Credit Card Merchant Account CISP Requirements

The PCI Data Security Standard is the reflection of a "walls of security" philosophy in which no one security tool or measure should ever be taken as providing absolute protection for credit card merchant account users from fraudsters trying to gain unauthorized access to sensitive data. Instead, risk of intrusion is limited by building multiple layers of preventive measures that function together.

The PCI Data Security Standard is made up of twelve requirements expanded by more detailed sub-requirements:

• Build and manage a secure network.
  • Install and manage a firewall set-up to protect data.
  • Do not use the original vendor-supplied default values for any system passwords or other security parameters.
• Protect consumer data.
  • Protect shared information.
  • Encrypt all transmissions of sensitive information across public networks.
• Build and manage a vulnerability management program.
  • Use and constantly update your anti-virus software.
  • Build and maintain secure systems and applications.
• Implement solid access control measures.
  • Restrict any access to information on "need-to-know" basis.
  • Issue a unique ID to each employee with computer access.
  • Restrict any physical access to sensitive data.
• Regularly examine and test networks.
  • Keep track of all access to your network's resources and customer data.
  • Regularly evaluate security systems and processes.
• Manage a data security policy.
  • Establish a policy that addresses data security.

Which Credit Card Merchant Account Users Should Comply?

CISP is mandatory to any organization - meaning any credit card merchant account user or provider - that keeps, processes, or transmits cardholder account information. All eligible retailers and merchant services providers, regardless of their size (or in the case of service providers, whether or not they support issuing or processing activity) are required to comply with the PCI Data Security Standard.

Beyond the basic information security, full implementation of the PCI Data Security Standard benefits retailers in multiple ways:

• Customer service. Consumers look for merchants they feel are safe to purchase from. Confident customers are loyal customers. They will come back again and again, and will share their experiences with others.
• Cost containment. By protecting consumers, credit card merchant account users also limit their own risk exposure and the direct and indirect costs associated with compromised account data.
• Public image. Data security is a constant topic of media attention. An incident of information loss or compromise not only damages consumers; it can seriously damage the retailer's public image.

Credit Card Processing Companies Clearing System

Credit card processing companies clear transactions using the Global Clearing Management System (GCMS). GCMS routes messages in the Integrated Product Messages (IPM) format. This kind of format is an International Organization of Standardization (ISO)-based flexible format that contains all clearing system information.

IPM Message Structure

All credit card processing companies IPM messages contain 4 main components:

• Message Type Identifier (MTI). This is the first element of every IPM message. The MTI is invariably located in positions 1 through 4 of the message. The MTI identifies the message class. For example, MTI 1442 designates a chargeback message.
• Bitmaps. These are the 2^nd and 3^rd elements of every IPM message. The bitmaps show the presence or absence of ISO information elements (DE 1 through DE 128) in each individual message. There are 2 bitmaps in each message:
  • Primary. These occupy positions 5–12; show the presence of data elements 1–64.
  • Secondary. These are in positions 13–20; show the presence of information elements 65–128. Each bit contains a value of precisely 0 if the corresponding element is absent in the message or a value of 1 if it is present.
  • Data elements. These represent different, pre-identified pieces of data and follow the bitmaps in order by number (known as data element number). For instance, function codes are stored in DE 24 (Function Code) and indicate the specific purpose of a message in a given message class. Examples of function codes are 450 (first chargeback - full amount) and 453 (first chargeback - partial amount).
  • Message reason codes. For the first chargebacks, second presentments, and arbitration chargebacks, these codes are stored in DE 25 (Message Reason Code).
For instance, a first chargeback, initiated by credit card processing companies for a full amount for MasterCard message reason code 4837 - No Cardholder Authorization would have the following values:
• MTI 1442 - indicating that the message is a chargeback.
• DE 24 (Function Code) 450 - indicating that the message is a first chargeback for the full amount.
• DE 25 (Message Reason Code) 4837 - indicating the reason for the chargeback.

Chargeback Benefits of GCMS

GCMS provides credit card processing companies and merchants with:

• Retrieval request and response information in chargeback messages so that banks can tell instantly the outcome of a retrieval request.
• Dates for paperwork sent, if present, in the previous cycle.
• Data from the previous chargeback cycle with each subsequent one, so that banks are not required to search for this information in their archives. These data include amounts, reason codes, and DE 72 (Data Record) texts.
• IPM Second Presentment/1240 and Arbitration Chargeback/1442 messages display the reason for the 2^nd presentment or arbitration chargeback.
• IPM documentation indicators perform one task - to show whether paperwork will follow the transaction.

What Everyone Ought to Know about Payment Gateways

I have received a ton of questions and inquiries coming into my inbox over the past few months that ended up convincing me that I have to write a refresher on the basic facts merchants ought to know about payment gateways. This post will go over them and explain what these services do and how they work with merchant accounts.

