any saved credit cards from the Bio2 tab of constituent records. You will only be able to see the asterisks and the last 4 digits of the credit card numbers.

Q: How would you process credit card returns or reversals?
A: Returns and reversals will continue to be processed outside of Raiser's Edge, through either IATS or ICVerify. The processes for these procedures within those products will not change.

Q: Is there any way to disable the 15-minute time-outs?
A: There is not. This was implemented because of a PCI rule, Rule 8.5.15 states "If a session has been idle for more than 15 minutes, require the user to re-enter the password to reactivate the terminal.". For more information, review Knowledgebase solutions BB700189 and BB618776.

8/5 Forums Roundup

Douglas Clinton — Wed, 05 Aug 2009 14:08:00 GMT

Here are last week's most popular Forums posts as well as unanswered posts:

Most Popular Topics:

Unanswered Posts:

Support Roundtable: The Raiser's Edge 7.91: What You Need to Know Q&A (Part 4)

Douglas Clinton — Thu, 30 Jul 2009 21:45:00 GMT

Here's the last group of questions from last week's session of our Support Roundtable The Raiser’s Edge 7.91: What you need to know. We will post additional questions here as they come up in future sessions.

Q: What happens if a credit card is entered into RE 7.91, then expires. Does it switch to the question mark format?
A: After a credit card has been expired for 60 days, then it will be removed from BBPS and replaced with question marks in RE, instead of asterisks. For more information, review Knowledgebase solution BB618296.

Q: Can we sign up for BBPS prior to updating, or is it done only at the time of updating?
A: You can register for BBPS at any time. The credentials that you register with will need to be noted for use during the actual update, though. At the time of the update, you will be prompted for those credentials, and after being entered, that is when the credit cards from your database are uploaded to BBPS.

Q: If a donor calls and wants us to create a new pledge using existing information in his record, how would we get the credit card token into a batch?
A: If you use BBPS, you can use the same functionality that exists today, by using the F7 button in the batch to retrieve existing credit cards from the constituent's Bio2 tab.

Q: What is the best method to ensure PCI-DSS compliance with other vendors?
A: Contact the vendor to request their Report on Compliance (ROC), or visit the official PCI website.

Q: For my monthly credit card pledge payments, can I set up a recurring batch, or do recurring batches have to be for recurring gifts rather than pledge payments?
A: Recurring Batches can be used for both pledge payments and recurring gift payments.

Q: When will NetCommunity 6.10 be available?
A: BBNC is scheduled to be released before the end of the 3rd Quarter.

Q: What if a user does not change their password right away? Do they need to continue typing in all capitals?
A: Upon first login into RE after the update, each user will need to log into RE with their existing passwords, but in ALL CAPS. After that initial login, we recommend that each user change their password to a strong, complex password (meeting the 8-character requirements). If they do not, then they will need to continue logging into RE with their existing passwords in ALL CAPS. For more information, review Knowledgebase solution BB608912.

Q: When using ICVerify to process credit cards, does it matter whether we process them online or by modem?
A: They will need to be processed online in order to communicate with BBPS.

Q: How long will the character limit for the password be? I know the minimum is 8 characters, what will be the maximum? How many days after will it prompt you to change your password? As a supervisor do you know what the password of your employees will be?
A: There is not a specified maximum character limit for passwords. The number of days until users are prompted to change their passwords is dependent upon what password options have been set in Config > Business Rules > Password options. As a supervisor, you will not be able to view your employees' passwords, but you will be able to change them.

Q: Can you change the question marks to asterisks, and how?
A: In order to do this, you must first have a BBPS account, and you must be successfully connected to BBPS. After obtaining the full credit card number, simply type over the existing credit card number. If your database is connected to the BBPS, the existing credit card number should switch to asterisks if it is a full 16-digit credit card number and hasn't expired.

7/30 Forums Roundup

Douglas Clinton — Thu, 30 Jul 2009 18:26:00 GMT

Here are last week's most popular Forums posts as well as unanswered posts:

Most Popular Topics:

Unanswered Posts:

Support Roundtable: The Raiser's Edge 7.91: What You Need to Know Q&A (Part 3)

Douglas Clinton — Wed, 29 Jul 2009 20:29:00 GMT

Here's the third group of questions from last week's session of our Support Roundtable The Raiser’s Edge 7.91: What you need to know:

Q: If the '?' means that we don't store credit card numbers, where do they go?
A: The credit card number is truncated, meaning that the first 12 digits are removed, and not stored anywhere. Only the last 4 digits will remain.

