Payment Security Policy

1. How card details are transmitted

Card payments are not yet enabled on this website. Registrations are submitted here and the secretariat follows up with settlement instructions. No card details are collected, transmitted or stored by this site today.

When card payments go live, they will be handled by a PCI DSS compliant payment service provider on the provider's own hosted payment page. Card numbers, expiry dates and security codes will be entered on that page and sent directly to the provider over an encrypted connection. They will not pass through, or be stored on, servers operated by ECCU Bankers Association Ltd..

2. What we never hold

• Full card numbers (PANs)
• Card expiry dates
• CVV / CVC security codes
• Card PINs or magnetic-stripe data

We will never ask you to send card details by email, by contact form, or over the telephone. If you receive such a request claiming to come from us, do not answer it and tell us at info@ecbankers.org.

3. How this website is secured

• All pages are served over HTTPS with TLS. Requests over plain HTTP are redirected, and HTTP Strict Transport Security is enforced in production.
• A Content Security Policy, frame protection and strict referrer rules are applied to every response, which limits the injection and clickjacking routes commonly used to skim payment pages.
• Forms are protected against cross-site request forgery.
• Accounts are protected by hashed passwords, optional two-factor authentication and passkeys, lockout after repeated failed sign-ins, rate limiting on sign-in, and a 30-minute inactivity timeout.
• Administrative access to registration data is limited to authorised secretariat staff and is separately authenticated.
• Member bank access codes are stored only as a keyed hash, so the stored values cannot be reversed into working codes.

4. Fraud and sanctions screening

Transactions may be screened by the payment provider and by us for fraud and sanctions risk. A transaction that fails screening will be declined, and where a payment has already been taken it will be refunded to the original card.

5. Cards accepted

We accept Visa and Mastercard and Amex. All transactions are billed in XCD (EC $), and the merchant outlet country is Saint Lucia.

6. Reporting a security concern

Email info@ecbankers.org or call +1 (268) 720-4323. If you believe a payment on your card was not authorised by you, contact your card issuer as well as us.