Credit Card Processing Blog

From a merchant’s point of view, face-to-face and e-commerce transactions are similar in that in both environments the payment information is electronically collected by the merchant’s system. In the former instance the data processing is performed by a point-of-sale (POS) terminal, which reads the card’s information following a swipe, while in the latter the task is performed by the merchant’s payment gateway, following the customer’s manual entry of her payment information on the merchant’s website.

But how do you accept your customer’s payment, if her credit card information is verbally given to you over the phone or electronically by fax or via email? Well, that’s when you need a virtual terminal. Here is what you need to know about this payment processing service and how to use it.

Virtual Terminal Basics

Virtual terminal is the web-based equivalent of the physical POS credit card acceptance machine. It performs exactly the same function, which is to collect the transaction information, encrypt it for protection against hackers, transmit it securely to the processor and then communicate the processor’s authorization response back to the merchant. The only difference is that, rather than reading the customer’s payment information from her card’s magnetic stripe or chip, the virtual terminal does it from a payment form, which is filled out by the merchant in a browser. In that respect, the virtual terminal resembles an e-commerce transaction processing set-up, except that in the latter case the payment form is filled out directly by the customer.

So it can be said that, when making an e-commerce payment, the customer is doing it through a simplified version of a virtual terminal. The only difference between making an online payment for yourself and doing it for a customer of yours is that in the first instance you are charging your own card, while in the latter you are billing your customer.

A great thing about virtual terminals is that they can be accessed from anywhere internet connection is available, either from a computer or a smart phone. You can set up multiple user accounts for your employees and assign different levels of control.

Some virtual terminals allow you to accept ACH (e-check) payments, in addition to bank cards. However, not all of them do, so if you need e-check acceptance, be sure to ask your prospective processor if their system supports it.

Recurring Payment Support

Some merchants’ business models are based on delivering products and services on a pre-determined schedule (weekly, monthly, etc.) over time. For instance, a car insurance policy is typically paid in monthly installments of pre-defined amounts. These are known as recurring payment plans and can last until the payment plan is canceled by the customer. A similar type of a plan can be set up for the payment of, say, a TV set. In this case, however, both the number of payments and their amounts are pre-determined and the plan is automatically discontinued after the last payment is processed. These are known as installment payment plans.

The virtual terminal is the best platform for setting up and managing recurring and installment payment plans. It enables you to create customer profiles by storing their payment information securely on your processor’s server. Then you can use the managed billing service that is built into the system to manage your customers’ payment plans.

Who Are Virtual Terminals For?

Virtual terminals are designed for everyone who accepts payments in a non-face-to-face environment. That includes e-commerce businesses, which sometimes need to process a payment that a customer has called in for some reason, rather than made online. Conveniently, all major payment gateways feature a built-in virtual terminal.

Yet, the primary virtual terminal users are mail order and telephone order (MO / TO) merchants, which accept payments exclusively by phone or mail. Virtual terminals are also the preferred payment processing platform for most non-profit and membership-based organizations, either exclusively or in combination with an e-commerce set-up.

The Takeaway

If you don’t meet your customers in person or do not operate an e-commerce website, you need a virtual terminal to accept payments. Typically, the most cost-effective approach would be to have your processor provide both the merchant account and the virtual terminal. Keep in mind that all major virtual terminals out there have the same capabilities, so there is no reason to overpay for any one of them.

Image credit: Real Simple.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

At UniBul Merchant Services the great majority of our clients are e-commerce and mail order or telephone order (MO / TO) merchants. We get to speak to people from many businesses and non-profits that accept payments in a non-face-to-face setting which, incidentally, is how we get many of the ideas for our blog posts.

A recent conversation with the owner of a medium-sized provider of SAT preparatory courses reminded me that I needed to write a refresher course on credit card acceptance over the phone. It has been a while since we have written anything on this topic and there are a few new things that need to be added to what we’ve already said.

How to Process MO / TO Credit Card Payments

Your primary objective when accepting payments over the phone or in the mail must be to verify the cardholder’s identity and the validity of the card. To that end, you will need to implement the following procedures into your payment processing cycle:

• At a minimum, you should always collect the following information from your customer:
  • The entire card account number.
  • The cardholder’s name, as shown on the card.
  • The card expiration date, as shown on the card.
  • The cardholder’s billing address.
  • The card security code (CVV2, CVC 2 or CID, depending on the brand).
  • Ask if the card has a start date and if so, record it.
  • Ask for a contact phone number. Ideally, you would want to obtain a land line phone number, which you can much more easily verify through directory services.
  • Ask for the name of the card issuer.
  • If you are taking an order over the phone, make a note of:
    • The date and time of the conversation.
    • The details of the discussion.

    
    These details can come in handy during a follow-up conversation, but also in case of a dispute later.

• If you are taking an order by mail or fax:
  • Always ask for a signature on the order form. Notate the field as mandatory.
  • Save a copy of the order.
  • Get proof of delivery.