Payment Gateway Facts

So payment gateway is a web-based service that communicates payment data between an e-commerce website and an acquiring bank. In essence, it is the web equivalent of the physical point-of-sale (POS) terminals that is used by brick-and-mortar retailers operating in face-to-face credit card processing settings. The data collected in this manner are encrypted to ensure that all sensitive information is transmitted securely.

Payment Gateway Transaction Cycle

Payment gateways link the website's shopping cart (the place where customers manage their purchases) with the processor's back-end system. The transaction stages are as listed below:

1. A consumer places an order on your website and provides his or her bank card account information.
2. The payment data are encrypted through a service called Secure Socket Layer (SSL) and sent on to the retailer's server.
3. The payment gateway now gathers the payment data and, after one more SSL encryption, sends it on to the acquiring bank's server.
4. The acquirer at this time routes the payment data on to MasterCard or Visa.
5. If the customer has used a Discover or an American Express bank card, the issuer in this case also serves as an acquirer and makes a decision on whether or not to approve an authorization request of the payment and then routes its response back to the retailer.
6. The Credit Card Association (Visa or MasterCard) sends the transaction data on to the issuer.
7. The issuer now either approves or rejects authorization approval of the payment and sends its response using a code (via the exact same channel) back to the merchant bank. The authorization responses for rejected transactions also provide details for the cause the transaction did not receive authorization.
8. The acquirer now routes the response code (through the retailer's payment gateway) to the website where it is displayed to the customer.

The cycle may seem complicated, but on the whole, from submitting the transaction to receiving the response code, only takes a few seconds.

The retailer now ships the merchandise and then deposits the transaction with its acquirer. It is crucial that payments do not get settled before the item is shipped, which may cause the transaction to be disputed.

E-Commerce Credit Card Processing Post Authorizations

Every time an e-commerce credit card processing transaction is approved by the issuer, the merchant should send a confirmation prior to completing and fulfilling the order. If the payment is rejected, however, your manual needs to specify how to handle the situation with the consumer and decide whether this type of rejection can be prevented in the future. Proceed in a manner that best serves the consumer and your own business by incorporating these best merchant services practices:

• Provide an email order confirmation for all approved payments. This will enable you to verify the validity of the customer's email address. If it is not valid, evaluate the situation to decide whether the order is authentic. You can also limit customer disputes by sending email order confirmations that notify the consumer of the approved sale and provides information about it.
• Examined rejected authorizations and take adequate actions. In most cases, it may be helpful to have your customer support representatives examine authorizations rejected by the issuers and receive corrected data or another form of payment that can enable you to proceed safely with the e-commerce credit card processing transaction.
  • Queue authorization rejections for examination and contact consumers to correct issues with their cards - for example incorrect date of expiration - or obtain other types of payment.
  • If the payment information is corrected, make sure you obtain an authorization approval prior to completing the sale.
  • Monitor the success rate of your rejection review strategy and adjust it, as may be needed.
• Monitor order rejection ratios. This vital practice can help you raise your approval rates and payment volume, and locate potential problems resulting from changes in the authorization procedures.
  • To be able to identify trends, monitor order rejections by reason code on a daily basis.
  • Separate issuer declines as opposed to those you reject for suspected fraud or any other reasons.

The authorization process needs to be well managed as it has a major impact on risk, customer support, and operational costs. E-commerce credit card processing that are shipping the products to the consumer more than seven days post the original authorization date, (so-called back-order), you will have to obtain a new authorization approval prior to proceeding with the shipment.

E-commerce credit card processing businesses need to use the Electronic Commerce Indicator (ECI) for all of their transactions. When included into the adequate fields of the authorization and settlement messages, the ECI signifies the sale as e-commerce. This frees the merchant from receiving a referral response and enables the issuer make a better informed authorization decision. The ECI also enables the merchant meet web transaction processing requirements. Work with your processor to incorporate the ECI, which is mandated by Visa for all online transactions.

Rules for Processing Credit Cards

Merchants processing credit cards must adhere to certain basic rules for accepting payments, including the ones listed below:

• Taxes. All applicable taxes need to be added to the transaction amount and must never be taken separately in the form of cash.
• Accepting cards. Take all valid bank cards of the brands stated in your agreement for processing credit cards.
• Maximum and minimum payment amount. Verify with your acquiring bank on what is the lower transaction amount that you are allowed to charge. U.S. merchants can establish a minimum payment amount on credit card transactions that should never exceed $10, should not treat various card issuers or brands differently, and shouldn't be applied to sales paid for with a debit card.
• No surcharging. Treat bank card transactions always like any other method of payment. Merchants processing credit cards should not assess any surcharge to a card payment.
• Unallowed uses. Merchants should never use a card to refinance any form of existing debts or for the payment of a debt that is deemed uncollectible (in other words, to recover money for a bounced check).
• Convenience charges. For merchants who offer an alternate payment acceptance method (such as phone, mail, or e-commerce) for customers to pay for products or services, a convenience fee may be added to the transaction amount. If the merchant chooses to asses a convenience fee to their customers, it must comply with applicable Visa and MasterCard rules regulating convenience fees.
• Laundering when processing credit cards. Merchants must only settle payments for their own businesses. Doing it for another merchant is known as laundering and is not permitted.
• Zero-percent tip. For restaurants, taxis, limousines, bars, beauty shop, and health payments with a bank card, the user should request authorization only for the check's amount, without including an estimated tip. Consumers can nowadays check their payment accounts in real time by phone, online, or at an ATM. An authorization request that includes an estimated tip can reduce a customer's available funds or credit line by an amount the consumer may not recognize. This can occur if a consumer leaves a tip in cash or adds one that is less than the estimated amount used for authorization purposes. For example, a restaurant sends an authorization request for a calculated tip of 20 percent of the check amount, however the customer actually leaves only 10 percent instead. Additionally, keep in mind that your restaurant authorization approvals are good for amounts of up to 20 percent on top of the check amount.

