Element Deletes Transactions After 120 Days – A Potential Refunding Nightmare

We recently switched to Element and so far, for the most part, it has been running smoothly. However, we recently found that Element only keeps transactions in their system for 120 days. This was not obvious to us in any documentation we had and is not included as part of the installation process. I’m sure it’s out there somewhere but suffice it to say, we didn't see it.

That means after 120 days you can’t process a refund as you normally would in Tessitura because refunds are based on transactions. If the transaction has been removed from Element it can’t be referenced and an error will be generated upon authorization.

If we needed to do a refund to a patron’s credit card after 120 days we can’t actually process the refund in Tessitura which would leave us with two options according to Element when I spoke with them at the conference. First, we could issue the credit to their account for another performance. This is basically a no-go for us. We don’t want to anger the patron by not crediting their card back in the case of an issue being our fault. Our second option would be to call Element and have them do a “blind credit”. In that case, we would need to provide the credit card information, which we would have to call the patron to obtain, and then tell Element how much to credit to the account. This is the process we would have to use.

It may not be obvious why this is a problem and at first I didn't think it was either. So every now and again we might have to get a patron’s credit card information and then put in a call to Element, no big deal. Then our director of ticketing brought up show cancellations. This happens more often than I thought it did and we often start selling shows more than 120 days out.  

I wrote a query to see how bad of a problem this could potentially be. There were 314 shows since the 2012-2013 season that had tickets bought more than 120 days before the show. 41 of those shows sold to 100+ patrons (not tickets, but patrons) before that mark. One of them sold to 505 patrons before that mark. That show took place just last year and was at an outdoor venue which can be a volatile situation.

If that show would have had to cancel day of or the day before our organization would have needed to have contact with 505 patrons, get their credit card information, and then call Element to have each one credited. Right now, to my understanding, other than on account credits (again, a no-go) we have no other option.

Element is not going to change their practice of deleting transaction after 120 days. We are but a small segment of a very high security business. The only fix, according to Element, would be for Tessitura to implement a way for blind credits to be processed within the application.

We're basically waiting for Tessitura to issue a fix to this and we can't know for sure when that will be or if they even plan on doing it. Blind credit processing could be a security risk as a person could issue a credit to a card without a transaction being associated. This means an unscrupulous person could issue blind credits in order to steal from the organization. I’m sure Tessitura would be hesitant to implement it and so I don't expect it any time soon if ever (here’s hoping I'm wrong!)

Does anybody have any ideas on what could be done about this? I'm hoping I've just missed something.

Thanks!



[edited by: Cliff Bailey at 8:59 AM (GMT -6) on 26 Aug 2015]
Parents
  • Thank you for the clarification Chuck. I think the conundrum comes from what Element says and what Tessitura says. There is no clear, unified document telling us as users (in clear language), what will happen with Element as a payment processor, as you laid out below. I’ve spoken with Element about issues with a previous licensee I was with when they transitioned to Element. They purchased the recommended swiping devices that Element said were compatible with Tessitura (and would also encrypt the credit card number). They came to find out that, those devices, in fact, didn’t work with controlled batches and experienced some embarrassing issues with donors. I think it would be very helpful if the Network and Element came together with documentation about using them as the payment gateway and some “industry best practices” that we as users could follow. I personally felt I was getting the “he said, she said” treatment from Element as they said it was not an issue with the devices and it was a Tessitura issue.

     

    Since payment processing and the storage of payment information will always be a part of our collective business (and is only going to get more restrictive with time), any work the Network can do to make these payment processing changes much clearer (especially as they pertain to Element – the suggested payment processor from Tessitura) would be extremely helpful.

     

    Christopher Cuhel | Database Coordinator

    The 5th Avenue Theatre

    1308 5th Avenue Theatre, Seattle WA  98101

    p 206.971.7916 f 206.292.9610

     

    Seattle's Acclaimed Non-Profit Musical Theater Company

     

    Website |  Facebook |  Twitter |  Youtube

     

    From: Tessitura Technical Forum [mailto:forums-technical@tessituranetwork.com] On Behalf Of Chuck Reif
    Sent: Wednesday, August 26, 2015 11:11 AM
    To: Christopher Cuhel
    Subject: Re: [Tessitura Technical Forum] Element Deletes Transactions After 120 Days – A Potential Refunding Nightmare

     

    It seems as if some clarification is needed here and I hope this helps. 

