PCI Compliance for Schools: Front Office, PTA, and Phone Payments

On this page 7 sections

1. Where Card Data Leaks in a School Front Office
2. Paper Permission Slips and Card Numbers: Stop Collecting Them
3. Taking Tuition Payments Over the Phone Safely
4. PTA and Booster Club Card Readers Need Separate Accounts
5. Which SAQ Applies: PCI Compliance for Schools by Payment Channel
6. PCI vs. FERPA: What Each Protects
7. Start With a One-Page Payment Map

Key takeaways

• The fastest compliance win in most schools is deleting the card-number line from every paper form. A secure filing system is a weaker substitute.
• Phone payments should be keyed live while the parent is on the line, or replaced with a payment link the parent completes on their own.
• A PTA or booster club is usually a separate organization and needs its own merchant account. It shouldn't share the front-office terminal or use a volunteer's personal app.
• A card number on a permission slip in a student folder can be both a PCI problem and a FERPA problem. Removing the card field fixes both.

PCI compliance for schools comes down to one habit: a parent's card number should go straight into a payment system and nowhere else. It shouldn't land on a permission slip, in the front-office inbox, or on a sticky note by the phone. Schools that accept cards agree to protect that data under the Payment Card Industry Data Security Standard (PCI DSS). In most schools, the gaps show up in three places: paper forms, phone payments and volunteer-run PTA sales.

PCI DSS is a security standard published by the PCI Security Standards Council, the body the major card networks formed. It is generally not a federal law. A school is bound to it through the merchant agreement it signed with its processor and bank. That's why your processor, not a government agency, asks you to validate compliance every year. The contract still has teeth. If card data leaks, the cost of investigation, reissued cards and fraud can be passed back to the merchant, and state breach-notification laws may apply on top of that.

For a school without a security team, the good news is that most fixes involve removing card data from the building, which is easier than guarding it.

Where Card Data Leaks in a School Front Office

A school front office handles more kinds of payments than many small businesses. It takes tuition or activity fees, field trips, yearbooks, lunch balances, lost library books, camp deposits, and whatever the PTA is selling that week. Each process was set up by a different person in a different year. That's how card numbers end up in odd places.

The usual leaks look like this:

• Paper forms with a card-number line, filed in a binder or a student's folder
• One shared login on the card terminal that every secretary, aide and volunteer uses
• Card numbers taken by phone and written down "to run later"
• Parents emailing a photo of their card or typing the number into a reply
• Voicemails on the main line with full card numbers in them
• A card terminal plugged into the same network the student laptops use

None of these needs a firewall expert to fix. They need one owner, usually the business manager or office manager, who keeps the list of payment methods and retires the ones that create stored card data.

School front office credit card handling also covers the device itself. Where your POS allows it, give each staff member their own login so refunds and voids trace back to a person. Check terminals regularly for tampering: an overlay on the card slot, a loose faceplate, a cable nobody recognizes. Keep a written list of each device's serial number and location. PCI DSS expects merchants with in-person card devices to inspect them and to train staff to spot tampering.

Keep the terminal off the student network. A cellular terminal, or one on its own separated network segment, keeps hundreds of student devices out of your compliance picture. Most modern smart terminals for front-desk payments can run on cellular or on a dedicated connection.

Paper Permission Slips and Card Numbers: Stop Collecting Them

School card numbers on paper forms are the most common problem and the easiest to fix. A field trip slip with lines for the card number, expiration date and three-digit security code creates stored cardholder data as soon as a parent fills it in. PCI DSS doesn't allow the security code to be kept after the payment is authorized, on paper or anywhere else. The full card number has to be protected for as long as it exists.

Here is an illustrative example of how quickly this adds up. A school sends 180 sixth graders to a science center. Assume one family in three pays by card on the paper slip, and the office keeps the slips until after the trip. The office now holds 60 full card numbers (180 ÷ 3). Each one sits next to a parent's signature, a child's name and often an emergency phone number. The binder stays in a cabinet for weeks while chaperone lists get sorted out.

The fix is to delete the card fields from every form. In their place, print a link or QR code to an online payment page hosted by your payment provider. The parent enters card details on the provider's page, so the number never touches your forms, email or computers. The paper slip still collects the signature and medical information. Payment happens separately and is matched by student name or order number. Our guide to collecting field trip fees online walks through the setup and how to reconcile payments against the class list.

What to Do With the Forms You Already Have

Run any outstanding payments, then destroy the card section the same day with a cross-cut shredder or a locked shred bin. Don't photocopy the slip first, because copies made "for the file" are how card numbers usually survive. If the slip has to be kept for liability or medical reasons, cut off the card portion and shred it. Marker can show through or be scanned, so don't rely on blacking the number out. Then check the binders from past school years, which is where most offices find the old ones.

Taking Tuition Payments Over the Phone Safely

A payment over the phone is a keyed, card-not-present transaction. The safest version has a staff member type the card directly into a virtual terminal for keyed payments, or into a terminal's keypad, while the parent is still on the line. Nothing gets written down at any point.

