eCommerce & Web Solutions Newsletter

This month we bring you some information about accepting credit & debit cards including:

• Accepting Credit Cards Online;
   
• Payment Card Industry Terminology;
   
• Liability for Online Credit Card Fraud, (when merchants are liable and when they are not);
   

PSP - Automatic handling of payment transactions online by a Payment Services Provider (or PSP) – the customer is transferred to a secure website hosted by the PSP, but customised to the same look and feel as the business’s website. The transaction takes place and is validated on the spot. The customer receives an acknowledgement and control is returned to the business’s website with an indication of whether the card was accepted or declined.

• The most common type of PSP acts as a gateway and passes the completed transaction to an Acquiring Bank that is providing the Internet Merchant Account. Payment to the business then proceeds in the normal way.
   
• Certain PSPs can also provide a complete end-to-end service – they provide an Internet Merchant Account and will complete the transaction, settling net funds directly into the business’s bank account on a weekly or monthly basis.

• In order to accept credit card details online securely and encrypt them for transmission back to your office by e-mail, a special type of web space called SSL space is required in addition to the main website space. You will also need an email encryption facility.

Note that if you handle card details yourself as would be the case with the SSL approach, then you will need to comply with the PCI DSS Payment Card Industry Data Security Standard which can be quite onerous. If you use a PSP, then you need to ensure that they comply. For more information about PCI DSS see the special feature in our February newsletter.

A merchant that is enrolled in 3-D Secure is generally not liable if:

• Cardholder Authenticated - (i.e. the card is registered for 3-D Secure and the password was entered correctly by the card holder). The card Issuer becomes responsible for the chargeback for Visa, MasterCard and Maestro.
   
• Cardholder/Issuer not Enrolled for Authentication (or card holder opts out of registration during checkout) - Because full enrolment is not yet universal, Visa and MasterCard offer global protection for personal cards where authentication has been attempted even if the issuing bank is not participating or the cardholder is not enrolled in 3-D Secure. However, Commercial cards are only covered if issued in the EU, while Maestro only offers protection for personal cards issued in the UK.
   
• Cardholder Authentication System not available and card is Personal MasterCard (issued anywhere) or is a Commercial MasterCard issued in the EU, or is a Maestro card issued in the UK

Merchants enrolled in 3-D Secure are liable when:

• Cardholder Authentication System not available and card is Visa (issued anywhere) or Maestro issued outside the UK, or is a Commercial MasterCard issued outside the EU
   
• Cardholder Authentication fails but the merchant accepts the transaction - (i.e. authentication was attempted, but failed).
   
• All other circumstances!

Note 1: If the brand is Visa and either the enrolled or status indicators are returned as Unknown this means that the merchant is not covered by the 3-D Secure scheme. In this case the merchant is still liable for any fraudulent transactions.

Note 2: There are some cases where the liability is not covered by the Card Issuer; for example non-European commercial cards under both brands. For more information please contact your acquirer.

Note 3: Even if a transaction meets the criteria, the issuing banks can still chargeback for other reasons, such as non-delivery of goods or faulty goods.