Inside the Black Hole

Self-service terminal is a cardholder-activated terminal (CAT), especially one that includes the functions both of delivering and paying for products (for example, an automatic terminal at a gas or train station).

The following card acceptance requirements apply to the use of self-service terminals, in addition to the general requirements applicable to all CATs:

1. Self-service terminals do not process personal identification numbers (PINs). They include, but are not limited to, automated gas station terminals.
2. All self-service terminals must comply with the following requirements:
   • The floor limit for all transactions at self-service terminals is zero, which means that all transactions must be authorized, regardless of the transaction amount.
   • The merchant’s processing bank must read and transmit full, unaltered card account data.
3. The authorization system will send all transactions identified as self-service terminals in the authorization request message to the card issuer.
4. The maximum transaction amount for all transactions at self-service terminals is $100 or its equivalent.
5. Chargebacks processed because no cardholder authorization was obtained for self-service terminal transactions will be allowed only if the card issuer verifies that the account number used in the transaction is fraudulent, as documented in a letter written by the cardholder to the card issuer. Additionally, the card issuer must block the account number and list it on Visa’s or MasterCard’s file with a “capture card” response until card expiration. Card issuers in the Europe region also must list such accounts on the European Stop List (ESL).
   Counterfeit transactions processed at self-service terminals for which the processing bank has transmitted the full magnetic stripe data in the authorization request message and for which an authorization was obtained are ineligible for chargebacks processed because of no cardholder authorization.
6. A U.S.-based merchant acquiring automated gas station transactions at self-service terminals may forward an authorization request message for $1 if properly identified by MCC 5542 (automated fuel dispenser) and cardholder-activated terminal level indicator 2. If an authorization is obtained, the processing bank is protected from authorization related chargebacks “requested / required authorization not obtained”, or “exceeds floor limit – not authorized and fraudulent transaction” for transactions less than or equal to $75. The processing bank protection is limited to $75 for transactions that exceed $75, and card issuers may charge back only the difference between the transaction amount and the implied $75 limit.
7. A self-service terminal that also is a hybrid terminal can perform fallback procedures from chip to magnetic stripe unless it is prohibited by regulations.

Accept card payments quickly and safely

Accept credit and debit card payments at the lowest processing costs. You will get:

• Free merchant account set-up.
• No fixed monthly fees.
• 24 / 7 customer support.

Transactions that a cardholder initiates during a flight are known as in-flight commerce (IFC). In-flight commerce terminals are cardholder-activated terminals operated on aircraft. Merchants operating such terminals and their processing banks must comply with the following requirements:

1. Requirements for processing banks and service providers.
   • Processing banks must ensure delivery and installation of the In-Flight Commerce Blocked Gaming File to gaming service providers, before they can process gaming transactions.
   • Processing banks must identify IFC services or products with the most appropriate merchant category code (MCC) in the authorization message and merchant business code (MCC) in first presentment messages. If an airline also acts as the service provider, the processing bank may not use an airline MCC but must assign the proper MCC for each type of IFC transaction. The following list of IFC transaction types must be identified with the designated MCC:
     
     

     IFC Transaction Type	MCC
     Catalog merchant	5964
     Duty-free store	5309
     Gaming	7995
     Miscellaneous services	7299
     Video game	7994

   
   

   • Transactions must be consolidated by MCC, per flight, for each cardholder account.
   • Processing banks must identify the transaction with the most appropriate transaction category code (TCC) in the authorization request message, as shown in the table below.
     
     

     If the IFC transaction is for…	The acquirer must use TCC…
     Gaming	U for Unique Transaction
     Anything other than gaming	R for Retail Purchase

   
   

   • The merchant’s name and location must include the service provider’s name and flight identification. The flight identification must be a recognizable identification of the airline.
   • The city field description for mailed purchases and gaming transactions should contain the service provider’s customer service telephone number. For all IFC transactions other than mailed purchases and gaming, the city field description optionally may be a customer service telephone number.
   • For all IFC transactions except IFC mailed purchase transactions, the transaction date is defined as the date that the flight departs from the originating city. The transaction date for mailed purchases is defined as the shipment date unless otherwise disclosed to the cardholder.
   • Processing banks must ensure that the service provider provides full disclosure to the cardholder via the video monitor screen prior to the initiation of any IFC transactions. The screen must prompt the cardholder to acknowledge these disclosure terms before initiating a transaction. Disclosures must include the following:
     • Full identification of the service provider and provision for recourse in terms of cardholder complaints or questions.
     • Notification that transactions will be billed upon the issuer’s approval of the authorization request.
     • For mailed purchases only, any additional shipping or handling charges.
     • Policy on refunds or returns.
     • Provision for a paper receipt.

