Credit Card Processing Blog

All valid Visa credit and debit cards display a set of unique security features that every merchant should be familiar with. Every time you accept a Visa card for payment and while waiting for the issuer’s response to your authorization request, you should examine these features to ensure that they have not been altered or tampered with in any way. Remember that an authorization approval does not protect you against fraud and it is your responsibility to verify the validity of the transaction.

Listed below are Visa’s card identification features, along with tips on how to verify their validity.

Visa Card Security Features

1. Visa brand mark. The blue and gold Visa logo is usually displayed on a white background in the bottom right, top left or top right corner. The upper left placement is allowed only on chip cards.

2. Account number. Visa account numbers always start with the number “4″ and are 16-digit long. The numbers must appear in one line and be clear and uniform in size and spacing.

3. BIN number. The first four digits of the account number must be printed directly below it. This is the issuer’s Bank Identification Number (BIN). These two numbers must be identical.

4. Member since. Some Visa cards display the month and year in which the account was open.

5. Expiration date. The expiration date should be located below the account number and be in the format “mm/yy.” Expired cards are invalid and should not be accepted.

6. Cardholder name. The cardholder name or a generic title may be printed or embossed on the card, however on some Visa cards the field may be blank.

7. Micro-chip. Some cards feature a chip, which is located above the account number.

8. Dove hologram. The Visa dove hologram can be placed anywhere on the front or back of the card. This three-dimensional image should appear to move as you rotate or tilt the card.

9. Vertical orientation. Some Visa cards are vertically oriented and the account information is laser-printed, not embossed. These cards have magnetic stripes and a card verification code on the back, just as their more conventional counterparts.

10. Mini-card. This is a miniature version of a standard Visa Card or Visa Electron Card.

11. Magnetic stripe. The magnetic stripe contains the card account’s identifying information. When the card is swiped through a point-of-sale (POS) terminal, the encoded information is read and displayed on the terminal’s screen. The displayed information should match the one on the card itself.

12. Signature panel. The signature panel must appear on the back of the card, with the word “Visa” printed repeatedly within an ultraviolet element. Depending on the card design, the panel may feature the full account number printed on it, only its last four digits or none at all. If the signature panel is scratched or erased, the word “void” appears underneath repeatedly.

13. Card Verification Value 2 (CVV2). The three-digit CVV2 number appears in a white box either to the right of the signature panel or within it. CVV2 is used in card-not-present transactions to verify that the customer is in possession of the card.

If your inspection of the card leads you to suspect that it may have been altered or tampered with in some way, you will have to make a Code 10 authorization call. You will be transferred to the issuer’s authorization center and be given instructions on how to proceed with the transaction.

The Takeaway

Accepting card payments in a face-to-face setting gives you the huge advantage of being able to physically inspect each card and ensure its validity. Add to that the ability to evaluate your customer’s behavior for signs of anything suspicious or unusual and it becomes obvious why a face-to-face environment is lower-risk than card-not-present one. There is no excuse for not taking advantage of it. Inspecting the security features of a Visa card should only take you a couple of seconds and there is no better way to spend your time while waiting for an authorization response.

Image credit: Banking4Tomorrow.com.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

Slowly but surely the EMV (also known as chip-and-PIN) credit card technology is coming to the U.S. JPMorgan Chase has just rolled out its third such product, co-branded with British Airways and designed specifically for Americans traveling abroad who’ve long had issues getting their magnetic stripe cards accepted outside the U.S.

All three of Chase’s chip cards are actually hybrids – they also feature a magnetic stripe, which makes them acceptable in the U.S. where the vast majority of pint-of-sale (POS) terminals do not at present support the chip-and-PIN technology. That, however, is about to change, fast.

The Chase / BA Card and the Issue with EMV

The new Chase / BA card will surely appeal to globe-trotting Americans, whose European credit card acceptance travails have been well documented, including on this blog. The issues began in the early 2000s when the EMV technology first made its appearance in the U.K. and then quickly displaced the older and less secure mag-stripe cards across Western Europe.

