Mr. Lowe

Revenue Management

How to Connect to a Credit Card Processor

By Bob Lowe, Vice President of POS Intergrations, Heartland Payment Systems

Of course every hotel needs to accept credit cards as a payment method, and to do that you need a credit card processor. As you select a processor, you should look at what they can do for you and how you will connect to them, because not all are created equal, and the choice you make could have a far- reaching impact. First, will you connect directly to them or connect through a switch, gateway or other intermediary? You may be constrained by the choices your property management system (PMS) or even your hotel brand offers, but it's good to explore those choices and make the decision that works best for you.

Your processor handles the authorization and settlement requests a hotel forwards and importantly provides the funding each day for guests using a credit card. The processor then incurs a cost from the card networks for the services they provide. These costs are defined by each card brand in their interchange price table. Interchange varies based on the type of card and the merchant classification and increases if the transaction does not fully comply with card regulations. Processors deduct fees to cover these costs from the amount forwarded to the merchant based on their own fee schedule or - like Heartland - provides transparency by simply charging the interchange plus a small margin, usually expressed in some number of basis points (bps) - one-tenth of one percent of the value of the transaction.

This style of billing is referred to as "interchange plus" and will provide you, the merchant, with an easy-to-understand and cost-effective program. The processor also may have other programs such as gift card, loyalty programs, lending programs, point of sale (POS) and payroll services that allow you to get multiple services from a single vendor.

Traditionally, a hotel PMS has connected to a gateway that then connects to a processor. Why does the PMS not simply connect directly to the processor? In the early days of integrated payments, the integration tools that processors offered were complex, and developers of a POS/PMS had limited understanding of the payments space, so writing to a gateway was an easy choice. The POS/PMS developer could write one interface to a gateway and enable a collection of processors. Similarly, the processors didn't have the market reach, bandwidth or integration products that allowed them to integrate with a POS/PMS, when they may only have a few customers wanting an integrated solution. The PMS to gateway to processor model made a lot of sense for everyone. Today's market is different in many ways.

First, many processors have invested in tools that make direct integration from a POS/PMS a lot easier for the developer than it used to be. For example, Heartland not only provides an Application Programmers Interface (API) - a specification the developer can use to create an integration - but also provides a Software Development Kit (SDK) that contains ready-built software class libraries that developers can include in their code as ready-made solutions. Also, with the current trend toward EMV, Heartland has a range of EMV payment devices from PAX and Ingenico that simplify development using a semi-integrated approach where devices accept a business request for an authorization or sale, gather the card information from the customer and communicate directly with the processor. These semi-integrated solutions don't require intermediary software to be installed in the hotel.

Next, the way hotels operate is much different from other industries. Early PMSs existed on a private hotel network - because the internet didn't yet exist. If you had an electronic connection to a central reservation system, it was over a private line, credit cards were manually swiped with a knuckle buster, and breaches really didn't occur. Today, 15 years after Visa launched its Cardholder Information Security Program (CISP), which later evolved into the Payment Card Industry Data Security Standard (PCI DSS), hotels are still suffering from credit card breaches and attacks seem to be increasing. So what makes hotels so vulnerable to data breaches?

The challenge for hotels is that, unlike restaurants and retail stores - where the existence of card data in the POS is short lived - hotels keep the card on file for days, months or even years. Card data flows into a hotel with electronic reservations or is manually keyed when taking phone bookings. It's used as a guarantee if the guest no shows or cancels, and it's sometimes used at arrival so the guest doesn't need to come to the front desk and check-in. The card is held until check out to handle incidental folios or late charges.

Finally, to make the next booking event easier, it's often kept on file as part of the guest profile. While the PCI DSS standard allows this extended use, it does so only if the data is obfuscated. But if that obfuscation can be reversed, such as in the case of encryption, the loss of obfuscated data is also seen as a breach. To make matters worse, when card data arrives at the PMS, it's often in clear text until a software process obfuscates it. It's this clear card data moving through memory on the way to being secured that is often the target of malware, and the way a breach occurs.

To tackle this concern, PMS vendors need to take a different approach to handling card data. They need to do more than securely integrate with a processor or gateway, and they need to make sure card data never enters the hotel's computer systems. Card data needs only to be allowed to exist within a specialized hardware device such as an EMV terminal, and electronic reservations need to be stripped of card data before that reservation enters the hotel's network. PMS vendors have held back from doing this mostly because it's a lot of work, it involves cost to the hotels and the choices of partners who could help were limited. Even if they found a partner who could help, most partners could only tackle some of the problem.

Processors are now beginning to understand the hotel industry's special needs and offer comprehensive end-to-end or point-to-point encryption capabilities to protect data in transit, as well as tokenization strategies to protect card data at rest in the hotel environment. Some even offer solutions for securing electronic reservations. Heartland partners with leading-edge technology companies to combine their processing solution with state-of-the-art security tools to deliver a fully secure solution to hotels.

With these streamlined integration options, more PMS developers are incorporating direct connects to processors. This is important because industries such as retail and restaurant have already focused in on the cost-saving potential that direct-to-processor integrations can provide. For example, quick service restaurants that do a high volume of low-ticket price transactions don't want to add cents per transaction to connect to their processor. They realize that it's an expenditure that doesn't increase the customer's perceived value of their product, so it's better to either take that cost as profit or spend it on something that attracts more business. The same thing is true in the retail space - high-volume, low-margin transactions makes processor direct connects an imperative. Businesses that do lower volume, higher ticket price also see the savings that a direct connect provides and often follow suit.

