My Merchant Account Blog

Fighting Fraud with ThreatMetrix

Wednesday, November 16, 2011

The online business world welcomed a very strong fraud prevention system for payment gateways when the cloud based ThreatMetrix Fraud Prevention Network was launched last year. As eecommerce spreads across a wide range of sectors, including social networks, financial services, affiliate marketing and the ever growing sector of online businesses, the market for preventing fraud is enormous and continues to grow. At the same time ThreatMetrix was entering an already crowded field of online fraud prevention systems.

As ecommerce grows by leaps and bounds so does online fraud paralleling that growth. In 2007 online businesses lost 3.6 billion dollars to fraud. Fraud from international transactions is more than 2.5 times that of domestic transactions. Over 73,000 malware threats are released every day. Most online businesses are using three or more fraud detection tools. All are looking for an exceptional fraud detection system.

So what makes ThreatMetrix different? It is designed to walk the fine line between customer convenience and business/customer security. Customers say these are the positives:

• ThreatMetrix Fraud Prevention Network goes beyond just protecting payment gateways to protecting online businesses and social media and new account originations, registrations and log ins.
• It does this without requiring any personally identifiable information (PPI).
• ThreatMetrix provides customizable fraud prevention by combining a variety of fraud prevention systems such as device detection, detection of botnets, scripts, VPNs and the origin of the devices, satellite dial up and mobile wireless detection.
• Customers can assign their own risk score for specific behavior occurring on their site. For instance if a retailer has a customer who visits their site five times in one day using five different email addresses, the retailer can score that behavior differently than another retailer might.
• Easy Integration between a customer’s back end software and ThreatMetrix’s global cloud based fraud prevention network. For most companies this is a matter of days instead of weeks or months.
• Cookieless fraud detection. This passive profiling is unique to ThreatMetrix and its real-time global system allows retailers to compare data received from a customer with data from hundreds of other retailers.
• Return on investment when purchasing ThreatMetrix is a matter of months not years.
• Stops first time fraud, recurring fraud and validates returning customers.

So many of ThreatMetrix’s customers report that they chose this system because is integrates payments, with logins and registrations. Because of this they no longer have to tie together a variety of products to meet their overall fraud prevention needs. ThreatMetrix allows its customers to get results in hours or days instead of weeks or months. So what are the components of the system and how do they actually work?

• Cookieless Device Identification: Cookies are no longer a reliable way to identify devices and prevent fraud. ThreatMetrix uses attribute matching and confidence scoring. They provide parallel matching across multiple cookie equivalents and cookie wiping, botnets, device manipulation and hidden proxies.
• No PII: Customers love this aspect of the system because their customers love it. ThreatMetrix uses data from the device along with the device’s internet connection and data from the transaction to determine its authenticity.
• First attempt fraud detection: Through its device and transaction data ThreatMetrix is stopping first attempt fraud in its tracks. Academics Direct reports an 80% reduction in first attempt fraud.
• ThreatMetrix accomplishes this in real time. The network evaluates hundreds of anonymous characteristics in real time and the end user never knows it.
• Shared Intelligence across a Global Network: This just may be the key to ThreatMetrix’s success and the fact that it is the fastest growing fraud prevention software. The information one customer receives is based on data from millions of transactions across ThreatMetrix’s customer base. The more customers they have the better this information becomes. It is in real time, always available and always current.
• Device Independent: ThreatMetrix does not care what device is being used - PC, tablet, Smartphone, it doesn’t matter.
• Customizable: Mentioned previously as a big customer favorite this aspect of the system allows the buyer to set it up the way they need it for their particular fraud risks. It also hides all this from the end user, instantly verifies previous visitors to the site and complements other anti-fraud tools.

Another example of the success of ThreatMetrix was in a joint venture with Telesign to reduce fraud on name.com. Here are the results:

• 10-12% fraud rate was reduced to 2%
• Lost revenue due to fraud was reduced by 98%
• Reduced $5000 loss per day to $1000
• Reduced the rate of manual review by 88% and reduced the needed Full Time Equivalent staff from 2.5 to .03 FTEs
• Reduced weekly charge backs by 80%

This success seems to be only one example of why the inline world is embracing ThreatMatrix at such a record breaking pace. This also seems to be particularly true in the mobile gaming market. Mobile gaming is one of the fastest growing ecommerce markets and ThreatMetrix seems to be well suited to corner it.

ThreatMetrix in Action

Gopro has been using ThreatMetrix for abtou twenty months.  In an interview with My Merchant Account Blog, Stephen from GoPro.com told us they had been extremely pleased with their services.  ThreatMetrix reduced friendly fraud by 15%, real fraud by 70%, and products not received by 15%. 

Like MaxMind, ThreatMetrix is compatible with all electronic payment gateways.  This was important to the company when reviewing other companies.  GoPro.com is not tied to any one processor or electronic payment gateway.

We would like to thank Stephen for take the time to answer some questions regarding ThreatMetrix.  If you are interesting in doing an interview, please contact us or call 888-928-5280 ext 822.

Your Merchant Account Blog

Thursday, July 08, 2010

My Merchant Account Blog is also now Your Merchant Account Blog.  We wanted to let you know that this blog is not just mine, but yours as well.  All merchants need to understand merchant accounts and how they work.  So many providers add on extra fees that it might be worth looking into another processor, especially if you are with First Data (First Data Might Be Over Charging Merchants).  You can still reach the site with www.mymerchantaccountblog.com or www.yourmerchantaccountblog.com.

