Payment security basics for membership sites

Card details are the most valuable thing a criminal can take from a membership business, and the most damaging for you to lose. A leak of card data can mean fraud losses for your members, penalties from payment companies and a blow to trust that is hard to recover from. The good news is that for most membership sites, the safest approach is also the simplest: arrange things so card numbers never touch your own systems at all.

This article covers the practical basics. It is general guidance rather than legal or compliance advice, and the requirements that apply to you depend on how you take payments and where you operate, so confirm the details with your payment processor or a qualified professional.

The golden rule: never let card numbers touch your systems

Modern payment processors let you accept cards without ever seeing the full number. There are two common ways this works:

• Hosted payment pages. At checkout, the member is taken to a secure page run by the processor, then returned to your site once payment is complete.
• Embedded payment fields. The card fields appear on your checkout page but are actually served by the processor, so the numbers go straight to them.

Either way, your site receives a token, a stand-in reference that lets you charge the member again for renewals without ever holding the card number. If your site is ever compromised, there are no card numbers to steal.

What PCI DSS means for you

PCI DSS is the security standard set by the card industry for anyone who accepts card payments. How much of it applies to you depends largely on how you handle card data. A business that uses hosted pages or embedded fields and never stores card numbers usually has a much lighter set of obligations, often confirmed through a short self-assessment questionnaire. Ask your processor which one applies to your setup and complete it.

Where card details sneak in anyway

Even with a perfect checkout, card numbers find their way into places they should not be. Members are trying to be helpful, and staff want to solve problems quickly. Watch for these:

• A member emails their new card number because a payment failed.
• Someone types card details into your contact form or a support chat.
• A staff member takes a payment over the phone and writes the number down.
• A member sends a photo of their card, or a screenshot of a bank statement.

Make it a firm rule that card details are never accepted by email, chat, phone notes or forms. If they arrive anyway, do not use them. Delete the message, including from sent and deleted folders, and point the member to the secure update page. Here is a reply your team can use:

Hi Rosa, thank you for sending your updated details. For your security, we never take card numbers by email, so we have deleted your message and have not used the information. You can update your card safely on your account page under Billing, which takes about a minute. We would also suggest keeping an eye on your statement, just as a precaution.

This comes up most often around failed renewals, so make sure your payment failure emails link straight to the secure update page. The processes in failed payments: the quiet cause of cancellations work better when the update route is obvious.

Lock down your payment processor account

Your processor account is where the money is. Someone who gets into it can issue refunds to themselves, change the bank account your payouts go to or download customer records.

1. Use a unique, long password and require two-factor authentication for everyone with access.
2. Give staff their own logins with limited roles. A support assistant might need to see payments and issue small refunds, but not change payout details.
3. Turn on alerts for changes to bank details, new team members, large refunds and unusual activity.
4. Protect your API keys. These are the secret codes that connect your membership site to your processor. Never paste them into emails or share them with anyone who does not need them, and replace them immediately if they may have been exposed.
5. Remove access promptly when staff or contractors leave.

Watch for fraud and card testing

Criminals sometimes use membership checkouts to test stolen cards, running many small payments to see which ones succeed. Warning signs include bursts of failed payments, many different cards from the same location and a sudden rush of sign-ups at your lowest price. Ask your processor what fraud screening it provides, and use the sign-up protections described in stopping spam sign-ups and bots.

Also watch your chargebacks, where a cardholder disputes a payment with their bank and the money is taken back. A few are normal. A sudden increase can mean stolen cards are being used on your site, and payment companies pay close attention to chargeback levels.

A worked example: a monthly payment security check

Here is a fifteen-minute routine for a hypothetical music lessons membership. Run it once a month:

1. Review the list of people with access to the payment processor and remove anyone who no longer needs it.
2. Confirm the payout bank account is correct.
3. Scan recent refunds for anything you did not expect.
4. Look at failed payments for clusters of small or repeated attempts.
5. Check chargebacks and respond to any open disputes.
6. Search the support inbox for numbers that look like card details and delete any you find.
7. Confirm your checkout is still using the processor’s hosted page or embedded fields and shows the padlock of a secure connection.

Your next steps

1. Confirm with your processor that your checkout never sends card numbers through your own site.
2. Find out which PCI DSS self-assessment applies to you and complete it.
3. Write and share a no-card-numbers-by-email rule with a reply template.
4. Turn on two-factor authentication and alerts in your processor account.
5. Review who has access and what each person can do.
6. Put the monthly check in your calendar.