Information on Merchant Accounts,
Ecommerce and Credit Card Processing

July 9th, 2010 by Jamie Estep

Dejavoo credit card terminals

Filed in: Credit Card Equipment, Merchant Accounts, Review | 1 comment

In the US, there are 2 credit card equipment manufacturers that basically own the entire terminal market, Verifone and Hypercom. Lipman USA is another major player however, Verifone purchased Lipman several years ago effectively creating 2 major brands. Another major company Ingenico, has a larger global presence, but their usage in the US in minimal at least in the independent sales markets.

A few years ago a new terminal company named Dejavoo was established. Dejavoo was founded by the original founder of Lipman USA, and seems to be founded on the same principles that Lipman was:  rock-solid products that are easy to use and very reliable. In my opinion Lipman’s Nurit 2085 is the most reliable and best land-line terminal to date. It isn’t very small, and it doesn’t look particularly classy, but it works well, it’s cheap, and it’s easy to use. Having watched the reliability of credit card terminals diminish over the past 10 years, I would love to see a highly-reliable brand emerge. Since the terminal market is monopolized by a few behemoths, it’s equally good to see a new competitor with a strong history of success in this specific industry.

Dejavoo currently offers several terminals which should meet the requirements of most merchants, whether retail or mobile. One of the coolest  things about the Dejavoo terminals, is that they all (except the C5 and M3) support a USB WiFi adapter, allowing a merchant with a secure WiFi network to eliminate an extra cord on their counter-top.

All Dejavoo terminals have quick thermal printers, and have internal PINpads. Dejavoo terminals meet the newer PCI-PED requirements for PINpads. Lastly, all Dejavoo terminals are at the lower end, if not the lowest, of cost for comparable terminals from other manufacturers.

Wired Dejavoo Terminals

Dejavoo C5 – The C5 is the entry level terminal from Dejavoo. It is dial only, and does not support USB components like the X series. It is the lowest cost terminal from Dejavoo. It is PCI certified and would be a comparable replacement for Nurit 2085, Hypercom T7 Plus, and similar products. The C5 looks to be the most durable of the Dejavoo terminals, and is slightly larger than the X or M lines. Most merchants will probably want the additional features of the X line, as the entry X5 terminal is a significant improvement to the C5 without a significant price increase.

Dejavoo X5 – The X5 is the first terminal in the X-line. It uses a custom Linux operating system, dual processors, and supports USB peripherals including the USB WiFi adapter. It features a compact, well styled design, and supports a multitude of features all for a low price. It is a dial-only terminal, but has more memory than current Verifone or Hypercom terminals. It is PCI compliant, and features a smart card reader and internal PINpad.

Dejavoo X8 – The X8 is almost the same as the X5 except that it supports processing over an 10/100 IP/Ethernet connection in addition to a dial-connection, and has an additional USB port. It is currently the lowest cost Ethernet terminal that we know of, just edging out the Hypercom T4220.

Wireless Dejavoo Terminals

Dejavoo M3, M5 and M8

The Dejavoo M series, are PCI certified, GPRS, wireless terminals. They are all based on the same M3 platform. The M5 has a base which includes a charging station. The M8 includes a base with an Ethernet port. The M5 and the M8 support the WiFi module, but the M3 does not.

The GPRS wireless network is normally used with ATT Wireless and is currently the most used network for credit card processing. So far I have not heard of development on the CDMA networks which would include Verizon and Sprint, but I imagine that there are plans in the future.

The M series terminals all include internal PINpads and thermal printers. They are compact, and use the same dual-processor system as the X terminals. Like X terminals, M series terminals accept normal credit cards as well as smart cards. The M series terminals aren’t the most elegant terminals out there, but it looks like Dejavoo traded fashion for a more robust and durable platform, which is far more important for wireless terminals.

Dejavoo WiFi Module

The Dejavoo WiFi module is an inexpensive USB WiFi stick that allows most Dejavoo terminals to process on a secure WiFi network. It theoretically works with the M3, M5, X5 and X8 terminals (We’ve personally only tested it with the X8, but Dejavoo has assured us that it works with the rest). We’ve been playing with one for the past week and despite some minor issues in initially getting the connection to work, it seems like this is the best only WiFi processing option available. The Verifone VX 610 is completely unusable because it’s support for WPA security is horrendous. The VX 670 is equally bad because it requires an expensive base, pushing the price above $800.

