D365 ERP F&O credit card processing

Posted on by
Reply

Need a credit card processing solution for D365? What you used in Microsoft Dynamics AX is probably not what you want for Microsoft D365 F&O. That’s because most payment gateways are horribly outdated with current payment processing requirements. Aside from PCI compliance, equally critical is compliance with the card network rules.

Three things you need to ask before selecting a payment gateway for D365:

  • Does the payment gateway support Unscheduled Credential On File?
  • How will you identify expired authorizations and update them?
  • If the initial authorization and final settlement are different, how does the payment gateway manage the authorization so that you can meet requirements for level 3 processing?

D365, ERP, and ecommerce consultants are generally not great resources for the last mile- getting paid, because it’s not their core expertise. If anyone tells you here are two or three options, you choose whichever you want, RUN! Each payment gateway has unique attributes. You need a consultant that not only knows payment processing, but also knows differences between payment gateways and how each will help or hurt your goals.

How can you find a good D365 payment gateway consultant?

While there is not a specific certification that is critical, it helps to have some type of certification vs just experience. The PCI Council offers a few different options, all of which are expensive which is why most people won’t bother getting them. However, because level 4 merchants are required to use only PCI QIR certified individuals, the PCI Council has lowered the cost (as well as the complexity, but that’s another story) to increase the number certified.

Since you’re reading this article, you’re looking for expert help. You’ve found it. I’ve been blogging about payment processing for years. I have used, sold and implemented solutions for authorize.net, PayPal, Payflow Pro, CenPOS, First Data, Chase Paymentech and many, many others. I’ve analyzed merchant statements, ecommerce shopping carts, ERP’s, merchant processors / acquirers, and a host of solutions that interact to impact merchant security, fraud risk, processing fees, and efficiency. Because I’ve seen what happens after the sale, including non-qualified transactions, chargebacks, risky security practices that often go against company policy but employees do it anyway, and more, I’m in a better position than most to give you the best advice for business to business, business to government, large transactions, card not present sales and specialty retail. If I don’t know it, I research everything and ask lots of questions that consultants and merchants don’t know to ask.

The Christine Speedy difference. PCI compliance is important to mitigate data breach risk, but equally important is compliance with complicated card network rules. Have you read any of the 1,000+ pages of Visa Rules? Or 300+ Mastercard transaction processing rules? Have any of the people you rely on? I’ve spent countless hours educating myself on them and learning about the nuances that impact your profit and risk. Technology directly impacts compliance. It doesn’t matter how big or how old a company is; the reality is most players in the payments industry fall behind with every new rule that comes out, even though these rules are usually announced years in advance so that they can prepare. Call 954-942-0483, 9-5 ET for expert advice about all things payments.

Magento Security Alert requires action to maintain PCI Compliance

Posted on by
Reply

Magento 2.3.1, 2.2.8 and 2.1.17 Security Update

A SQL injection vulnerability has been identified in pre-2.3.1 Magento code. To quickly protect your store from this vulnerability only, install patch PRODSECBUG-2198. However, to protect against this vulnerability and others, you must upgrade to Magento Commerce or Open Source 2.3.1 or 2.2.8. We strongly suggest that you install these full patches as soon as you can.

PCI Compliance Requirement 6: Develop and maintain secure systems and applications. All critical systems must have the most recently released software patches to prevent exploitation. The average merchant relies upon third party developers for web site maintenance, but unless specifically contracted to update the e-commerce software and add-on modules, don’t count on it.

Only 16.4% of organizations that had suffered a data breach were compliant with Requirement 6, compared to an average of 64% of organizations assessed by our QSAs in 2014- Verizon 2015 PCI Compliance Report.

Payment gateway implementation requirements have changed over time as a result of cross-site scripting and cross-site request forgery (CSRF) to meet current PCI Compliance standards. Merchants should verify all components of their ecommerce ecosystem are current, and have a system for ongoing monitoring and updating.

RESOURCES

  • Magento Security Center
  • MAGENTO SECURITY ALERT, March 26, 2019
  • Christine Speedy, 3D Merchant Services, offers a Magento payment gateway module for merchants to improve their omnichannel customer experience and mitigate fraud and vulnerability risk. Special B2B customer benefits include friction-less payments across all sales channels; text and email Express Checkout, customer invoice portal for 24/7 ACH, credit card, wire and more payment types, and US EMV with level 3 processing. Magento and ERP modules combine to provide a powerful array of solutions to improve cash flow and profits while maximizing security. 954-942-0483.

Which Payment Gateways Support Stored Credential Requirements?

Posted on by
Reply

Rules for storing and using stored cards changed for merchants in 2017, yet many payment gateways in 2019 still don’t support the transaction requirements, opening risk of issuer chargeback, fines, and assessments to merchants. Since the card networks are now notifying acquirers of non-complaint merchants, it’s time to get serious about making updates. This article updated authorize.net and Cybersource information on June 4, 2020.

The four types of stored credential transactions are recurring billing, installment billing and Unscheduled Credential On File, where buyer agrees to store the card and future transactions will be initiated either by merchant or buyer. Read more about the stored credential rules either by searching the blog for ‘credential’ or click here for card network rules. The payment gateway manages most of the compliance after merchants make the appropriate changes for standalone or integrated solutions, but merchants also have responsibility for getting the proper wording and opt-in record keeping for agreements to store cards.

