Subject: Attention: Mandatory PCI compliance requirements
From: <[email-masked]>
To: "Labor Law Poster Service" <[email-masked]>
Date: Wed, 16 Jul 2008 20:01:38 -0700

Dear Labor Law Poster Service,

The Credit Card Associations (Visa, Mastercard, Discover, American Express) have developed and implemented programs to ensure that cardholder data is stored and transmitted securely. These programs have recently been aligned - and demonstrated compliance is mandatory for your business.
------------------------------------------------------------
What is PCI compliance?
------------------------------------------------------------
The Payment Card Industry (PCI) mandates that you meet minimum online data security requirements. This means enrolling with a certified security vendor for PCI certification services consisting of:

1.  Quarterly security scanning of your office and store internet connections, as well as your website.
2.  Completion of a security self-assessment questionnaire.

For more information on this mandatory cardholder information security programs please go to:

Visa USA - http://usa.visa.com/business/accepting_visa/ops_risk_management/cisp.html

MasterCard - https://sdp.mastercardintl.com/cgi-bin/mainpage.cgi

------------------------------------------------------------
PayPal is here to help with compliance resources.
------------------------------------------------------------
-- We've contracted with ScanAlert, certified PCI vendor, to help our customers get in compliance at no cost for the first year.

--Enroll with ScanAlert online at: http//www.scanalert.com/

--If you choose to enroll with ScanAlert please let them know you are a PayPal Merchant

------------------------------------------------------------
How does my business become - and stay - compliant?
------------------------------------------------------------
4 steps to staying PCI compliant:

1.  Complete and pass the annual security self-assessment questionnaire.
2.  Complete and pass quarterly security scans of your internet infrastructure.
3.  Get your certificate of compliance.
4.  Fax your certificate to PayPal at (402)951-0448.

------------------------------------------------------------
What does PayPal need from my business in the next 7 days?
------------------------------------------------------------
Please fax your certificate of compliance to: (402)951-0448.If you do not have a PCI certificate, please provide a plan of action to us with:

- A scheduled date for the security scan and questionnaire with a PCI certified vendor within 30 days of this request.
------------------------------------------------------------
Questions?
------------------------------------------------------------
Write to us at [email-masked]

Thank you for your time and attention to this matter. As always, we appreciate your business.

(1) If you are not PCI-compliant, the Credit Card Association may impose fines of more than $500,000per event for data security compromises.
(2) You are not required to enroll with ScanAlert, and may select another vendor.  Keep in mind, if merchants experience a data breach, they are ultimately the ones held responsible for it.

Thank you for using PayPal!
The PayPal Team

----------------------------------------------------------------
PROTECT YOUR PASSWORD

NEVER give your password to anyone, including PayPal employees. Protect yourself against fraudulent websites by opening a new web browser (e.g. Internet Explorer or Netscape) and typing in the PayPal URL every time you log in to your account.

----------------------------------------------------------------

Please do not reply to this email. This mailbox is not monitored and you will not receive a response. For assistance, log in to your PayPal account and click the Help link in the top right corner of any PayPal page.

PayPal Email ID PP1022