We hope that you find these posts useful when deciding to choose a merchant account provider, possibly an electronic payment gateway (Quantum Gateway is recommended), PCI DSS, how to prevent chargebacks, and much more!

Card Verification Value - Card Verification Code - Card Identification Number

Friday, January 08, 2010

So what's the difference between Card Verification Value (CVV), Card Verification Value 2 (CVV2), Card Verification Code (CVC), Card Verification Code 2 (CVC2), and Card Identification Number (CID)?  To one extent, nothing - especially when it comes to American Express and Discover Card - these card associations rely on the CID.

CVV / CVV2

The card association, Visa, uses this term to identify the 3-digit number, usually found on the back of the card.  Visa refers to this 3-digit number on swiped transactions, when the data is collected via a POS terminal.  Visa refers to this 3-digit as CVV2 when it is used in card-not-present environments, i.e. Internet or Telephone transactions (Vetting the Transaction - Card Verification Value or Card Identification Number).

CVC / CVC2

MasterCard (and Cirrus / Maestro branded cards) use this term to refer to the 3-digit number.  Just like Visa, CVC (also known as CVC1) is stored on the magnetic stripe and is read when a merchant swipes the card.  CVC2 is the 3-digit number usually found on the back of the MasterCard on the signature panel and is usually used to help prevent fraudulent transactions on Internet and Telephone transactions (Vetting the Transaction - Card Verification Value or Card Identification Number).

CID

Discover Card and American Express refer to this number as a CID.   Of course, it cannot be as simple as that.

American Express

American Express uses a 4-digit number, found on the front of the American Express card and printed above the account number (not below).  American Express might also refer to this number as 4DBC.

Discover Card

The CID on the Discover Card is pretty much the same as Visa / MasterCard - it is a 3-digit number found on the back of the card.

One thing to consider though - never store this variable in your database in no way, shape, or form.  You could end up on the MATCH / TMF List.

Merchant Account Resources Directory

Thursday, December 24, 2009

My Merchant Account Blog receives a lot of people asking for link exchanges.  Unfortunately, we do not support this feature on this blog, but have created a Merchant Account Resources Directory for such websites.  The Merchant Account Resources Directory asks that your website is in the industry and is legitimate (we know this might be a lot to ask but one can hope).

We would like to welcome all legitimate

• Merchant Account Agents, Partners, and Resellers (like Mile High Merchant Accounts)
• Electronic Gateway Providers (like Quantum Payment Gateway, Authorize.net, 2000Charge)
• E-Commerce Solution Providers and Shopping Cart Providers
• Internet Payment Service Providers (IPSPs) aka Third Party Processors (3PP) (like Paypal and Share-It! / Digital River) and High Risk Internet Payment Service Providers
• Blog (like My Merchant Account Blog and Merchant Account Blog)
• Point of Sales Terminals and Software
• Chargebacks (like CRB Company - also mentioned in one of the famous articles on this blog - Sell Your Chargebacks)
• Merchant Account Providers (like CDGCommerce)
• Canadian Merchant Account Providers
• High Risk Internet Merchant Account Providers
• Merchant Account Acquirers (like 5th Third Bank and Chase Paymentech)
• Fraud Prevent Tools (like MaxMind)
• Trade Organizations (like NACHA, Electronic Transactions Association, and Canadian Acquirers Association)

to post their links in the Merchant Account Resources Directory.  If you have a link that does not fit a category, please contact them to see if they will add a new category.

Merchant Account News

The Merchant Account Resources Directory also has a Merchant Account News Section - if you are interested in writing unbiased articles, please contact them to become an editor.

Our Grand Opening

Thursday, September 03, 2009

I know that when a business starts, everyone is excited.  Merchants will often hold a "grand opening sale".  While you might think this is a good thing, in the Internet realm - it is letting the the scammer know you are green to the area and might open you up to numerous fraud orders.  For review, please check out the post: Some Ways to Help Internet Merchants Reduce Fraud and Chargebacks.

If you need to post this type of sale, be very wary of any orders that as previously identified in our Preventing Online Fraud post.  And make sure that you keep an eye on your Chargeback Ratios.  Your merchant account needs to be maintained by you just as much as the merchant account provider.  Just by simply checking the (billing) address and the Card Verification Value 2 / Card Identification Number (CVV2 / CVC2 / CID)  will potentially save you hundreds, if not thousands.  Don't let those large orders fool you.

Internet Payment Service Providers

Wednesday, August 19, 2009

Internet Payment Service Providers (IPSP) or Third Party Payor (3PP) is another option for some merchants.  Most of the IPSPs require the merchant to direct the customer over to its secure webserver to handle the transaction.  The IPSP will scrub the transaction for you, since it is their merchant account you are using.  Probably one of the more well known IPSPs is Paypal (owned by eBay).  Depending on the country the business owner is in, he might qualify for their "Website Payments Standard" which will allow the merchant to process the transaction on his secure web server, allowing the consistency during the checkout process.

Paypal's fees vary per country and per type of account.  For the most part, the fees are similar to Checkout by Amazon and Google Checkout.

There are a number of IPSPs available to merchants worldwide.  Some are reputable and some might not be.  Do your homework before enlisting in any of these services, and make sure you understand their terms of use and acceptable use policy.  For example, most IPSPs will not support a Ponzi / MLM scheme.  If you sign up with an IPSP that does not support a Ponzi scheme, sooner or later the IPSP will find out.  When they do, your agreement will be suspended or terminated.  Any funds that are in your account with the IPSP will be frozen.