     
     For IFC gaming transactions, service providers must additionally disclose the following:

     • Maximum winnings ($3,500) and maximum losses ($350).
     • Notification that total net transaction amount (whether a net win or loss) will be applied against the cardholder’s account.
     • Notification that cardholder must be at least 18 years of age to play.
     • Notification that some card issuers may not allow gaming.
   • Processing banks must ensure that the service provider is capable of providing an itemized receipt to the cardholder for all IFC transactions. The processor must ensure that, at the cardholder’s option, the service provider can effect this offer in one of three ways:
     • Printing a receipt at the passenger’s seat.
     • Printing a receipt from a centralized printer on the plane.
     • Mailing a receipt to the cardholder.

     
     The mailed receipt offer must be made available via the video monitor and must require the cardholder to input his or her name and address. For IFC gaming transactions the service provider must provide a receipt to the cardholder by one of the first two methods described above. The receipt must contain the following elements:

     • Identification of the passenger’s flight, seat number, and date of departure.
     • Itemized transaction detail.
     • Gaming transaction specified as a net win or net loss.
     • The cardholder’s account number truncated on the receipt. Processors must ensure that transaction receipts provided to cardholders show only the last four digits of the cardholder account number. The remaining digits must be truncated. It is also recommended that truncated digits are replaced with fill characters such as “x”, “*”, or “#” and not with blank spaces or numeric characters.
   • For IFC terminals, the assurance and demonstration of security of the transmission of data between the on-board client server and the processing bank and the physical controls over hardware and operating software. Encryption of transmitted data is recommended.
2. Transaction requirements.
   • No maximum transaction amount applies to any IFC transaction, with the exception of IFC gaming transactions.
   • An IFC terminal that also is a hybrid terminal is prohibited from performing fallback procedures from chip to magnetic stripe.
3. Cardholder account number verification – in-flight verification prior to transaction initiation. Prior to initiating an in-flight card transaction, the account number must be verified. The following procedures should be followed:
   • The service provider must conduct a Mod-10 check digit routine to verify the card’s authenticity.
   • The service provider must confirm that the card account number is a valid one. A valid number for each card brand should begin with:
     • American Express cards – 3.
     • Visa cards – 4.
     • MasterCard cards – 5.
     • Discover cards – 6.
4. Authorization requirements.
   • The authorization request message must include the cardholder-activated terminal indicator.
   • The processor must read and transmit full, unaltered card-read data. An IFC authorization request may not contain a key-entered account number or expiration date.
   • Transactions are either authorized air-to-ground during the transaction or authorized in a delayed batch. All are authorized on a zero floor limit basis.
   • The processor must convert all “refer to card issuer” and “capture card” messages received from issuers to “declines.”
5. Clearing requirements.
   • The processor is not permitted to submit declined transactions for clearing.
   • No surcharges or service fees may be assessed on any IFC transaction.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

A face-to-face environment provides a much more secure way for accepting card payments than a non-face-to-face setting. As a result, brick-and-mortar businesses typically suffer from less fraud and chargebacks and pay lower transaction fees than e-commerce and direct marketing (MO / TO) merchants. Let’s take a look at the typical characteristics of a face-to-face transaction, what makes it safer and how to keep it that way.

Card-present transactions are those in which both the card and the cardholder are present at the time the payment is processed. Card-present merchants include grocery stores, department stores, fast-food restaurants, movie theaters, etc. Card acceptance settings where cardholders use unattended point-of-sale (POS) terminals, such as gas stations, are also defined as card-present transactions.

Visa and MasterCard require that merchants make all efforts to ensure that all card payments they accept are legitimate. This is in the merchant’s best interest as well, as fraud is costly, damages its reputation and, if unchecked, can lead to the suspension of the merchant account.

All card-present transactions are executed at a POS terminal. Whether you are experienced at the job or are new to it, if you follow a few simple card acceptance procedures, you will be sure to do it right every time a card is presented by a customer. A typical face-to-face card acceptance procedure goes through the following stages:

1. Swipe the card. The first step in the payment acceptance process is swiping the card. Once the card is swiped, you should take it in your possession for the remainder of the transaction.
2. Authorization. Authorizations are required before completing a card-present transaction in the following instances:
   • The transaction amount exceeds your floor limit or the floor limit applicable to the transaction.
   • The card is expired or not yet valid.
   • The card is not signed.
   • You wish to delay presenting the transaction record.
   • The transaction receipt cannot be imprinted although the card is present.
   • The terminal is unable to read the magnetic stripe or the chip (if one is present) on the card.
   • The account number is listed on the Electronic Warning Bulletin or on the regional Warning Notice. If an account is listed in on the Electronic Warning Bulletin or regional Warning Notice, you must call your processor’s voice authorization center. You may be instructed to retain the card, which you should only do if it is safe to do so.
   • The transaction is a recurring payment installment and a previous authorization request was declined by the card issuer.
   • You are suspicious of the transaction for any reason. If the card or the cardholder looks suspicious, you must contact your processor’s voice authorization center and make a Code 10 call.

