5 ms·

I'm the OP. Let me know if any of you out there have questions! Or, better yet, experiences with simplifying payments on your site good or bad.

jevinskie 14y ago
How are you penalized if you don't collect the extra information (besides potentially higher rates as stated in the post)? Are there more frauds leading to chargebacks that may have been detected if the card merchant had more information?
- brandonb 14y ago
  If you were to use a really minimal payment form (number and expiration), it's likely that you'd get somewhat more chargebacks. However, you'd also get more revenue. Let's say your chargeback rate goes from 0.1% to 0.2%, but your conversion rate goes from 50% to 60%, then you come out way ahead. In our experience, you can stop most fraud without putting up roadblocks for your users. Every site is different, but to give an example, we were able detect 90% of fraud for a site with a huge fraud problem without requiring any extra verification from the users. The really key penalty to avoid is what is called an "excessive chargeback program," which usually triggers for chargeback rates that exceed 1%. You initially get a warning, and if you can't get your chargeback rate down, your payment processor has the right to shut you off. If you're in an excessive chargeback program, then I'd definitely recommend "playing it safe." But otherwise, I think slimming down your payment form and carefully measuring the effect on fraud is almost always a smart business move.
  - thedufer 14y ago
    > Let's say your chargeback rate goes from 0.1% to 0.2%, but your conversion rate goes from 50% to 60%, then you come out way ahead. No, you don't. You need more information about the transaction then that. What if your profit margin is 1%? Then you've come out even, because chargebacks cost you the full cost of an item, but an extra conversion only nets you the profit on that sale. Note: I assumed that the 0.1% and 50% to 60% were both percentages of potential sales, because it made the math easier. Otherwise, you have 20% x 1%=2% more profit and .2% x 120%-.1%=.14% more loss from chargebacks, so you have come out slightly ahead.
haroldu 14y ago
Doesn't Verified by Visa and SecurePay by Mastercard solve this problem? Whenever I enter a credit card I get asked to enter an online password as well. Of course, ideally every citizen would be able to sign anything with a public-private key pair, counter-signed by the state.
- jevinskie 14y ago
  I hated when Newegg started using Verified by Visa. The password requirements were so silly that I would always forget my password. I haven't been prompted to enter my VbV password at Newegg for some years.
- borlak 14y ago
  Verified by Visa is incredibly annoying to the consumer. I've abandoned payments because I forgot my password. Now I have it turned off completely.
  - retube 14y ago
    How do you turn it off?
    - borlak 14y ago
      I haven't had to use it in a long time so my memory is fuzzy...but last I remember, when the actual Verified by Visa form pops up, there is an option to disable it.
- jsnell 14y ago
  Verified by Visa is an extremely high friction mechanism. It requires registration the first time around for each CC, and also an extra password or some other authentication mechanism like a bank dongle. If significant people bounce off transactions due to needing to type in their address, or due to needing to flip over the credit card and read 3 numbers, I don't even dare to think of what the bounce rate is for these mechanisms. It's especially bad since just about no websites I ever buy anything from use VbV / SecurePay. That means that I don't remember the authentication secrets off the top of my head, so unless I'm at home will likely abort the extremely rare transactions that really require it. I've maybe needed VbV once in the last year, and had to try 3 cards before I found one that I could use on the spot.
annon 14y ago
The "40% higher conversion rates" for not requiring CVV is extremely suspect to me. Looking at the paper, it wasn't an A/B test, but comparing entire sites. There could be any number of variables causing a difference in conversion rates. On top of that, there is no published date, but it does mention May 2007 being in the future. Six years is an eternity in the ecommerce space, and I have a feeling people are more familiar with what the CVV code is and where it is located today.
- brandonb 14y ago
  You're right that it's not proper A/B test, so it may be a case that correlation doesn't imply causation. Unfortunately, there's not a lot of research published with rigorous A/B testing for this kind of thing. If any of you out there would like to run an A/B test (and have us help detect fraud if you're worried about increases there), I'd love to help!
  - boucher 14y ago
    Of course, any increase in conversion also needs to balance the increase in declines you'll see by not providing a security code.
- raverbashing 14y ago
  I think it's suspicious as well. Fine, here's the thing, if the person can't find the CVV in the card, I don't want his business. Period
mrb 14y ago
I have purchased stuff on sites that have greatly simplified their payment process to the point I did not need to type anything at all! I click "Checkout"; the site displays a QR code; I scan it with my smartphone, which decodes it and prompts "Send 0.123 BTC to xxx?"; and I click "OK". Done. This is how the purchasing experience looks like with Bitcoin which, for merchants, solves the fraud problem. Hence buyers do not need to give any billing information.
- pixl97 14y ago
  >Send 0.123 BTC to xxx How is 'xxx' determined? Looks like a great place to install malware that overtops the sites QR with its own and sends the payment off to the wrong place.
  - mrb 14y ago
    'xxx' is read from the QR code. The attack vector you mention is no different than malware that intercepts your credit card number when typing it in.

