Inside the Black Hole

Visa maintains a service – the Check Acceptance Service – that, as the name suggests, facilitates check payments. It enables U.S. merchants to route check approval requests through Visa’s payment system – VisaNet – to participating check acceptance vendors.

In this post I will review the basics of Visa’s Check Acceptance Service.

What Is Visa’s Check Acceptance Service

The Check Acceptance Service enables U.S. payment processors to route check approval requests through VisaNet from a merchant to a participating check acceptance vendor. The service is optional for processors.

There are five check acceptance vendors: Equifax Card Services, ETC Scan, JBS / NPC, State Street Bank, and TeleCheck. These companies guarantee payment of the customer’s check if the check is approved and assume responsibility for collection if the check is returned.

How the Check Acceptance Service Works

Here is the Check Acceptance Service flow:

1. The process begins with a customer presenting a check for payment at a participating merchant.
2. The merchant sends the check information to its processor through a point-of-sale (POS) terminal that scans the bank account and customer information from the check. The merchant then keys into the terminal the amount of the check.
3. The processor initiates a check acceptance request based on the information provided by the merchant and routes it to a check acceptance vendor.
4. The vendor returns an acceptance or a denial response to the merchant through the same path.
5. The processor collects the funds by routing the check information through a separate clearing process. If a check acceptance vendor approves a check that is subsequently not paid, the vendor bears the liability.

Once initiated, check acceptance transactions cannot be reversed.

Check Acceptance Service Messages

The following messages are used by the Check Acceptance Service:

• 0100: Authorization Request. This message code designates a request to confirm the availability of funds and to verify the payee’s identity. It is used for check acceptance transactions when the processor has an agreement with one of the check vendors. The 0100 message requests that the vendor guarantees the customer’s check. The check amount is then collected through a standard check-clearing process.
• 0110: Authorization Response. This message code designates a response to a 0100 message. The 0110 response includes the check authorization information from the vendor. If applicable, it will include the vendor’s error reason code in Field 48 – Additional Data – Private.

The Takeaway

I think that the most important thing to take away from this article is that, if a check is approved, you (the merchant) are entitled to get paid. If the check ends up bouncing, the liability is borne by the check acceptance vendor who is responsible for collecting the unpaid amount.

Typically, check acceptance and credit card processing are provided by the same company. If you do need to accept checks, make sure that, when selecting a processor, you carefully evaluate both services and pricing proposals. Don’t take the check acceptance for granted, as for many processors it is only a secondary priority and the service may not be up to scratch.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

For the most part, merchants don’t want to know much about how Visa’s transaction processing system works, or the equivalent system of any of Visa’s rivals, for that matter. As long as the customers’ cards can be accepted and the payments processed quickly and securely, most merchants are satisfied and perfectly happy to remain ignorant of what goes on behind the scenes to enable a transaction to be processed.

Now, I will not argue that this is wrong and that you should spend months educating yourself on the inner workings of Visa’s or MasterCard’s transaction processing systems. I am arguing, however, that there is a bare minimum of information that you need to know, so that when (and it is not if) something goes wrong, you will be better prepared to understand why and, possibly, to help resolve the issue.

Visa’s Transaction Processing System

VisaNet – Visa’s transaction processing system – connects the Visa payment network with Visa’s member bank’s systems and with other networks to facilitate transaction processing and other services. VisaNet transmits transaction information between processors and issuers and supports:

• Sales, cash, and bill payment transactions made with any Visa card.
• Recurring payments, as well as prepaid card transactions that allow partial authorization approvals.
• Travel and entertainment (T&E) card transactions.
• ATM transactions for other payment networks, which can also support the sale of dispensable products such as stamps and coupons.
• Private label and proprietary card transactions.

Support for these products outside of the U.S. can vary.

VisaNet’s Transaction Cycle

VisaNet processes qualifying transactions through its authorization, clearing, and settlement services, which are defined as follows:

• Authorization is the process that enables the card issuer to approve or decline a sales transaction before the sale is finalized or cash is disbursed.
• Clearing is the process of transmitting transaction information from the payment processor to the issuer to be then posted to the cardholder’s account.
• Settlement is the process of determining the exact amount of the funds that need to be exchanged between the processor and issuer that are parties of a cleared transaction. The actual exchange of these funds is a separate process.

Transactions can be authorized, cleared and settled using either single or dual messages, which are defined as follows:

• If using a single message, the transaction authorization request contains clearing and settlement data, in addition to authorization information. Typically, single-message (also called “full financial”) transactions are authorized and cleared online, but settled offline.
• If using a dual message, the transaction information is sent to VisaNet twice. At first only information needed for an authorization decision is transmitted, followed by a transmittal of information for clearing and settlement purposes. Typically, dual-message transactions are authorized online, but cleared and settled offline. Dual message processing is also known as “batch processing.”