    Tessitura has always had the ability to store credit cards and we are PA-DSS certified to continue to do that.  Nothing in any new version of Tessitura has changed this ability.  It has also always been the case that some sites have preferred not to store card data and we have the ability to configure the software to do that as well.

    New functionality in v12.1 and v12.5 provides additional new options available for card handling.  Following is a summary of the options currently available.

    1. You can continue to store credit cards as you have done in the past, using them for refunds and automated billing when necessary.
    2. You can decide not to store any credit card data on your system at all.
    3. You can decide not to store actual card data and instead decide to tokenize the cards that you use for automated billing.  This allows you to continue to do automated billing without storing card data.   There is a token storage fee for Element users.  Tokenization is not currently an option for TNS users in the UK and Ireland.
    4. Cards that are tokenized in Tessitura can be used for all of the same purposes that regularly stored cards are.  That means that you can select a tokenized card from the list of stored credit cards and refund directly to it.
    5. Regardless of whether you store any credit card data in Tessitura, Element users in North American can also refund credit card transactions back to the original card by using the Refund by Transaction number feature.  Element’s retention policy for this feature is to store the transaction reference and card data for 120 days.  Payment Express users also have this ability for most transaction types.
    6. If you elect to neither store the card information or tokenize, then you have increased security but have left yourself in a position of not having access to card information after 120 days, in which case you would have to contact the customer if a refund were necessary.

    I want to make it clear that we have not taken away any existing functionality for credit card handling—just provided some new options.  These new options do have some limitations because each of them are designed to provide greater levels of security.

    V12 also introduced support for encrypted card readers—this option was also designed to provide additional security and ease of PCI compliance by keeping credit card data off of your network.  However, these new types of secured readers are not required—you can continue to use your existing card swipes.  Doing so does mean that unencrypted card data is transmitted on your network as it has always been.

    It is possible that future security regulations may force us to restrict the options available in Tessitura for card storage and handling.  But at the moment, we are providing only additional capability to provide you with more options.  Data security, and in particular payment data security, is something that we take very seriously and so we are always studying and participating in best practices in this area.


    Hope this information helps explain things.

     

    From: Cliff Bailey <bounce-cliffbailey2866@tessituranetwork.com>
    Sent: 8/26/2015 8:58:43 AM

    We recently switched to Element and so far, for the most part, it has been running smoothly. However, we recently found that Element only keeps transactions in their system for 120 days. This was not obvious to us in any documentation we had and is not included as part of the installation process. I’m sure it’s out there somewhere but suffice it to say, we didn't see it.

    That means after 120 days you can’t process a refund as you normally would in Tessitura because refunds are based on transactions. If the transaction has been removed from Element it can’t be referenced and an error will be generated upon authorization.

    If we needed to do a refund to a patron’s credit card after 120 days we can’t actually process the refund in Tessitura which would leave us with two options according to Element when I spoke with them at the conference. First, we could issue the credit to their account for another performance. This is basically a no-go for us. We don’t want to anger the patron by not crediting their card back in the case of an issue being our fault. Our second option would be to call Element and have them do a “blind credit”. In that case, we would need to provide the credit card information, which we would have to call the patron to obtain, and then tell Element how much to credit to the account. This is the process we would have to use.

    It may not be obvious why this is a problem and at first I didn't think it was either. So every now and again we might have to get a patron’s credit card information and then put in a call to Element, no big deal. Then our director of ticketing brought up show cancellations. This happens more often than I thought it did and we often start selling shows more than 120 days out.  