jevinskie 14y ago

How are you penalized if you don't collect the extra information (besides potentially higher rates as stated in the post)? Are there more frauds leading to chargebacks that may have been detected if the card merchant had more information?

brandonb 14y ago
If you were to use a really minimal payment form (number and expiration), it's likely that you'd get somewhat more chargebacks. However, you'd also get more revenue. Let's say your chargeback rate goes from 0.1% to 0.2%, but your conversion rate goes from 50% to 60%, then you come out way ahead. In our experience, you can stop most fraud without putting up roadblocks for your users. Every site is different, but to give an example, we were able detect 90% of fraud for a site with a huge fraud problem without requiring any extra verification from the users. The really key penalty to avoid is what is called an "excessive chargeback program," which usually triggers for chargeback rates that exceed 1%. You initially get a warning, and if you can't get your chargeback rate down, your payment processor has the right to shut you off. If you're in an excessive chargeback program, then I'd definitely recommend "playing it safe." But otherwise, I think slimming down your payment form and carefully measuring the effect on fraud is almost always a smart business move.
- thedufer 14y ago
  > Let's say your chargeback rate goes from 0.1% to 0.2%, but your conversion rate goes from 50% to 60%, then you come out way ahead. No, you don't. You need more information about the transaction then that. What if your profit margin is 1%? Then you've come out even, because chargebacks cost you the full cost of an item, but an extra conversion only nets you the profit on that sale. Note: I assumed that the 0.1% and 50% to 60% were both percentages of potential sales, because it made the math easier. Otherwise, you have 20% x 1%=2% more profit and .2% x 120%-.1%=.14% more loss from chargebacks, so you have come out slightly ahead.

haroldu 14y ago

Doesn't Verified by Visa and SecurePay by Mastercard solve this problem? Whenever I enter a credit card I get asked to enter an online password as well. Of course, ideally every citizen would be able to sign anything with a public-private key pair, counter-signed by the state.

jevinskie 14y ago
I hated when Newegg started using Verified by Visa. The password requirements were so silly that I would always forget my password. I haven't been prompted to enter my VbV password at Newegg for some years.
borlak 14y ago
Verified by Visa is incredibly annoying to the consumer. I've abandoned payments because I forgot my password. Now I have it turned off completely.
- retube 14y ago
  How do you turn it off?
  - borlak 14y ago
    I haven't had to use it in a long time so my memory is fuzzy...but last I remember, when the actual Verified by Visa form pops up, there is an option to disable it.
jsnell 14y ago
Verified by Visa is an extremely high friction mechanism. It requires registration the first time around for each CC, and also an extra password or some other authentication mechanism like a bank dongle. If significant people bounce off transactions due to needing to type in their address, or due to needing to flip over the credit card and read 3 numbers, I don't even dare to think of what the bounce rate is for these mechanisms. It's especially bad since just about no websites I ever buy anything from use VbV / SecurePay. That means that I don't remember the authentication secrets off the top of my head, so unless I'm at home will likely abort the extremely rare transactions that really require it. I've maybe needed VbV once in the last year, and had to try 3 cards before I found one that I could use on the spot.

annon 14y ago

The "40% higher conversion rates" for not requiring CVV is extremely suspect to me. Looking at the paper, it wasn't an A/B test, but comparing entire sites. There could be any number of variables causing a difference in conversion rates. On top of that, there is no published date, but it does mention May 2007 being in the future. Six years is an eternity in the ecommerce space, and I have a feeling people are more familiar with what the CVV code is and where it is located today.

brandonb 14y ago
You're right that it's not proper A/B test, so it may be a case that correlation doesn't imply causation. Unfortunately, there's not a lot of research published with rigorous A/B testing for this kind of thing. If any of you out there would like to run an A/B test (and have us help detect fraud if you're worried about increases there), I'd love to help!
- boucher 14y ago
  Of course, any increase in conversion also needs to balance the increase in declines you'll see by not providing a security code.
raverbashing 14y ago
I think it's suspicious as well. Fine, here's the thing, if the person can't find the CVV in the card, I don't want his business. Period

mrb 14y ago

I have purchased stuff on sites that have greatly simplified their payment process to the point I did not need to type anything at all! I click "Checkout"; the site displays a QR code; I scan it with my smartphone, which decodes it and prompts "Send 0.123 BTC to xxx?"; and I click "OK". Done. This is how the purchasing experience looks like with Bitcoin which, for merchants, solves the fraud problem. Hence buyers do not need to give any billing information.

pixl97 14y ago
>Send 0.123 BTC to xxx How is 'xxx' determined? Looks like a great place to install malware that overtops the sites QR with its own and sends the payment off to the wrong place.
- mrb 14y ago
  'xxx' is read from the QR code. The attack vector you mention is no different than malware that intercepts your credit card number when typing it in.