VP2PE and Payment Card Industry Acronyms Revealed

Posted on February 12, 2018 by Christine Speedy

What does it mean to be HIPAA, PCI Level 1, VP2PE, and QIR compliant in the world of credit card processing? Learn the lingo and know what certifications to verify when choosing a payment gateway or any solution that touches payments.

PCI DSS

If you accept credit cards, you must comply with Payment Card Industry Data Security Standards. There’s no exception. Anyone who advises that a solution means you don’t have any responsibility is dead wrong. The PCI Security Standards Council (PCI SSC) mission is to enhance payment account data security by fostering broad adoption of the PCI Security Standards. The organization was founded by American Express, Discover Financial Services, JCB, MasterCard Worldwide, and Visa International. The council sets the standards, the card brands levy penalties and fines for non-compliance.

PCI Level 1 Service Provider

If a third party entity provides services for, or on behalf of a Merchant, and those services control or could impact the security of cardholder data or of transactions that are processed, that entity is a PCI Service Provider for the Merchant and falls within the Merchant’s scope of PCI DSS compliance. For example, if you accept payments online, the payment gateway is a PCI Service Provider. Or if you use a lockbox company, they must be certified. PCI Level 1 is the most common PCI Compliance certification for a service provider. You can verify if a service provider is compliant with Visa here https://www.visa.com/splisting/searchGrsp.do. If the company you’re doing business with is not on the list, ask questions.

PA DSS

If a software application controls or could impact the security of cardholder data or of transactions that are processed, for PCI compliance, merchants must only use Payment Application Data Security Standards that are certified. For example, a lock box company that processes transactions or a retail point of sale system. If payments are segregated from the application, then PA DSS does not apply. In my experience, this is a weak area for merchants because not all application providers understand their requirements; some will do the standard PCI scan and say they’re PCI Compliant, but in reality, they’re using a homegrown application to process transactions which they have not certified.

HIPAA

There is no Health Insurance Portability and Accountability (HIPAA) certification for service providers and it does not fall under the purview of the PCI Council. However, a PCI Service Provider may choose to engage a third party auditor to attest compliance in order to better serve merchants in industries that require HIPAA compliance.

QIR

Organizations qualified by PCI SSC as Qualified Integrator and Reseller Companies (QIR Companies) are authorized to implement, configure, and/or support validated PA-DSS Payment Applications on behalf of merchants or service providers for purposes of performing Qualified Installations as part of the QIR Program. Level 4 merchants were a big portion of data breaches so as of January 2017, they’re mandated to only use QIR certified individuals for their implementations and maintenance. Level 4 are merchants with less than 20,000 Visa or MasterCard e-commerce transactions annually, and all other merchants processing up to 1 million Visa or MasterCard transactions annually. QIR applies to individuals; a company may have multiple people certified.

P2PE

Point-to-point encryption (P2PE) is a standard established by the PCI Security Standards Council. The objective of P2PE is to provide a payment security solution that instantaneously converts confidential payment card (credit and debit card) data and information into indecipherable code at the time the card is swiped to prevent hacking and fraud. It is designed to maximize the security of payment card transactions in an increasingly complex regulatory environment.

VP2PE

VP2PE is not an official acronym of the PCI Council for Validated P2PE, but it is descriptive. The P2PE Standard defines the requirements that a “solution” must meet in order to be accepted as a PCI validated P2PE solution. A “solution” is a complete set of hardware, software, gateway, decryption, device handling, etc. Validated solutions are listed in the PCI Council web site. They reduce PCI compliance scope and burden for merchants. For example, about 35 questions vs 359, and 4 sections instead of 12.

Today there are only 42 companies with 49 validated solutions in the entire world. Some of the solutions are only valid with a particular acquirer. For merchants seeking an agnostic VP2PE solution, the list gets very small.

