level 3 or 4?

[mjpor]

Sorry if this comes off as being a newbie question… I am, I admit.

My organization processes about 50K credit card transaction (aggregate of visa and MC ) in a year and looks like we fall under level 3. BUT, we don’t process payment ot POS. Instead, we take orders from our customers (via phone, fax or via our website) and subsequently bill them after orders are shipped out. We process credit card payments via skipjack (they are PCI compliant). Customers send us their credit card info by phone and we store their cc data in a secured area.

By the number of transactions, looks like we are level 3 BUT then, I don’t think these are considered E-commerce transaction, hence we qualify as level 4?

Thanks much for your help. I am glad to have stumbled upon this forum.

[bhuebner]

Ultimately, it is up to your acquiring bank to define your merchant level. You can dispute the level assignment with your acquiring bank, provided you have justification.

With the new SAQ D, which is sounds like you fall into, quarterly scans are required and should be submitted with the SAQ.