We take card payments at a thrift store and at events. What do we need to worry about?

Taking payments in several places, some of them outdoors on a Saturday, is normal for a nonprofit and it is manageable. Two separate concerns, and people usually worry about the wrong one.

PCI compliance. Real, and less onerous than it sounds if you set it up correctly. The principle: use a payment device or service where the card data goes straight to the processor and never touches your computer, your network or your staff. With a modern reader, your compliance obligation shrinks to a short self assessment questionnaire rather than anything serious. What expands it dramatically is keying card numbers into a computer, taking numbers over the phone and writing them down, or using an old terminal that stores data. If anyone in your organization is writing card numbers on a paper form, stop that this week.

The event reality, which is the part that actually bites. Connectivity at an outdoor event is often poor, the volunteer running the table has never used the device before, and nobody knows the login. Practical answers: pick a reader with an offline mode that queues transactions and processes them when the signal returns, and know its limits; test it at the venue if you can, or at least test that the cell signal is usable where the table will be; set the volunteer up with their own access rather than the executive director's account; and take a charged battery pack, because the tablet will die at hour three.

For a thrift store specifically: the point of sale computer is usually the oldest machine in the organization and it sits in a room volunteers pass through all day. Individual logins, a screen lock, and the device on a network segment separate from the office are worth doing. It is also frequently the machine nobody backs up, and if it holds inventory and sales history that should change.

One more, since it applies everywhere and nonprofits get targeted: online donation pages get tested with stolen cards, because a charity donation form is a convenient way for a criminal to check whether a card number still works. If you are seeing lots of small failed donations, that is what it is. Your processor has tools for it and we will help you turn them on.