   
   Listed in the table below are the possible responses to your authorization request and advice on how to proceed when you receive the response:
   
   

   Response	Explanation
   Approved	Issuer approves the transaction. This is the most common response – about 95% of all authorization requests are approved.
   Declined or Card Not Accepted	Issuer does not approve the transaction. The transaction should not be completed. Return the card and instruct the cardholder to call the Issuer for more information on the status of the account.
   Call, Call Center, or Referrals	Issuer needs more information before approving the sale. Most of these transactions are approved, but you should call your authorization center and follow whatever instructions you are given. In most cases, an authorization agent will ask to speak directly with the cardholder or will instruct you to check the cardholder’s identification.
   Pick Up	Issuer wants to recover the card. Do not complete the transaction. Inform the customer that you have been instructed to keep the card, and ask for an alternative form of payment. If you feel uncomfortable, simply return the card to the cardholder.
   No Match	The embossed account number on the front of the card does not match the account number encoded on the magnetic stripe. Swipe the card again and re-key the last four digits at the prompt. If a “No Match” response appears again, it means the card is counterfeit. If it can be done safely, keep the card in your possession, and make a Code 10 call.

   
   

3. Examine the card. While waiting for the authorization result, check the card’s security features to make sure it is authentic. Make sure that the card account, the expiration date and the card security code not been altered or tampered with and that the back of the card is signed.
4. Customer signature. If the transaction is authorized, you should obtain the cardholder’s signature on the printed sales receipt. If the signature is missing, you may lose re-presentment rights if the transaction is charged back.
5. Compare signatures. Compare the signature provided by the customer to the one on the back of the card and make sure they match. Also compare the account name and number printed on the receipt to the ones on the card.
6. Return the card and receipt to your customer. If you are satisfied that the transaction is legitimate, return the receipt and the card to the cardholder, along with the purchased merchandise to complete the transaction.
7. Make a Code 10 call. If you believe that a fraudulent activity is taking place, make a Code 10 call to your processor’s authorization center for instructions on how to proceed.

Accept card payments quickly and safely

Accept credit and debit card payments at the lowest processing costs. You will get:

• Free merchant account set-up.
• No fixed monthly fees.
• 24 / 7 customer support.

Floor limit is the amount above which credit card transactions must be authorized before being processed. The floor limit can vary from business to business and is specified in the merchant processing agreement. All card transactions conducted in a non-face-to-face environment have a zero floor limit, which means that all of them must be authorized, regardless of the amount. Non-face-to-face transactions include e-commerce and MO / TO (mail order and telephone order) payments and refunds, but exclude transactions at cardholder-activated terminals (CATs), like the ones at gas or train stations, which are considered face-to-face, even though the merchant is not physically present to accept the card.

For example, if a store’s floor limit is $25.00, every purchase of $24.99 or less would not have to be authorized, while transactions of $25.00 or more would require authorization. Authorization is the process by which a card issuer approves or declines a transaction. In a face-to-face environment, the authorization occurs automatically when the cardholder swipes her card through the merchant’s point-of-sale (POS) terminal. In a non-face-to-face setting, the authorization occurs when the card account’s information is submitted online or over the phone. In both instances, once the card information is provided, it is routed to the card issuer through Visa’s or MasterCard’s network and then the card issuer’s response is routed back through the same channel, approving or declining the transaction.

Floor limits carried a much greater importance in the past when the merchant had to call for an authorization on any payment amount that was over a predetermined level. Back then payment card processing involved taking a physical imprint of the card and the authorization process required a personal review, making the process both time consuming and expensive. Today merchants can benefit from electronic authorization systems that payment processors provide at a very low cost. Once a payment is authorized, the merchant has an additional, and powerful, assurance against fraud. Still, even today, the floor limit concept comes into play occasionally.

For example, if unable to connect to the payment processor’s authorization system, a merchant will not be able to obtain an electronic authorization and will have no recourse against fraudulent activity or a customer dispute that will potentially lead to a chargeback. Yet, if the transaction amount is less than the floor limit, no authorization is required by the payment processor. If, however, the amount is over the floor limit, the merchant must authorize the transaction and can do this by making a telephone call to the payment processor and obtaining a “voice authorization.” In this case the merchant will be well advised to also take the card’s imprint and place it on the sales receipt. Voice authorizations should be used only as a last resort, as they bypass the processing bank’s systems and cannot be used as supporting evidence in chargeback re-presentments. You should avoid key-entering voice-authorized transactions.

Accept card payments quickly and safely

Accept credit and debit card payments at the lowest processing costs. You will get:

• Free merchant account set-up.
• No fixed monthly fees.
• 24 / 7 customer support.