{"id":5438,"date":"2020-05-19T13:23:43","date_gmt":"2020-05-19T18:23:43","guid":{"rendered":"https:\/\/3dmerchant.com\/blog\/?p=5438"},"modified":"2021-12-01T17:25:34","modified_gmt":"2021-12-01T22:25:34","slug":"remote-checkout-with-credit-card","status":"publish","type":"post","link":"https:\/\/3dmerchant.com\/blog\/merchant-processing-industry-news\/remote-checkout-with-credit-card","title":{"rendered":"Remote checkout with credit card"},"content":{"rendered":"\n

Businesses are shifting to remote credit checkout to avoid close contact with customers. Remote checkout systems range from cheap to pricey, but when comparing safe and secure solutions, it’s important to know what questions to ask to maximize profits and mitigate risk. In particular, telephone credit card transactions, text, and work from home practices directly impact profits and risk.<\/p>\n\n\n\n

A popular practice is to eliminate customer entry into facilities. Communication methods include expansion of telemedicine and secure portals. Two areas are lacking: text and credit card payment. Even the most advanced facilities fall short in one way or another. <\/p>\n\n\n\n

Credit card number via phone problems for typical retail merchant account:<\/strong><\/p>\n\n\n\n

  1. Merchants are prohibited from writing sensitive cardholder data on paper (Visa sec. 5).<\/li>
  2. Key entering into computer:
    1. Results in 100% invalid \u2013 yet issuer approved- authorizations*, typically increasing costs 30-100% per transaction. <\/li><\/ol>
      1. Increases data breach risk with home and office hardware and network in scope for Payment Card Industry Data Security Standards (PCI). <\/em><\/li><\/ol>
        1. Employees access to cardholder data an added risk<\/li><\/ol><\/li>
        2. Key entering into desktop terminal:
          1. Same authorization problem as above (See merchant statement for non-qual, STD, EIRF, Level I etc)<\/li><\/ol>
            1. All transactions at risk of consumer or issuer chargeback since EMV chip\/swip data expected but not received.<\/li><\/ol><\/li>
            2. Ties up phone lines for already overwhelmed staff;  another data breach risk<\/li>
            3. Note: Digital forms that can be decrypted are unacceptable<\/li>
            4. If storing\/tokenizing cardholder data, most solutions are PCI compliant, not but not compliant for network (Vcardholder agreement and future transaction authorizations<\/li><\/ol>\n\n\n\n

              Card not present alternatives: <\/strong><\/p>\n\n\n\n

              SMS\/text with\nsecure pay<\/p>\n\n\n\n

              1. 80-95% of Americans have a smart phone; all age groups, including seniors, are texting<\/li>
              2. Puts customers in control of entering, storing, managing cardholder data<\/li><\/ol>\n\n\n\n

                Email with secure pay- also eliminates employee access to cardholder data. A growing threat is business email compromise with phishing schemes increasing during Covid-19 crisis.<\/p>\n\n\n\n

                Hosted pay page- I do not recommend as this is not efficient during quick check in and\ncheck out needs.<\/p>\n\n\n\n

                What merchants should look for\nin vendor solutions: <\/strong><\/p>\n\n\n\n

                1. 3-D Secure cardholder authentication<\/strong> for customer initiated payments; qualify for reduced card not present rates plus fraud disputes for \u201cI didn\u2019t authorize\u201d disappear. The benefit is much like EMV chip for retail, and merchants can save even more on interchange fees for some cards due to lower risk.<\/li>
                2. 3rd<\/sup> party app or web based solution that segregates all devices, hardware and networks from scope for PCI,<\/strong> including key entered transactions; The latter can be managed via special terminal, app, or encrypted virtual keypa<\/strong>d, perfect for workers at home and on the go.<\/li>
                3. 3rd<\/sup> party app or web based text solution that eliminates client data from employee devices and hardware, and is compliant with various text\/telecom rules (FCC, TCPA etc<\/strong>). If employees are texting on their devices, it’s incredibly difficult or impossible to get that data later if needed in a legal dispute.<\/li>
                4. Checkout option to enter authorized 3rd<\/sup> party <\/strong>for animal pick up, time of day, and even details about car or truck if desired.<\/li>
                5. Automated authorization optimization <\/strong>for card present, phone order, card on file and customer initiated transactions. This is either managed by technology (preferred) or multiple merchant accounts. Ok, many probably don’t know what this means, but it’s the difference between employees having to optionally take certain steps and technology automatically managing it.<\/li>
                6. One-way texting with payment collection <\/strong>has minimal additional compliance burden for various rules. <\/li>
                7. Two-way texting<\/strong> is much more robust, with even more upside for efficiency (think photo\/video, updates throughout the stay, promotional link with notification animal entered surgery, survey at end, and continued opt-in to future marketing). The value of opted-in marketing, when used wisely, cannot be understated.<\/li><\/ol>\n\n\n\n

                  Merchants will benefit from increased approvals, more profits, happier\ncustomers, less phone time, and more secure operations. All of this adds up to\nboth internal and external customer experience improvements during a stressful\ntime dealing with Covid-19 repercussions and beloved animals needing urgent\ncare.<\/strong><\/p>\n\n\n\n

                  Christine Speedy\u2019s Analysis:<\/strong><\/p>\n\n\n\n

                  Merchant\u2019s lack\nthe right technology tools, which have been used by other industries for years,\nto meet new card not present requirements while maximizing profits and\nmitigating risk. Rapid adoption will reap virtually immediate rewards. <\/p>\n\n\n\n

                  * Issuers will approve\nmost requests if funds are available, but merchants must comply with various\ncard acceptance rules based on how an authorization is requested or pay\npenalties. For example, a retail merchant account requires EMV chip or swipe\ndata. When the don\u2019t get it, penalties apply. Solutions to dynamically qualify\nper different rules require a technology update, typically via 3rd<\/sup>\nparty solution.<\/p>\n\n\n\n

                  Research Links: <\/strong><\/p>\n\n\n\n

                  Card network rules: http:\/\/3dmerchant.com\/blog\/merchant-bulletins-downloads<\/a><\/p>\n\n\n\n