Rules for storing and using stored cards changed for merchants in 2017, yet many payment gateways in 2019 still don’t support the transaction requirements, opening risk of issuer chargeback, fines, and assessments to merchants. Since the card networks are now notifying acquirers of non-complaint merchants, it’s time to get serious about making updates. This article updated authorize.net and Cybersource information on June 4, 2020.
The four types of stored credential transactions are recurring billing, installment billing and Unscheduled Credential On File, where buyer agrees to store the card and future transactions will be initiated either by merchant or buyer. Read more about the stored credential rules either by searching the blog for ‘credential’ or click here for card network rules. The payment gateway manages most of the compliance after merchants make the appropriate changes for standalone or integrated solutions, but merchants also have responsibility for getting the proper wording and opt-in record keeping for agreements to store cards.
Which payment gateways support authorization requirements for stored credentials? Ask gateways if they support your specific card not present transaction type. Even if they do, merchant compliance is not automatic and merchants cannot rely on web developers to automatically get them updated either. This list is valid as of today. Please comment below if you have new information about updates or more payment gateways to add to the list.
- Authorize.net- No, see developer forum for note. 6/4/2020 update: Upon further information gleaned from various sources, merchants are being advised to ‘upgrade’ to Cybersource not only for stored credential but also Strong Customer Authentication (SCA2) and other items.
- Bluepay- Unable to determine.
- Braintree- Yes, added MasterCard 1/18/19, Visa 2018.
- CenPOS– Yes, since 2017, all transaction types. CenPOS does not publish developer information online. See contact info below for sales, integrations and developer assistance.
- Cybersource- When this blog post was publised, the answer was no per this article (original link to https://www.cybersource.com/mitsc_mandate/#1 is now 404, page not available, however, as of June 4, 2020, Cybersource documentation is still referring to the same broken page which says they are getting ready.) An April 21, 2020 note says they are ready on some processors https://support.cybersource.com/s/article/Support-for-Merchant-Initiated-Transactions-and-Credential-on-File-for-Visa-Mastercard-and-Discover. I question the accuracy of the zip file contents here https://support.cybersource.com/s/article/Support-for-Merchant-Initiated-Transactions-and-Credential-on-File-for-Visa-Mastercard-and-Discover 1.Establishment of Relationship. The initial transaction must be identified as a COF transaction even when it is the first instance (whether a zero-dollar authorization or first transaction). The cardholder must be present for this initial transaction. I agree with the logic as it applies to Cybersource, however, “cardholder must be present” is not applicable to payment gateways, for example CenPOS, capable of dynamically delivering the correct authentication data regardless of channel at the time of authentication and also future transactions.
- Ingenico- Maybe. Yes, with Ingenico ePayments DirectLink on the international web site, but I was unable to find the related developer code for updating US ePayments needs.
- Orbital (Chase)- Unable to determine.
- Payeezy (First Data)- Yes, developer instructions.
- PayFlow Pro- Unable to determine, doesn’t look like it.
- Shift4 – No.
- Vantiv/WorldPay- Maybe. With the merger of these companies, merchants might or might not be using a payment gateway that supports it. Developer info for Worldpay.
How can you easily identify if you’re compliant with card network rules? Here’s a few items to check for:
- Is there a checkbox for customer to accept terms?
- Are you asking for the security code? While not required if using alternative 3-D Secure cardholder authentication, in my experience, if you’re not asking for it, it’s outdated 100% of the time.
This article is not meant to be a comprehensive list of requirements and may be outdated. The most important takeaway is merchants and developers should not assume that their partners are automatically keeping them current or compliant with the latest rules for card acceptance compliance. In fact, with the update in 2020, it’s coming up on THREE YEARS since the rules went into effect. For continuous compliance, you need a trusted payments expert that knows the rules. Developers can implement programming, but are not experts in processing.
Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for a payment gateway compliant with stored credential rules that can be quickly implemented. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.