Q: At what point are the credit card numbers erased in the current version? Our IT does not want to install the new version for a couple of weeks and we normally process our batch on the 10th of the month.
A: In your current version, no credit card numbers will be 'erased'. If you use NetSolutions, the credit card numbers from new Recurring Gifts will not download into Raiser's Edge. If you do not use NetSolutions, no credit cards will be truncated until you update to 7.91.

Q: If a donor provides a replacement card number midway through their pledge schedule, how should this be entered to update the token BBPS is using?
A: You only need to update the existing credit card in RE. You can also delete the existing credit card and add the new credit card.

Q: If we use RE:Anywhere, is there a separate upgrade that needs to happen after upgrading to 7.91? Specifically, is there an RE:Anywhere 7.91 version?
A: Yes, you will need to run the RE:Anywhere 7.91 update separately. For more information, check out Knowledgebase solution BB1647.

Q: How do we make sure credit card numbers are entered into the BBPS so they use the asterisk instead of the question mark?
A: Make sure you have an internet connection on the workstations where credit card numbers will be entered and/or processed, and make sure that Port 443 is open on your Firewall, if applicable. In addition, make sure you enter the full 16 digits of the credit card number.

Q: If we use NetSolutions to process online donations and use our accounting department to process the rest of the donations, do we need to sign up for the BBPS?
A: Yes. BBPS will be necessary for NetSolutions if you accept Recurring Gifts.

Q: Is it required to have people change their passwords, or can we opt to not make that a requirement?
A: It is an option to have users change their passwords. To opt out of this option, you can go to Config > Business Rules > Password options, and unmark the checkbox 'Enable password expiration'.

Q: We record our client's health card numbers in the card field of the Bio2 tab. We mask this so only certain users can see the full number. Does upgrading to 7.91 mean we will no longer have access to these full numbers and we will have to start recording them in attributes?
A: Yes. Since those numbers will be truncated during the 7.91 update, you will no longer see the full number. It is recommended that those numbers begin to be stored in another field (perhaps one that you can apply security to).

Q: After the initial change of the password from all caps, can users keep the same password indefinitely?
A: Upon first login into RE after the update, each user will need to log into RE with their existing passwords, but in ALL CAPS. After that initial login, we recommend that each user change their password to a strong, complex password (meeting the 8-character requirements). If they do not, then they will need to continue logging into RE with their existing passwords in ALL CAPS. When they are prompted to change their passwords depends on the Password options set in Config > Business Rules > Password Options. For more information, check out Knowledgebase solution BB608912.

Q: If the credit card is blanked out during the upgrade, the Payment Type will still be 'Credit Card' and the business rule will still require a valid credit card number to be entered as a result. How will this affect stored gifts?
A: This will not affect stored gifts. To prevent this from happening in the future, set the Business Rule in Config > Business Rules > General > 'When saving a record with invalid credit card information…' to 'Save record anyway'.

Support Roundtable: The Raiser's Edge 7.91: What You Need to Know (Part 2)

Douglas Clinton — Tue, 28 Jul 2009 19:35:00 GMT

Here's the next group of questions from the 7/23 session of our Support Roundtable The Raiser’s Edge 7.91: What you need to know:

Q: We utilize the OnDemand product, but we have not been updated to the newest version. We are going live with BBNC on Aug. 1. Will we be able to take donations and also process recurring gifts before BB updates us?
A: You will not be able to accept new Recurring Gifts, but you can continue to process existing recurring gifts before updating.

Q: Currently I process credit cards using a Hypercom terminal, manually entering each credit card transaction. What should I expect with the new version?
A: You can still process credit cards in the same manner, but we recommend you speak with a Qualified Security Assessor for specific analysis of your procedure.

Q: If I have a credit card number stored in a pledge, will I be able to charge the card for their monthly/quarterly pledge payments? Or do they need to provide the credit card number each time a payment is due? We have an IATS account.
A: If you choose to use the BBPS, then you can use the same card that is stored on the Pledge record. For more information, see Knowledgebase solution BB613095.

Q: We integrate with Patron Edge. How will this affect the credit card transactions in RE?
A: You can continue to process credit cards in RE, provided you select the option to use BBPS.

Q: Will IE8 be supported with 7.91?
A: At this time, IE8 is not supported with 7.91, but we are continuing testing of these 2 products to ensure compatibility at a later date.

