PCI DSS Security Awareness Training for Front Office Staff
Seven short modules for the people who take card payments: at the counter, over the phone and from mailed order forms. Each module ends with a short assessment, and every page can be listened to as well as read.
- 7
- Modules
- 15
- Minutes per module, about
- 4
- Questions per assessment
- 12
- Months the certificate is valid
Who it is for
Staff who handle EFTPOS terminals, take card-present payments, and take phone and mail orders: counter staff, receptionists, cashiers and anyone who covers the counter. PCI DSS v4.0.1 asks that they receive security awareness training when they start and at least once every twelve months.
It is not a course for IT staff, developers or assessors. Networks, encryption, system configuration and the wider PCI DSS requirements are out of scope; what is in scope is what a person at the counter can see, touch and be asked for.
The seven modules
1. The card and what you may touch
What is on a payment card, which parts you may handle, and the two things you must never write down or keep
2. Your terminal and how to check it
Knowing your EFTPOS terminals, checking them for tampering, and who is allowed to touch them
3. Taking a payment at the counter
Card-present payments done safely, from the customer's hand to the terminal and back
4. Phone and mail orders (card-not-present)
Taking card details by phone or from a mailed form without keeping anything you should not
5. Receipts, refunds and paper
What a receipt may show, where the merchant copy goes, and how refunds are done without card data changing hands
6. People who want your terminal or your login
Recognising the person at the counter, on the phone or in your inbox who is after your terminal, your login or your customers' cards
7. When something is wrong
What counts as an incident at the front office, and the five steps that keep it small
How it works
- Each module is a handful of pages with a worked situation and practice questions, and takes about 15 minutes.
- Every page has a narrated version, so a learner can listen instead of reading.
- A 4-question assessment closes each module; the pass mark is 75%, and a learner can retry until they pass.
- Completing all 7 modules issues a certificate with a credential ID, the date of completion and a 12-month validity, and each completion is recorded against the learner's account.
Where it fits in PCI DSS
Requirement 12.6.1 asks for a formal security awareness programme, and Requirement 12.6.3 asks that personnel receive that training on hire and at least once every twelve months, including awareness of threats such as phishing and social engineering. This programme is the front office part of that: the annual training for the people who take card payments, with a record of who completed it and when.
Start with module one
Create an account, open the programme, and the first module is a few minutes of reading or listening.