10 ms·

Could someone who deals with PCI compliance please explain some other nuances of credit cards that I've been curious about: * Fault/Decline Codes returned from

Could someone who deals with PCI compliance please explain some other nuances of credit cards that I've been curious about: * Fault/Decline Codes returned from processors like CyberSource. How are these factored? How do processors do Regex on names/addresses? [1][2] * CVV numbers and what they mean/how they are treated in the system? If CVV number is included does this increase chargeback protection? * How CHIP cards work differently in the processing system, if at all? * Do "knuckle-busters" (carbon copy physical imprints) follow any sort of compliance anymore? [1] http://apps.cybersource.com/library/documentation/dev_guides/Reporting_Developers_Guide/reporting_dg.pdf http://apps.cybersource.com/library/documentation/dev_guides... [2] http://apps.cybersource.com/library/documentation/dev_guides/AFS_IG/20050726_AFS_IG.pdf http://apps.cybersource.com/library/documentation/dev_guides...

pbreit 13y ago
Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the processor to decline. This might be preferable to the merchant from a cost-saving standpoint as well as not needing to "void an auth" in order to free up the cardholders spendability. The idea behind CVVs is that merchants are disallowed from storing them so they are far less likely to be included in stolen credit card databases. Thus, requiring them significantly decreases fraud risk. And, yes, many gateways/processors charge more for missing or incorrect CVVs. It's harder to "steal" a chip card since the information is not sitting on an easy-to-read mag-stripe. It's not clear that chip cards would have avoided the Target thing since the fraudsters infiltrated the terminal software. I'm guessing more current terminals/software is simply harder to compromise. "Chip & pin", as is widely used in places such as Canada and Europe, might help a bit since you would need the PIN to shop off-line. But it would have minimal effect for online shopping since PIN is typically not requested. The reason we still sign receipts and yes, you still see a carbon copy here and there, is mainly because it protects the merchant if the cardholder does a "chargeback". Merchants typically store the receipts and only turn them over if a chargeback is received. Showing the signed receipt to your processor will usually absolve you from any loss. I think the above is accurate or close to.
- michaelt 13y ago
  Can I piggyback on this and ask an unrelated question I'm curious about? Let's say an online merchant gets a transaction they very strongly suspect is a stolen credit card (perhaps it's from a customer with a long history of using stolen cards) but it validates just fine. Is there any provision in the interface for merchants to ask the credit card company to perform extra fraud checks, like calling the cardholder?
  - kevinconroy 13y ago
    No, there are no such provisions. The card companies have their own fraud prevention/detection departments which mine transactions and look for abnormal behavior. If they spot something out of the ordinary (big purchase, foreign purchase, etc) then they will call you to validate.
    - bigd 13y ago
      Which is why, every time I travel, I end up with all the cards blocked. I hate you visa.
      - yummyfajitas 13y ago
        Call before you go and tell them you are traveling.
        Daniel_Newby 13y ago
        Somewhere I read that such a call triggers a fraud red alert.
        stephenr 13y ago
        I read somewhere that masturbating makes you go blind too. I use an AU Visa card all over the place. Once it was blocked (after a purchase) because I charged $1200 in a bangkok furniture shop. One call to the bank and it was useable again, and they knew I spend a lot of time in thailand so it's not automatically "suspicious" behaviour.
joshaidan 13y ago
The story behind the CVV is something like this: CVV is also known as card not present number. Historically it was printed on the back of the card, or on the front using unraised type. This way, if an impression of a credit card was taken (using one of those old fashion swipe back and forth machines), the CVV number would not be included in the impression. This provided some protection for card owners, as it prevented a merchant from using the credit card number obtained from an impression to say place an order using the CC over the phone. This is why you're required (or it's recommended) that you ask for the CVV number for any transaction where the card is not present.
- dylz 13y ago
  I'm confused, how does this work? There is no raised type on any of my cards whatsoever, how do you take an impression of a flat card?
  - vidarh 13y ago
    In the old days, before most places had machines to swipe the mag stripe, they used to take card imprints. I'm 38, and have had cards for 20 years, and I've never had anyone imprint my cards. So these days it's not very necessary to have raised type on the cards for most people.
pkteison 13y ago
1a) Varies by issuing bank. Your processor sends the transaction viaVisa & MasterCard ("network") which passes along the transaction to the issuer (a large bank), which in turn decided to approve or decline the transaction and passes back a code. Your processor may map that specific code to a more general code, which behavior will often vary per client - some clients just want to get back "Declined" while some want "Invalid expiration date". Unfortunately since decline code behavior varies -by issuer-, it's possible to get back wrong codes, so you can't trust them really. For example, you might see a Mastercard with an invalid zipcode come back as invalid expiration date, while another mastercard with an invalid zipcode comes back with invalid AVS. Then if you present "invalid expiration date" to your end user, they will be confused because the expiration date is fine. In my experience, detailed decline codes are more trouble than they're worth, the customer will have to call their bank to fix anything regardless so just tell them declined - call bank. 1b) Numbers only. See for example http://en.wikipedia.org/wiki/Address_Verification_System http://en.wikipedia.org/wiki/Address_Verification_System and understand that "street address" just means whatever numbers are there at the beginning of the address. Also understand that this is frequently incredibly low quality data, all you can really rely on is the zipcode match part, trying to do any better will result in a lot of false negatives. 2) There are multiple names for this. In the beginning, on mag stripes, CVV/CVC (name varies by network) was developed and it was a way to validate that somebody didn't build a mag stripe based on just knowing the card numbers - it's data that exists only on the mag stripe and is not printed on the card. Then, CVV2/CVC2/CID/etc was developed and it is a way to validate that somebody has seen the actual card - it is data that is printed on the card but is not in the stripe. People usually don't know about the difference and are talking about CVV2/CVC2 when they say CVV or CVC. The key thing that makes this work is that merchants are restricted from storing the CVV2/CVC2/CID data (and they already weren't supposed to store mag stripes, so CVV/CVC also), so if somebody gets a database dump of a bunch of credit cards it shouldn't have CVV2/CVC2 data in it. It also doesn't come for free from an automated skimmer because it isn't on the mag stripe. And, way back in the day, it wouldn't have been on the carbon copies because it was in flat type. So, this really does add some security to a transaction. So what it does for chargeback protection is make it more likely that you are dealing with someone who physically has the card in front of them, because that little bit of data is harder to steal than the other bits of data. It still doesn't let you win a chargeback - for that, you need a signature, which you won't have if you're doing ecommerce, so you'll lose. It just makes the chargeback less likely in the first place. Additionally, if you are classified as doing ecommerce, some issuers will simply decline any transaction that doesn't have CVV2/CVC2. Varies by merchant category and by issuer. 3) Don't know, I processed cards in America. Debit cards when used with PIN have a completely different technology behind their security, and a completely different set of laws covering them than credit cards do, but I don't know about chip-and-pin. 4) Don't know, because Internet.
notatoad 13y ago
Collecting a CVV2 code doesn't increase your chargeback protection (for merchants, there is essentially no chargeback protection. if a customer wants to issue a chargeback, you'll get a chargeback). What it does is reduce your risk profile, which is part of how your processing fees are collected. If you don't collect the CVV2 you're going to have a much higher risk profile, and will either pay a higher processing fee or else be denied the ability to process cards at all. Chips are the same thing - it reduces the fraud risk, thus reducing your processing fees. the carbon imprint is just like a chip - physical proof that the card was present during the transaction. card-present environment is a much lower risk profile than card not present environment, the difference between the two is often a full percentage point in processing fee. The address verification is not a regex, it's just a simple lookup. Most merchants don't actually do address verification though because it is fairly expensive.
- virtualwhys 13y ago
  How do you mean address verification is fairly expensive? Expensive in terms of lost sales (i.e. users giving up in frustration due to mismatches) or something else? We've had AVS in place for years and get reduced fees as a result. How many people give up on payment due to AVS mismatches, however, is another matter.
  - notatoad 13y ago
    our payment gateway would charge us more for address verification than our merchant bank would discount us for using address verification.