Other Internet Payment Service Providers

I will take the time and list out a few other third party payors in this section.  Keep in mind that we do not support any one service listed.

Checkout by Amazon

Checkout by Amazon was founded in 2007 and headquartered in Washington, United States.  Checkout by Amazon has a varying price structure.  For payments under $10.00, the discount rate is 5.0% and the transaction rate is 5¢.  In most cases, the transaction rate (fixed rate) is higher and the discount rate (percentage) is lower.  A $5.00 transaction would cost the merchant about 30¢.  If you have a merchant account / electronic payment gateway, the transaction would cost about 41¢.  For transactions more than $10.00, the discount rate is 2.9% and the transaction rate is 30¢.  A $20.00 transaction would cost about 90¢ with Checkout by Amazon and about 74¢ with a merchant account / electronic payment gateway.

Checkout by Amazon also offers volume discounts.  If you are processing between $3,000 and $10,000 a month, the discount rate lowers to 2.5% and the transaction rate stays the same at 30¢.  For volume between $10,000 to $100,000 a month, the discount rate lowers to 2.2% and the transaction rate is still 30¢.  If you are processing more than $100,000 a month, the discount rate lowers to 1.9% and the transaction rate is still 30¢.  While this might seem to be a good deal, you can get a merchant account in the United States for probably the same and maybe even a lower transaction rate.

Bill Me Later

Bill Me Later is another option available to some owned by eBay, its headquarters are in Maryland, United States.  It offers customers the opportunity to get the merchandise but billed in installments.  Bill Me Later underwrites each purchase at the time of the transaction.  The line of credit is not revolving - it's for that purchase.  The customer might be able to purchase your goods and not make a payment for 90 days, or maybe no interest for six months.

Click and Buy

Click and Buy was founded in 2000 and is located in London.  For United States merchants, there is a $19.95 registration / set-up fee and $19.95 monthly service fee.  The discount rate is 2.9% and the transaction rate is 35¢.  So if you only had one transaction that month, let's say $100.00, your monthly bill would be about $23.29.

Google Checkout

Google Checkout was founded in 2006 and based in California, United States.  Their rates seem to be comparable to Checkout by Amazon.  If your monthly volume less than $3,000 a month, the discount rate is 2.9% and the transaction rate is 30¢.  If the monthly volume is between $3,000 and $9,999.99, the discount rate is 2.5% and 30¢ per transaction.   Volume between $10,000 and $99,999.99 will lower your discount rate to 2.2%, while keeping the transaction rate at 30¢.  If your volume is over $100,000.00, the discount rate is lowered to 1.9%, but the transaction rate is still at 30¢.

Some merchants who were using Google Checkout from the start were not happy when Google Checkout raised their rates (discount rate was 2.2% and the transaction fee was 20¢.  Some even wondered if Google would keep this business model, but their post back in March 2009 (Google Checkout Fees in 2009) let's the readers know that upcoming enhancements are to be expected.

Revolution Money

Revolution Money was founded in 2007 and headquartered in Florida, United States.  One of the founders is Steve Case (American Online Founder).  It offers several payment products: RevolutionCard, RevolutionGift prepaid card, and Revolution MoneyExchange.  The RevolutionCard is an alternative to Visa / MasterCard brands.  The interchange rate is low (.5%), compared to the discount rate of an Internet Merchant Account. 

The card is accepted by about 650,000 merchants currently.  Right now, the RevolutionCard is supported by the merchant account providers:

• Chase / Paymentech
• RBS WorldPay
• Fifth Third Processing Solutions
• Cardinal Commerce
• Keystone (Petroleum Processing-Pay at the Pump)
• Auric Systems

Share-It / Digital River

Share*It! is a service of Digital River, established to help merchants sell their digital goods online.  It offers two plans: share-it! VALUE and share-it! FLEX.  While the discount rate is a bit higher, ranging from 4.9% - 8.9%, its services should be considered if you are selling software / scripts online.  Share*it! will complete the transaction on its secure web server.  They will scrub the transaction for you, even offering the consumer the chance to create an account with them.

They also can manage the downloads, registration sign-ups, backups, and licensing.  Selling downloadable goods can be very high risk, but share*it! assumes that responsibility so you don't have to. 

Obopay

Obopay was founded in 2005, located in California, United States.  Obopay is a bit different in that it focuses more on mobile payments.  You can buy, transfer money, or pay with any mobile phone using Obopay's mobile application or through text messaging.  You can also access Obopay's website through a PC or on your Internet ready mobile device.  You can fund your Obopay account with a credit card or a bank account.

Paymate

Paymate was established in 2000 and they are based in New South Wales, Australia.  Their services are available in 57 countries.  In the United States, buyers pay 3% plus 50¢.  There is also a $15.00 chargeback fee imposed on the merchant if you lose dispute.  Paymate will first respond to the initial inquiry from the bank when a chargeback happens.  You do not need to register with Paymate to make a purchase.  The seller though will be put through a process before he / she can use Paymate to accept payments and should be able to project a least $36,000 in volume for the next 12 months.

Standards for Country Codes

Thursday, May 07, 2009

Most of the electronic payment gateways and Internet Payment Service Providers (IPSP) / Third Party Payor (3PP) rely on a two alpha characters to distinguish the country, rather than use the entire country.