The problem was that cards issued by U.S. banks still relied exclusively on the magnetic stripe. They could still be accepted through EMV terminals if fallback procedures were followed, but in real life most European merchants either did not know how to do that or simply didn’t want to.

As a result, many Americans found themselves unable to use their cards in Europe. In 2008 alone, U.S. issuers lost $447 million in revenues, because 9.7 million Americans could not use their cards abroad, according to a report from Aite Group, a research and advisory firm. Moreover, U.S. issuers were missing out on a huge cost-cutting opportunity in the form of lower fraud losses. Their U.K. peers were enjoying a decline in in-store credit card fraud from £218.8 million ($342.3 million) in 2004 to £98.5 million ($154.1 million) in 2008, according to data from the U.K. Payments Administration.

Why then, you may ask, haven’t U.S. banks taken steps to resolve the issue and save themselves well over half a billion dollars a year in the process? Well, it turns out that the wholesale switch to EMV would have cost issuers a lot more, close to $3 billion, according to one estimate by the Mercator Advisory Group, a consultancy. Apparently the banks thought that was a bit too much and just kept swallowing their losses. All that changed, however, with the arrival of yet another payment technology – near-field communication or NFC.

Visa: All U.S. Processors Must Support Chip Transactions by April 2013

NFC is the technology behind Google Wallet, Isis and many other new mobile payments services that many studies predict are about to take the world by storm in the coming years. It allows payments to be made by waving chip-containing phones by NFC-enabled POS terminals, which communicate wirelessly between each other to complete a transaction.

As Google and most of its rivals, as well as all big U.S. telecommunications companies, began developing their NFC platforms, which clearly were encroaching in Visa’s territory, the credit card giant decided to step into the fray and mandate that all of its processing banks “support merchant acceptance of chip transactions no later than April 1, 2013.” In case you somehow misunderstood what that meant, Visa spelled it out for you:

The adoption of dual-interface chip technology will help prepare the U.S. payment infrastructure for the arrival of NFC-based mobile payments by building the necessary infrastructure to accept and process chip transactions that support either a signature or PIN at the point of sale.

It is clear that Visa is hoping to lay down an NFC standard, so that all POS terminals can communicate with chips containing Visa card information, regardless of whether the customer uses Google Wallet, Isis or any one of the many other platforms that are soon going to be in use.

The Takeaway

Visa’s sudden NFC push is actually good for consumers and, in a case of a benign side effect, it is also helping to cure Americans’ card-induced headaches in Europe. Of course, in time EMV cards will displace mag-stripe ones altogether, but that day is still some way off.

The Chase / BA card comes with another feature that is sure to be greatly appreciated by its users. It charges no foreign transaction fees, unlike all older Chase cards, mine very much included, which cost you additional three percent of the sale’s amount when you use them abroad. I hope other banks will now take a page of Chase’s book.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

There is a wide range of risk management services that merchants and processors can choose from and implement into their fraud prevention strategies. Some of them are free, while others are paid for and some of them can be used in any type of credit card acceptance setting, while others are specifically designed for card-not-present or face-to-face environment.

In this article I will review eight risk management services developed by Visa to help your business and payment processor detect and prevent fraud.

Fraud Detection Services

1. Falcon Fraud Manager – a customizable platform that performs fraud scoring to capture relationships and patterns and detect and stop potentially fraudulent activity. The primary system components are:

• Falcon Debit – calculates a fraud score for each transaction based on individual cardholder and transaction data. If the score indicates a high probability of fraud, the transaction can be sent to a fraud analyst for review or be blocked. The fraud score can also be used for making real-time authorization decisions.
• Falcon Expert – enables users to define rules to automate fraud prevention procedures by allowing the use of other relevant transaction information, in addition to the fraud score.

2. Flash fraud rules – provide a parameter-based set of rules to help identify and block suspect transactions falling into pre-determined risk categories. The following data fields can be used to block suspicious transactions:

• Merchant country code.
• Merchant category code.
• Merchant ZIP code.
• Acquiring network ID.
• Personal account number (PAN) entry mode.
• Transaction amount range.
• CVV checked indicator.
• CVV result.
• BIN.
• Prior Falcon score.
• Visa Advanced Authorization Risk Score or Risk Condition Code.