A note on wireless security and processing – WEP security is completely prohibited by PCI so do not under any circumstance use WEP or a non-secure connection to process using WiFi. Businesses should use WPA or WPA2 preferable and use a strong password like “4p%n&1GiJF$*nK8n”.

Conclusion

Based on our initial experience with Dejavoo terminals, they look to be the most promising brand of terminals we’ve seen in a long time, especially with regard to their wireless M-series wireless terminals. Several processors have made Dejavoo their preferred brand. I would like to see their performance over the next year or two before making a commitment. In any case, if I were Verifone or Hypercom, I would probably be concerned.  The Dejavoo terminals appear to be superior to both brands in just about every way including price, and only time will tell if they live up to their founder’s reputation.


June 17th, 2010 by Jamie Estep

Debit Interchange Regulation is Already Going to Hurt Consumers

Filed in: Industry News |

About a week ago, the US Government passed financial reform bills that included regulating debit card fees and regulating merchant’s ability to surcharge or set minimum and maximum purchase amounts. What congress has never look at is the repercussions of regulating something like interchange, even if it’s just for debit. Recent events have shown us a glimpse at the future of debit cards.

I read a great article about Durbin’s amendment in which I found out that free checking accounts were virtually non-existent before the invention of signature (or offline) debit. Signature debit is where a merchant processes a debit card like a credit card without requiring a PIN number. With the invention of signature debit, banks had a steady source of income from debit interchange that was directly attached to their customer’s bank accounts. With this additional income, came the invention of the free checking account. Right now most consumers and small businesses use free checking accounts, which are partially subsidized by fees the bank receives from signature debit interchange. These fees also help pay for chargeback investigations, and help pay for account features that you would have had to pay for before there were free checking accounts.

Now that congress is capping debit interchange, we can expect changes with regard to free checking account practices. Since these accounts can no longer be subsidized by signature debit interchange, banks are going to have create monthly fees for checking accounts. Chargeback investigations also cost banks huge amounts, so we can expect further fees will be charged to cover the additional costs for these. Right now, BOFA and others have announced that they plan on charging fees for checking accounts once the new regulations go into effect. Goodbye, free checking…

What I think is the biggest flaw to the debit regulation, and of much greater significance in the overall picture, is the double standard that congress has proposed. The law limits the amount banks can charge for debit interchange. At the same time, it exempts financial institutions with less than $10B in assets in attempt to help these smaller institutions out, but at the same time allows merchant to discriminate against types of payment at their discretion. A thoughtful move, but because of the second part it will have a near 100% opposite effect than planned.

Merchants will now inherently be more inclined to, and be allowed to, accept debit cards with the lower rates, which will be the big bank’s cards! Instead of helping credit unions and small banks, congress instead created the perfect avenue to put them out of the debit card picture. While it’s unrealistic to assume that the smaller banks will not be issuing debit cards at all, it is completely reasonable to assume that retailers (especially the large ones) will favor and may only accept cards from large banks that they pay less for. We’ll start seeing signs like only Bank of America debit cards are accepted here, and congress not only made it completely legal for merchants to do this, but they created the system to facilitate it!

With one swipe the future shows the end of free checking accounts, and the end of credit union’s issuing their own debit cards.

I’ll readily admit that I am partial when it comes to regulation of my industry, but how could congress have created something so blatantly damaging to credit unions and small banks in the US. As soon as the credit unions learned about the details of the rules , they began lobbying. However, the wording and details were published after the rules were passed, so to stop it now is more a prayer than anything else. It doesn’t take an expert to know that large retailers follow the savings, just like consumers…


June 9th, 2010 by Jamie Estep

The myth of bankcard deposit reconciliation

Filed in: Amex / Discover, Merchant Accounts | 3 comments

I am often asked on how to reconcile bankcard settlements (batches) to the money coming into a bank account. While a seemingly simple theory, as most accountants and anyone who has tried to match up settlements to deposits know, it’s far from easy.

In a perfect world we would see our settlement report at the end of the day, and a day or two later would see the exact same amount deposited into our bank account. In reality, we see our settlement report at the end of the day, and then we see absolutely no resemblance of it in our bank account, at any point, ever! The exception may be if you run a single transaction per day. The more transactions you process, the less your deposits will reconcile.

