Supplier keeping my debit card details

PRW71

Hi,

I'm a self employed photographer and use a particular supplier for the odd occasion when I'm providing an album for my clients.

In the past I've paid for albums with the VISA debit card on my business bank account. They are currently holding an album for me that as yet I haven't had the money to pay for, but I got a call from my bank today to tell me that they declined a payment from this supplier on my debit card.

Whilst I'm aware that I owe the supplier money for the album they didn't tell me that would be trying to take payment today on this card and it means that they must have kept my card details (including the CCV number.....the payment was declined due to insufficient funds, not because of a CCV mismatch, and as I wasn't present they must have been asked for it).

I'm assuming this is in breach of some kind of law but before I tackle them about it I wondered if I could get confirmation from anyone who knows about these things here? Although I owe them for the album it should be up to me how I pay for it, shouldn't it?

Also, what would the potential punishment be for this supplier if they have broken the law?

Many thanks

Paul

browneyedbazzi

Hi Paul,

How was your current order with this supplier placed? (ie in person, over the phone, through an online ordering system, email etc)

Have you previously ordered from this supplier using an online ordering system that you put your card details into? If so, care to name the supplier so we can check out their Ts and Cs?

wealdroam

Note that the CCV isn't always required for 'card holder not present' transactions.

Whether the CCV is required or not for these type of transactions, depends on a number of things.
One thing being the supplier's view on the risk involved and the merchant bank's charges for taking some of that risk from the supplier.

In other words, your allegation the the seller "must've kept the CCV details" is unfounded.

Pretty sure your supplier hasn't broken any law though.

What sort of punishment would you like your supplier to suffer?

PRW71

The actual order was placed using an online system, but no payment details are given at that time. They take payment details over the phone once the order is ready for despatch.

My understanding was that the CCV is always required for "customer not present" transactions.

I've already checked and they don't have any Ts and Cs on their website.

PRW71

By the way, I don't necessarily want them to be punished, but it puts me in a much better position if they have broken a law to know what the potential punishment could be.

Evilm

Check that they haven't mentioned a CPA (Continuous Payment Authority) to you. If they have one of these you have to actively cancel it to tell them not to use it IIRC.

InsideInsurance

PRW71 wrote: »

My understanding was that the CCV is always required for "customer not present" transactions.

There are two options:

1) The correct way, they have established a continuous payment authority and as such they are not required to provide expiry dates, ccv, issue numbers etc for subsequent transactions

2) The wrong way, they have stored your card details and are putting each transaction through as a cardholder not present/ MOTO

Even if they are going for option 2 then the CCV is not mandatory for them to use though they will pay higher transaction fees due to the lower security of their processes.


If they have gone with option 1 then this can be cancelled by you with your bank (though many banks deny it). This doesnt stop your obligations to pay it just stops them from taking it at their own will.

PRW71

Thank you. I'm pretty certain they won't have a continuous payment authority set up.....I only deal with them 2 or 3 times a year and they usually call to take payment over the phone. Plus, I would have had to agree explicitly to it wouldn't I?

I suspect this may be the actions of just one rogue chap in the accounts department who doesn't realise what he's done by storing my card details for future use.

If they have done things the wrong way, then which authority's regulations are they in breach of? When I speak to them about it I would prefer to be armed with the appropriate knowledge.

Slowhand

You only need to have done business ONCE to agree to a CPA, Please understand that.

PRW71

I do understand that, but I'm saying that they don't seem like the kind of business where it would be appropriate to use one, plus I've never signed any kind of agreement with them....I've just given them card details over the phone each time I've needed to pay for an album.

PRW71

Just spoke to the company in question. They didn't know anything about a CPA and said that they just assumed that as I'd given them my card details in the past I was happy for them to be used again!

Oh, and they do need the CCV number for processing transactions, so they've kept *all* my card details.