Mr. Lowe

Revenue Management

How to Connect to a Credit Card Processor

By Bob Lowe, Vice President of POS Intergrations, Heartland Payment Systems

Of course every hotel needs to accept credit cards as a payment method, and to do that you need a credit card processor. As you select a processor, you should look at what they can do for you and how you will connect to them, because not all are created equal, and the choice you make could have a far- reaching impact. First, will you connect directly to them or connect through a switch, gateway or other intermediary? You may be constrained by the choices your property management system (PMS) or even your hotel brand offers, but it's good to explore those choices and make the decision that works best for you.

Your processor handles the authorization and settlement requests a hotel forwards and importantly provides the funding each day for guests using a credit card. The processor then incurs a cost from the card networks for the services they provide. These costs are defined by each card brand in their interchange price table. Interchange varies based on the type of card and the merchant classification and increases if the transaction does not fully comply with card regulations. Processors deduct fees to cover these costs from the amount forwarded to the merchant based on their own fee schedule or - like Heartland - provides transparency by simply charging the interchange plus a small margin, usually expressed in some number of basis points (bps) - one-tenth of one percent of the value of the transaction.

This style of billing is referred to as "interchange plus" and will provide you, the merchant, with an easy-to-understand and cost-effective program. The processor also may have other programs such as gift card, loyalty programs, lending programs, point of sale (POS) and payroll services that allow you to get multiple services from a single vendor.

Traditionally, a hotel PMS has connected to a gateway that then connects to a processor. Why does the PMS not simply connect directly to the processor? In the early days of integrated payments, the integration tools that processors offered were complex, and developers of a POS/PMS had limited understanding of the payments space, so writing to a gateway was an easy choice. The POS/PMS developer could write one interface to a gateway and enable a collection of processors. Similarly, the processors didn't have the market reach, bandwidth or integration products that allowed them to integrate with a POS/PMS, when they may only have a few customers wanting an integrated solution. The PMS to gateway to processor model made a lot of sense for everyone. Today's market is different in many ways.

First, many processors have invested in tools that make direct integration from a POS/PMS a lot easier for the developer than it used to be. For example, Heartland not only provides an Application Programmers Interface (API) - a specification the developer can use to create an integration - but also provides a Software Development Kit (SDK) that contains ready-built software class libraries that developers can include in their code as ready-made solutions. Also, with the current trend toward EMV, Heartland has a range of EMV payment devices from PAX and Ingenico that simplify development using a semi-integrated approach where devices accept a business request for an authorization or sale, gather the card information from the customer and communicate directly with the processor. These semi-integrated solutions don't require intermediary software to be installed in the hotel.

Next, the way hotels operate is much different from other industries. Early PMSs existed on a private hotel network - because the internet didn't yet exist. If you had an electronic connection to a central reservation system, it was over a private line, credit cards were manually swiped with a knuckle buster, and breaches really didn't occur. Today, 15 years after Visa launched its Cardholder Information Security Program (CISP), which later evolved into the Payment Card Industry Data Security Standard (PCI DSS), hotels are still suffering from credit card breaches and attacks seem to be increasing. So what makes hotels so vulnerable to data breaches?

The challenge for hotels is that, unlike restaurants and retail stores - where the existence of card data in the POS is short lived - hotels keep the card on file for days, months or even years. Card data flows into a hotel with electronic reservations or is manually keyed when taking phone bookings. It's used as a guarantee if the guest no shows or cancels, and it's sometimes used at arrival so the guest doesn't need to come to the front desk and check-in. The card is held until check out to handle incidental folios or late charges.

Finally, to make the next booking event easier, it's often kept on file as part of the guest profile. While the PCI DSS standard allows this extended use, it does so only if the data is obfuscated. But if that obfuscation can be reversed, such as in the case of encryption, the loss of obfuscated data is also seen as a breach. To make matters worse, when card data arrives at the PMS, it's often in clear text until a software process obfuscates it. It's this clear card data moving through memory on the way to being secured that is often the target of malware, and the way a breach occurs.

To tackle this concern, PMS vendors need to take a different approach to handling card data. They need to do more than securely integrate with a processor or gateway, and they need to make sure card data never enters the hotel's computer systems. Card data needs only to be allowed to exist within a specialized hardware device such as an EMV terminal, and electronic reservations need to be stripped of card data before that reservation enters the hotel's network. PMS vendors have held back from doing this mostly because it's a lot of work, it involves cost to the hotels and the choices of partners who could help were limited. Even if they found a partner who could help, most partners could only tackle some of the problem.

Processors are now beginning to understand the hotel industry's special needs and offer comprehensive end-to-end or point-to-point encryption capabilities to protect data in transit, as well as tokenization strategies to protect card data at rest in the hotel environment. Some even offer solutions for securing electronic reservations. Heartland partners with leading-edge technology companies to combine their processing solution with state-of-the-art security tools to deliver a fully secure solution to hotels.

With these streamlined integration options, more PMS developers are incorporating direct connects to processors. This is important because industries such as retail and restaurant have already focused in on the cost-saving potential that direct-to-processor integrations can provide. For example, quick service restaurants that do a high volume of low-ticket price transactions don't want to add cents per transaction to connect to their processor. They realize that it's an expenditure that doesn't increase the customer's perceived value of their product, so it's better to either take that cost as profit or spend it on something that attracts more business. The same thing is true in the retail space - high-volume, low-margin transactions makes processor direct connects an imperative. Businesses that do lower volume, higher ticket price also see the savings that a direct connect provides and often follow suit.