If the final transaction amount is not known at the time of authorization, as is typically the case with transactions processed by hotels and by car rental agencies, as well as gas stations, single-message transactions can be processed much like dual-message ones. This is done through a process known as “deferred clearing,” where the authorization request is processed online, but the clearing and settlement are performed later (e.g. at the end of the day. Deferred clearing is only available for Visa point-of-sale and Electron transactions. An alternative to deferred clearing is the “Real-Time Clearing,” designed specifically for gas stations, where transactions are pre-authorized and processed immediately, rather than at the end of the day.

The Takeaway

It is important that you understand what takes place during the period between the swipe of your customer’s card and the deposit of the transaction amount into your bank account. If you invest the time to do so, you will be better able to ensure that your merchant account is set up in a way that best addresses your particular circumstances.

Alternatively, of course, you can just leave it all up to your processor and hope it does the right thing.

Get a personalized credit card rate for each of your transactions!

Get the lowest possible credit card processing rate for each individual transaction! Our interchange-plus pricing model gives you:

• Processing rates calculated separately for each transaction to ensure that not a single one of them is overcharged.
• No more mid-qualified and non-qualified fees.
• No fixed monthly fees.

Merchants accepting credit cards in a face-to-face setting do not need to obtain a customer signature for all of their transactions. Sales under certain amounts are exempted from the signature requirement under the Visa Easy Payment Service (VEPS) and MasterCard’s Quick Payment Service. The two programs are very similar, but in this post I will focus exclusively on the VEPS program.

What Is VEPS

The VEPS program provides merchants operating in face-to-face environment with the ability to accept payment cards without the need to obtain a signature or personal identification number (PIN) from the cardholder and to not print out a sales receipt unless requested by the customer (which is why the Starbucks barista always asks you whether or not you want a receipt when you pay your coffee by credit card).

VEPS Qualifications

To qualify for VEPS, transactions need to meet the following criteria:

• Purchase transactions.
• Processed in a card-present setting (transactions of $25 and under) or in unattended environment ($15 and under).
• Authorization approval is obtained.
• Processed by a merchant with an approved Merchant Category Code (MCC), which according to Visa represent 98 percent of the total count. About half of the non-qualifying MCCs designate various direct marketing codes.
• All card types can qualify, including magnetic-stripe, EMV chip and proximity payments.
• The point-of-sale (POS) terminal must read and transmit unaltered magnetic stripe, chip data, or contactless card data.

Not-Qualified Transactions

Not qualifying for the VEPS program are transactions involving:

• Fallback procedures (that is, transactions processed when the terminal cannot connect to the processor’s system).
• Account funding.
• Cash-back.
• Manual cash disbursement.
• Quasi-cash.
• Prepaid card loading.
• Dynamic Currency Conversion (DCC).

Processing VEPS Transactions

Merchants are under no registration requirements. Eligible VEPS transactions are processed following standard transaction procedures, except that no PIN entry and customer signature are required and a customer sales receipt is optional.

No additional fees apply for participating in the VEPS program. Visa’s CPS / Small Ticket interchange rate is available for many bank card transactions, provided the following criteria are met:

• The transaction involves a Visa Consumer Card (Visa Signature Preferred are excluded).
• The amount is $15 or less.
• An authorization approval is obtained.
• Entered into interchange through VisaNet (Visa’s payment system).
• The POS terminal reads and transmits unaltered card data.

Of course all standard factors are reflected into the interchange rate determination as well.

The Takeaway

The biggest advantage the VEPS program offers to qualifying merchants is convenience. Not having to collect signatures and PINs from cardholders or to print out sales receipts, unless explicitly requested by the customers, speeds up the checkout process, while fraud and chargeback protections remain in place. Moreover, consumers equally appreciate being checked out speedily.

So if you qualify for the program but have not implemented it yet, you should contact your acquirer and request them to guide you through the process.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

When we first published an article on EMV cards back in April, we did not expect it to cause much of a stir among our non-industry-related readers. Instead, we received quite a few emails from Americans who’d had difficulties using their mag-stripe cards in Europe and many of them were asking us how they could get a chip-and-PIN one (which is how EMV cards are known in Europe).

Of course we can’t get chip-and-PIN cards here in the U.S. Wells Fargo and JPMorgan Chase told us that they were planning to start issuing smart chip-based cards at some point, but the details were scant.

Now Visa has decided to weigh in on the subject in a rather big way. The biggest credit card network in the world is making it mandatory for all U.S. processors to support acceptance of chip-based transactions by April 1, 2013, in order to prepare the ground for the arrival of NFC-based mobile payments, we learn from a press release. Of course, by then NFC will have arrived in force.

Visa’s Decision

Here is what I think is the gist of Visa’s announcement:

Visa will require U.S. acquirer processors and sub-processor service providers to be able to support merchant acceptance of chip transactions no later than April 1, 2013. Chip acceptance will require service providers to be able to carry and process additional data that is included in chip transactions, including the cryptographic message that makes each transaction unique.

Why do that? Visa:

The adoption of dual-interface chip technology will help prepare the U.S. payment infrastructure for the arrival of NFC-based mobile payments by building the necessary infrastructure to accept and process chip transactions that support either a signature or PIN at the point of sale.