Authorization Services

3. Authorization edit checks – can be set at the financial institution, card group, or individual cardholder level. Users can set limits separately for cash and point-of-sale (POS) activity, and timeframes can be set for single- or multiple-day periods. Authorization edit checks include:

• Daily spending limits – monitor amount spent and cash back.
• Velocity checks – monitor the frequency of card use.
• Expiration date checks – verifies if the card is expired and checks for an exact expiration date match.
• Name match – limits the risk of counterfeit cards by comparing the Track 1 names on incoming authorizations to names on file.
• PIN validation – matches entered PIN to the PIN on file (for ATM and select POS transactions).

4. Visa fraud protection services. The following programs verify additional information in the authorization message:

• Cardholder Verification Value (CVV) – validates verifies a unique three-digit code on the magnetic stripe of all Visa cards to detect counterfeit cards.
• Cardholder Verification Value 2 (CVV2) – validates a unique three-digit number, printed on the back side of the card, to limit fraudulent card-not-present transactions.
• Dynamic Cardholder Verification Value (dCVV) – verifies a dynamic three-digit value provided by the chip on a contactless card to detect fraud.
• Address Verification Service (AVS) – enables merchants to validate a cardholder’s billing address by matching it to the one on file with the issuer.

5. Verified by Visa (VbV) – used to authenticate a cardholder’s identity by asking them to enter a password during the authorization process of an online Visa transaction.

6. Visa Advanced Authorization – a risk evaluation system that provides risk information for all authorizations initiated with a U.S.-issued Visa card. Visa has developed fraud rules to stop activity based on pre-defined Visa Advanced Authorization scores. Risk information is provided in the form of:

• Risk scores – indicate the probability that an authorization is fraudulent.
• Risk condition codes – provides information for compromised accounts or ones associated with an account-generation scheme, as identified across the Visa payments system.

7. Stand-in processing – Visa authorizes transactions when the issuer’s host system is unavailable or when the issuer has chosen Visa to process certain transactions on their behalf.

8. Suspect activity reporting – it helps identify excessive or abnormal cardholder activity levels. Reports can be configured to monitor transaction counts and dollar limits.

The Takeaway

Not all of the above services are designed to be implemented on a merchant level. Perhaps you don’t really need to be all that familiar with some of them. Yet, it doesn’t hurt to know what’s being done to fight fraud, especially if you are operating in a high-risk industry. Educating yourself on risk management is the surest way to improve your business’ fraud prevention capabilities.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

We write about a lot of payment card industry-specific staff here on this blog: services, systems, products, best practices, etc. We try to explain, as best we can, how the credit card processing world functions and, more to the point, where your place in it is. Some of the things we write about you really, really need to understand very well, others you need to have at least some basic knowledge of, while still others some of you can do perfectly well not even knowing of their existence or meaning.

The system that I will review in this article falls squarely into the first of the above categories. It is Visa’s payment system, the biggest payment processing platform in the world and the one that is likely to handle the majority of your card transactions.

What Is Visa’s Payment System?

Visa’s system includes technology, products, services and marketing programs that facilitate the electronic exchange of information and funds among financial institutions, merchants, consumers, businesses, non-profits and governments. Visa defines the rules that enable financial transactions to be completed safely and reliably, including functional and technical specifications.

Who Participates in Visa’s Payment System?

The following entities take part in each transaction facilitated by Visa’s system.

• Merchant – an entity (business or non-profit) that is authorized to accept Visa-branded cards for the payment of products and services.
• Acquirer (also known as a merchant bank) – a financial institution and a Visa member that contracts with merchants to accept Visa cards for the payment for goods and services.
• Cardholder – an authorized user of Visa cards.
• Issuer – a financial institution and a Visa member that issues Visa cards for use in transactions and enters into agreements with its cardholders for the billing and payment of these transactions.