    I wrote a query to see how bad of a problem this could potentially be. There were 314 shows since the 2012-2013 season that had tickets bought more than 120 days before the show. 41 of those shows sold to 100+ patrons (not tickets, but patrons) before that mark. One of them sold to 505 patrons before that mark. That show took place just last year and was at an outdoor venue which can be a volatile situation.

    If that show would have had to cancel day of or the day before our organization would have needed to have contact with 505 patrons, get their credit card information, and then call Element to have each one credited. Right now, to my understanding, other than on account credits (again, a no-go) we have no other option.

    Element is not going to change their practice of deleting transaction after 120 days. We are but a small segment of a very high security business. The only fix, according to Element, would be for Tessitura to implement a way for blind credits to be processed within the application.

    We're basically waiting for Tessitura to issue a fix to this and we can't know for sure when that will be or if they even plan on doing it. Blind credit processing could be a security risk as a person could issue a credit to a card without a transaction being associated. This means an unscrupulous person could issue blind credits in order to steal from the organization. I’m sure Tessitura would be hesitant to implement it and so I don't expect it any time soon if ever (here’s hoping I'm wrong!)

    Does anybody have any ideas on what could be done about this? I'm hoping I've just missed something.

    Thanks!




    This message was sent automatically to you by www.tessituranetwork.com because you subscribed to the Tessitura Technical Forum. You may reply to this message to post to the Technical forum or visit the site to search, read and post to the forums. In the interest of keeping the forum posts from becoming cluttered, we encourage you to delete previous message text from your reply before sending. Thank you!

  • So, if we chose to move away from housing credit card data in Tessitura (which was the intent of using Element), and we need to do a long term billing period (say a donation every month), would we need to set up a calendar reminder every 119 days to make sure we adjust the billing method so the credit card information is retained? Part of the major reason many of us are transitioning to Element is because we want as minimal exposure to credit card breech as possible. I was under the impression that other then tokenization (should a company choose to do this) and removing card number storage from Tessitura, processing credit cards would be essentially the same. It appears this is not the case.

     

    Again, I will ask that Tessitura and Element work together to provide to users an FAQ sheet so that we can fully understand the changes and be able to make better informed decisions on how we will process credit cards and with which company we will use to do that.

     

    Christopher Cuhel | Database Coordinator

    The 5th Avenue Theatre

    1308 5th Avenue Theatre, Seattle WA  98101

    p 206.971.7916 f 206.292.9610

     

    Seattle's Acclaimed Non-Profit Musical Theater Company

     

    Website |  Facebook |  Twitter |  Youtube

     

    From: Tessitura Technical Forum [mailto:forums-technical@tessituranetwork.com] On Behalf Of Chuck Reif
    Sent: Wednesday, August 26, 2015 1:43 PM
    To: Christopher Cuhel
    Subject: RE: [Tessitura Technical Forum] Element Deletes Transactions After 120 Days – A Potentia~��6(!�f�

     

    If you store the credit card yourself (as most people have always been doing), then you can issue a refund at any point, just as you have always been able to do. 

    From: Cliff Bailey <bounce-cliffbailey2866@tessituranetwork.com>
    Sent: 8/26/2015 6:58:06 PM

    Chuck,

     

    Thank you very much for your response. It was very informative but didn't specifically address what I need to know.

     

    I realize I had a long post so I want to make my questions more plain;

     

    If you're using element, 120 days after a sale can we use tessitura to refund a credit card?

     

    If not, what do you recommend we do in the case of a show that is canceled where 500 customers need to have their credit cards refunded?

     

    Thanks!



    -------- Original message --------
    From: Chuck Reif <bounce-chuckreif3941@tessituranetwork.com>
    Date: 08/26/2015 2:09 PM (GMT-05:00)
    To: Cliff Bailey <cbailey@kentuckycenter.org>
    Subject: Re: [Tessitura Technical Forum] Element Deletes Transactions After 120 Days – A Potential Refunding Nightmare

    It seems as if some clarification is needed here and I hope this helps. 

    Tessitura has always had the ability to store credit cards and we are PA-DSS certified to continue to do that.  Nothing in any new version of Tessitura has changed this ability.  It has also always been the case that some sites have preferred not to store card data and we have the ability to configure the software to do that as well.