CenPOS

CenPOS, a payment technology provider, has a Health Insurance Portability and Accountability (HIPAA) attestation from a third party external auditor across a broad range of payment solutions offered by the company. CenPOS is listed as a registered Level 1 Service Provider on the Visa web site; and is listed on the PCI Council web site VP2PE solutions and QIR sections. The CenPOS Validated P2PE solution is compatible with many acquirers. You can also find me, Christine Speedy, under QIR certifications when searching by name. (CenPOS is not a software application so is not listed as PA DSS.

Christine Speedy, CenPOS Sales 954-942-0483, 9-5 ET is based out of South Florida and NY. CenPOS is a merchant-centric, end-to-end payments engine that drives enterprise-class solutions for businesses, saving them time and money, while improving their customer engagement. CenPOS secure, cloud-based solution optimizes acceptance for all payment types across multiple channels without disrupting the merchant’s banking relationships. When you call Christine, there is no middle man; all agreements are direct with CenPOS. As one of the very first to sell for CenPOS, I have deep experience to help merchants understand benefits and get live fast.

What is level one level two and level iii processing?

Posted on March 17, 2017 by Christine Speedy

Level 1, Level 2 and level 3 processing are different ways of handling purchasing or p-card, business, commercial, and corporate cards. Each level has unique data specifications that determine the potential rate merchants pay for related card acceptance. Even if Level 1, Level 2 and level 3 data is sent to the acquirer, or credit card processor, the merchant may not qualify for the associated rate due to other rules not being met. Although interchange rates are the non-negotiable fees all merchants pay, they can be influenced.

MYTH: If I use a level 3 processor, I’ll get the lowest rates. False. Many rules must be followed. The payment gateway and integration method, if applicable, is largely in control of potential rate qualification. Few have the necessary technology automation to maximize profits. Additionally, the processor may be certified for one channel, but the merchant accepts payments via multiple channels such as retail and e-billing.

What is level 1 processing?

The default commercial card transaction is level 1.

What is level 2 processing?

Requires level II data, including the entry of customer code, card acceptor type, tax ID and sales tax.

For MasterCard, a sales tax amount is required, and the amount must be greater than $0.00, but no less than 0.1% – 30 % of the transaction amount. This is important because most B2B companies typically are not charging sales tax, therefore cannot qualify for level II rates, and need to focus on level III.
For Visa, a tax amount is not required, but the merchant must indicate whether the transaction is tax exempt.

Most acquirers and payment gateways support level 2 data.

What is level 3 processing?

Level III minimum data requirements include: Summary Record – Discount Amount, Freight/Shipping Amount, Duty Amount and Account Number and Line Item Detail Record – Item Sequence Number, Item Commodity Code, Item Descriptor, Product Code, Quantity, Unit of Measure, Unit Cost, and Discount per Line Item, Line Item Total, and Line Item Detail Indicator.

While that sounds like a lot, this can be managed by the payment gateway, which is required for level III processing. It’s critical to point out that the data is the minimum requirement to even potentially qualify. There are a bunch of other rules. For example, authorization and settlement must be equal and settlement must be within required timeframe. Again, this is an area for B2B that often causes a problem. Payment gateway capabilities and integration method must support all the rules, including numerous new Visa rules.

Each rate below is for the same credit card, but different rules apply to qualify for them.

2016-2017 U.S. Region MasterCard Commercial Rates—Small Business Credit
Interchange Rate Program	Level 4
Standard	3.26% + $.10
Data Rate 1	2.96% + $.10
Data Rate II	2.31% + $.10
Data Rate III	2.06% + $.10
Large Ticket 1/II/III	1.51% + $40

Not to be confused with processing level, MasterCard came out with “Small Business Level”, which is about the cardholder and issuer relationship size (how much the cardholder spends).

What is CAVV Authentication Verification Value?

Posted on November 8, 2016 by Christine Speedy

Cardholder Authentication Verification Value, or CAVV, are potential responses for customer initiated Visa debit and credit card transactions where the Verified by Visa, or Vbyv, authentication method is used. E-commerce, online payments, and Electronic Invoice Presentment & Payment (EIPP or EBPP) are all solutions in which a customer can participate in self-authentication.