Post a short set of rules for front-desk staff:

1. Key the payment live. If the system is down, take a callback number, not the card number.
2. Take payment calls away from the counter, out of earshot of students and waiting parents, and don't read the number back aloud.
3. Don't record calls that include card numbers. If your phone system records calls, ask the vendor how to pause recording or route payment calls to a line that isn't recorded.
4. Refuse card numbers sent by email or text. Reply without quoting the number, delete the message from the inbox and the trash, and send the parent a payment link.
5. If a voicemail contains a card number, delete it and call the parent back.

Use one computer for the virtual terminal and keep it off email and general web browsing. That keeps the number of systems that touch card data small. A better option is to send an invoice or payment link so parents type their own card details. Nobody on staff hears the number, and families can pay after hours.

Keyed transactions also tend to cost more than tapped or dipped cards, because card networks price card-not-present sales as higher risk. Our breakdown of school credit card fees and MCC codes covers why. If you're thinking about passing that cost to families, read the convenience fee rules for tuition payments first.

PTA and Booster Club Card Readers Need Separate Accounts

PTA payment security starts with how PTAs are organized. A PTA, PTO or booster club is usually its own nonprofit, separate from the school or district, with its own tax ID and bank account. Its card sales should run on its own merchant account under its own name. They don't belong on the front-office terminal, and they don't belong in a volunteer's personal payment app.

Mixing the two causes several problems. School and PTA money get commingled, which district finance rules often prohibit. Refunds and chargebacks land on the wrong organization. The school's PCI scope also grows to include volunteers it never trained, using devices it doesn't control.

Personal payment apps have their own risk. The money lands in an individual's bank account. When that volunteer's child moves up to high school, the sales records leave with them.

The setup that holds up from year to year looks like this:

• The PTA owns its merchant account and its card readers, and the treasurer keeps a list of the readers by serial number.
• Each officer who takes payments has their own login.
• Passwords are changed and old users removed every time officers turn over, usually in late spring or at the start of the school year.
• If a reader dies during a book fair, volunteers take cash or switch to a backup reader. They never write down card numbers.

A cellular mobile card terminal for PTA events works in a gym or on a football field without the school's Wi-Fi. For event-by-event setup, see our guide to PTO fundraiser card readers for fun runs and book fairs.

Which SAQ Applies: PCI Compliance for Schools by Payment Channel

Most schools prove compliance once a year with a Self-Assessment Questionnaire (SAQ), a checklist published by the PCI Security Standards Council. There are several versions, and the one you fill out depends on how card data reaches you. The fewer of your own systems that touch card numbers, the shorter the questionnaire.

Using several channels can move you to a broader questionnaire, so confirm with your processor which one covers your whole setup. The council revises its questionnaires, so check the current versions in its document library rather than relying on last year's copy.

Here is a decision you can make right now. Suppose an illustrative school takes field trip payments on paper, phone payments through a virtual terminal on the office PC, and in-person payments on a terminal connected to the school network. Each choice pushes it toward a longer questionnaire. If it moves trips to a hosted payment page, phone payments to emailed links, and the terminal to cellular, nearly every card number moves outside its own systems.

Two more details matter. Some processors add a monthly fee if a merchant doesn't complete its annual validation. That charge is processor pricing, not a card network rule, so look for it on your statement. Districts should also settle who signs the questionnaire. When one merchant account covers several campuses, the central finance office usually owns it. Campuses with their own merchant IDs may need their own answers.

If you're moving online, hosted online payment options keep the card entry on the provider's side.

PCI vs. FERPA: What Each Protects

FERPA and payment data come up together because school offices handle both. They are different rules with different owners.

The two can overlap. A permission slip in a student's file that carries a parent's card number may be both stored cardholder data and part of that student's education record. Removing the card field solves both problems at once.

Payment systems can also hold student information, such as lunch balances, fee histories and names tied to transactions. Ask whether your payment vendor's contract covers how it handles that data. Many private schools don't receive federal education funds directly and may fall outside FERPA, though state student-privacy laws can still apply. This is general information, not legal advice. Confirm your obligations with district counsel or a qualified attorney.

Start With a One-Page Payment Map

This week, list every way money reaches your school: each form, phone line, inbox, terminal, website and PTA table. Next to each one, write whether a staff member or volunteer ever sees, hears, writes or types a full card number. Every "yes" is a change to make, and most can be fixed by moving that payment to a hosted page, a payment link or a standalone terminal.

Then ask your processor which questionnaire your setup requires and when it's due. If you'd like a second look at your setup, request a free quote from MannyPay. A specialist responds within one business day.

IC

About the author

Isabella Cruz

Isabella Cruz is Business Growth & Commerce Editor for Beyond the Swipe, writing for small businesses, restaurants, retailers, entertainment venues and e-commerce sellers.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.