Why reconciling is often difficult…

Issuers don’t settle together

This is becoming less of a problem as Discover and Amex are starting to settle with Visa and MasterCard, but it still exists with many accounts, probably still the majority. Since Amex and Discover historically operated on completely different networks, and completely different financial systems, they would never settle directly with Visa and MasterCard. While one shouldn’t expect an Amex deposit to be labeled the same as Visa/MC deposits, it’s still difficult to add the correct deposits together. This is mainly because Amex and Discover often take longer to be settled and deposited than Visa/MC. Your Visa/MC transaction may be in your bank in 48 hours, but your Amex may take a week. When your business’s bank account has hundreds of deposits and withdrawals like most do, it’s extremely difficult to match the correct deposits with the corresponding settlements.

You accept PIN-debit, fleet and/or other proprietary cards

The more types of cards you accept, the more unlikely your batches are to reconcile with your deposits. Everything from PIN debit, fleet and gas cards, JCB, Diners, EBT cards, to gift cards and anything other than a typical Visa or Master credit card requires different processing systems and networks to handle the transaction settlement. It’s rare that any of these follow the same protocols as Visa/MC which means the deposits don’t come in same deposit or even at the same time.

Settlement times

When you accept a credit card it must be settled at the end of the day. The method that your transaction are settled depends on how you are processing cards. You may be manually batching your terminal, you may have a terminal with auto-batch, or you may have a gateway that batches for you, and each of these methods can present different opportunities for something to get messed up or out of sync when settling. Once batched, these transactions are queued up to be settled and paid with the card issuer.

The problem, is that it’s fairly easy to end up with settlement time mismatches. You could batch at 3PM, and your platform could batch at 2:30, this would add a day to your deposit time. You may have some complicated setup on the back-end that involves multiple systems settling your transactions, and again if there is some mismatch, transactions can get pushed back. Some systems settle multiple times per day but give you a single report at the end of it. It’s even possible that some transactions get split between batches if there are time-mismatches somewhere in on the back-end. This is a nightmare to try and identify, let alone understand what is happening.

Since very few systems have been built from the ground up, many of these systems, which neither you nor your processor have any control over, are complicated and antiquated. Processing networks are often many layers of systems tied together to provide the functionality needed. This complexity can create virtual bottlenecks which can make a mess of settlement times.

Your pricing may be the real reason

There are several types of pricing structures, in reference to how and when your fees are taken out at the end of the month that are commonly used with merchant accounts. The primary 2 are daily and monthly discounting. If you are on daily discounting, your qualified percentage and transaction fee are subtracted from your deposits every day. At the end of the month, your surcharges (mid and non qualified transaction) are billed to your account. This makes the end of month bill substantially easier to swallow, but guarantees that deposits will never match settlement reports. Monthly discounting on the other hand, is where all of your fees are withdrawn at the end of the month. If you want any chance of reconciling to the dollar, you must be on monthly discounting. However, many businesses will not qualify for monthly discounting as your processor is taking a gamble in the event you do not have the money available at the end of the month. This has become much more common over the past 2 years. If you are a new business or if you have ever had an ACH reject or NSF when your processor tried to collect your fees, you should expect to be on daily discounting, at least until you can establish better processing history. If you are an existing business without ACH rejects or any major risk factor, you should be able to get your processor to put your account on monthly discounting. Keep in mind, if your account does not have the available funds in it at the end of the month, you will be quickly switched to daily discounting.

Is there any fix?

Reconciling can be expected to become easier as issuers and different card types begin to settle with Visa and MasterCard, but it’s going to be a lengthy migration. If you accept fleet cards, or some of the non-bankcard types, it’s unlikely that these will ever be deposited with your normal transactions.

If you understand the type of transactions you are accepting, whether your Discover and/or Amex transactions settle with your Visa/MC ones, the amount of time that it takes for your batches to hit your bank, and you are processing on monthly discounting, it is possible to get your transactions to reconcile, or mostly reconcile. If you end up running into a situation where back-end systems are causing the problems, it’s unlikely you will be able to easily remedy the situation. Depending on what type of terminal, POS system or software you are using, there may be no other option than to continue processing without an easy ability to reconcile your transactions


June 8th, 2010 by Jamie Estep

Payment Resources

Filed in: Merchant Accounts | 1 comment

Here is a list of the payment related resources I read on a regular basis. If you’re looking for good payments, merchant account and data security resources, these are some good ones. If you have any recommendations, please feel free to post them up. I’m always looking to add to my list of regular payment reading.

