Card Payments

Mr0

I know there are a few bank people on these forums, hope someone can help me.

I am self employed and recently signed up to with a provider to take card payments. Everything was working fine for a few months. There are 2 ways for me to take card payments: chip and pin, and over the phone and I input the details online via a 'virtual terminal'.

Chip and pin is fine, and I prefer this way as I think it is more secure. However I recently had a customer request that I take his card details over the phone. I wasn't very comfortable with this.

My question is, how safe is it for me to take payments like this?

If for example I later find that the card was stolen, would the bank of that account/cc then turn to me and ask for their money back? I noticed that there are 2 steps of approvals, one from my terminal provider and then from the customers card provider. If the payment was initially approved by the bank, could they later ask for their money back?

The virtual terminal asks for the usual things like card name, number security number at back and address. Do they even function as a security check as all the information could be found on the 'stolen' card.

Sorry if I sound paranoid, still new to the whole card thing. I have turned away some business for this reason before.

mum2one

its better to ask the questions, I'm the otherside of the coin, making payments over the phone and to be honest I am happy and personally feel 100$ secure, as generally there are extra security questions, the actual pin of the number does not get given.

The only time I would presume a problem is if the card was stolen then used, but as long as you follow the right procedures there shouldn't be a problem x

Captain__

Hi, I have not used a card payment service but looked into it as I was horrified by what retailers have to pay to transact our business to them. This being my qualifications to comment (almost nil) I would say ask your service provider as protections may differ from one to another, however.

It is my impression that if you have done due diligence to check the details and followed the guidelines to take the transactions over the phone, then the validity of the transaction stands with the card issuer, you get the money and the issue goes between the card issuer and the holder of the card.

There are regulations that define the protection level that a consumer has against card theft, and hence the bank takes most of the risk in transacting the business. If there are any improprieties, then I would imagine they will go back to the supplier of goods.
Best of luck


Again, I would say ask the vendor of your equipment, but this is my impression.

Atidi

Mr0 wrote: »

I know there are a few bank people on these forums, hope someone can help me.

I am self employed and recently signed up to with a provider to take card payments. Everything was working fine for a few months. There are 2 ways for me to take card payments: chip and pin, and over the phone and I input the details online via a 'virtual terminal'.

Chip and pin is fine, and I prefer this way as I think it is more secure. However I recently had a customer request that I take his card details over the phone. I wasn't very comfortable with this.

My question is, how safe is it for me to take payments like this?

If for example I later find that the card was stolen, would the bank of that account/cc then turn to me and ask for their money back? I noticed that there are 2 steps of approvals, one from my terminal provider and then from the customers card provider. If the payment was initially approved by the bank, could they later ask for their money back?

The virtual terminal asks for the usual things like card name, number security number at back and address. Do they even function as a security check as all the information could be found on the 'stolen' card.

Sorry if I sound paranoid, still new to the whole card thing. I have turned away some business for this reason before.

If someone was going to use a stolen card, they'd probably do it in person as then they are preobably anonymous and as soon as they have left, the chances of you ever finding them is remote.

If someone is using a card remotely, surely you know who they are and where they live (as that is where you would them deliver to).

Mr0

When my own card details were stolen before, I know that my bank gave me back the money. I am not sure if the bank will then go back to the supplier of goods to recover some of this. Can anyone confirm? Or maybe the costs would be too high that they wouldn't bother. In my case it was used for buying something in Asia so I am not sure if they will go through all that trouble for about £200.

I called my processing provider and they said that all responsibility is on me, but I would imagine that they would want that to be the case. I have input the details as given, and the provider approves, usually a few days later the bank settles this (I have not yet received a transaction that the bank refused). The money has all been paid to my bank account.

I am just wondering when does it stop. I go through the right processes and there is no hint really of any fraud.

In terms of delivery sometimes people order using a card registered at one address and want the goods delivered at another. This could be perfectly legit, I do this sometimes too. Or sometimes people order over the phone and request a time for collection, so I wouldn't have an address anyway.

Now that i think about it, the only information that is not found on a possible stolen card is the card holder's address. Does anyone know if inputting an incorrect address would stop the card payment being accepted?

martindow

Mr0 wrote: »

Or sometimes people order over the phone and request a time for collection, so I wouldn't have an address anyway.

In this situation the cutomer should be asked to make the payment with their card when they collect. It should not be done as a customer not present transaction.

Mr0

martindow wrote: »

In this situation the cutomer should be asked to make the payment with their card when they collect. It should not be done as a customer not present transaction.

When they come to collect I normally ask them to use the card reader. However I noticed some people are not comfortable using the reader, maybe because I am just a small retailer and not some national chain.

My card reader is portable so I can even take payment on delivery but some people still rather give their details over the phone.

martindow

Mr0 wrote: »

When they come to collect I normally ask them to use the card reader. However I noticed some people are not comfortable using the reader, maybe because I am just a small retailer and not some national chain.

My card reader is portable so I can even take payment on delivery but some people still rather give their details over the phone.

The problem is that you are at more risk of a chargeback if you have a customer not present transaction and no evidence of delivery. I suppose it comes down to a judgement of what you are selling and the person involved, but there is a risk.

This is from Streamline's advice especially the last paragraph

http://www.streamline.com/customer-zone/operating-instructions/merchant-operating-instructions-card-not-present-transactions/merchant-operating-instructions-mail-order-and-telephone-order/

Delivery, documents and record-keeping

Goods ordered by mail or telephone order must be delivered to the person who ordered them and not released to third parties, including relatives and taxi drivers.
A signature should be obtained from the cardholder as proof of delivery – this can be used as evidence in the event that a dispute subsequently arises.
For all MOTO transactions you must send these documents to the cardholder with the delivery:

• Sales invoice, to support the transaction
• Cardholder’s copy of the POS receipt from the terminal or the sales voucher

Terminal receipts, paper vouchers and other transaction records are high-security items and access to them should be restricted. Keep your copies of all transaction details in a secure fireproof place for at least 18 months in case there is a query later. If you are not able to produce records when asked to, there may be a chargeback. Do not alter transaction records in any way. If there is a dispute, the cardholder’s copy will normally be taken as correct. After 18 months, make sure that you dispose of all transaction records securely, in line with your Contract.
If a cardholder wishes to collect the goods they must come to your premises in person and produce their card. In this case, you must either cancel or refund any previously-completed MOTO transaction and process a new card present transaction, following the instructions in your terminal guide and the prompts on your terminal. Find out more in Card Present Transactions.