Yes, I too am skeptical of RCD's motivations. But I think we ought to give him a chance to support his statement. After all, it's a quirky little machine, smaller screen (Square's issue with the Android screens was a layout issue apparently), not so much theft candy and you can't beat the price. If it worked it would be ideal. So here we go:
RCD, 1) have you ACTUALLY TESTED Square specifically with this device and what was your experience?
2)How many credit card charges did you run?
3) What is your level of confidence that this could be trained to an average volunteer (who doesn't know anything about smartphones) or do you need arcane knowledge of Android to use it?
4) How long does the battery run in normal use?

this is a 40 year old problem: do you trust the person you're handing your card to? If they want to steal from you, all they need is a pen. As far as third parties, there have been many cases of wiretapped credit card phone lines, hacked swipe machines, skimmed ATMs, skimmed wireless credit cards, you name it. One large chain even got their whole system compromised. Why is Best Buy safer than some random merchant using Square? You can't say.

There might be, longshot, some sort of iPhone virus that intercepts millions of credit card numbers, but that's up to Square to manage those losses, and they've been doing this for 2 years now. If they encrypt the data in hardware in the scanner, the phone may never see the credit card number. PCI is mainly about retention and Square deliberately avoids retaining credit card numbers in the terminal. It's genius, by avoiding PCs altogether they avoid PC security problems. Now they only have to worry about smartphone security. Most vendors handle that by only embracing the most locked-down phones - Apple's. (and that's why they won't let you jailbreak/customize your phone OS). I assume they have the usual PCI CSS issues back at the server farm, but that's not your problem.

Specifically, PCI DSS is securing the computers used in the transaction. I'm a computer security professional, and I assure you, it's not humanly possible without a full-time staff who attends Blackhat. Perhaps your fee pays for that staff to secure your bank's systems and perhaps your credit card machine. It's too little to insure your PC's against loss, so that falls to you.

Ultimately, it's about liability. Pity EMI vs. Comerica. I do computer security for a living, and I know my ability and limitations... I can be on guard a lot, but not every time. The bad guy only has to be lucky once. The relevant thing is Comerica kicking financial responsibility back onto the customer who got hacked. And you think your bank is gonna treat you different? That's why I don't online bank.

Bottom line is liability. Who gets stuck holding the bag when there's fraud. With credit cards the answer is universal: "NOT the consumer". Whether that's you or Square, I'm not sure. There's a reason they charge 2.7%.


Square and competitors' 2.7% is inclusive of ALL fees and costs. The traditional's charge a lower "percentage" but nickel-and-dime you to death, like

Suppose your annual charges are $30,000. $185 amounts to about 0.61% of your total charges all by itself.

Square and competitors are deliberately trying to appeal to those who would accept 2.7% if it was a FAIR 2.7% and didn't require further ripoffs. Their competitor Verifone with their Sail product, not only matches it, but if you pay $12-ish a month, they drop the rate another 0.7%. Now you're very competitive with traditional credit merchants.

And yes, I know there are some that won't pay any percentage at all. But they actually do pay a percentage, they just do the very thing they hate: they hide the costs in a dozen "nickel and dimed" experiences. Figure every cash loss you have for handling cash, like bank fees, shortages, losses, employee theft, break-ins, robberies. Now add the psychic energy wasted in such things or their prevention. Now think of all the time spent. Which is not free, because counting the drawer keeps you from doing something else. Seems to me you get over 2.7% in a hurry.

Does the museum purchase the tablet/Ipad? Does the museum pay for the monthly service charges for the phone? Or are you using a volunteer's phone to do the work attaching the Square object to it?

What if there is not internet service at your location? Are you using another's wireless operation to connect without their knowledge?

If it's the colby tablet at around $82 then I'd say that's reasonable for the museum, but I don't see where the phone with monthly charges can be offset, unless you get a bigger number of passengers just because they will use credit cards instead of cash o r check.

The Club Car arrived in my (snail mail) mail box today… (the Club Car being the newsletter of the Pacific Locomotive Association (PLA), owners, operators of the Niles Canyon Railway… www.ncy.org ) The PLA and Niles Canyon Railway is also the home of the Golden Gate Railroad Museum (GGRM)… who 6 years ago lost their site in a former Naval base in San Francisco, and found a haven in the canyon…. Robert McD will remind you to own your site, then build car barns...)