Websites:
Federal Reserve Payment Board
Payment News
Visa Partner Network

Blogs:
Amazon Payment Blog
Anceace’s Blog
Andy Orrock | Payment Systems
Ask About PCI
Anton Chuvakin Blog
Broox Peterson
Credit Cards Online 101
Digital Money Blog
Google Checkout Blog
Info Law Group
Network Security Blog
Payment Card Security & IT Controls Explained
Payment Systems Blog
Payment Talk
The Paypal Blog
Retail Information Security
Storefront Backtalk
TransFs | Financially Speaking


June 7th, 2010 by Jamie Estep

VOIP + Credit Card Terminal = Bad Idea

Filed in: Data Security, Merchant Accounts | 1 comment

I’ve heard an alarming trend from a number of sources about how to hook up a credit card terminal to a VOIP (Voice Over Internet Protocol) telephone system. Several of the examples I’ve seen probably worked as well, so let’s get right to the point.

Do not connect your dial-up credit card terminal to a VOIP connection!

Even if you get this to properly work, which is apparently possible using an analog adapter, you are now violating a number of PCI regulations regarding data security. When you process using a dial-up connection, the data transmission is not encrypted. Since the transaction is going over a phone network which operates differently, with regards to security, than internet, it’s OK by PCI and issuer data security standards (Whether the existing security is enough, is another debate). When you put that terminal on a VOIP connection, you are now transmitting unencrypted data directly over the internet.

Encrypt transmission of cardholder data across open, public networks

Do not do this, do not try to do this, and do not let your cable or other internet provider tell you that it’s safe and secure. I’ve heard of both Time Warner and ATT service reps telling customers that it is perfectly secure to do this. It’s not. Same thing goes for Magic Jack, Vonage, Packet 8, Comcast, or any other VOIP provider out there.

There is almost no way to encrypt data from your terminal over the internet unless your terminal supports end-to-end encryption, which realistically barely exists as of yet, or you have some extremely fancy and expensive telecom equipment. You would certainly know if you fall into this category.

If you have a VOIP only connection, you need to purchase an Ethernet compatible terminal, like a Verifone VX570 or VX510 (Dual Comm), Nurit 8400 (Dual Comm) or a Hypercom T4220. The T4220 and VX510 are the lowest cost out of this group. Get your new terminal programmed to connect over the internet by your processor. Connect your Ethernet terminal to a spare port on your Ethernet switch, hub or router.

Don’t try to get your dial-up terminal to work over VOIP even though it may be possible.


June 3rd, 2010 by Jamie Estep

Fraud as a Service

Filed in: Fraud, Industry News |

First Data published an incredible paperPDF regarding the sophistication of electronic fraud. I highly recommend taking a look at it for anyone in the payments or IT industries, and anyone interested in learning about how advanced and organized cyber-crime has become.

More than any resource I’ve seen before it, this paper gives a clear and easy to understand description of the current state of electronic crime.


May 27th, 2010 by Jamie Estep

ATM fees gone awry

Filed in: ATM |

I was in Mexico a few weeks ago and I made the mistake of withdrawing $80 from an ATM. The reason that this was a mistake is that the ATM dispensed US dollars. Being in a tourist area, I assumed that this was a US ATM. I was unfortunately very wrong.

Here’s what you may end up paying for an ATM withdrawal…

  1. Exchange rate to transfer my $80 to about 900 pesos – 8% cha-ching.
  2. Exchange rate to turn my 900 pesos back into USD – 8% cha-ching.
  3. Adjustment fee (no idea what this one is)3.5% ch-ching.
  4. Finally I was charged a non-Chase ATM fee (which I expected, more or less)$3 cha-ching.

Conclusion… 23% to withdraw US money from a Mexican ATM.

I went back to the ATM and not once did it say anything about any fee whatsoever, not a fixed fee, let alone a percentage 3 times in a row.

Lessons learned:

  1. Don’t withdraw from foreign ATM’s (not likely to be feasible).
  2. Don’t withdraw money in your own currency from a foreign ATM.
  3. There are going to be ATM fees even if there aren’t any listed.
  4. If there are no fees listed, there’s a reason why they’re not listed!
  5. Most of us are in the wrong business!

May 13th, 2010 by Jamie Estep

PCI-DSS compliance becoming justifiable?

Filed in: Data Security, Industry News, Merchant Accounts | 1 comment

Since I have became involved with PCI-DSS several years ago I have always had a major complaint about PCI-DSS.

Merchants do not have protection from liabilities if they take the steps to become compliant!