How does CAVV impact interchange rates, the bulk of credit card processing fees?

To qualify for CAVV interchange rates, merchants must register for Verified by Visa through their merchant services provider, and must use a payment gateway that supports the service as part of the transaction process. In addition, other rules apply such as settlement time and more; the latter part can be managed automatically with an intelligent payment gateway.

The best Visa Card Not Present Key entered transaction credit rate is 1.80%.
The same Visa transaction as above, but with a valid CAVV response is 1.70%.

How does CAVV impact fraud risk?

If a passed validation response is returned, then fraud risk shifts to the card issuer. Responses other than ‘fail’ may warrant additional scrutiny as part of a layered approach to mitigate fraud risk.

CAVV Transaction Response Code Values:

“ ” – Blank CAVV or AEVV Not Present
0 – CAVV or AEVV Not Validated due to erroneous data submitted
1 – CAVV or AEVV Failed Validation – Authentication Transaction. This is an indication of potential bad or fraudulent data submitted as the CAVV/AEVV.
2 – CAVV or AEVV Passed Validation – Authentication Transaction
3 – CAVV or AEVV Passed Validation – Attempted Authentication Transaction. (Determined that the Issuer ACS generated this value from the use of the Issuer’s CAVV/AEVV key[s]).
4 – CAVV or AEVV Failed Validation – Attempted Authentication Transaction. This is an indication of potential bad or fraudulent data submitted as the CAVV/AEVV. (Determined that Visa generated this value from the use of CAVV/AEVV key[s]).
5 – Reserved for future use – NOT USED
6 – CAVV or AEVV Not Validated – Issuer not participating in CAVV/AEVV validation. This value is generated when an Issuer requests the “do not verify” flag to be established for its BINs. This parameter enables an Issuer to temporarily stop CAVV/AEVV verification while resolving CAVV/AEVV key issues. VisaNet processes this value as a valid CAVV/AEVV.
7 – CAVV or AEVV Failed Validation – Attempted Authentication Transaction. This is an indication of potential bad or fraudulent data submitted as the CAVV/AEVV. (CAVV/AEVV generated with Visa Key)
8 – CAVV or AEVV Passed Validation – Attempted Authentication Transaction. (CAVV/AEVV generated with Visa Key)
9 – CAVV or AEVV Failed Validation – Attempted Authentication Transaction. This is an indication of potential bad or fraudulent data submitted as the CAVV/AEVV (CAVV/AEVV generated with Visa Key – Issuer ACS unavailable)
A – CAVV or AEVV Passed Validation – Attempted Authentication Transaction. (CAVV/AEVV generated with Visa Key – Issuer ACS unavailable)
B – CAVV or AEVV Failed Validation – Attempted Authentication Transaction. This is an indication of potential bad or fraudulent data submitted as the CAVV/AEVV. (CAVV/AEVV generated with Visa Key)
C – CAVV or AEVV Not Validated – Attempted Authentication Transaction. Issuer did not return a CAVV/AEVV results code in the authorization response. VisaNet will treat this as valid CAVV/AEVV if the Issuer approves the authorization.
D – CAVV or AEVV Not Validated – Authentication – Issuer did not return a CAVV/AEVV results code in the authorization response. VisaNet will treat this as valid CAVV/AEVV if the Issuer approves the authorization.
I – Invalid Security Data
U – Issuer does not participate or 3-D Secure data not utilized.
Default space filled

Note, other card brand authentication terms are AEVV, American Express Verification Value and MasterCard Universal Cardholder Authentication Field (UCAF^™). All of these, including VbyV, use the global standardized 3-D Secure XML security protocol. Payment gateways can implement 3-D Secure in different ways, which can potentially impact profits and risk.

For CenPOS solutions to enable customer cardholder authentication, including payment gateway, contact Christine Speedy today. Not all solutions work alike, contact an expert.

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Card Not Present, CenPOS, credit card processing

B2B Cloud payment processing technology blog about increasing profits, efficiency and security.

Category Archives: terminology