Merchant Credit Card Account Chargeback Basics

For a merchant credit card account user, chargeback is a transaction that the issuer returns to the payment processing bank as a financial liability and which, at this point, the processor may return to the retailer. In short, it reverses a sales:

• The issuer subtracts the sale's amount from the customer's card account. The customer receives a refund and is no longer financially liable for the dollar amount of the sale.
• The card issuer initiates a chargeback through the association to the processor for the dollar amount of the sale.
• The processor will, usually, deduct the sale's amount from the merchant credit card account user's account. The retailer ends up losing the amount of the transaction.

For retailers, chargebacks can be very costly. You can lose both the sale's amount of the payment that is charged back and the related product. You will also, of course, be incurring your own internal costs for handling the chargeback. As you control how your staff manage transactions, you can preclude many unnecessary chargebacks from occurring by simply training your personnel to pay attention to a few details.

Chargeback Reasons

The most common reasons for a merchant credit card account user to receive a chargeback are:

• Customer disputes.
• Payment processing errors.
• Authorization issues.
• Fraud.

Although merchants probably cannot avoid chargebacks altogether, you can certainly take steps to limit or at least prevent some of them. Many chargebacks are the consequence of an avoidable mistake, so the more you understand about proper transaction processing procedures, the less probable it is for you to inadvertently do, or fail to do, something that could lead to a chargeback.

Customer disputes are one of the most typical reasons for chargebacks. A consumer may dispute a transaction because:

• A refund has not been issued when the consumer expected it would be.
• Product ordered was never received.
• A service was performed not as expected.
• The consumer did not make the payment, but it was fraudulent.

As these chargeback types may indicate customer dissatisfaction - and the possibility for lost sales in the future - remedying the underlying issues should be an integral part of each merchant credit card account user's customer service policies.

When the payment networks detect an invalid chargeback, it is automatically sent back to the card issuer that originated it, and the retailer and acquirer never see it.

Merchant Bank Account Check Payment Data

On the whole, the number of non-cash payments in the United States rose by 4.6 percent, on average, per year between 2006 and 200, approximately the same rate as the previous 3-year period (4.5 percent). In comparison, gross domestic product and personal expenditures rose by 1.8 and 0.3 percent, respectively, each year for the period. The value of non-cash payments declined by 1.6 percent per year over the same period, possibly reflecting the economic recession.

Merchant Bank Account Check Payment Data

The number of checks cashed in 2009 is calculated to have been 24.5 billion, totaling $31.6 trillion in value. That was a decline of 7.1 percent per year, on average, between 2006 and 2009, leading to 6.1 billion fewer checks cashed in 2009 than in 2006. Because the ACH system was used to convert some checks by billers and merchant bank account users, the number of checks cashed is not equal to the number of checks written, which declined slower than the number of checks cashed. There were 5.3 billion more checks written in 2006 than in 2009; the decline was 5.7 percent per year.

The average amount of checks cashed declined from $1,363 in 2006 to $1,292 in 2009. When we include the checks that were converted to ACH, which averaged $227 in 2009, the value of the average written check fell from $1,278 in 2006 to $1,165 in 2009. The fall in the average value probably reflects the recession that existed throughout the latter part of the examined period, and does not necessarily constitute a permanent change in consumers and business financial behavior.

Over the past 3 years, the level of checks cashed electronically more than doubled. These changes are expanding the efficacy of the ACH system for interbank checks - those cashed on a different depository financial institution than the one at which the checks were deposited. An estimated 97 percent of these checks featured the replacement of the initial paper check with an electronic payment version at some point in the process, compared to a calculated 43 percent at the time of the previous 3-year period.

From 2006 to 2009, the number of checks bounced at the merchant bank account level declined by 6.1 percent per year, from 153 million to 127 million. For the period, the number of checks cashed also fell, and the ratio of bounced checks to cashed checks declined from 0.50 percent in 2006 to 0.52 percent in 2009. The total value of bounced checks declined 11.4 percent per year during the same period, from $182 billion in 2006 to $127 billion in 2009. The ratio of bounced checks to cashed checks by value fell from 0.44 percent to 0.40 percent.