  
  Your processor may also request that additional details are obtained. Contact them and ask what their requirements are. There is usually a good reason for that.

• Use the Address Verification Service (AVS) for all of your transactions. Verifying whether the billing address provided by your customer matches the one on file with the issuer is an important indicator that should be part of your fraud prevention process. It is a simple and inexpensive service and there is absolutely no reason not to use it.
• Implement a fraud screening process, which would, if certain pre-defined high-risk characteristics are discovered, suspend the processing of the transactions at issue and set them aside for a more detailed review. Whether proprietary or provided by a third-party, your fraud screening mechanism should use the following elements as trigger points for the suspension of a transaction:
  • Match with information in your internal negative file.
  • Exceeding your internal velocity limits and controls.
  • An AVS mismatch.
  • A security code mismatch.
  • International shipping address.
  • International IP address.
  • Shipping address that is different from the billing one.
  • High-risk shipping address, such as P.O. boxes, prisons, hospitals and addresses with known fraudulent activity.

When developing your own internal policies for processing credit card transactions (yes, you do need to do that!), you should adjust the above procedures to address your particular circumstances. Then you will need to provide adequate training to all of your employees.

Get a personalized credit card rate for each of your transactions!

Get the lowest possible credit card processing rate for each individual transaction! Our interchange-plus pricing model gives you:

• Processing rates calculated separately for each transaction to ensure that not a single one of them is overcharged.
• No more mid-qualified and non-qualified fees.
• No fixed monthly fees.

By now all regular visitors to this blog should have learned that accepting payments online, over the phone or in any other card-not-present setting is a much riskier affair than a face-to-face transaction. Admittedly, most of our readers are involved, in one way or another, in processing credit card payments, and already knew that from experience, even before we first wrote on the subject.

Still, it is worth reiterating exactly what the risks are, before we suggest ways to mitigate them. The two biggest issues, often interrelated, associated with processing card-not-present payments are fraud and chargebacks. The reason why fraud is more rampant online than in brick-and-mortar stores is that it is much more difficult to establish the legitimacy of the cardholder and the validity of the card when neither can be seen. Chargeback levels are higher for much the same reason, but also, because accepting card payments online or over the phone allows for more processing errors.

Yet, although at an obvious disadvantage, e-commerce and MO / TO merchants are not exactly at the mercy of the criminals. Plenty of tools are available to help you fight fraud and following best card acceptance practices will further minimize fraud and chargeback levels. In this post I will offer nine simple steps for processing card-not-present payments. If you follow them in each of your sales transactions, both your fraud and chargeback rates will decline significantly.

When a customer makes a payment at the checkout of your online store or over the phone to complete a transaction, your system needs to perform the following actions:

1. Collect the payment information. At a minimum, the following information needs to be submitted with each sales transaction:
   • The cardholder’s name, card account number and expiration date.
   • The cardholder’s full billing address and the shipping address (if applicable).
   • The payment date.
   • The total amount of the payment, including all applicable taxes and gratuities purchased on the card.
   • A mutually acceptable description of the products or services purchased by the cardholder.
2. If participating in Verified by Visa (VbV) or MasterCard SecureCode (you should), complete the respective authentication process and provide the authentication data in the authorization request. These services add an additional security layer to help protect merchants that accept cards over the internet.
3. Perform internal fraud screening. You need to develop a fraud screening system, or obtain one from a third-party vendor. This mechanism will, if certain predefined high-risk characteristics are found, suspend the processing of the transaction at issue. Such services will help you verify the validity of both the cardholder and the card.

   
   Additionally, transactions should be matched against velocity parameters, high-risk locations and internal negative files. Transactions that raise suspicions should be subjected to a further review.

4. For transactions that pass your internal scrutiny, obtain authorization from the card issuer. Authorization is the process of obtaining permission from the card issuing bank to accept the card for payment and should be obtained for all card-not-present transactions (see chart below).

   
   

   
   With your authorization request you should also perform the following verifications:

   • Address verification. The Address Verification Service (AVS) is a risk management tool that enables merchants accepting card payments in a non-face-to-face environment to verify the validity of the billing address provided by their customers by comparing it to the one on file with the card issuer.
   • Verification of the card security code. Card security codes are the 3-digit numbers on the back of Visa, MasterCard and Discover cards and the 4-digit codes on the front of American Express cards. They were introduced to help e-commerce and MO / TO merchants verify that their customers are in a physical possession of their cards at the time of the transaction. It is a feature that all major payment gateways support and your payment processing provider should make it available to you. You should never store card security codes.
5. Use the correct electronic descriptor. The electronic descriptor identifies the transaction type and helps processing banks to differentiate merchants based on the way payments are accepted. Indicate “Mail Order,” “Telephone Order,” “Internet Order,” or “Signature on File,” as applicable, into the appropriate field of the authorization and settlement messages.
6. Provide your customer with the expected delivery date. Tell your customer what the delivery method and expected delivery date will be. If a delivery is running late, immediately inform your customer of the new expected delivery.
7. Do not deposit transactions before the shipping date. For card-not-present transactions, the transaction date is the shipping date, not the order date ( see graph above). Transactions cannot be deposited until the products or services have been shipped. Also, you shouldn’t be late with your deposits. Transactions deposited more than 30 days after the transaction date may be charged back to you.
8. Make your organization’s return and credit policies available to consumers through clearly visible links on your website. Placing these links in your website’s footer or header will usually make them present on all pages, so that customers can easily review them.
9. Place your customer service number on all of your website pages. This is a crucial, though often neglected, requirement. Most customer questions can be answered and concerns alleviated with a simple phone call, before they deteriorate into disputes and chargebacks. You should also make available to your customers other communication methods, like email and chat, but not in place but in addition to phone support.