Country Names	ISO 3166-1-alpha-2 code
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
A	top
Afghanistan	AF
Åland Islands	AX
Albania	AL
Algeria	DZ
American Samoa	AS
Andorra	AD
Anguilla	AI
Antarctica	AQ
Antigua and Barbuda	AG
Argentina	AR
Armenia	AM
Aruba	AW
Australia	AU
Austria	AT
Azerbaijan	AZ
B	top
Bahamas	BS
Bahrain	BH
Bangladesh	BD
Barbados	BB
Belarus	BY
Belgium	BE
Belize	BZ
Benin	BJ
Bermuda	BM
Bhutan	BT
Bolivia	BO
Bosnia and Herzegovina	BA
Botswana	BW
Bouvet Island	BV
Brazil	BR
British Indian Ocean Territory	IO
Brunei Darussalam	BN
Bulgaria	BG
Burkina Faso	BF
Burundi	BI
C	top
Cambodia	KH
Cameroon	CM
Canada	CA
Cape Verde	CV
Cayman Islands	KY
Central Africa Republic	CF
Chad	TD
Chile	CL
China	CN
Christmas Island	CX
Cocos (Keeling) Islands	CC
Colombia	CO
Comoros	KM
Congo	CG
Congo, The Democratic Republic of	CD
Cook Islands	CK
Costa Rica	CR
Côtoe D'Ivroire	CI
Croatia	HR
Cuba	CU
Cyprus	CY
Czech Republic	CZ
D	top
Denmark	DK
Djibouti	DJ
Dominica	DM
Dominican Republic	DO
E	top
Ecuador	EC
Egypt	EG
El Salvador	SV
Equatorial Guinea	GQ
Eritrea	ER
Estonia	EE
Ethiopia	ET
F	top
Falkland Islands (Malvinas)	FK
Faroe Islands	FO
Fiji	FJ
Finland	FI
France	FR
French Guiana	GF
French Polynesia	PF
French Southern Territories	TF
G	top
Gabon	GA
Gambia	GM
Georgia	GE
Germany	DE
Ghana	GH
Gibraltar	GI
Greece	GR
Greenland	GL
Grenada	GD
Guadeloupe	GP
Guam	GU
Guatemala	GT
Guernsey	GG
Guinea	GN
Guinea-Bissau	GW
Guyana	GY
H	top
Haiti	HT
Heard Islands and McDonald Islands	HM
Holy See (Vatican City State)	VA
Honduras	HN
Hong Kong	HK
Hungary	HU
I	top
Iceland	IS
India	IN
Indonesia	ID
Iran, Islamic Republic of	IR
Iraq	IQ
Ireland	IE
Isle of Man	IM
Israel	IL
Italy	IT
J	top
Jamaica	JM
Japan	JP
Jersey	JE
Jordan	JO
K	top
Kazakhstan	KZ
Kenya	KE
Kiribati	KI
Korea, Democratic People's Republic of	KP
Korea, Republic of	KR
Kuwait	KW
Kyrgyzstan	KG
L	top
Lao People's Democratic Republic	LA
Latvia	LV
Lebanon	LB
Lesotho	LS
Liberia	LR
Libyan Arab Jamahiriya	LY
Liechtenstein	LI
Lithuania	LT
Luxembourg	LU
M	top
Macao	MO
Macedonia, The Former Yugoslav Republic of	MK
Madagascar	MG
Malawi	MW
Malaysia	MY
Maldives	MV
Mali	ML
Malta	MT
Marshall Islands	MH
Martinique	MQ
Mauritania	MR
Mauritius	MU
Mayotte	YT
Mexico	MX
Micronesia, Federated States of	FM
Moldova, Republic of	MD
Monaco	MC
Mongolia	MN
Montenegro	ME
Montserrat	MS
Morocco	MA
Mozambique	MZ
Myanmar	MM
N	top
Nambia	NA
Nauru	NR
Nepal	NP
Netherlands	NL
Netherlands Antilles	AN
New Caledonia	NC
New Zealand	NZ
Nicaragua	NI
Niger	NE
Nigeria	NG
Niue	NU
Norfolk Island	NF
Northern Mariana Islands	MP
Norway	NO
O	top
Oman	OM
P	top
Pakistan	PK
Palau	PW
Palestinian Territory, Occupied	PS
Panama	PA
Papau New Guinea	PG
Paraguay	PY
Peru	PE
Philippines	PH
Pitcairn	PN
Poland	PL
Portugal	PT
Puerto Rico	PR
Q	top
Qatar	QA
R	top
Réunion	RE
Romania	RO
Russian Federation	RU
Rwanda	RW
S	top
Saint Barthélemy	BL
Saint Helena	SH
Saint Kitts and Nevis	KN
Saint Lucia	LC
Saint Martin	MF
Saint Pierre and Miquelon	PM
Saint Vincent and the Grenadines	VC
Samoa	WS
San Marino	SM
Sao Tome and Principe	ST
Saudi Arabia	SA
Senegal	SN
Serbia	RS
Seychelles	SC
Sierra Leone	SL
Singapore	SG
Slovakia	SK
Slovenia	SI
Solomon Islands	SB
Somalia	SO
South Africa	ZA
South Georgia and the South Sandwich Islands	GS
Spain	ES
Sri Lanka	LK
Sudan	SD
Suriname	SR
Svalbard and Jan Mayen	SJ
Swaziland	SZ
Sweden	SE
Switzerland	CH
Syrian Arab Republic	SY
T	top
Taiwan, Province of China	TW
Tajikistan	TJ
Tanzania, United Republic of	TZ
Thailand	TH
Timor-Leste	TL
Togo	TG
Tokelau	TK
Tonga	TO
Trinidad and Tobago	TT
Tunisia	TN
Turkey	TR
Turkmenistan	TM
Turks and Caicos Islands	TC
Tuvala	TV
U	top
Uganda	UG
Ukraine	UA
United Arab Emirates	AE
United Kingdom	UK
United States	US
United States Minor Outlying Islands	UM
Uruguay	UY
Uzbekistan	UZ
V	top
Vanuata	VU
Vatican City State	see Holy See
Venezuala, Bolvarian Republic of	VE
Vietnam	VN
Virgin Islands, British	VG
Virgin Islands, U.S.	VI
W	top
Wallis and Futuna	WF
Western Sahara	EH
Y	top
Yemen	YE
Z	top
Zambia	ZM
Zimbabwe	ZW

If needed, you can download a text file (3683 bytes) or a zipped file (2030 bytes) of the country codes.

