I'm a new business that conducts online auctions for estate sales. When searching for software to use, I had no idea about PCI Compliance. My merchant account told me it was easy. It would be if the developer of the software had created a hosted form from my site to my payment gateway.
Because they didn't, I was required to have an AVS scan which failed. The software developer (who is different than the company that owns the software) told me PCI Compliance was baloney and that he has an SSL certificate so everything is encrypted and fine. He said he has only heard of PCI compliance a few times after building 700 websites and no one has been able to tell him what to change to be compliant. The owners of the software also claimed to have never heard of PCI compliance as well - they use the software and so do about 6-7 other independent businesses who have never had their merchant accounts ask about PCI Compliance (supposedly). I have ended my relationship with this company.
I am now in the process of trying out software from a different company that both owns the software and hires the developers. They claim to have a PCI Compliant environment, but they also don't use a hosted form - they use APIs to send over the info to the gateway, which likely means I will need to scan every 90 days. I'm not concerned about inconvenience, what does concern me is the safety and security of my customers and my liability.
It seems I am completely on the hook for PCI Compliance, including the fines and costs to replace cards, etc., but the developers/software companies have no skin in the game and have nothing to lose and no incentive to change to a hosted form to make PCI Compliance reasonable for merchants who don't want to or can't afford to create their own software. Is this normal? Can someone tell me why PCI Compliance is on the merchant only? I'm ready to shut down my business because it seems I am the only one holding the bag when it comes to compliance, yet I have no control over the software except for my choice to use it. I won't sleep at night unless I know I am doing the best I can to keep my customer's data as secure as possible. Can anyone provide insight or advice here? Or is this specific to my particular industry?