Taking Card Payments over the Phone
Discussion
Ok - so sorry if this is random, but I need some thoughts on this subject from a larger community -
My company is looking to expand our website offerings (AVaficionado.co.uk) with some more expensive AV equipment. Our current model is to either use PayPal to process online payments, or bank transfer (mostly corporate account sales)
We want to be able to offer alternatives to PayPal, and take card payments both in person, via the website (non Paypal) or over the phone. It is the over the phone orders that are scaring the crap out of us to be honest. The few companies I have spoken to about putting this facility in place basically have all said there is no cover for the retailer taking payments over the phone from a fraud protection perspective. I have gone through a couple of "Virtual Terminal" white papers / demos which is how you would process a "customer not present" over the phone card payment, and they appear massively lacking in a basic security area - namely the card holders address ?? I have sat in a meeting today with a large name in Card Payment processing, who basically said that all virtual terminal solutions are the same, and that only the card details inc. the 3 digit code are required to authorise a transaction. No where on their virtual terminal is the retailer asked for the card holders address details which can then be confirmed by the card processing organisation at the back end - this seem like madness and this can't be "the norm" surely ?
There are thousands or organisations that take card payments over the phone - they can't all decide the business is a risk worth taking. Sure, we understand the principle of only shipping to the registered card holders address, but if the card processing system does not ask us for that address, how the hell is it going to confirm that the address we have been asked to ship to matches the card holders address they have on record ?
If anyone is using a Virtual Terminal system for such transactions that DOES request address details, please PM me, as I refuse to believe what I have been told this morning in "the norm" !!
Your time appreciated.
My company is looking to expand our website offerings (AVaficionado.co.uk) with some more expensive AV equipment. Our current model is to either use PayPal to process online payments, or bank transfer (mostly corporate account sales)
We want to be able to offer alternatives to PayPal, and take card payments both in person, via the website (non Paypal) or over the phone. It is the over the phone orders that are scaring the crap out of us to be honest. The few companies I have spoken to about putting this facility in place basically have all said there is no cover for the retailer taking payments over the phone from a fraud protection perspective. I have gone through a couple of "Virtual Terminal" white papers / demos which is how you would process a "customer not present" over the phone card payment, and they appear massively lacking in a basic security area - namely the card holders address ?? I have sat in a meeting today with a large name in Card Payment processing, who basically said that all virtual terminal solutions are the same, and that only the card details inc. the 3 digit code are required to authorise a transaction. No where on their virtual terminal is the retailer asked for the card holders address details which can then be confirmed by the card processing organisation at the back end - this seem like madness and this can't be "the norm" surely ?
There are thousands or organisations that take card payments over the phone - they can't all decide the business is a risk worth taking. Sure, we understand the principle of only shipping to the registered card holders address, but if the card processing system does not ask us for that address, how the hell is it going to confirm that the address we have been asked to ship to matches the card holders address they have on record ?
If anyone is using a Virtual Terminal system for such transactions that DOES request address details, please PM me, as I refuse to believe what I have been told this morning in "the norm" !!
Your time appreciated.
We use WorldPay, 99% of the time it's online payments by the customer but also their "MOTO" service too. I'm pretty sure that MOTO does address verification too, however it would be displayed in the control panel after the payment has been made.
If the purchases are of a high enough value it might be worth looking at fraud/identity checking services - eg. check that they are on the electoral roll at that address, that the name/address are "known" etc.
If either AVS or the fraud check brings up questions you can telephone them to ask some questions, do further checking, perhaps use a more expensive courier, or if it's a very high value purchase delivery and not too far, deliver it personally and check the customer's ID before handing it over. (A customer who objects to any of these is probably a customer you don't want anyway).
Quite often people type postcodes incorrectly, eg. O's as 0 (zero), I's as 1, and often when you point it out they don't even understand the difference!
If the purchases are of a high enough value it might be worth looking at fraud/identity checking services - eg. check that they are on the electoral roll at that address, that the name/address are "known" etc.
If either AVS or the fraud check brings up questions you can telephone them to ask some questions, do further checking, perhaps use a more expensive courier, or if it's a very high value purchase delivery and not too far, deliver it personally and check the customer's ID before handing it over. (A customer who objects to any of these is probably a customer you don't want anyway).
chrisp84 said:
We make software that takes card details relayed over the phone (aswell as via website etc).
We have the address verivication service there, however our customers never turn it on as it's not that great.
If you were to automatically refuse transactions when the address doesn't match then there would probably be quite a few problems, however as long as the match details are available to review then it is fine - eg. flag any purchase > £100 where it doesn't match for manual review.We have the address verivication service there, however our customers never turn it on as it's not that great.
Quite often people type postcodes incorrectly, eg. O's as 0 (zero), I's as 1, and often when you point it out they don't even understand the difference!
Edited by Gareth79 on Monday 21st October 19:55
Ean218 said:
We take card orders over the phone, but process them on a PDQ machine which, for card not present, asks for house number and post code numbers. That's one reason why we have kept our machine and do not use a virtual terminal.
Same here, but I'm fully aware of it security limitations but it's not something we do an awful lot ofOur biggest problem was charge-backs. And the paperwork that came with the charge-back notification from the merchant was, to paraphrase, "for c-n-p transactions where the customer has not entered their PIN number, don't even think about challenging the charge-back as you won't get anywhere." I don't know if it's changed now. As I recall, this applied whether we'd typed the details into the PDQ machine, or processed it on-line via SecPay, though I may be wrong on this last point. And our average product sale was £29, not hundreds or thousands of pounds.
droopsnoot said:
Our biggest problem was charge-backs. And the paperwork that came with the charge-back notification from the merchant was, to paraphrase, "for c-n-p transactions where the customer has not entered their PIN number, don't even think about challenging the charge-back as you won't get anywhere." I don't know if it's changed now. As I recall, this applied whether we'd typed the details into the PDQ machine, or processed it on-line via SecPay, though I may be wrong on this last point. And our average product sale was £29, not hundreds or thousands of pounds.
We mostly do < £100 transactions and the main reason is that the customer doesn't recognise the company name, which is a .com name which is related to, but doesn't completely describe what they bought (which is a service, not any physical product, so very unlikely to be targeted for fraud). The company phone number does appear on their statement though, so nearly every time they just call and within ten seconds they know what it's about. In about 20,000 transactions only one person has filed a chargeback without contacting us, and we sorted that pretty fast.Gassing Station | Finance | Top of Page | What's New | My Stuff