IRS Seeks Data from Payment Processor

Thursday, April 16, 2009

U.S. District Judge Robert Blackburn granted a request from the Internal Revenue Service (IRS) on April 15, 2009.  In this request, the IRS is seeking records as part of investigation of taxpayers whose businesses directly deposit income from credit, debit, and other payment cards into foreign accounts to avoid paying U.S. taxes.  I have not had a chance to read the court documents, but right now it looks like the IRS is targeting merchants who have the payment processor deposit funds into an offshore account.  This comes as the Swiss banking giant UBS agreed to turn over dozens of names suspected of concealing income from the IRS a couple of months ago.

I imagine though that other payment processors that support these types of accounts will be next, i.e. Paypal.  You can always at least find a few messages a week in the message boards asking if Paypal (or other payment processors) report the earnings to the IRS.  And most of these posters tend to have their website in their signature.  Now to me, this just seems to invite the IRS to review your business and personal income tax reporting - but I could be wrong.  Of course, if you are reporting everything to the IRS, you have nothing to worry about. 

Usually we see a lot of merchants that are not based in the United States and they are wanting a merchant account from a U.S. transaction processor.  Most transaction processors in the United States can only support U.S. based merchants due to their underwriters and policies.

So, if you are a United States merchant with a bank account not located in the United States - be warned, especially if you are using Cardservice International (dba First Data Independent Sales) - the IRS is looking for monies owed.

Using and Accepting Gift Cards

Thursday, April 09, 2009

Just a few years ago, you bought a gift card for a specific company, i.e. BlockBuster, Best Buy, even Wal-Mart.  Then the card associations allowed issuing banks to issue gift cards with the card association logos on them.  this allowed the person who was receiving the gift to use the card almost anywhere. 

Let's say you received a gift card that had the American Express logo on it.  This means that you could use the gift card anywhere that was displaying the American Expression logo - from buying groceries at your favorite shopping market or buying music from the online e-commerce store.  This made it easier on the giver - he / she could easily buy a gift card with a card association logo on it, eliminating the need to force the recipient to go to a specific location.

Using the Gift Card as a Consumer

These gift cards though do come with some more responsibility though.  On the back of the card, you should find a toll free number.  For American Express gift cards, the toll free number (in the United States) is 877-297-4438.  Once you enter the 15-digit credit card number, along with the 4-digit Card Identification Number (CID) found in the upper right corner on the front of the card, you will be told your balance.

After you are told the balance, listen for the other information.  Option 5 should be for all other questions.  This will direct you to a customer service representative.  At this point, you can give the representative your name and address.  This will then help you use the card on websites that use Address Verification Service (AVS) as a starting point as a way to prevent online fraud.  Merchants rely on AVS to help check the validity of the transaction.

The next thing, you as the consumer needs to know, is the balance on the gift card.  If your balance is $9.81 but you are at the store buying goods that total $18.76, you need to let the cashier know to authorize $9.81 on the card.  Once that sale is complete, the cashier will then ask you for $8.95 - which you should be able to pay with cash, a credit card, or another gift card.

Accepting the Gift Card as a Merchant

As a merchant, you should not need to do too much to accept the gift card from from one of the card associations.  Your shopping cart should allow the option for the consumer to enter an amount to authorize.  If this amount is lower than the total, that amount should be displayed once the first amount is authorized, allowing the consumer to complete the sale.

If you rely on AVS as a stepping stone to help prevent online fraud, you might want to contact your electronic payment gateway and merchant account provider to see what they support.  I know that I have always stressed using AVS as the first step to help prevent online fraud, unfortunately though, unless the consumer has registered the gift card with the issuing bank, you might be unable to rely on this service.

Credit Transaction

Tuesday, December 30, 2008

There might be a time where you need to refund a customer, however the transaction is not on the electronic payment gateway.  For example, you might have change electronic payment gateways or the customer no longer has the credit card that was used to purchase the merchandise. 

This feature is usually disabled because of the risks involved.  For example, the merchant could abuse this privilege by crediting his own credit card.  You might have an individual that does the billing, and that person could credit his own credit card, skip town - leaving you with an empty bank account.  Or you might accidentally enter the wrong credit card number in the virtual terminal, thus crediting another person instead of your customer.

In the electronic payment gateway's virtual terminal, look for Credit (instead of Sale).  You should be able to enter the correct information to credit your customer's credit card.  If you do not see this option, contact your merchant account provider to have permission to do a credit transaction.

Our Grand Opening

Monday, December 17, 2007

I know that when a business starts, everyone is excited.  Merchants will often hold a "grand opening sale".  While you might think this is a good thing, in the Internet realm - it is letting the the scammer know you are green to the area and might open you up to numerous fraud orders.  For review, please check out the post: Some Ways to Help Internet Merchants Reduce Fraud and Chargebacks.