Which payment gateways support authorization requirements for stored credentials? Ask gateways if they support your specific card not present transaction type. Even if they do, merchant compliance is not automatic and merchants cannot rely on web developers to automatically get them updated either. This list is valid as of today. Please comment below if you have new information about updates or more payment gateways to add to the list.

  • Authorize.net- No, see developer forum for note. 6/4/2020 update: Upon further information gleaned from various sources, merchants are being advised to ‘upgrade’ to Cybersource not only for stored credential but also Strong Customer Authentication (SCA2) and other items.
  • Bluepay- Unable to determine.
  • Braintree- Yes, added MasterCard 1/18/19, Visa 2018.
  • CenPOS– Yes, since 2017, all transaction types. CenPOS does not publish developer information online. See contact info below for sales, integrations and developer assistance.
  • Cybersource- When this blog post was publised, the answer was no per this article (original link to https://www.cybersource.com/mitsc_mandate/#1 is now 404, page not available, however, as of June 4, 2020, Cybersource documentation is still referring to the same broken page which says they are getting ready.) An April 21, 2020 note says they are ready on some processors https://support.cybersource.com/s/article/Support-for-Merchant-Initiated-Transactions-and-Credential-on-File-for-Visa-Mastercard-and-Discover. I question the accuracy of the zip file contents here https://support.cybersource.com/s/article/Support-for-Merchant-Initiated-Transactions-and-Credential-on-File-for-Visa-Mastercard-and-Discover 1.Establishment of Relationship. The initial transaction must be identified as a COF transaction even when it is the first instance (whether a zero-dollar authorization or first transaction). The cardholder must be present for this initial transaction. I agree with the logic as it applies to Cybersource, however, “cardholder must be present” is not applicable to payment gateways, for example CenPOS, capable of dynamically delivering the correct authentication data regardless of channel at the time of authentication and also future transactions.
  • Ingenico- Maybe. Yes, with Ingenico ePayments DirectLink on the international web site, but I was unable to find the related developer code for updating US ePayments needs.
  • Orbital (Chase)- Unable to determine.
  • Payeezy (First Data)- Yes, developer instructions.
  • PayFlow Pro- Unable to determine, doesn’t look like it.
  • Shift4 – No.
  • Vantiv/WorldPay- Maybe. With the merger of these companies, merchants might or might not be using a payment gateway that supports it. Developer info for Worldpay.

How can you easily identify if you’re compliant with card network rules? Here’s a few items to check for:

  1. Is there a checkbox for customer to accept terms?
  2. Are you asking for the security code? While not required if using alternative 3-D Secure cardholder authentication, in my experience, if you’re not asking for it, it’s outdated 100% of the time.

This article is not meant to be a comprehensive list of requirements and may be outdated. The most important takeaway is merchants and developers should not assume that their partners are automatically keeping them current or compliant with the latest rules for card acceptance compliance. In fact, with the update in 2020, it’s coming up on THREE YEARS since the rules went into effect. For continuous compliance, you need a trusted payments expert that knows the rules. Developers can implement programming, but are not experts in processing.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for a payment gateway compliant with stored credential rules that can be quickly implemented. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

D365 ERP payment gateway

Posted on by
Reply

What’s an economical payment gateway for D365? One that enables business to qualify for the lowest rates possible for any given card type, mitigates chargeback risk, and creates efficiencies. Many businesses using AX 2012 and D365 need to store a card and charge on demand. To qualify for the lowest rates and mitigate risk of penalties and fines, compliance with the card network rules is required.Minimum requirements to potentially qualify for the best rates are:

  • For card not present payments, including invoice portal, support 3-D secure; some issuers offer a lower rate averaging 20 BPS (.20%) less.
  • Compliance with 2017 Visa stored credential mandate (which will also get you compliant with MasterCard etc). Many payment gateways do not support this yet.   Ask, ” Do you support “Unscheduled Credential On File” rules?; store the card, charge on demand. Currently authorize.net, Red Maple and Payflow Pro do not.
  • If doing preauthorizations, a method to reauthorize expired auths, and a method to make initial and final auth the same amount if it changes after the preauth. Failure to do so increases the qualified credit card rate an average of 30% for businesses on pass-through interchange pricing.
  • Reversing unused authorizations; Mastercard penalty is now a hefty .25% for misuse of authorization.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for a D365 payment gateway that can be quickly implemented. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.

authorize.net alternative for Visa stored credential

Posted on by
Reply

Need an alternative to Authorize.net to comply with stored credential rules, including for both recurring and Unscheduled Credential On File? Authorize.net does not yet offer a solution for Visa stored credential or Mastercard. This includes both merchant initiated transaction and customer initiated transaction in addition to the other items in the Visa Stored Credential Transaction framework and mandates effective October 14, 2017.

The payment gateway is the biggest piece of the puzzle for compliance. My clients were compliant back in 2017. Whether integrated or standalone, I can help you comply with this and many other rules that impact merchant fees and chargeback risk. Even B2B companies that never have chargebacks are at risk.

Call Christine Speedy, CenPOS Global Sales. 954-942-0483, 9-5 ET for all your recurring billing and stored credential payment gateway and virtual terminal needs. CenPOS is an integrated commerce technology platform driving innovative, omnichannel solutions tailored to meet a merchant’s market needs. Providing a single point of integration, the CenPOS platform combines payment, commerce and value-added functionality enabling merchants to transform their commerce experience, eliminate the need to manage complex integrations, reduce the burden of accepting payments and create deeper customer relationships.