Cost is not the only criteria. One of the challenges the payment industry faces is the time to bring new technology to the market. When a card brand decides to offer a new feature in the U.S. payment space or simply offers a technology in the U.S. that is in use in other geographies, the adoption rate is constrained by the complexity of the supply chain. For a new payment feature to really have market value, it has to be adopted by all processors, gateways and middleware products as well as all POS/PMS providers. Plus, of course, the issuers and card brands must adopt it, too.

The complexity of the payment chain generates a lot of resistance that needs to be overcome before card holders see the benefit. A good example in the hotel space is the number of U.S. hotels that now accept EMV chip cards. Card brands are not the only developers of new technology. Processors also offer enhanced functionality, and these enhancements need to be adopted downstream as well. The result can be that participants at each level in the supply chain only support the common feature set of all the participants at the next level up. Or, said differently, change occurs at the pace of the slowest participant. Shortening the supply chain may allow a merchant to enjoy a wider range of new options, such as Apple Pay.

Having looked at cost, functionality, length of supply chain and what is supported by your PMS provider, you may decide that connecting to your choice of processor through a gateway, switch or other intermediary is the right choice for you. The hotel chain you belong to may have used the features of a switch or gateway to enable them to achieve their global PCI compliance, or perhaps the mix of products you have in your hotel is not supported by direct processor integrations. There is no right answer for everyone, but it certainly makes sense to understand the options that are available to you and make the decision that is best for your business. Discuss with your PMS provider what options are available and whether they have a direct processor connection. You may be surprised at what choices you have!

Bob Lowe has been in the software space for more than 30 years. He is currently vice president of POS Integration with Heartland Payment Systems (now part of Global Payments) and lives in Northern California. Initially working in development and product management, he has held senior roles with hotel software providers. He has been involved in CRS, property management, point-of-sale and spa, golf and event management systems that were sold globally. He oversaw the integration of merchant systems to credit card gateways, switches and processors is many parts of the world, and implemented strategies to address the card security standards beginning with CISP, PABP that led to the formation of the PCI Council and the establishment of PCI DSS. Mr. Lowe can be contacted at 530-274-2329 or Robert.Lowe@e-hps.com Please visit https://www.heartlandpaymentsystems.com for more information. Extended Bio...

HotelExecutive.com retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by HotelExecutive.com.

Receive our daily newsletter with the latest breaking news and hotel management best practices.
Hotel Business Review on Facebook
General Search:

OCTOBER: Revenue Management: Technology and Big Data

Gary Isenberg

Hotel room night inventory is the hotel industry’s most precious commodity. Hotel revenue management has evolved into a complex and fragmented process. Today’s onsite revenue manager is influenced greatly by four competing forces, each armed with their own set of revenue goals and objectives -- as if there are virtually four individual revenue managers, each with its own distinct interests. So many divergent purposes oftentimes leading to conflicts that, if left unchecked, can significantly damper hotel revenues and profits. READ MORE

Jon Higbie

For years, hotels have housed their Revenue Management systems on their premises. This was possible because data sets were huge but manageable, and required large but not overwhelming amounts of computing power. However, these on-premise systems are a thing of the past. In the era of Big Data, the cost of building and maintaining an extensive computing infrastructure is incredibly expensive. The solution – cloud computing. The cloud allows hotels to create innovative Revenue Management applications that deliver revenue uplift and customized guest experiences. Without the cloud, hotels risk remaining handcuffed to their current Revenue Management solutions – and falling behind competitors. READ MORE

Jenna Smith

You do not have to be a hospitality professional to recognize the influx and impact of new technologies in the hotel industry. Guests are becoming familiar with using virtual room keys on their smartphones to check in, and online resources like review sites and online travel agencies (OTAs) continue to shape the way consumers make decisions and book rooms. Behind the scenes, sales and marketing professionals are using new tools to communicate with guests, enhance operational efficiencies, and improve service by addressing guests’ needs and solving problems quickly and with a minimum of disruption. READ MORE

Yatish Nathraj

Technology is becoming an ever more growing part of the hospitality industry and it has helped us increase efficiency for guest check-inn, simplified the night audit process and now has the opportunity to increase our revenue production. These systems need hands on calibration to ensure they are optimized for your operations. As a manager you need to understand how these systems work and what kind of return on investment your business is getting. Although some of these systems maybe mistaken as a “set it and forget it” product, these highly sophisticated tools need local expert like you and your team to analysis the data it gives you and input new data requirements. READ MORE

Coming Up In The November Online Hotel Business Review

Feature Focus
Architecture & Design: Authentic, Interactive and Immersive
If there is one dominant trend in the field of hotel architecture and design, it’s that travelers are demanding authentic, immersive and interactive experiences. This is especially true for Millennials but Baby Boomers are seeking out meaningful experiences as well. As a result, the development of immersive travel experiences - winery resorts, culinary resorts, resorts geared toward specific sports enthusiasts - will continue to expand. Another kind of immersive experience is an urban resort – one that provides all the elements you'd expect in a luxury resort, but urbanized. The urban resort hotel is designed as a staging area where the city itself provides all the amenities, and the hotel functions as a kind of sophisticated concierge service. Another trend is a re-thinking of the hotel lobby, which has evolved into an active social hub with flexible spaces for work and play, featuring cafe?s, bars, libraries, computer stations, game rooms, and more. The goal is to make this area as interactive as possible and to bring people together, making the space less of a traditional hotel lobby and more of a contemporary gathering place. This emphasis on the lobby has also had an associated effect on the size of hotel rooms – they are getting smaller. Since most activities are designed to take place in the lobby, there is less time spent in rooms which justifies their smaller design. Finally, the wellness and ecology movements are also having a major impact on design. The industry is actively adopting standards so that new structures are not only environmentally sustainable, but also promote optimum health and well- being for the travelers who will inhabit them. These are a few of the current trends in the fields of hotel architecture and design that will be examined in the November issue of the Hotel Business Review.