If you need to post this type of sale, be very wary of any orders that as previously identified in our Preventing Online Fraud post.  And make sure that you keep an eye on your Chargeback Ratios.  Your merchant account needs to be maintained by you just as much as the merchant account provider.  Just by simply checking the (billing) address and the Card Verification Value 2 / Card Identification Number (CVV2 / CVC2 / CID)  will potentially save you hundreds, if not thousands.  Don't let those large orders fool you.

How to Handle a Large Order

Friday, November 16, 2007

When you have an order that varies significantly from your typical order size, special care needs to be taken to make sure the order is legitimate. Fraudsters typically place large orders with unsuspecting merchants so you should be wary of shipping out merchandise until you have fully "vetted" the order.  For example, lets say your average ticket is about $200.00.  You just received an e-mail from your store showing that a customer has placed an order for $3,000.00 worth of merchandise and the electronic payment gateway shows that the address verification (AVS) and Card Verification Value 2 (CVV2) was verified. But what now?  Do you ship out the merchandise to the customer and hope that they are legitimate?  Of course not!  The AVS and CVV2 verifications are simply not adequate enough to ensure that the customer is not using a stolen credit card.  Further vetting of the transaction is required.

Vetting the Transaction

Fraudsters will ask that the merchandise be shipped to a different address than the one on the credit card so a good place to start is to look at the Internet Protocol (IP) address of the consumer to see if it is close to the credit card billing address. Some merchants have a service built into their shopping cart software that will verify this automatically. Or you can use a website like Geo IP Tool or IP 2 Location.  Unfortunately, this might not work for all consumers, especially dial-up users on America Online (AOL). For example, an IP address of AOL is 172.192.48.225. Most of these will report back to Reston, Virginia, United States. This does not help you as the merchant, especially if the billing and shipping address is in Colorado.

Contacting the Consumer

Fraudsters will typically not leave a valid phone number and will usually use a free email service such as Yahoo!® or Hotmail®. Don't hesitate to contact the customer on large orders. When calling them you should identify yourself and ask them to verify the order. Don't be afraid to also e-mail the customer and ask them to reply back to the e-mail to verify the order. You might also require the customer to sign a credit card authorization form and fax it to you.

Require a Signature on Delivery

When shipping out the order, ask the shipper to get a signature on delivery. You should also notify the customer that you will require a signature on delivery or else the merchandise will be returned.

Contact your Payment Processor

After you have vetted the transaction and documented your actions, contact your merchant account provider before your daily batch is uploaded. Most processors will place funds on hold if the order amount is significantly larger than the typical ticket size for your account. Tell them about the order and what you have done to verify it. Ask them if they need you to do anything else. When they tell you everything is OK, get the representative's name and / or employee ID number.

People Sending One Cent via Paypal

Wednesday, October 24, 2007

Some people have reported receiving a $0.01 (one cent) deposit to their Paypal account.  The sender could be verified or not.  The sender could be from the United States or not.  The question is, do you want to accept this payment?  While finding a penny lying on the ground may be considered good luck, finding a penny in your Paypal account may not be so lucky.  Chances are that you do NOT want to accept this payment because the sender is probably trying to verify your e-mail address and / or establish a business relationship with you so they can sell your email address to spammers.

Verifying Your E-Mail

Once the person has verified your e-mail address, he or she can now add it to their list of valid email addresses and then sell the list to spammers.  Never accept money from someone that you do not know.  If you are like me and use a particular e-mail address for Paypal, you do not want anyone else having that.  This helps to prevent those phishing e-mails.

Establishing a Business Relationship

By accepting money from someone, you are establishing a business relationship with that person which helps to bypass any of the laws that are in place to help prevent some types of spam, junk mail, and junk faxes.

So before accepting that one cent, ask yourself how much is your e-mail address and / or business relationship is worth?

Merchandise Not Received

Thursday, October 04, 2007

This chargeback is one of the more common reasons.  Consumers order a product and then call the issuing bank to inform them and hopefully get the money back.  The issuing back will start the process for you, and usually will credit your account immediately while informing the acquiring bank and the merchant account provider to start the retrieval request and possibly charging you, the merchant, a retrieval request fee.

The easiest way to respond to this chargeback code 30 is to provide the merchant account provider with a signature stating the merchandise was delivered.  This is what the issuing bank will be looking for.  If you do not have this, it is very difficult to prove the product was received.  Some companies require a signature only over a certain amount - this might be something to consider as well.

Specifying a Date of Delivery

This is very popular with a lot of merchants, they want their customers to know when to expect the merchandise.  However, this can work against you.  If you tell the consumer the merchandise will be delivered on Wednesday but it was actually delivered on Thursday, the consumer has a reason for a chargeback. 

The issuing bank will not be looking for proof of delivery but looking for some type of an agreement from the consumer saying it is OK to be received a day later.  Send the consumer an email and get his / her response.  Maybe even consider a fax with a signature stating that it will be OK for the goods to be delivered one day late.

If the consumer keeps the merchandise, you have a case against the consumer.  You can contact the consumer informing them that you are going to sell the chargeback.  If you need help writing your Terms of Service to protect yourself and business and to have the ability to charge fees when you get a fraudulent chargeback by a merchant, contact Jeffrey Cohen.

Merchant Direct Access Service

Thursday, September 27, 2007

Visa offers merchants a service called the Merchant Direct Access Service (MDAS) which allows merchants access to address verification service (AVS) by a toll-free number, using a touch-tone phone. The service is specifically targeted to small mail order / telephone order (MO/TO) or Internet merchants for whom AVS may not be cost-effective.  Merchants using MDAS are charged on a per-transaction basis.

