So, you’ve decided you want to accept card-not-present (CNP) payments. It’s a lucrative investment—because who doesn’t love the convenience of shopping online or calling in an order instead of making a trip to the store?
Statistics tell us it is, too. There was a 15.5% increase in U.S. ecommerce sales from 2016 to 2017, with a total of $115.3 billion raked in from cyber space in just the 3rd quarter of 2017, according to the U.S. Census Bureau of the Department of Commerce.
Online shopping has been on the rise since 2000, and is projected to continue growing at an even more rapid pace. More merchants than ever are experiencing the benefits of tapping into the e-marketplace.
Benefits of Accepting CNP Payments
Let’s start with the good stuff. So many online stores and MOTO merchants wouldn’t exist if the benefits didn’t outweigh the risks, which we’ll get into later. MOTO—mail order/telephone order—is financial institution lingo for phone merchants, and ecommerce refers to selling online.
Online and phone payments give your customers the ultimate convenience of paying how they want to, when they want to, where they want to. You benefit from more payments coming in, fewer late payments, reduced overhead costs and, ultimately, increased cash flow.
The impulse buying associated with credit cards makes it likely that customers will spend more than they would with cash or debit cards. When the customer’s payment experience is smooth and easy, and you’re delivering quality merchandise or services, chances are that customer is going to come back and build loyalty to your brand.
Having an online store makes your business exponentially more visible, accessible and profitable.
What do I Need to Accept Credit Cards Online?
First you’ll need a merchant account, if you don’t already have one. A merchant account is a business bank account that sits between your credit card processing company, also known as a merchant services provider or merchant account provider, and your business. You need one because credit card purchases entail an authorization and settlement process involving several different players.
The credit card-issuing bank, credit card network (like Visa, MasterCard, Discover, American Express, JCB), and merchant account provider (on behalf of your business) all have a role in approving or declining credit card payments, then moving the money from the customer’s bank to yours. If you’re interested in the details of how all that works, you can read this incredibly boring yet informative article, Credit Card Processing 101.
If you want to spare yourself, though, the summary is that you can’t accept credit cards without the help of one of these merchant account providers—they are the link between you and credit card networks. If you already have a merchant account for card-present transactions, you’ll want to contact your merchant account provider to make the appropriate adjustments so that you can accept CNP payments.
Unfortunately, there are thousands of merchant account providers who will try to offer you the best credit card processing software and services under the sun. Sifting through them to find the best fit for your business is the real challenge. Some specialize in high risk industries, others decline them on the spot.
Most of them use dishonest sales tactics, and might offer you low rates without disclosing hidden fees that actually make them quite expensive to contract for merchant services. We’ll get into how to find the right one below, but first let’s break down the high risk tag.
High risk can mean a lot of different things: bad credit, excessive chargebacks, selling government-regulated merchandise (firearms, tobacco, alcohol, etc.), risque or edgy content some banks just don’t like to associate with (adult entertainment, glass pipes, etc.), history of illegal activity, and so much more.
Unfortunately, even if your business is none of these you still might get smacked with the high risk label simply because you operate online or over the phone.
Why Does the High Risk Label Matter?
Merchant account providers not only retrieve your funds from credit card sales, they also vouch for you as they interact with banks and credit card companies on your behalf. Say you get hit with a big-ticket chargeback and can’t afford to cover it, or have since closed your merchant account (this is a common scenario because customers have 6 months to sometimes a year, depending on the card brand, to file a chargeback claim). Your merchant services provider is next in line to pay the bank back if you can’t.
So in a way, they’re like your financial guarantor. That’s why it can be difficult for high risk businesses to find a merchant account provider, let alone one that doesn’t charge exorbitant rates to process credit cards. The higher the risk, the higher the transaction rate because providers want to create a buffer that protects them from financial loss, should it occur. However, many providers will exploit that by taking the high rate thing a little too far.
Most of the transaction rate you see from the merchant account provider is actually just passed through from the card brands (the “interchange”). It’s the markup that the provider keeps that you’re able to negotiate. Which brings us to the tactics you can bring to the table to get the best ecommerce or MOTO merchant account at the lowest possible rate.
How to Find the Right Merchant Account Provider
…And avoid getting stuck in an expensive contract.
As we mentioned, some merchant account providers aren’t exactly transparent when it comes to disclosing the terms of your agreement. Your negotiating power, and knowing the right questions to ask, can help lower your rates. Most importantly, reading the fine print of your contract can save you a lot of time and money reinvesting in a new credit card processor if you’ve found yourself paying more than you should be.
