Online payments

Card data and sensitive authentication data elements:

How to be sure that you are compliant with PCI DSS requirements?

Bank informs merchants once per year what kind of action must be taken to comply with PCI DSS . Requirements are presented in the table in below.

Merchants are categorized into 4 levels based on the annual number of card payment transaction by one card brand (i.e., MC, VISA, Amex etc.). Level 1- Level 3 merchants are required to report their compliance status and Level 4 merchants are required to report filled SAQ directly to their acquiring bank.

Keep in mind, that you’ll need to perform:

• Security audit, that is made by a certified auditor acting as Qualified Security Assessor (QSA) at the legal entities, who are presented on the PCI DSS official web-site.
• Scanning of the network, that is made by a qualified net scanning vendor acting as Approved Scanning Vendor (ASV) or Qualified Security Assessor (QSA). ASV can conduct a scanning procedure for physical and online merchants but have no rights to perform an annual audits.
• Internal audit, during which questions in SAQ (Self Assessment Questionnaire) have to be answered. The questionnaire content depends on technical solution.

PCI DSS requirements and goals

The 12 requirements and goals in the table below will help you to understand what important actions must be performed to be compliant wiht PCI DSS rules.

For more information please visit https://www.pcisecuritystandards.org/

Common reasons for chargebacks include:

• the cardholder did not perform the transaction (frequently an indication of fraud);
• cancelled recurring transaction;
• goods not as described;
• goods faulty or defective;
• failure to respond to voucher requests.

Chargebacks may also be made for other reasons, including goods or services not having been received.

Tips on dealing with chargebacks:

• In order to prevent undelivered product claims it is highly recommended to use a delivery service that offers delivery confirmation.
• In order to prevent broken merchandise claims during shipping, always purchase shipping insurance if your items are fragile. Make sure you clearly document the timeframe in which such claims will be processed.
• There are two ways of handling claims concerning merchandise breakage not caused by shipping: have the customer contact the manufacturer directly if the item is under warranty or ask the customer to ship the item back to you. Make sure your returns policy is very clear about the timeframe and the returned merchandise authorisation process.
• If the customer claims they never ordered the product, make sure you have clear documentation of their order.
• Whenever possible handle communication via e-mail as that way you will have a precise record of all conversations.
• The requirement is to have terms and conditions clearly presented on the website where the online services are provided. The Consumer Protection Regulations set out the information that must be provided to customers prior to entering into an agreement. The regulations apply to anyone who supplies goods or services under a distance contract; you cannot opt out of them.
• The information must be provided in a clear and comprehensible manner appropriate to the means of distance communication used. The information you need to provide includes specific details of the goods or services in question, their price (including VAT and other taxes) and delivery charges, as well as the details of customers' cancellation rights. You also need to include the full contact details of your business.
• If the goods or services ordered by the customer are likely to be unavailable, you must inform them if you wish to provide substitute goods or services of equivalent quality and price.

What authorisation does mean:

• The account number is valid
• The card has not been reported as lost or stolen (although it may still be lost, stolen or compromised, i.e. the card details may have been unduly obtained or copied) and the card owner may be unaware of this)
• There are sufficient funds available to cover the transaction

What authorisation does not mean:

• Authorisation does not confirm that the person providing the card number is the legitimate cardholder - the risk remains that the person providing the number has either stolen or unduly obtained the card
• There is also a risk of the purchaser having unduly obtained the card number without being in possession of the card

Although it is important to obtain authorisation for each transaction, this alone does not protect you against the risk of fraud or chargeback. These risks remain even if authorisation has been obtained.

Due to their high value and suitability for resale, the following types of goods are frequently targeted by fraudsters:

• Electronics
• Household appliances
• Jewellery
• Computers
• Furniture
• Goods easily sold for cash

If you trade in any of these goods, be extremely careful before handing over/shipping items. Make sure you take all possible steps to confirm that the purchaser is the actual cardholder.

The following are indications of potentially suspicious transactions. Often it is the existence of more than one indication that suggests a potentially fraudulent activity.

1. First-time shopper - Criminals are always looking for new merchants to steal from
2. Larger-than-normal orders - Because stolen cards and account numbers have use only for a limited time period, criminals need to maximise their purchases
3. Orders that include several varieties of the same item - Having more than one of the same item increases the criminal's profits
4. "Urgent" or "overnight" shipping - Criminals want their fraudulently obtained items as soon as possible for quick resale and are not concerned about extra delivery charges
5. Shipping outside of the merchant's country - There are times when items purchased in fraudulent transactions are shipped to criminals outside of the home country
6. Inconsistencies - Information in order details such as a mismatch in the billing and shipping addresses, telephone area codes with corresponding near post office codes, e-mail addresses that do not look legitimate and irregular times of day when orders are placed.
7. Multiple transactions on one card during a short period of time - This could be an attempt to 'run a card' until the account is closed
8. Shipping to a single address via transactions on multiple cards - This could involve an account number generated using special software or even a batch of stolen cards
9. Multiple transactions on one card or a similar card with a single billing address, but multiple shipping addresses - This could represent an organised activity, rather than one individual at work
10. For online transactions, multiple cards used from a single IP (Internet Protocol) address - More than one or two cards could indicate a fraudulent scheme
11. Orders from Internet addresses that make use of free e-mail services - These e-mail services involve no billing relationships and often neither an audit trail nor verification that a legitimate cardholder has opened the account

Merchants can minimise the possibility of fraudulent purchases and chargebacks from online transactions by taking certain precautions:

• request the name of the cardholder's bank - fraudsters who have unduly obtained account details will not have this information. If the purchaser hesitates in giving the name of their bank, caution should be exercised;
• request the purchaser to provide a faxed copy of their driver's licence;
• the risk of goods not being received should be evaluated if goods are forwarded to a post office box;
• obtain a signed receipt from the cardholder when the goods are delivered;
• in the case of orders for a large number of different goods, telephone the cardholder after the order is placed to confirm the order. Also, have the purchaser read back all details of the order. Frequently, where an order is fraudulent, the purchaser is unable to confirm these details, as they were ordering at random, with no record of what they ordered;
• be suspicious in cases where multiple cards are used for a single purchase;
• do not continue to attempt authorisation after receiving a decline;
• exercise extra caution in relation to overseas orders - large orders should in all cases be held back for shipping until the enquiries above are made into the legitimacy of the purchaser. Merchants should not ship goods until satisfied that the purchase is legitimate.

By using the 3-D Secure authentication services, the merchant obtains chargeback protection (i.e. fraud liability shift) on a transaction in most events where a chargeback would normally be received on the basis of a claim that the customer did not actually participate in the transaction. These services provide customers, retailers and banks with greater security in online card payments.