Now before QSA’s light their torches, let me just say that I completely understand and agree that PCI Compliance ≠ Security. Nevertheless, from a business perspective it’s hard to take a program like this seriously when there is no real benefit from becoming compliant. One can always argue that security is a benefit, but in reality it’s not unless you actually prevent a data loss with it, and there’s no measurable monetary benefit of something that you don’t know was prevented.

I do have a strong belief, which I think is further illustrated by the slow adoption rates of level 3 and level 4 merchants, that most merchants don’t take PCI seriously. Losing customer data is nothing to be joking about, but they way PCI has been implemented with liability dumped on merchants and processors, and the fact that compliant businesses get no protection over non-compliant ones, is laughable. Independent of the PCI Council which they helped start, MasterCard now requires security scans for all merchants even if they don’t process on the Internet or over an IP connection. How can PCI possibly be taken seriously if the founding companies create independent standards after they start an organization specifically to make sure they all have the same standards?

So what’s the big news?

Washington state just passed a law (HB 1149 pdf) that effectively legitimizes PCI, or at least legitimizes much of the cost in becoming compliant. What this law will do is grant a merchant safe harbor from liabilities resulting from a data breach, provided that the merchant was PCI compliant when the breach occurred. It also states that the breached organization’s compliance cannot be revoked as a result of a breach. Basically, if you were compliant at the time of the breach, you are still compliant after the breach. This sort of retroactive revocation of PCI compliance has occurred in several major breaches. From my observation, this law is the first breath of reason that I have seen pushed towards PCI compliance.

Business owners (at least in Washington) can look at PCI and assume, if we become secure and become PCI compliant, we’re no longer as-liable if some extraordinary circumstance results in us losing data. The proactive response is: let’s get this taken care of, lets make sure that our data is secure, and let’s get compliant!

Currently that same business owner is checking [YES] to all the boxes and emailing in their questionnaire. They’re asking, so it doesn’t matter if I’m PCI compliant, I’m still fully liable for any costs and damages if someone steals my data? Hmm… [YES] to all… DONE!

The pitfalls

With legislation like this there are pitfalls, and probably some big ones.

First off, the law states that merchants must be validated compliant within 1 year of the breach occurring. 1 year is far too long for a business that was compliant to be assumed to be still compliant. Additionally, this doesn’t address the fact that the business could quite easily take steps to actually become secure, but intentionally remove them for operations sake once they pass a security scan or self assessment.

Second, the law is only for Washington which makes it worthless in all practicality. However, the fact that one state is passing it may push Visa/MC/AMex/Disc to look at adding real protection to PCI.

Third, the law doesn’t address actual costs to consumers such as fees from bounced checks or other bank and credit associated fees. Merchant’s would most likely still be liable for many of these fees (assuming that there are some) if they suffered a breach.

Lastly, the law would justify costs for becoming compliant, but could put huge costs on someone else (and it’s unclear who). If the merchant does suffer a sizable breach, it’s clear that there are real costs in re-issuing cards. What’s not clear is who would end up paying for them if this law is passed.

Meaningless?

Until this law is adopted by the issuers or put into effect on a national level, the benefits from it on a widespread scale, are going to be little to none. I’m openly against government regulation in any industry, yours or mine, so I do hope that card issuers and PCI security council take a serious look into adopting similar measures directly into PCI. I think that providing some sort of protection like this would greatly legitimize PCI especially in the minds of the business owners that are forced to become compliant and feel that PCI does not give them any benefit. It’s time for PCI to give small business owners a real reason to become secure and to become PCI compliant. A measure like this law is that reason!


May 4th, 2010 by Jamie Estep

The right to accept credit cards

Filed in: Merchant Accounts | 1 comment

US amendment 28 guarantees businesses the right to accept credit cards, or not so much…

Plastic cards have become the normal way for businesses to accept payments. Electronic transactions passed up cash and paper checks a few years ago, and are now so integrated into our lifestyles that carrying cash is far less common than several plastic cards. With this complacency to the idea of credit cards, many have become equally complacent on how much of a privilege it is to be able to take your customers card.

Let’s quickly break down what is really happening when your customer hands you their card for a purchase.

Your customer – To start off with, your customer is granting you an enormous amount of trust that you will charge them the correct amount for their purchase, and that the product you sold them isn’t a complete piece of crap. Let’s face it, in reality you could just type in a number much higher than the actual cost, and they may not notice for several weeks. If it’s a debit card, the money’s completely gone from their checking account! With every transaction, your customer is basically giving you the key to their bank account, telling you to take the money yourself. How often do you hand your wallet of cash to a cashier, and just tell them to get it themselves?