So there it is. In effect, the huge hype around an untested and unproven mobile payments technology is already causing the beneficial side effect of solving a pressing issue for an increasing number of Americans trying to use their mag-stripe cards in Europe.

Dynamic Authentication

The release pays much attention to the use of dynamic authentication for securing chip-based card transactions, but it doesn’t tell us exactly what it is. Let me fill in the gap.

In a face-to-face EMV transaction, the cardholder would first enter her PIN to initiate the transaction. Where dynamic transaction authentication is supported, the point-of-sale (POS) terminal would at this time prompt the smart card to produce a one-time password that would be then used to complete the transaction. The point here is that a counterfeit card would not be able to communicate with the reader and the transaction would not be completed.

The reason Visa is pushing dynamic authentication right now is that all NFC-enabled devices will have a chip embedded into them by default that would store the user’s card account information, turning the smart phone into a form of an EMV credit card. As new POS terminals will be needed to communicate with these new payment forms anyway, they might as well be equipped with the latest fraud prevention technology. I think it is a good decision on the part of Visa.

The Takeaway

It should be noted that Visa is not requiring banks to start issuing PIN-based cards, but it is very likely that they will, once the infrastructure is laid out for accepting them. After all, U.S. issuers lost $3.9 billion in overall transaction volume and $447 million in revenues in 2008, because 9.7 million American cardholders were unable to use their cards abroad, according to data from Aite Group. Moreover, U.S. issuers have been receiving tons of complaints from inconvenienced American vacationers. Why haven’t they responded?

Well, issuers were faced with a chicken-and-egg type of a problem here in the U.S. If they did start issuing EMV cards, these would only have been accepted abroad, which would not have justified the investment. Now that Visa has required processors to ensure acceptance of chip-and-PIN, that changes the dynamics completely.

In fact, issuers are likely to also benefit from a benign EMV side effect in the form of lower fraud losses. In the U.K. the implementation of the chip-and-PIN technology resulted in in-store credit card fraud falling from 218.8 million pounds ($356.5 million) in 2004 to 98.5 million pounds ($160.5 million) in 2008, according to statistics from the U.K. Payments Administration. U.S. banks will no doubt take the windfall if it comes their way.

Get a personalized credit card rate for each of your transactions!

Get the lowest possible credit card processing rate for each individual transaction! Our interchange-plus pricing model gives you:

• Processing rates calculated separately for each transaction to ensure that not a single one of them is overcharged.
• No more mid-qualified and non-qualified fees.
• No fixed monthly fees.

Your primary concern when accepting credit cards should be to ensure that the card presented for payment is valid and the customer is its authorized user. This is more easily done in face-to-face transactions where, if in doubt, you can simply ask your customer for her driver’s license to make sure that she really is who she claims to be. This is the reason brick-and-mortar businesses typically suffer from much lower fraud rates than their counterparts accepting payments online or over the phone.

This is also the reason the credit card companies have designed various tools and services specifically for validating card and cardholder information in non-face-to-face types of transactions. One of these tools is Visa’s Card Verification Value 2 (CVV2), which I will review in this post.

What Is CVV2?

Card Verification Value 2 (CVV2) is a three-digit security code imprinted on the signature panel, or in a white box immediately to the right of it, on the back of all valid Visa cards to help verify that a customer is in possession of a genuine card at the time an order is placed.

How to Use CVV2?

When processing a card-not-present Visa payment, you should:

1. Ask your customers for the last three numbers on or to the right of the signature panel on the back of their cards. Avoid asking for the “CVV2″ number, as the customer may not know what it refers to.
2. If your customer provides the CVV2 code, send this information, along with all other transaction data (that is 16-digit account number, card expiration date, cardholder name and address, etc.) for authorization approval.
3. Additionally, include one of the following CVV2 indicators, whether or not you are including a CVV2 code in your authorization request:
   
   

   CVV2 Presence in Authorization Request	Indicator
   You have not included CVV2	0
   You have included CVV2	1
   Customer has stated CVV2 is illegible	2
   Customer has stated CVV2 is not on the card	9




4. After obtaining an authorization approval, examine the CVV2 response code and take action based on all transaction characteristics.
   
   

   Response Code	Recommended Action
   M – Match	Proceed with the transaction (provided no other transaction characteristics raise suspicions).
   N – No Match*	This response code should be seen as a sign of possible fraud. Hold the order for further verification and examine all other potentially suspicious transaction characteristics.
   P – Not Processed	This response indicates a technical problem or the request did not provide all the information needed to validate the CVV2 code. Resubmit your authorization request.
   S – CVV2 should be on the card	Follow up with your customer and make sure that she checked the correct location for CVV2 (see above).
   U – The issuer does not participate in CVV2	Examine all available information and decide whether to complete the transaction or investigate further.

   
   *If the authorization request is approved, but the CVV2 response is a “No Match,” the merchant is protected against fraud chargebacks.

Do Not Store CVV2

Visa prohibits the storage of CVV2 codes as a part of the order information or customer account data. The security code can only be used during the authorization process and removed from any files or storage devices once a response is received. MasterCard, Discover and American Express also prohibit the storage of their security codes.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).