The lead article, on the front cover is titled, “The GGRM collects E-tickets on the Niles Canyon”

It talks of a March weekend service with SP 2472, with ticketing by a event web site ticket service (Everbright) with tickets being read by l-pads using QR codes and how well it worked. It notes that in the future tickets will be sold on the train using a square…
The Canyon, (Niles Canyon, Fremont CA) is located on the edge of what is known as Silicon Valley, the head quarters of Google, Facebook, Yahoo and such are within 20 miles… (Robert McD works for Yahoo, my wife works for Google...) The technology is expected… but also, it works…

The article's author, Ronald Vane is shown in a picture, using his I-pad to check tickets... Ron is sports a grey beard... In gorillas a grey back is a mark of maturity... in humans it is a mark of both maturity, and age... I sport a beard which is grey... If we can adapt your museum can too...

I note that Visa (and the other Card providers PS. the wife used to work for Visa, their headquarters are nearby as well...) have significant security standards in place... the battle against fraud is ongoing, and there are risks... risks related to technology, but also risks of tripping when stepping off a car onto ballast... We all have to manage risk daily...

Randy

PS, in the article, Ron noted that "A few passengers wanted their ticket punched, so out cam my ticket punch and they were satisfied"....

Any way you want to do it. It doesn't matter whose device. If a volunteer will lend his phone, that is awesome because it completely solves the problem of getting a data connection.

However the museum would need to have its own Square account, for tax reasons and so the museum's name appears on the credit card bill instead of the individual. That is what you'd punch into the phone to configure the app.


If you go back to the various options back on page 1, all of those assume you have no internet at the location and must bring your own, either via devices with cellular modems or in option #4 with MiFi routers. A Mifi router is a special piece of equipment which provides a private WiFi hotspot in any location where cellular data service can be obtained. Obviously this is something you are paying the cell company for the connectivity, typically $50/month, but it serves all handheld terminals in that location.


No contract. Everything I posted in the earlier message assumes you are paying month-by-month or prepay. It just doesn't make sense to pay for 12 months of service when you only really need it 5 months or even 1 month. If most months out of the year you are operating where WiFi is, then you can turn off the service.



Yeah, but I also say "next to your own railroad." They're a tenant :(


I don't think being in a tech center has anything to do with it. Heck, when it comes to information technology, IRM makes us all look like chumps, and they're in Chicago.

I attribute it to their rather obvious, positive can-do attitude and sheer desire to succeed. Everything about that operation just radiates real pride and can-do spirit. They win because they're rock stars. Any reasonably intelligent person can solve any tech problem with a sufficient supply of "really want to solve it", and this tech is just getting easier by leaps and bounds. Plus, they plainly have the unabashed and enthusiastic support of their Board and management. What they're doing is too way radical to push past one that is naysaying and change-averse.

QUITE a stark contrast to many other organizations we know of, which are strong-willed about how to do business, e.g. the ones that sit there saying 2.7% is just too much. I guarantee the Everbright service was more than that.

Hey, everyone wants success if they can get it on THEIR terms. What's remarkable is when people are willing to have success on success's terms.

Edit: a more significant comment was warranted.

I use Square for my business. Most of my business is with accounts I invoice but new/unknown customers are COD and often they bring a check (once in a while cash) but in some cases I am not dealing with anyone in person and they want to pay by CC. It was never worthwhile to get set up with the bank for the handful of transactions but I was getting a little embarrassed saying I can only take CC's via PayPal. So Square (for iPhone) came along at just the right time.

Because most often the CC transactions are with out of town folks I made up an authorization form for them to fill out, sign, and fax back. Thus, I've not made much use of the card scanner. I have done transactions with my own card and a friend's to prove that it works which it did.

Only problem I have ever had with Square is when it seems to hang on putting it through which I'm sure has little to do with them and everything to do with AT&T service in the middle a day in the middle of a big city: They are overwhelmed. I try to make sure I'm on WiFi first now.

Overall, it does what I need. It's not free to use of course but the fact that there is no ongoing charge is exactly what I needed.

Steve

While it is not experience on a train with train MC/Visa and other cards, in St. Augustine selling carriage tours we used the mobile credit card machine. This gave us a paper receipt for the customer and the company. It connected with a cellular connection and worked well for that porpoise. Other tour services were and are using the cube and are just as happy. However ticketing for carriages and tours in St. Augustine is not uniform and still somewhat cumbersome. The QR codes sound like a possible way to standardize and streamline the ticketing process when sold from multiple locations and venders.

The more convenient that it is for the customer to spend their money the faster they will. This is one area that it is important to make use of modern 21st century technology.