Cost is not the only criteria. One of the challenges the payment industry faces is the time to bring new technology to the market. When a card brand decides to offer a new feature in the U.S. payment space or simply offers a technology in the U.S. that is in use in other geographies, the adoption rate is constrained by the complexity of the supply chain. For a new payment feature to really have market value, it has to be adopted by all processors, gateways and middleware products as well as all POS/PMS providers. Plus, of course, the issuers and card brands must adopt it, too.

The complexity of the payment chain generates a lot of resistance that needs to be overcome before card holders see the benefit. A good example in the hotel space is the number of U.S. hotels that now accept EMV chip cards. Card brands are not the only developers of new technology. Processors also offer enhanced functionality, and these enhancements need to be adopted downstream as well. The result can be that participants at each level in the supply chain only support the common feature set of all the participants at the next level up. Or, said differently, change occurs at the pace of the slowest participant. Shortening the supply chain may allow a merchant to enjoy a wider range of new options, such as Apple Pay.

Having looked at cost, functionality, length of supply chain and what is supported by your PMS provider, you may decide that connecting to your choice of processor through a gateway, switch or other intermediary is the right choice for you. The hotel chain you belong to may have used the features of a switch or gateway to enable them to achieve their global PCI compliance, or perhaps the mix of products you have in your hotel is not supported by direct processor integrations. There is no right answer for everyone, but it certainly makes sense to understand the options that are available to you and make the decision that is best for your business. Discuss with your PMS provider what options are available and whether they have a direct processor connection. You may be surprised at what choices you have!

Bob Lowe has been in the software space for more than 30 years. He is currently vice president of POS Integration with Heartland Payment Systems (now part of Global Payments) and lives in Northern California. Initially working in development and product management, he has held senior roles with hotel software providers. He has been involved in CRS, property management, point-of-sale and spa, golf and event management systems that were sold globally. He oversaw the integration of merchant systems to credit card gateways, switches and processors is many parts of the world, and implemented strategies to address the card security standards beginning with CISP, PABP that led to the formation of the PCI Council and the establishment of PCI DSS. Mr. Lowe can be contacted at 530-274-2329 or Please visit for more information. Extended Bio... retains the copyright to the articles published in the Hotel Business Review. Articles cannot be republished without prior written consent by

Receive our daily newsletter with the latest breaking news and hotel management best practices.
Hotel Business Review on Facebook
General Search:

AUGUST: Food & Beverage: Multiplicity and Diversity are Key

Paul Hancock

Vegetables are no longer served as garnishes or accompaniments but, center stage in the dining scene in this day. Plate design and bold flavors are more paramount than ever. The “wow” effect is in full effect. Guests are more eager to try something new more than ever before. It is entertainment, so it has to be great and throughout the dining experience. There is a cultural shift happening right in front of our eyes with vegetables. Vegetables have been the unsung heroes of the plate for many decades. That is changing. READ MORE

Robert  Hood

What does a restaurant look like in 2017? To define what a restaurant is is a difficult process and not an easy thing to do considering that foodservice has evolved so much and comes in so many shapes and sizes. In 2017 restaurants are not even defined for having chairs or tables for diners or even want diners to stay after the point of food purchase and the sale is completed. This is the world of the ‘QSR’ or ‘Quick Service Restaurant’ and since it arrived it has changed restaurant culture, our food service experiences on an almost daily basis, and begs the question ‘is QSR the new fine dining?’ READ MORE

Chris Ferrier

Many hotels are overwhelmed by the thought of putting together a ‘buy local’ or ‘farm-to-table’ culinary program when they also have to serve many guests. Where do you start? Should chefs contact all the local farms, breweries, wineries, fish mongers, meat and poultry farms in their area? Should they visit each farm? Many years ago, this was what we did; but with 1,200 meals to prepare, often we would clear out the farmers’ goods and still not have enough for what we needed. READ MORE

Bobby Martyna

A key trend in hotel development is making the hotel lobby a destination for guests. Where in the past, the focus was primarily on the guest room, moving forward, brands and independents are looking to transform the lobby into a space where guests can socialize, work, snack and dine. In order for the lobby destination to be both compelling and memorable, the retail design, visual merchandising and food selection need to convey what is special about the location and must work together to deliver a surpassing guest experience. READ MORE

Coming Up In The September Online Hotel Business Review

Feature Focus
Hotel Group Meetings: Blue Skies Ahead
After a decade of sacrifice and struggle, it seems that hotels and meeting planners have every reason to be optimistic about the group meeting business going forward. By every industry benchmark and measure, 2017 is shaping up to be a record year, which means more meetings in more locations for more attendees. And though no one in the industry is complaining about this rosy outlook, the strong demand is increasing competition among meeting planners across the board – for the most desirable locations, for the best hotels, for the most creative experiences, for the most talented chefs, and for the best technology available. Because of this robust demand, hotels are in the driver’s seat and they are flexing their collective muscles. Even though over 100,000 new rooms were added last year, hotel rates are expected to rise by a minimum of 4.0%, and they are also charging fees on amenities that were often gratis in the past. In addition, hotels are offering shorter lead times on booking commitments, forcing planners to sign contracts earlier than in past years. Planners are having to work more quickly and to commit farther in advance to secure key properties. Planners are also having to meet increased attendee expectations. They no longer are content with a trade show and a few dinners; they want an experience. Planners need to find ways to create a meaningful experience to ensure that attendees walk away with an impactful memory. This kind of experiential learning can generate a deeper emotional connection, which can ultimately result in increased brand recognition, client retention, and incremental sales. The September Hotel Business Review will examine issues relevant to group business and will report on what some hotels are doing to promote this sector of their operations.