ParcelForce recoups £1m a year from UK Customs using PCI-com

[TrueBlueTerrier]

ParcelForce recoups £1m a year from UK Customs using PCI-compliant payment system

http://www.computing.co.uk/ctg/analysis ... nt-payment" onclick="window.open(this.href);return false;

Switching to a hosted Payment Card Industry Data Security Standard (PCI-DSS) compliant telephony system has helped international courier ParcelForce recoup £4m in customs charges over the past four years, the company has revealed.

Part of the Royal Mail Group, ParcelForce first started using NewVoiceMedia ContactWorld PCI in 2007 to inform customers that they needed to pay VAT on parcels from overseas and process their payment.


This is something that its call centre agents previously did over the telephone with inconsistent results that left the company vulnerable to breaches of PCI-DSS regulations.

"Ninety per cent [of charges] are for import items where somebody has gone online and brought something from abroad and the UK Customs says ‘that looks valuable' and put a value on the parcel for VAT purposes," said ParcelForce operational support manager Patrick Morgan.

The courier pays the duty to HM Revenue & Customs in advance, and then has to recover the costs from the customer.

"There would be no way to recover that money without this application. The driver turns up at the premises to deliver the parcel but in most cases the customer does not have any cash because they were not aware that customs would charge them," said Morgan.

"So the driver either drives off and arranges to redeliver or in most cases just leaves the parcel and hopes the customer will pay. Sometimes we do not receive any funds, sometimes just a partial fee."

PCI DSS regulations specify that Credit Card Validation Value (CCV2) security details must not be kept post-authorisation, and that full Personal Account Numbers (PANs) should not be kept without additional protection measures.

They also ban any human involvement with the card details, or storing and manual recording of the information that could cause a security breach.

Parcelforce's existing telephony solution was unable to meet these requirements as it had no automated process to take card details, meaning every caller had to speak with an agent to process duty payments.

Now rather than the ParcelForce call centre agent taking credit payment, the call is transferred to NewVoiceMedia's interactive voice recognition (IVR) system to activate the credit card details and expiry data to take the payment. Any problems and the customer is transferred back to the ParcelForce agent.

The system is used by around 150 ParcelForce agents at any one time on average, though that number climbs to 300 in the peak Christmas period.

"Our guys key the value of the charge into the system and send it over to NewVoiceMedia. The customer goes onto the web site and chooses some way of paying and we receive payment from the service provider. None of the actual data is stored at ParcelForce, it is all hosted by NewVoiceMedia," said Morgan.

The IVR system is "fully secured and PCI compatible", said Morgan, and involves the application itself talking to the customer rather than the agent, with the software capturing the credit card details and transmitting them to the WorldPay payment service. Using keypad input for credit card numbers also reduces scope for errors.

"If you use true IVR and customers say their credit card number, 55 per cent accuracy would be a good figure, but we are using dual-tone multi-frequency (DTMF) where customers press one for yes, two for no etc, and key in the credit card numbers from the keys on their phone, so over 90 per cent [accuracy] is achievable," said Morgan.

The link between the hosted NewVoiceMedia system and ParcelForce tracking software is protected by a virtual private network (VPN) and both ParcelForce and NewVoiceMedia are regularly audited for compliance.

"We have to do self audit every 12 months where we check that the agents are not writing details down, not just ParcelForce but across the Royal Mail Group," said Morgan.

"NewVoiceMedia has to be certified every 12 months because it is such a long process."

[axeman]

And the biggest problem is when the declaration is filled in royal fail just charge for the total displayed on the label as we all know there is no duty on postage so by default royal fail is hitting unsuspecting customers with a charge they are not liable for. of course you can claim it back including the handling fee levied if you show the value to be less than level to atract duty or even if it's still liable for duty but at a reduced level ......... if your savvy (extremly drawn out process) but hey it is royal fail did you expect any thing different. and how many customers are out there without that knowledge being fleeced on a daily bassis