    New functionality in v12.1 and v12.5 provides additional new options available for card handling.  Following is a summary of the options currently available.

    1. You can continue to store credit cards as you have done in the past, using them for refunds and automated billing when necessary.
    2. You can decide not to store any credit card data on your system at all.
    3. You can decide not to store actual card data and instead decide to tokenize the cards that you use for automated billing.  This allows you to continue to do automated billing without storing card data.   There is a token storage fee for Element users.  Tokenization is not currently an option for TNS users in the UK and Ireland.
    4. Cards that are tokenized in Tessitura can be used for all of the same purposes that regularly stored cards are.  That means that you can select a tokenized card from the list of stored credit cards and refund directly to it.
    5. Regardless of whether you store any credit card data in Tessitura, Element users in North American can also refund credit card transactions back to the original card by using the Refund by Transaction number feature.  Element’s retention policy for this feature is to store the transaction reference and card data for 120 days.  Payment Express users also have this ability for most transaction types.
    6. If you elect to neither store the card information or tokenize, then you have increased security but have left yourself in a position of not having access to card information after 120 days, in which case you would have to contact the customer if a refund were necessary.

    I want to make it clear that we have not taken away any existing functionality for credit card handling—just provided some new options.  These new options do have some limitations because each of them are designed to provide greater levels of security.

    V12 also introduced support for encrypted card readers—this option was also designed to provide additional security and ease of PCI compliance by keeping credit card data off of your network.  However, these new types of secured readers are not required—you can continue to use your existing card swipes.  Doing so does mean that unencrypted card data is transmitted on your network as it has always been.

    It is possible that future security regulations may force us to restrict the options available in Tessitura for card storage and handling.  But at the moment, we are providing only additional capability to provide you with more options.  Data security, and in particular payment data security, is something that we take very seriously and so we are always studying and participating in best practices in this area.


    Hope this information helps explain things.

     

    From: Cliff Bailey <bounce-cliffbailey2866@tessituranetwork.com>
    Sent: 8/26/2015 8:58:43 AM

    We recently switched to Element and so far, for the most part, it has been running smoothly. However, we recently found that Element only keeps transactions in their system for 120 days. This was not obvious to us in any documentation we had and is not included as part of the installation process. I’m sure it’s out there somewhere but suffice it to say, we didn't see it.

    That means after 120 days you can’t process a refund as you normally would in Tessitura because refunds are based on transactions. If the transaction has been removed from Element it can’t be referenced and an error will be generated upon authorization.

    If we needed to do a refund to a patron’s credit card after 120 days we can’t actually process the refund in Tessitura which would leave us with two options according to Element when I spoke with them at the conference. First, we could issue the credit to their account for another performance. This is basically a no-go for us. We don’t want to anger the patron by not crediting their card back in the case of an issue being our fault. Our second option would be to call Element and have them do a “blind credit”. In that case, we would need to provide the credit card information, which we would have to call the patron to obtain, and then tell Element how much to credit to the account. This is the process we would have to use.

    It may not be obvious why this is a problem and at first I didn't think it was either. So every now and again we might have to get a patron’s credit card information and then put in a call to Element, no big deal. Then our director of ticketing brought up show cancellations. This happens more often than I thought it did and we often start selling shows more than 120 days out.  

    I wrote a query to see how bad of a problem this could potentially be. There were 314 shows since the 2012-2013 season that had tickets bought more than 120 days before the show. 41 of those shows sold to 100+ patrons (not tickets, but patrons) before that mark. One of them sold to 505 patrons before that mark. That show took place just last year and was at an outdoor venue which can be a volatile situation.

    If that show would have had to cancel day of or the day before our organization would have needed to have contact with 505 patrons, get their credit card information, and then call Element to have each one credited. Right now, to my understanding, other than on account credits (again, a no-go) we have no other option.

    Element is not going to change their practice of deleting transaction after 120 days. We are but a small segment of a very high security business. The only fix, according to Element, would be for Tessitura to implement a way for blind credits to be processed within the application.