To use the MDAS, you need access to a touch-tone telephone and your Merchant Access Code (MAC) which you can obtain from your merchant account provider.  To request an address verification, call the MDAS toll-free number, 1-800-VISA-AVS (1-800-847-2287). An automated voice unit guides you through the process of submitting a customer’s account number and address, and gives you the results of the verification.

MDAS responses are similar to AVS, but do not include a single-letter response code.  There are currently five responses that can be obtained from the MDAS:

1. Exact Match: Street address and zip code match
2. Partial Match: Street address matches, but not zip code or zip code matches, but not street address
3. No Match: Neither the street address nor zip code matches
4. Retry Later: Card issuer system is not available at the present time
5. Global: International address; cannot be verified

This system might be useful if you need to verify the address prior to running a credit card transaction.

Merchant Accounts and Cash Advances

Friday, September 07, 2007

By now, you probably have seen a few companies offering you an advance on your credit card processing volume.  Some companies might not be eligible for this cash advance based on their volume, time processing with their merchant account provider, or services that they offer.

Merchant Cash Advance

This service is known as a Merchant Cash Advance (MCA) and involves the purchase of the portion of a business' future card sales at a discount.  The purchase price paid by an Merchant Cash Advance provider is a lump sum of cash delivered to the business for its use as working capital:

• Advertising
• Equipment
• Renovations
• Equipment
• Expansion
• Inventory
• Taxes
• Working Capital
• Emergencies

A Merchant Cash Advance is not a loan - it is the purchase of specified amount of card sales (that has yet to come).  The Merchant Cash Advance provider usually contracts with a Merchant Account Provider to collect the purchased sales.  This means that the dollar amount received by the Merchant Cash Advance provider on a given processing day is based on the merchant's net card sales volume (post-chargebacks, reserves, and other processors related charges.

Merchant Cash Advance Provider

Usually the the Merchant Cash Advance Provider will contract with the Merchant Account Provider to receive payments from the merchant.  One way is known as Automated Clearing House (ACH) and another is "batch-splitting". 

In the ACH method, debits in the amount equal to the agreed percentage of the covered card sales are instituted by the processor from the merchant's bank account (i.e. Demand Deposit Account (DDA)) though ACH transactions.  In the batch-splitting method, the merchant allows the Merchant Account Provider to forward the agreed upon percentage directly to the Merchant Cash Advance Provider's account.  The rest of the money is then deposited into the merchant's bank account.

Pros and Cons Using a Merchant Cash Advance

Since the re-payment plan is based on a percentage of the future sales, the Merchant Cash Advance Provider will receive their money usually on a daily basis.  However, if you have to pay more than your "Safe Retrieval Percentage", you run the risk of going out of business.  For example, if your agreed upon retrieval percentage rate is 10%, you should make sure your mark-up is higher than this rate to cover this additional expense.

Merchant Cash Advance Providers usually require less paperwork than traditional capital sources and can often go from the application to completed funding in a week or less.  Some Merchant Cash Advance Providers do not require personal collateral to secure the merchant's obligations. 

Some Merchant Cash Advance Providers will also require the merchant not to switch Merchant Account Providers and other terms.  They will usually require the merchants to provider guarantees of performance as well.

Retrieval Fee Changes

Most Merchant Account Providers have a relationship with a Merchant Cash Advance Provider.  Usually it is better to do business with these companies since this industry is still growing and is self-regulated.  Some Merchant Cash Advance Providers might increase the retrieval percentage without the merchant's expressed consent if the merchant's sales slow down and the Merchant Cash Advance Provider is not getting their money back in a timely manner (if your sales slow down).  Verify with the Merchant Account Provider what their regulations are when it comes to this as well as the Merchant Cash Advance Provider.

Yahoo Merchant Solutions

Friday, August 24, 2007

Yahoo!® Merchant Solutions helps to provides businesses an easy way to start up their e-commerce website.  While at first glance, their prices might seem pretty inexpensive, but they are actually a bit more expensive than other electronic payment gateways.  That's right - they are an electronic payment gateway, just like Quantum Gateway LinkPoint Gateway, Payflow, Authorize.net/Cybersource.

If you would like to use Yahoo®, I recommended check out FDIS Costa Mesa - they are campatible with the Yahoo® Payment Gateway.

Yahoo!® provides merchants three different plans which includes a monthly fee.

A monthly fee that covers the web hosting services that support your store, including: hosting your store and products on our secure, reliable servers; using our powerful software platform; and conducting business on the Yahoo!® Merchant Solutions infrastructure.

This monthly fee can be compared to a hosting provider, such as TechEvolution and an electronic payment gateway.  And unlike the LinkPoint Gateway, Yahoo!® charges a transaction fee for using their gateway: .75% (Professional), 1.25% (Standard), or 1.5%(Starter).  This monthly fee is $39.95, $99.95, or $299.95 a month. 

However, if you sign up with a merchant account with the Quantum Gateway, you can opt for their hosted e-commerce store at no additional fees.

The Pros of Using Yahoo!® Small Business

The benefits of using Yahoo!® Small Businesses can be considerable.  If you want a company to handle and maintain the hosting, want one company to call, Yahoo!® might be the best solution.  If you would like to have discounts on Yahoo!® paid searches, Yahoo!® might be the company to call.

