Hang Seng Bank Ltd.

Notes on Collection through Credit Card with service provided by Hang Seng Bank Ltd.

The University has signed agreement with Hang Seng Bank Ltd. (HSB) to provide credit card collection service via mail order and terminals for University to receive payments using VISA , Mastercard and China UnionPay Card.

• Credit Card Collection Services
• Commission fee charged by HSB
• Procedure for applying to use HSB Credit Card Collection Service
• Important notes on processing of credit card transactions
• Important notes on Credit Card Primary Account Number (PAN) Storage and Truncation Policy
• Enquiries

Credit Card Collection Services

The HSB Credit Card Collection Service facilitates the following credit card payment collection methods:

1. Mail Order Service (Mail Order)

   It is a payment collection tool for departments to collect VISA and Mastercard payment whereby customers provide their credit card information to departments. Departments then submit customers’ credit card information by completing the word-format file of ‘Mail Order Authorization Code Request Form’, encrypting the file and sending it to HSB by email to obtain the authorization code for collection. Departments using this collection method will be subject to the risk of handling customers’ confidential credit card information as the customers provide their credit card information to departments directly.

2. Electronic Data Capture (EDC) terminal

   It is a payment collection tool for departments to collect payments using VISA, Mastercard and China UnionPay Card when the cardholder is present at the site of the function held by placing the credit card on the card reader of terminal installed.

Commission fee charged by HSB

Procedure for applying to use HSB Credit Card Collection Service

Any interested party can obtain the credit card operating accounts upon written application to Investment and Treasury Unit (ITU). Necessary information regarding the type of receipts and duration of function should be attached with the application. Upon receiving properly authorized written application from Department, a merchant number will be assigned to Department which should observe the following procedures:

1. Procedures in handling collection of income by mail order
   1. A registration / booking form for collecting payment is sent by Department to customers who will be required to fill in their credit card information including:
      • Name of customer
      • Name of the Credit Cardholder (same as name printed on the credit card)
      • Credit Card Number
      • Card Expiry Date
      • Amount (in HKD)
      • Signature of Cardholder
   2. After collecting the returned forms from customers, Department should complete the word-format file of “Mail Order Authorization Code Request Form“.

   3. Once the word-format file of “Mail Order Authorization Code Request Form” is completed by Department, the file should be encrypted and sent to HSB by email to obtain the authorization code for collection.

      Special attention has to be paid to the “Important Notes To Merchants” as stated on the “Mail Order Authorization Code Request Form”:

      • Please quote the merchant number assigned to your Department.
      • For Merchant Reference Number, please follow the format XXXX-001 with the last 3 digits being the sequence number of your forms. Such sequence number is important to ensure that there is no missing of your records during transit to the bank. The first 4 characters can be set for identification purpose, e.g., cost centre number.
   4. In case of foreign currency, please convert to Hong Kong Dollar equivalent amount before filling in the word-format file of the form, e.g., US$1=HK$7.80. Please note amount in foreign currency is not accepted by bank.
2. Procedures in handling collection by the Electronic Data Capture (EDC) Terminal
   1. Key in the transaction amount;
   2. Place the credit card on the card reader of the terminal;
   3. Wait for the print out and present it to the cardholder for signature;
   4. Ensure that the signature on the sales slip matched with that on the signature panel of the card;
   5. Return the card and the cardholder copy (yellow copy) of the sales slip to the customer together with the sales invoice of the purchase. Official receipt can be printed by inputting the transaction in the Income Collection and Receipt Issuance System (IRIS);
   6. Retain the Bank / Merchant Copy (white copy) for record; and
   7. At end of each business day, print the settlement slip for all the transactions made during that day. If Department does not print the settlement slip for the transactions made during the day, HSB will not receive the signal to claim payment from credit card holders’ bank and Department will not be able to receive any money related to the transactions.

Important notes on processing of credit card transactions

1. For collection by mail order, after obtaining the authorization code from HSB, Departments should send properly authorized receipt voucher generated from RVII in CUSAP or summary report generated from Income Collection and Receipt Issuance System (IRIS) along with the return copy of the “Mail Order Authorization Code Request Form” from HSB with authorization code and the daily advice downloaded from HSB website to the Finance Office for fund checking and income posting. The original registration form should be kept properly by the Departments for handling subsequent queries from bank / credit card holders.

   Departments should process the card payment as soon as possible because the card expiry date will affect the collection, especially for those credit cards with expiry date within three months. The daily advice downloaded from HSB has to be printed within 7 days as the daily advice will be deleted by HSB system.

2. For collection by the EDC Terminal, Department should keep the sales slips. Only the settlement slips are required to be attached to properly authorized receipt voucher generated from RVII in CUSAP or IRIS bank-in summary report and send to the Finance Office for fund checking and income posting.

Important notes on Credit Card Primary Account Number (PAN) Storage and Truncation Policy

In order to reduce the risk of credit card data breach and the unnecessary storage of full card PAN information that lead to incidents of data compromise, theft or unintended disclosure during disposal, the following principles must be followed by all colleagues of departments who handle the acceptance of credit card as a form of payment for product and service.

1. For Mail Order

   Once the “Mail Order Authorization Code Request Form” has been prepared by Department and the encrypted file has been sent to HSB by email to obtain the authorization code for collection, Department is required to keep the form and the file in a safe place. When Department sends the properly authorized receipt voucher or IRIS bank-in summary report to Finance Office for fund checking and income posting, Department should attach copy of the form with authorization code where the PAN on the form should be blocked with last four digits of the PAN shown, e.g., XXXX XXXX XXXX 6789 for the PAN and XXX X for the expiration date.

   For the original registration form, Department has to redact all but the last four digits of the PAN by blocking them out with a marker, after the documents containing the full PAN have been retained for 90 days, which is typically when chargebacks or disputes occur.

   All documentations that contain credit card information including the original registration form and the “Mail Order Authorization Request Form” should be stored in a secure area, e.g., a locked file cabinet, and access to these files should be restricted to designated staff only. The files should be securely destroyed after a retention period of 2 years.

2. For Electronic Data Capture (EDC) terminal

   All credit card data are encrypted through EDC terminal collection and when displayed, the card number is masked to show only the last 4 digits, e.g., XXXX XXXX XXXX 6789.

   The merchant receipts should be stored in a secure area and securely destroyed after a retention period of 2 years.

Enquiries

For any enquiries, please contact Ms. Yuki Lam at 3943-7186 or Ms. Kitty Lau at 3943-1939 of Investment and Treasury Unit.