    We're basically waiting for Tessitura to issue a fix to this and we can't know for sure when that will be or if they even plan on doing it. Blind credit processing could be a security risk as a person could issue a credit to a card without a transaction being associated. This means an unscrupulous person could issue blind credits in order to steal from the organization. I’m sure Tessitura would be hesitant to implement it and so I don't expect it any time soon if ever (here’s hoping I'm wrong!)

    Does anybody have any ideas on what could be done about this? I'm hoping I've just missed something.

    Thanks!



    --
    View this message online at http://www.tessituranetwork.com/Community/forums/p/14238/43885.aspx#43885 or reply to this message
    --
    This message was sent automatically to you by www.tessituranetwork.com because you subscribed to the Tessitura Technical Forum. You may reply to this message to post to the Technical forum or visit the site to search, read and post to the forums. In the interest of keeping the forum posts from becoming cluttered, we encourage you to delete previous message text from your reply before sending. Thank you!

     

    Cliff Bailey

    Database/Tessitura Administrator

    502.566.5101 p | 502.645.2428 m

     

    The Kentucky Center for the Performing Arts

    501 West Main Street, Louisville, KY  40202

    www.kentuckycenter.org

     

    Facebook | YouTube | Flicker | Twitter  | Blog

     

     



    --
    View this message online at http://www.tessituranetwork.com/Community/forums/p/14247/43904.aspx#43904 or reply to this message
    --
    This message was sent automatically to you by www.tessituranetwork.com because you subscribed to the Tessitura Technical Forum. You may reply to this message to post to the Technical forum or visit the site to search, read and post to the forums. In the interest of keeping the forum posts from becoming cluttered, we encourage you to delete previous message text from your reply before sending. Thank you!

  • Gloria,

    I specifically asked Element about that. It doesn't matter if you're tokenized or not, Element removes transactions after 120 days and thus Tessitura cannot refund. To break down what you posted in red;

    Currently Tessitura supports the refund option which needs a transaction to match up against in the system to perform. We purge card data and reference number from our system after 120-days for compliance reasons which means a refund can no longer “match” up against anything in the system, hence the limitation.

    The part in bold is the important bit. Tessitura needs transactions for the refund but Element purges it after 120 days making normal refunds after 120 days impossible.

    Tessitura has an option to integrate to the credit transaction which doesn’t require a matching transaction on the other side and will just process. The merchant just has to have the card number or be using Element’s tokenization to call up the token and refund the card.

    What they’re talking about here is what I mentioned below and Element refers to it as a “blind credit”. If Tessitura were to implement a function allowing us to make a “blind credit” in the system we would only need to have a saved credit card to be able to refund. However, currently Tessitura requires a transaction as well as the credit card information.

     

    I would like to get further information from them as well to verify I’m right. I’d love to be wrong about it but I’m pretty sure I’m not. 

  • Oh, and as they said in their response to you ... tokenized credit cards are also only stored for 120 days. Meaning you can't pull up a saved credit card after that period either unless you've saved it in Tessitura and you're *not* tokenized.

    That means even if Tessitura implements the fix to this issue, you wouldn't be able to refund at the "blind credit" level after 120 days if you're tokenized because the credit card would no longer be in their system. 

    If I'm understanding this issue properly, tokenization would potentially make this problem worse if you needed to refund after 120 days. 

  • Cliff,

    Our DBA had a conversation with an Element representative after one of the sessions where this was discussed.  The Element representative indicated that they (Element) are encouraging the Network to include the "blind credit" functionality in v12.5.1 (the first EMV version).  The Element rep. felt that if the Network did not get it into v12.5.1, they would get it into another release shortly thereafter.  

    Element was clear that there was no way for us to bypass this restriction on our own and that there was no way for Element to accommodate a change to their 120 day rule.

    It looks to me that the "blind credit" will be the only viable option and that it will be up to the Network to include this functionality in a release sooner rather than later. 

    I too would like to hear something official from the Network concerning this issue.