The Cons of Using Yahoo!® Small Business

The costs would be the one thing to consider.  For an e-commerce store to start out, you need a Secure Sockets Layer (SSL) certificate, a hosting company, an electronic payment gateways, a merchant account, and of course your own domain name.  Purchasing these items through another company would be cheaper, both in set-up costs and monthly costs.

Yahoo!® Small Business Solution Costs

Yahoo!® partners with Chase / Paymentech and uses the First Data Nashville Platform to help process the transactions.  The basic costs of this account is:

• Setup/application fee: none
• Monthly fee: $22.95
• Transaction fee: $0.20 cents per transaction, and 2.69% for Visa and MasterCard (2.58% for debit cards)

Another Option for Selling Your Products

I would recommend signing up for a merchant account through Mile High Merchant Accounts and choosing the Quantum Gateway.  The cost for the merchant account and electronic payment gateway is $10.00 a month.  They offer a store at no additional fees.

How Credit Card Numbers Are Determined

Sunday, November 26, 2006

The card number itself comes from ISO 7812/7816 standards. The first digit on the card will tell you what category it is in per the standards. Four and five identifies the card as banking and financial and six identifies the strip as merchandizing and banking. Three is actually travel and entertainment. The number itself has a structure to it - the first six digits being the Bank Identification Number (BIN).

The method for determining a valid credit card number is known as the mod-10 or Luhn's method (named after the inventor Hans Peter Luhn).  The United States issued a patent (2950048) for this method in August 1960.

MasterCard

MasterCard will usually begin with 51-55 with 16 digits. Usually the first six digits is the BIN and the next nine digits are your account number.

Visa

Visa credit card numbers will begin with a four and have 13 or 16 digits. It can be presumed though that most cards issued with the Visa logo will have 16 digits. Usually the first six digits is the BIN and the next nine digits are your account number.

American Express

American Express will usually begin with a 34 or 37 and have 15 digits.  You can also check out the American Express Merchant Reference Guide (October 2010).

Diner's Club

Diner's Club will usually begin with 300-305, 36, or 55. Those beginning with a 36 should have 14 digits will those beginning with 55 will have 16 digits. Keep in mind that in the last quarter of 2004, MasterCard and Diner's club formed an alliance. Cards issued in Canada and the USA start with 55 and are treated as MasterCards worldwide. International cards use the 36 prefix and are treated as Mastercards in Canada and the US, but are treated as Diner's Club cards elsewhere.

Discover Card

Discover Card card will usually begin with 6011 and have 16 digits. Check out Standard Security Features Common to Discover Network Issued Credit Cards for more information.

There are a few other organizations like JCB, Maestro, Solo, Switch, Visa Electron that can be found, however a lot of these are debit cards which might require a personal identification number (PIN) to be used with the transaction.

The last digit of the credit card is known as the check digit - this helps the credit card to be verified properly.  The digits between the BIN and the last digit are the account number for the individual.

Microsoft Frontpage MVP

Sunday, October 08, 2006

Corey Bryant was nominated this year for the Microsoft Frontpage Most Valuable Professional and they actually accepted me.

Ways to Prevent Spam

Friday, April 07, 2006

When you go to a website, they almost always want your email address.  Most people have a at least two email addresses: one for family and friends and one for business.  Most of the email addresses people get are free, e.g. from live.com, GMail, Yahoo, Hotmail, etc.  There are pros and cons associated with these email addresses of course.  For example, if your personal "GMail" account is a bit too "personal", you don't want to give that out to a human resource department. 

So what's the best way to control spam, be professional, and friendly?  Get your own domain name.  Yes, that's right.  Go to a registrar, for example:

• www.GoDaddy.com
• www.Dotster.com
• www.Omnis.com

You do not need to know how to build a website.  You only need a hosting company, like TechEvolution, to host your email.  Let's say you and your significant other names' are Brad and Jennifer.  You can see if the domain name bradandjennifer.com is available.  If it is, this will cost you about $10.00 a year for registration.  Then you can use a company, TechEvolution or even go back to GoDaddy.

Once you set up your domain, you will set up a POP3 account.  What I have done is set up a personal email address that I give out to people I trust.  I then have what is called a "catch-all" - let's call it catchall@bradandjennifer.com.  So, when I go to Facebook, I set up facebook@bradandjennifer.com.  When Facebook sends out a confirmation email, it will be diverted over to this catch-all account.  I can confirm the email address. 

Let's say about a week down the road, you notice you are receiving a lot of email addressed to this email address.  TechEvolution offers SmarterMail as one mail server (another is Microsoft Exchange).

In the SmarterMail Web Control Panel, you can set up a filter to automatically delete any e-mail that is now sent to this e-mail address.  Of course, you will want to first change your e-mail address on Facebook first.

We don't mean to pick on Facebook, but we recommend that you do this for every company - Amazon, Bank of America, Wells Fargo, PayPal etc.  This also helps you immediately if you receive an e-mail from your bank telling you their has been a problem and you need to sign into their website by using a link in the e-mail.  If the e-mail is not addressed to, say hsbc@bradandjennifer.com, then you know it is a "phishing" e-mail.  Of course, you should always go to the financial institution's website.

You hear a lot about "breaches", but only the person's name and e-mail address was compromised, no 'vital' information to your account.  However, your e-mail address is important to you of course and not as trivial as they might want you to think.

Another option is to just open a free email account used for the message boards / forums / social media websites as well, but that could be another thing to do.  If you get your own domain name, you can easily save any / all e-mails on your local computer with an e-mail client, like Microsoft Outlook.