pbreit 13y ago

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the processor to decline. This might be preferable to the merchant from a cost-saving standpoint as well as not needing to "void an auth" in order to free up the cardholders spendability. The idea behind CVVs is that merchants are disallowed from storing them so they are far less likely to be included in stolen credit card databases. Thus, requiring them significantly decreases fraud risk. And, yes, many gateways/processors charge more for missing or incorrect CVVs. It's harder to "steal" a chip card since the information is not sitting on an easy-to-read mag-stripe. It's not clear that chip cards would have avoided the Target thing since the fraudsters infiltrated the terminal software. I'm guessing more current terminals/software is simply harder to compromise. "Chip & pin", as is widely used in places such as Canada and Europe, might help a bit since you would need the PIN to shop off-line. But it would have minimal effect for online shopping since PIN is typically not requested. The reason we still sign receipts and yes, you still see a carbon copy here and there, is mainly because it protects the merchant if the cardholder does a "chargeback". Merchants typically store the receipts and only turn them over if a chargeback is received. Showing the signed receipt to your processor will usually absolve you from any loss. I think the above is accurate or close to.

michaelt 13y ago
Can I piggyback on this and ask an unrelated question I'm curious about? Let's say an online merchant gets a transaction they very strongly suspect is a stolen credit card (perhaps it's from a customer with a long history of using stolen cards) but it validates just fine. Is there any provision in the interface for merchants to ask the credit card company to perform extra fraud checks, like calling the cardholder?
- kevinconroy 13y ago
  No, there are no such provisions. The card companies have their own fraud prevention/detection departments which mine transactions and look for abnormal behavior. If they spot something out of the ordinary (big purchase, foreign purchase, etc) then they will call you to validate.
  - bigd 13y ago
    Which is why, every time I travel, I end up with all the cards blocked. I hate you visa.
    - yummyfajitas 13y ago
      Call before you go and tell them you are traveling.
      - Daniel_Newby 13y ago
        Somewhere I read that such a call triggers a fraud red alert.
        stephenr 13y ago
        I read somewhere that masturbating makes you go blind too. I use an AU Visa card all over the place. Once it was blocked (after a purchase) because I charged $1200 in a bangkok furniture shop. One call to the bank and it was useable again, and they knew I spend a lot of time in thailand so it's not automatically "suspicious" behaviour.