That’s it, nine simple steps to follow in each of your transactions. Actually, the last two are only applicable to e-commerce businesses, so MO / TO merchants only have seven to think of. Unfortunately, some fraud and chargeback causes will remain beyond your control, but applying the above suggestions will remedy the vast majority of them and you will be in a pretty good shape.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

We recently reviewed the requirements for accepting card-present Discover transactions. In this post we will go over the requirements for processing mail and telephone order (MO / TO) sales.

Just as is the case with Visa and MasterCard, the floor limit for card-not-present Discover transactions is zero. This means that merchants accepting Discover card payments over the telephone or in the mail are required to obtain an authorization approval for each transaction. Listed below are the payment acceptance procedures that need to be followed for MO / TO transactions:

1. Cardholder verification. Although it is not a mandatory requirement, MO / TO merchants should verify the cardholder’s billing address and confirm the delivery address by using the Address Verification Service (AVS). AVS confirms an address provided by the cardholder by comparing it with the one on file with Discover. It is a strong tool for protection against fraud, although it does not eliminate the possibility of chargebacks.
2. Documentation of card sales. Merchants are required to include all merchandise and / or services purchased at one time on one sales receipt. Additionally, the following information must be provided for each mail or telephone order card sale:
   • Cardholder name.
   • Card account number.
   • Card expiration date.
   • Merchant’s name.
   • Shipping address.
   • Description of the merchandise or service purchased.
   • Total amount of the transaction (including sales tax and / or tip).
   • Transaction date.

   
   Merchants should retain the transaction information, along with the shipping date, for at least six months and provide it per request in case of a chargeback or a customer dispute.

3. Transmission of transaction information. Merchants are required to transmit their Discover card transaction data daily. For all MO / TO transactions, the sales data should not be transmitted until the merchandise or services have been shipped, delivered or provided. MO / TO merchants are allowed, however, to accept deposits on their sales and can send to Discover transaction data related to such deposits before the shipping or delivery date.
4. Delivery requirements. MO / TO merchants are required to provide the cardholder, at the time of delivery of the products or services, with an invoice or other documentation that includes the information listed in section 2 above. Merchants should consider using shipping services that allow them to obtain the cardholder’s signature as proof of delivery, which can later be used in case of a customer dispute or a chargeback. If a cardholder comes to the merchant’s location to pick up a product ordered by mail or telephone, the merchant is required to obtain an imprint of the card and the cardholder’s signature.

Most MO / TO merchants now use virtual terminals for processing their card transactions. Virtual terminals are typically set up to automatically provide Discover, as well as the other card networks and companies, with the information they require, in the manner they have prescribed. You should not take this for granted, however, and double check with your processor. Additionally, and this is entirely within your own control, you need to ensure that, for all MO / TO sales, transaction data are not transmitted to your processing bank until the merchandise or service have been shipped or provided.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

The Merchant Direct Access Service (MDAS) provides Address Verification Service (AVS) authorization services to smaller merchants operating in a card-not-present environment, mainly to small mail order and telephone order (MO / TO) businesses. MDAS connects merchants to the AVS service by telephone. If your credit card processing volume is small or infrequent and if electronic access to AVS is not otherwise available, or if you want to access AVS for transactions that are key-entered when the card’s magnetic stripe cannot be read, MDAS may be the right option for you. MDAS provides AVS service on a per-transaction basis.

How to use MDAS. To use the Merchant Direct Access Service, all you need is a telephone and a Merchant Access Code (MAC) which you will get from your payment processing provider. To request an AVS authorization, you will dial a toll-free number and follow the instructions that the automated system will give you. You will need to provide your customer’s billing address and account number and the system will give you the verification results.

MDAS responses. The responses MDAS provides are very similar to the ones AVS provides but do not include response codes. You will receive one of the following MDAS responses:

MDAS provides a way to use AVS on a selective basis. Merchants who choose to implement it will be able to cut costs by minimizing address verification requests, while still verifying the validity of these credit card transactions that are most likely to be fraudulent. If you choose to enroll in MDAS, you need to contact your processing bank.

Accept card payments quickly and safely

Accept online payments via credit and debit cards and electronic checks at the lowest processing costs. You will get:

• Free merchant account and Authorize.Net gateway set-up.
• No monthly merchant account or gateway fees.