    Is there a plan to accommodate "blind credit" functionality from within the application in a future release?  If so, is there a release for which that functionality is targeted?

    Dan

  • I should let Andy Kraus weigh in on this (he's the one who spoke with Element at the conference about this issue), but it seemed pretty clear to us that they simply had no concept of a business model where someone might sell something significantly in advance of it being delivered.

    This also has significant customer service impacts for us.  Our season typically starts in September, but our initial onsale begins in April.  Our season ends in May (or sometimes early June).  So you could easily buy tickets to a performance that you will not attend for 14 months.  But beyond that, our typical patron makes one purchase a season.  If they were to buy tickets at the beginning of one season, and not again until towards the end of another, we're talking up to a 26 month span between purchases.  That would be fairly extreme, but the majority of our customers are going to make a purchase with us typically once every 12 months.  This means we cannot keep a card on file for the vast majority of our customers.

    The next thing to consider is cards being used to pay pledges or payment plans.  Most people are going to have a quarterly payment plan system as their maximum, so that's unlikely to be a problem, but pledges are often billed at longer intervals, and in those cases the card will also be lost and the development officer will have to call up the donor and bug them for their card information again.

  • Tanya, 

    Unfortunately I believe your information is incorrect though I wish it wasn't. At first I thought the same as you and though it seemed like an annoying way for Element to make money, it wasn't a big deal. We could just keep ongoing donor information and simply remove tokens after a performance is over. We could make that work.

    However, I found that with or without tokens, Element only keeps transactions and credit card information for 120 days. That information is straight from Element.



    [edited by: Cliff Bailey at 12:43 PM (GMT -6) on 26 Aug 2015]
  • Cross posting this here from another thread:

    It seems as if some clarification is needed here and I hope this helps. 

    Tessitura has always had the ability to store credit cards and we are PA-DSS certified to continue to do that.  Nothing in any new version of Tessitura has changed this ability.  It has also always been the case that some sites have preferred not to store card data and we have the ability to configure the software to do that as well.

    New functionality in v12.1 and v12.5 provides additional new options available for card handling.  Following is a summary of the options currently available.

    1. You can continue to store credit cards as you have done in the past, using them for refunds and automated billing when necessary.
    2. You can decide not to store any credit card data on your system at all.
    3. You can decide not to store actual card data and instead decide to tokenize the cards that you use for automated billing.  This allows you to continue to do automated billing without storing card data.   There is a token storage fee for Element users.  Tokenization is not currently an option for TNS users in the UK and Ireland.
    4. Cards that are tokenized in Tessitura can be used for all of the same purposes that regularly stored cards are.  That means that you can select a tokenized card from the list of stored credit cards and refund directly to it.
    5. Regardless of whether you store any credit card data in Tessitura, Element users in North American can also refund credit card transactions back to the original card by using the Refund by Transaction number feature.  Element’s retention policy for this feature is to store the transaction reference and card data for 120 days.  Payment Express users also have this ability for most transaction types.
    6. If you elect to neither store the card information or tokenize, then you have increased security but have left yourself in a position of not having access to card information after 120 days, in which case you would have to contact the customer if a refund were necessary.

    I want to make it clear that we have not taken away any existing functionality for credit card handling—just provided some new options.  These new options do have some limitations because each of them are designed to provide greater levels of security.

    V12 also introduced support for encrypted card readers—this option was also designed to provide additional security and ease of PCI compliance by keeping credit card data off of your network.  However, these new types of secured readers are not required—you can continue to use your existing card swipes.  Doing so does mean that unencrypted card data is transmitted on your network as it has always been.

    It is possible that future security regulations may force us to restrict the options available in Tessitura for card storage and handling.  But at the moment, we are providing only additional capability to provide you with more options.  Data security, and in particular payment data security, is something that we take very seriously and so we are always studying and participating in best practices in this area.


    Hope this information helps explain things.


  • And just to be clear, Tessitura has always had, and continues to have, the ability to do "blind credits".  That is what you are doing when you issue a refund from the payment window after swiping or keying in a card number.

Reply Children
No Data