joshaidan 13y ago

The story behind the CVV is something like this: CVV is also known as card not present number. Historically it was printed on the back of the card, or on the front using unraised type. This way, if an impression of a credit card was taken (using one of those old fashion swipe back and forth machines), the CVV number would not be included in the impression. This provided some protection for card owners, as it prevented a merchant from using the credit card number obtained from an impression to say place an order using the CC over the phone. This is why you're required (or it's recommended) that you ask for the CVV number for any transaction where the card is not present.

dylz 13y ago
I'm confused, how does this work? There is no raised type on any of my cards whatsoever, how do you take an impression of a flat card?
- vidarh 13y ago
  In the old days, before most places had machines to swipe the mag stripe, they used to take card imprints. I'm 38, and have had cards for 20 years, and I've never had anyone imprint my cards. So these days it's not very necessary to have raised type on the cards for most people.

pkteison 13y ago

1a) Varies by issuing bank. Your processor sends the transaction viaVisa & MasterCard ("network") which passes along the transaction to the issuer (a large bank), which in turn decided to approve or decline the transaction and passes back a code. Your processor may map that specific code to a more general code, which behavior will often vary per client - some clients just want to get back "Declined" while some want "Invalid expiration date". Unfortunately since decline code behavior varies -by issuer-, it's possible to get back wrong codes, so you can't trust them really. For example, you might see a Mastercard with an invalid zipcode come back as invalid expiration date, while another mastercard with an invalid zipcode comes back with invalid AVS. Then if you present "invalid expiration date" to your end user, they will be confused because the expiration date is fine. In my experience, detailed decline codes are more trouble than they're worth, the customer will have to call their bank to fix anything regardless so just tell them declined - call bank. 1b) Numbers only. See for example http://en.wikipedia.org/wiki/Address_Verification_System http://en.wikipedia.org/wiki/Address_Verification_System and understand that "street address" just means whatever numbers are there at the beginning of the address. Also understand that this is frequently incredibly low quality data, all you can really rely on is the zipcode match part, trying to do any better will result in a lot of false negatives. 2) There are multiple names for this. In the beginning, on mag stripes, CVV/CVC (name varies by network) was developed and it was a way to validate that somebody didn't build a mag stripe based on just knowing the card numbers - it's data that exists only on the mag stripe and is not printed on the card. Then, CVV2/CVC2/CID/etc was developed and it is a way to validate that somebody has seen the actual card - it is data that is printed on the card but is not in the stripe. People usually don't know about the difference and are talking about CVV2/CVC2 when they say CVV or CVC. The key thing that makes this work is that merchants are restricted from storing the CVV2/CVC2/CID data (and they already weren't supposed to store mag stripes, so CVV/CVC also), so if somebody gets a database dump of a bunch of credit cards it shouldn't have CVV2/CVC2 data in it. It also doesn't come for free from an automated skimmer because it isn't on the mag stripe. And, way back in the day, it wouldn't have been on the carbon copies because it was in flat type. So, this really does add some security to a transaction. So what it does for chargeback protection is make it more likely that you are dealing with someone who physically has the card in front of them, because that little bit of data is harder to steal than the other bits of data. It still doesn't let you win a chargeback - for that, you need a signature, which you won't have if you're doing ecommerce, so you'll lose. It just makes the chargeback less likely in the first place. Additionally, if you are classified as doing ecommerce, some issuers will simply decline any transaction that doesn't have CVV2/CVC2. Varies by merchant category and by issuer. 3) Don't know, I processed cards in America. Debit cards when used with PIN have a completely different technology behind their security, and a completely different set of laws covering them than credit cards do, but I don't know about chip-and-pin. 4) Don't know, because Internet.

notatoad 13y ago

Collecting a CVV2 code doesn't increase your chargeback protection (for merchants, there is essentially no chargeback protection. if a customer wants to issue a chargeback, you'll get a chargeback). What it does is reduce your risk profile, which is part of how your processing fees are collected. If you don't collect the CVV2 you're going to have a much higher risk profile, and will either pay a higher processing fee or else be denied the ability to process cards at all. Chips are the same thing - it reduces the fraud risk, thus reducing your processing fees. the carbon imprint is just like a chip - physical proof that the card was present during the transaction. card-present environment is a much lower risk profile than card not present environment, the difference between the two is often a full percentage point in processing fee. The address verification is not a regex, it's just a simple lookup. Most merchants don't actually do address verification though because it is fairly expensive.

virtualwhys 13y ago
How do you mean address verification is fairly expensive? Expensive in terms of lost sales (i.e. users giving up in frustration due to mismatches) or something else? We've had AVS in place for years and get reduced fees as a result. How many people give up on payment due to AVS mismatches, however, is another matter.
- notatoad 13y ago
  our payment gateway would charge us more for address verification than our merchant bank would discount us for using address verification.