|
Jul 31
2009
|
Limitations with Recurring Payments and Continuous AuthorityPosted by: Dave on Jul 31, 2009 |
|
Is the Card Verification Code (CVC) used for recurring payments?
The first question raised concerned the Card Verification Code (CVC) value and its usage in an online payment transaction. When you make an online purchase with your credit card you are required to enter the CVC value. This value is an important security check when processing an online credit card transaction and provides protection against credit card fraud. Section 3.2.2 of the Payment Cards Industry Data Security Standard (PCI DSS) does not permit the storage of the CVC under any circumstances."3.2.2 Do not store the card-verification code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions."
As a result if you are processing a recurring online credit card transaction you will not have access to the CVC value. Processing transactions without the CVC involves a higher risk of fraudulent transactions occurring. Recurring payments tend to be used in a B2B environment where the merchant knows the customer. In this scenario the risk of fraud is relatively low. If you are a B2C merchant and are using recurring payments in a situation where you believe there may be a risk of fraud then best practice is to take the initial payment as a regular transaction using the CVC value before accepting the customer in your systems as a recurring payments client.
How is the card expiry date handled with recurring payments?
The next question we received relates to the expiry date. A valid expiry date is a required value when processing an online transaction but this date, of course is subject to change. When you add a customers card details to your payment providers secure system, an expiry date is recorded. Of course, over time the customer receives a new card, with a new date. Any recurring transaction will fail as a result of the unchanged expiry date. In this case you, as a merchant, would have to contact your customer to record the new expiry date and update the card details.
Some payment providers will have functionality to help you manage this process built into their system. For example they may alert you when a card has expired so you will be able to contact the customer and update the details in advance of processing the next payment.
Are there any other options?
The two items discussed above are limitations with recurring payments. The payments industry has a solution that overcomes these restrictions of recurring payments. Continuous Authority (CA) is a transaction type designed specifically for recurring payments. It deals with the two issues outlined above, the CVC and the expiry date are not required when processing the transaction. The transactions can continue to be processed once the card number does not change. The main advantage to the Merchant is they do not have to worry about the expiry date changing. Once the initial transaction is processed successfully then any repeats of this transaction will be trusted so the CVC and the expiry date do not need to be provided.
CA transactions are not supported by all of the acquirers. Continuous Authority only works with Visa and MasterCard credit cards. As a result of this Continuous Authority is not supported by all payment providers.
Earlier this week WorldNet TPS officially launched NetCollect, their recurring payments solution. There are also offerings available from DataCash, Endeavour, Realex and SagePay. In next weeks Blog post we will look at these recurring payment solutions in more detail.
Dave
--
If you liked this article then you should subscribe to our 
Blog RSS feed.
Related Blog Posts:
written by John Clarke , July 31, 2009
In recent years visa & mastercard have tried to develope systems to support recurring transactions. The VAU (Visa Account Updater) and ABU (the Mastercard version- the two schemes can never agree on a name!), were ambitious in scope, but have largely remained unimplemented, and so are of very limited benefit. So for merchants looking to support recurring payments, 3rd Party solutions provided by the Payment Gateways are best option.
written by dave lowry , August 04, 2009
Hi John,
I am not familiar with VAU or ABU. I must do some research and see what I can find out about them.
I agree that 3rd party solutions provided by the Payment Service Providers are the best option for Merchants.
My next blog post will look at recurring payment products and services provided by the PSPs to Irish merchants.
Thanks,
Dave
written by Andrew Rothwell , August 20, 2009
When a cardholder is signing up _online_ for recurring billing, what is acceptable proof of authenticity (or authorization), that an acquirer or scheme needs to cite? Is a username and verified confirmation code sufficient, or is a signature on a piece of paper required?
I'm asking from the perspective of potential chargebacks arising.
written by dave lowry , September 02, 2009
Hi Andrew,
Sorry for delay in replying to you, I always miss comments for some reason. If you are setup for continuous authority recurring payments then the initial transaction will require the customer to enter their expiry date and cvv so this will be used to approve the initial transaction. Subsequent transactions will not require the expiry date or cvv. Some providers support 3D Secure for Continuous Authority so the initial transaction can be verified this way. If you are not using continuous authority then it is probably best to check with your acquiring bank to find out what are the conditions of your merchant service agreement.
Thanks,
Dave
written by Ange , November 20, 2009
And the problem with CAP's is that they can be difficult for the customer to cancel as they are reliant on the trader to be homourable. A number of fraudsters have been using this approach to extract small but regular payments from unsuspecting clients with bank accounts. They are able to extract payments using expired cards for long periods of time this way with no recourse. the banks will deny they have any responsibility. The law needs to be changed to ensure that the account holder can cancel a CAP through their bank with reasonable notice.
