My Merchant Account Blog

Electronic Payment Gateway-The Start of a Transaction

Saturday, January 20, 2007

An electronic payment gateway, like LinkPoint, Payflow, Authorize.net, is the virtual connectivity between your website and the credit card companies.  These gateways will offer an API (Application Programming Interface), a secure website where you can actually direct your consumers over to process credit cards, and virtual terminal where you can actually enter credit card information to process (i.e. if you had a customer call you to place an order via the telephone).  

When the customer hit submits, the electronic payment gateway goes into action.  It sends the request to a transaction processor or platform (i.e. First Data).  First Data will then authorize or decline this transaction if they have the authority or sends it over to the acquiring bank.  The acquiring bank then sends it to the card association who takes the transaction and sends it to the issuing bank.  The issuing bank then authorizes or declines the transaction and sends the response back up the chain through the card association, to the acquiring bank, to the transaction processor, to the electronic payment gateway and then finally the response is displayed to the consumer. 

Each gateway will offer a fraud protection product.  LinkPoint has a product called LinkShield™. LinkShield™ combines the industry's top fraud-protection tools to provide an exceedingly comprehensive fraud protection service.  Since almost one hundred gateways go through First Data's Nashville Platform to process, this product is one of a kind.  First Data uses the technology from Fair Isaac® Falcon® and ClearCommerce Fraud Analyzer to provide the merchant with up-to-date information on the transaction.  Merchants are now able to fight fraud much better.  Unfortunately, this product does not seem to be offered by First Data or any of its registered agents.  And along with Verified by Visa (VBV) / MasterCard Secure Code (MSC), chargebacks can be a thing of the past.

Once the merchant gets the notification from the electronic payment gateway of a successful transaction, the merchant can begin shipping the goods to the consumer.  A batch is usually automatically ran at night and this will complete the transaction.  Batching the transaction will actually get the ball rolling for the merchant to get his / her money.  Up until this point, no money has been moved into the merchant's bank account.  For more information, please see How Does a Credit Card Transaction Get Processed.

MasterCard and the PCI Data Security Standard

Monday, January 08, 2007

Data theft from online merchants, providers and third party processors is increasing at an alarming rate. Card associations developed the Payment Card Industry (PCI) Data Security Standard to help combat compromises. MasterCard was a primary sponsor in the PCI Data Security Standard during its inception in 2005.

MasterCard Site Data Protection

MasterCard Site Data Protection (SDP) is a component of the PCI Data Security Standard.  This program provides guidelines to merchants, acquirers, providers and compliance tools to help protect credit card data.

Being PCI Compliant

Being PCI compliant is not just getting scanned by a vendor like ControlScan. It is also adhering to standards, like storing card holder data and only allowing certain personnel access to cardholder data; completing a self-assessment questionnaire; and a possible on-site review (for Level One Merchants and Level One and Two Service Providers).

Storing Cardholder Data

Under PCI Standards, companies can store a cardholder's account number in a secure fashion. The account number should be encrypted or truncated. You can store the expiration date and cardholder's name as well. If these are stored in along with cardholder's primary account number, they should be encrypted as well. Merchants are not authorized to stored the CVC2 or Personal Identification Number (PIN).

Failure to Comply

Failure to comply with these standards can result in fines imposed by MasterCard. Level One Merchants along with Level One and Two Service Providers can be fined up to $25,000 USD per merchant or service provider.  Level Two and Three Merchants can be fined up to $5,000 USD per merchant.  Further non-compliance may also result in termination of your merchant account.

Fighting Fraud in your E-Commerce Store

Monday, January 01, 2007

Card association payer authentication (e.g. Verified by Visa (VBV), MasterCard SecureCode (MSC)) is becoming increasingly more important in online transactions. Also knowing whether the consumer is near his or her billing address by using Geo-IP. Other merchants would like to know if the consumer has a tendency to do a chargeback, maybe consumer purchasing behavior.

Verified by Visa / MasterCard SecureCode

I wrote some things regarding VBV / MSC a few months ago and it still holds true today. VBV merchants are protected from chargebacks on the Reason Code 83 (I didn't do it). MasterCard users though have to be enrolled in MSC for you, the merchant, to be protected.

Consumer Purchasing Behavior

While a number of electronic payment gateways use First Data's Nashville platform to process the credit card transaction, First Data maintains these transactions per Visa and MasterCard regulations. Using software developed by Fair Isaac Corporation, LinkShield™ is unavailable to LinkPoint merchants. A few gateways that use First Data's Nashville Platform include:

• LinkPoint Secure Payment Gateway
• Authorize.net Electronic Payment Gateway
• Verisign's Payflow Services
• PC Charge
• Cybersource
• Jettis
• USA ePay
• Yahoo®

This is just a small percentage of electronic payment gateways that use the First Data Nashville Platform as their transaction processor. First Data takes these transactions and profiles them. When using the LinkShield™ product along with the LinkPoint Secure Payment Gateway, the merchant has the ability to accept or decline the transaction based on the score that First Data provides. First Data also provides another optiion using the ClearCommerce® FraudAnalyzer

FraudAnalyzer uses neural network technology to score fraud risk in real-time. The model was developed by examining extensive transaction and chargeback data supplied by ClearCommerce's Fraud Data Consortium, which includes millions of e-commerce transactions supplied by thousands of merchants. With the addition of FraudAnalyzer, the ClearCommerce® Engine is the only transaction processing software that integrates merchant rules, neural network risk scoring, service data and human review to minimize credit card fraud costs.