I am looking for best practices regarding the collection of Pre-Authorized Debit (PAD) agreements electronically. The Canadian Payment Association only seems to provide the following statement regarding electronic PAD agreements:
"If the customer provides their authorization electronically, it is your responsibility to verify that the personal and/or banking information set out in that payor's PAD agreement actually belongs to that payor using a commercially reasonable method of verification approved by your sponsoring financial institution."
First of all, does anybody have any insight into what this means exactly. I am waiting to hear back from the bank, but so far first level support at RBC Express doesn't really know.
What would they be looking to be verified exactly, and what would a commercially reasonable method be? Would I need a system for customers to log into, or could I just have a field on the form where they provide their student/account number so we can apply the new payment method to the right account in our record system when we receive the agreement?
The statement doesn't go into details about the security of collecting peoples' sensitive financial information, and I'm wondering if the same security precautions that are required when processing a payment online apply.
At first I was thinking I could simply send a PDF by email which they fill out and return, but obviously this is a bad idea since not everybody's emails are encrypted. I also thought of creating a form on our public website which could be linked to, but don't know if the fact that it's public makes it insecure, even over HTTPS.
I was also wondering if sending a link to a private Google Form would be good enough. Google Forms use HTTPS, so would this be sufficient, especially if the form is not public and only accessible potentially to customers who have received a link to it in the past?
Google warns not to submit passwords through their forms, I believe because they're a popular platform for phishing scams, but they don't warn specifically against the collection/submission of financial information -- maybe this is just implied by the other warning, I don't know.
I realize our bank might be the best source for clarification on some of this, but any experience or insights into this would be greatly appreciated.
PAD Agreement form fields currently required for our written aggreement:
Desired Withdrawal Date (1st or 15th)
Account Number (at our music school)
Student Name (actively taking lessons at our school)
Name of Financial Institution (FI)
- FI Address or Branch Name
FI Account & Transit Numbers
Name(s) of FI Account Holder
- Address(s) of FI Account Holder (street, city, province, postal code)
- Residence Phone #
- Business Phone #
PACC form fields that will be required:
- Account Number (at our music school)
- Student Name (actively taking lessons at our school)
- Card Type (Visa or Mastercard)
- Credit Card No. & Expiry Date
- Cardholder Name & Address (Street, City, Province, Postal Code)
- Home & Work Phone No.'s