Q: Where do we get the ICVerify Security Token from?
A: When you register for the BBPS, at that time you can also have the ICVerify Security Token generated. For more information, see Knowledgebase solution BB700728.

Q: Any issues so far with the general release of 7.91 that we should be aware of?
A: The only issue we have come across has been resolved in the latest patch, patch 4. The issue was processes such as exports, reports, queries, etc. not continuing to process when users are locked out due to inactivity. This has since been resolved. For more information, see Knowledgebase solution BB700427.

Q: If a donor calls and gives me his credit card number, then tells me to charge his credit card $25 every month, am I able to do this, or will I need to obtain the donor's credit card number each month in order to process his gift?
A: This is a Recurring Gift, and, yes, you will be able to accept the donor's credit card for that gift and charge that card $25 each month. You will need to be using BBPS in order to do this. Without BBPS, full credit card numbers are not stored in Raiser's Edge.

Q: If a user has a password that is less than 8 characters, at what point will the user be forced to change his password?
A: Upon first login into RE after the update, each user will need to log into RE with their existing passwords, but in ALL CAPS. After that initial login, we recommend that each user change his password to a strong, complex password (meeting the 8-character requirements). If they do not, then they will need to continue logging into RE with their existing passwords in ALL CAPS. When they are prompted to change their passwords depends on the Password options set in Config > Business Rules > Password Options. For more information, see Knowledgebase solution BB608912.

Q: With our current monthly pledges that are being paid by credit card, will we have to change the gifts to recurring gifts in order to ensure that the credit card will be charged each month?
A: No. If you use the BBPS, you can continue to process these pledge payments the same way that you do currently through RE.

News You Can Use: Important Information for Organizations Who Process Credit Cards by Exporting or Printing Credit Card Numbers from The Raiser's Edge

Kevin Brunson — Tue, 14 Apr 2009 18:38:00 GMT

This applies to organizations that store credit card data in The Raiser’s Edge, and authorize credit card transactions by exporting or printing credit card numbers. If your organization uses IATS or ICVerify to authorize credit cards in the Batch module, or you don't use The Raiser's Edge to store credit cards, these changes do not affect you.

As a result of new credit card regulations covered under PCI, The Raiser’s Edge 7.91, scheduled for release in the second quarter of 2009, will no longer store full credit card numbers. To achieve compliance Blackbaud has removed storage of full credit card numbers from all products, including The Raiser's Edge 7.91.

In The Raiser’s Edge 7.91 full credit card numbers are replaced with reference tokens. These tokens map to the full number stored in the Blackbaud Payment Service (BBPS). Only the last four digits of credit cards will display on constituent and gift records and in the Batch module. Credit card numbers will appear as 12 asterisks followed by the last four digits of the card (i.e. ************7864).

After installing this update, you will no longer be able to view, print or export full credit card numbers, or authorize credit cards by printing or exporting credit card data.

To authorize credit card transactions in The Raiser's Edge, you must create an account with a supported credit card processor. Current supported processors for The Raiser’s Edge are IATS and ICVerify.
• IATS is an online solution that has a direct interface with The Raiser’s Edge. To create an account with IATS or to learn more, please see Knowledgebase solution BB142121.
• ICVerify is a third-party software application that is installed on any workstation you use to authorize credit card transactions. For information on purchasing ICVerify, see Knowledgebase solution BB126. If you use ICVerify you must be on version 4.03 SP2 or higher.

If your organization selects to remain on your current version and continue processing credit cards by exporting or printing credit card numbers, we strongly recommend that you contact a Qualified Security Assessor (QSA). A QSA can advise your organization on how to secure your credit card data and authorize credit card transactions in accordance with PCI.

To learn more about PCI or to take the PCI self-assessment questionnaire, please visit the PCI Security Standards Council's website.

We will continue to provide information about PCI compliance on our PCI compliance page, our PCI Compliance blog, and in our newsletters. Subscribe to the PCI Compliance blog RSS feed to be notified when new posts are made.

For even more information, check out the PCI FAQs. The FAQs are updated as additional information becomes available.

4/8 Forums Roundup

Douglas Clinton — Wed, 08 Apr 2009 17:11:00 GMT

Every day people post questions on our Forums. Sometimes people are looking for help with a specific issue, and other times they might have more general questions about best practices. Here's a list of unanswered posts from the past two weeks:

If you have advice or insight to share, join the discussion today!