Some questions you should ask before putting your John Hancock anywhere include:
- Do you have an early termination fee?
You don’t want to get stuck in a years-long contract. An ETF is usually negotiable.
- Are there monthly fees? If so, what are they?
Some, like NABU, MasterCard’s Network Access Brand Usage fee, are charged by card brands and passed through to you, making them unavoidable. The ones you’ll want to ask about are monthly service or membership fees that come directly from the credit card processor.
- Is this the best rate you can offer?
If you ask, the MSP will likely be more flexible with your rates.
- Do you have experience with my business type?
Sometimes, eager salespeople might get you started but then waste your time when your application gets to the underwriters only to find that they don’t accept your business type.
- How fast will I get my funds?
Next-day funding is the gold standard for retail merchants. However, for MOTO and ecommerce merchants, two business days is the norm. If your ecommerce or MOTO business has a solid processing history, you may be able to get next day funding for card-not-present purchases, though. So it’s worth a shot trying.
- Do you offer PCI compliance support?
Payment Card Industry (PCI) compliance entails an annual security run-through to make sure your business is safeguarded from fraud. Your merchant account provider should offer complementary support in this area. Non-compliance can result in fines and compromised security. If this service isn’t included with your merchant account, and is instead added on for a fee, you should probably keep looking.
- Can you show me what my processing statement would look like?
If it’s not crystal clear, look elsewhere.
- Do you support high ticket and high volume sales?
Long, unexpected holds on funds can really put a damper on your cash flow. Make sure you know if there will be volume or transaction caps on your merchant account, and be sure not to low ball your average ticket size and average monthly volume in your application so that your merchant services provider can set it up with the proper capabilities.
- Can you handle multi-currency sales?
Again, eager salespeople might say they’re giving you the best merchant account that can do anything in the world. However, you’ll want to make sure your account can actually accept different currencies, if your business calls for them.
- What is your pricing model?
Nine times out of 10, it’s best to stick with interchange plus pricing. Tiered pricing, another common option, offers varying rates for different tiers, which are often fuzzily-defined and exploited to charge you higher rates. Interchange plus is a consistent markup—the “plus”—on top of what the credit card networks charge—the “interchange.”
- Is your payment software up to date with industry security standards and compatible with the systems I already have in place?
You’ll want your business to run like a well-oiled machine and your payment solution to reduce your administrative task load. Most payment processing software integrates with shopping carts, accounting software and other third-party applications. You’ll want to ask if the credit card processing solution you’re considering will work with the software you already have in place, or plan to have in place. Likewise, you’ll want to make sure that the software they’re offering you isn’t outdated so you don’t have to replace it in a year.
- Do you offer chargeback prevention support?
The more built-in services the merchant services provider offers, the better. Many will have a department dedicated to walking you through the process of detecting, preventing and managing chargebacks.
It’s also important to consult resources like the Visa Global Registry of Service Providers and the Better Business Bureau to make sure the credit card processor you’re considering is legitimate.
MOTO, eCommerce, or Both?
This depends on your business model. If you operate 100% over the phone, you can use what’s called a virtual terminal. It’s hosted on a secure server provided by your credit card processor, and you simply log onto it from any web browser. You key in the card data manually and—boom—the funds appear in your merchant account in one to two business days, or later depending on your agreement.
Virtual terminals are common for telemarketers, debt collection agencies, home-based businesses and anyone who wants to offer more flexibility in payment methods. You don’t necessarily need a website, although it would be helpful to market your content.
An online store needs a website where its payment gateway can live. A payment gateway is like a virtual terminal except it’s customer-facing. The cardholder keys in their own card information, and the gateway automatically passes it through the authorization process.
The merchant can be off taking care of other priorities while the gateway handles transactions, which are monitored by the credit card processor. If suspicious amounts or volumes come in, the processor will notice and run interference. Luckily, most payment gateways are compatible with thousands of applications, like shopping carts, accounting software and website plug-ins.
Sales, returns and accounting are designed to be simple and easy with an online payment gateway. And, there’s really no limit on how much you can enhance your online store with one. The smoother and more customer-friendly it is, the greater your conversion rate will be.
All of the components can integrate with one another to give your customers a fast, easy shopping experience. They also come with automated fraud detection and management tools, among other features that help protect your business. Online sales reports, automated recurring billing, automated invoicing, CRM solutions, loyalty software—you can really go wild customizing your online store with the payment gateway acting as its hub.