Visa Payment Transaction Flow

Here is how each of the above entities participates in a Visa transaction:

1. The cardholder presents the merchant with a card for payment. The card data are read directly from the card by a point-of-sale (POS) device, key-entered into it by the merchant or provided by the cardholder on the merchant’s website or over the phone.
2. The merchant transmits the transaction information to the acquirer.
3. The acquirer sends a transaction authorization request to Visa.
4. Visa sends the authorization request on to the issuer or, in certain circumstances, it may perform “stand-in processing” on behalf of the issuer and approve or decline the transaction.
5. The issuer sends back to Visa an authorization response, either approving or rejecting the transaction.
6. Visa sends the authorization response on to the acquirer.
7. The acquirer routes the authorization response to the merchant.

Visa Payment Process

A typical Visa transaction involves three stages: authorization, clearing and settlement:

1. Authorization is the process of approving or rejecting a transaction by the issuer.
2. Clearing is the process of transmitting final transaction data from acquirers to issuers for settlement. During this stage are calculated the fees and charges that apply to the transaction.
3. Settlement is the actual exchange of funds between acquirers and issuers for all transactions that are cleared.

The Takeaway

Visa’s payment system may handle more than a half of all of a typical merchant’s card transactions. The payment processing tools may vary from one merchant to another and will depend on the transaction setting, but all of them will involve the same principal entities (some transactions may feature one or more additional participants) and will be processed following exactly the same sequence of interactions as described above. You should learn the dynamics of this process and educate yourself on how to best perform your own duties. We have written quite a few articles, guides and manuals to help you out.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

Most of you are quite familiar with Visa’s Card Verification Value 2 (CVV 2) – the three-digit number on the back of all Visa cards that is used to verify that customers are in physical possession of their cards in non-face-to-face transactions. What you probably know much less about is the other CVV number, the one that is stored in the card’s memory and is used to perform similar purposes, but in face-to-face transactions. Let’s take a look at it.

What Is CVV

The Card Verification Value (CVV) is a 3-digit number encoded on Visa credit and debit cards. CVV is stored within the card’s magnetic stripe, if available, or alternatively it can be stored in the chip of a smart credit or debit card.

CVV is a point-of-sale (POS) and ATM risk management service that protects card transaction participants from fraud-related losses resulting from mag-stripe counterfeit Visa cards. Each CVV is a unique value, calculated from data encoded in the magnetic stripe or the chip using the Data Encryption Standard (DES) algorithm.

Types of CVV

There are two types of card verification value, based on where the information is stored:

• CVV is the code stored in the card’s magnetic stripe.
• iCVV (Integrated Chip Card Card Verification Value) is the code stored in the card’s chip.

If a smart card features both a magnetic stripe and a chip, the same CVV number can be stored on both. Alternatively, issuers can choose to calculate different values, in which case the one stored on the chip is an iCVV.

The two types of CVV are calculated with an algorithm that uses a service code for CVV validation and the value 999 for iCVV validation. All other algorithm components are the same and include the:

• DES key.
• Primary account number (PAN).
• Card expiration date.

How Is CVV Validation Performed

The CVV value is submitted with all other magnetic stripe or chip data as part of the transaction authorization request. The CVV can be validated either by VisaNet – Visa’s payment system – or by the issuer itself. The issuer can approve, refer, or decline transactions that fail CVV or iCVV validation, depending on its procedures.

When an authorization request is received, VisaNet or the issuer:

1. Calculates the CVV or the iCVV.
2. Verifies the CVV or the iCVV on the card by comparing it to the calculated value.
3. Sends a response code to the processor that indicates whether the validation was successful or it failed. A failed validation can indicate a counterfeit card, but it can also be due to an incorrect reading or encoding of the CVV or iCVV. The available CVV validation response codes are:
   • Approve.
   • Refer to issuer.
   • Pick up.
   • Decline.

The Takeaway

You don’t really need to know all that much about the CVV, as in face-to-face transactions your POS terminal simply collects it, together with all other mag-stripe or chip information, and routes the whole thing for authorization. You never get to handle it the way e-commerce and MO / TO merchants do CVV 2 numbers. Still, if you are going to be accepting cards for payments, educating yourself on the basics can’t be all bad.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).