The Ring-or-Click Combo
Having the ability to accept payments online and over the phone is ideal so that you can just go with the customer’s preferred payment method. Some customers feel more comfortable entering card information themselves, while others are more skeptical of online payment forms and prefer the personal touch of paying over the phone. Since risk levels are similar, most merchant account providers won’t increase your rates if you want to leverage both payment methods.
If you already have a physical storefront, adding an online and/or MOTO solution isn’t as complicated as it might sound. Thanks to compatible equipment and software, you can keep track of all your transactions, no matter the channel, from one integrated solution.
How to Keep Your CNP Account in Good Standing
Using the Address Verification Service (AVS) is a must. It requires buyers to enter their billing address before they make a purchase. AVS checks the address provided with the address the card-issuing bank has on file and transmits a code back through the payment gateway instantaneously. If the two don’t match, the order is declined.
This prevents credit card thieves from making purchases with stolen cards. If they happen to know this detail, then you’re just SOL. Fraud is inevitable, but you can reduce your vulnerability to it with other tools that offset the losses.
Card Verification Value/Card Verification Code (CVV or CVC) is the three or four digit number on the back of the card. Your payment gateway should require this information as well, and with it you can weed out thieves who only have bits and pieces of stolen information, like those on the front of the card.
Employee training is paramount for transactions that take place over the phone. You’ll want to make sure employees never skip the AVS or CVV, that they are accurately entering information, that there’s a monitoring system in place to ensure they aren’t stealing information, and even consider recording phone calls.
You’ll want to have as much proof as possible if the card-issuing bank comes knocking about a chargeback. If you have enough evidence that the transaction was legitimate, you can fight the chargeback.
You’ll also want to make sure that your online payment gateway and/or virtual terminal are up to date with the latest security protocols. These are laid out by the PCI Security Standards Council (PCI SSC), a group of card networks that enforce rules every merchant who accepts or handles credit cards is required to follow.
Your MSP should be able to walk you through the annual Self-Assessment Questionnaire (SAQ) to assist you in fulfilling PCI compliance.
For ecommerce merchants, PCI compliance will also require a vulnerability scan of your IP address to detect any weaknesses in your internet connection. Your ecommerce merchant account provider should have a relationship with a PCI approved scanning vendor (ASV), be able to schedule the scan for you, and be able to walk you through the remediation of any vulnerabilities if you don’t pass the scan.
Payment software should come with customizable fraud detection tools. Merchants can set rules-based filters and thresholds that block payments that originate from certain IP addresses, limit the amount of payments you accept in one hour or one day (curbing high volume fraud attempts), decline payments if the billing and shipping addresses don’t match, and a lot more.
Some even send banks automatic responses to chargeback retrieval requests so that you don’t have to. When you maintain ecommerce best practices, you can offset the risks that come with operating any store online.
What are the Risks?
Well, whenever the physical card and cardholder aren’t present for a purchase, there’s a greater chance of your business getting hit with fraud and chargebacks. Chargebacks happen when customers dispute payments and their card-issuing banks forcibly take the funds from the merchant and give them back to the customer. It’s like a refund, except the business doesn’t have a say in it.
There are many reasons customers initiate chargebacks, but the big ones include fraud, “not as described” products or services, non-receipt of goods or services, and, unfortunately for business owners, “friendly fraud,” which happens when dishonest customers abuse the chargeback system to reverse purchases that were actually valid. Chargebacks are common misfortunes for business owners, and beloved perks for credit cardholders.
Most credit card fraud happens online or over the phone. Phishing, merchant database hacks and unscrupulous employees are a few examples. There’s no real way to validate the cardholder’s identity when you accept a CNP payment.
For transactions that occur in store, the merchant can examine the card, ask for identification, get a PIN or signature, use the ultra-secure EMV chip terminal, and, as a result, not be held liable for fraud. Instead, the credit card issuer is. These card-present merchants are only on the hook for fraud if they don’t have an EMV chip reader and the customer uses an EMV chip card (but that’s a whole other story).
When selling online and over the phone, the merchant is responsible for reimbursing fraud losses to customers, not to mention the merchandise they lose from a fraudulent transaction. There’s a lot on the line.
Keeping your CNP merchant account well-protected and well-integrated with the rest of your software is the key to running a successful MOTO or online business. And, with the right merchant account provider, you shouldn’t have to handle all that alone.