Your processor (or acquirer) – Next, let’s look at the service your merchant account provider is actually providing you. Yes, they magically move the money from your customer to your bank account. However, that’s the least significant role that they play when you process a credit card. What a processor is really doing is granting your business instant credit, every time your customer makes a purchase from you. Let me word this in another way: when you accept a payment, your processor is depositing the money into your bank account on 100% credit. In 99% of cases, the processor has no collateral against the money they are giving you. Your processor may not see any revenue from your processing for 2 months, and they’re not collecting a dollar of interest on that money while they wait! Would your bank allow you to walk in every day and give you cash for your invoices only on your word that you’ll pay them in a few weeks or so, without asking for interest… Probably not.

If you take into consideration that there are millions of businesses in the US, and that some large businesses accept millions of dollars in credit cards a month, it is truly remarkable how much credit is continuously issued. Sure, there’s sometimes errors but fact that billions of dollars of credit is available at any time, without further qualification, without any input from a bank, and considering how smoothly the entire system works, it is simple amazing.

In the age of today, it’s easy to overlook the amount of trust that merchants receive when they do something as simple as swipe a card through their terminal. In addition, many interchange regulation activists skew the actual role of how processors fit into the merchant account industry, and where the fees that you pay each month actually go. Next time your business accepts a card, just remember the amount of trust that you are given for that money to end up in your bank account. It’s far more remarkable than just some electronic transfer between your customer’s bank and you.


May 3rd, 2010 by Jamie Estep

A Comparison of 3 Alternative Payment Methods

Filed in: 3rd Party Processors, Merchant Accounts, Review | 9 comments

Ecommerce website owners have typically had 2 payment methods their customers would want to pay with, Paypal and credit cards. In the the past 10 years there have been many attempts and many failures to dethrone Paypal’s dominance as the primary alternate payment method on the internet. In the past 2 years, 2 services, Google Checkout, and Amazon Payments, have emerged as at least a distant-contender in the alternate payment landscape, both using their massive presence and customer base to establish an immediate threat to Paypal’s dominance.

So, how do the 3 alternate payment methods compare to each-other from a merchant’s perspective? There are 3 main areas that merchants are generally interested in, cost, protection, and integration. The following is a comparison of Google Checkout, Paypal, and Amazon payments in these 3 areas.

Cost

Since cost is one of the most, if not the most, important aspects of any payment system, we’ll waste no time in comparing these. All of these services offer volume based pricing, meaning if you process many thousands of dollars per month the cost comes down considerable.

Standard processing fees:

Monthly Volume Paypal Google Checkout Amazon Payments
0-$3,000 2.9% + $0.30 2.9% + $0.30 2.9% + $0.30
$3,000-$10,000 2.5% + $0.30 2.5% + $0.30 2.5% + $0.30
$10,000-$100,000 2.2% + $0.30 2.2% + $0.30 2.2% + $0.30
>$100,000 1.9% + $0.30 1.9% + $0.30 1.9% + $0.30

Micropayments:

Transaction Amount Paypal Amazon Payments
(< $10 Amazon, < $12 Paypal) 5% + $0.05 5% + $0.05

It’s no coincidence that Google and Amazon have priced their services exactly the same as Paypal. Paypal has a terrible reputation from many sellers perspective, and I think that Amazon and Google are betting that by simply matching their costs, they will gain customers based on their quality of service.

Seller protection

Google Checkout, Paypal, and Amazon Payments are all considered 3rd party processing systems. What this means is that they are accepting payments on behalf of your business. With a traditional merchant account, your business has a direct relationship with Visa and MasterCard through your credit card processor, whereas a 3rd party processor, you are basically using the 3rd party processor’s merchant account.

Seller protection is of significant importance because the 3rd party processor is responsible for any expenses related to chargebacks and fraud from your business. If you receive a chargeback, they generally pass expenses down to your business, but the 3rd party processor is ultimately accountable to Visa and MasterCard for expenses associated with these. Google Checkout, Paypal, and Amazon Payments employ their own fraud screening, customer dispute, and chargeback management systems. Since you have very little control and access to your customer and transaction information, it is important to understand what sort of protection you have available, and what sort of pre-filtering you can setup to prevent unwanted transactions in the first place. One good note about Amazon payments in particular, is that many of the potential customers using this services have long standing relationships with Amazon.com, which can greatly reduce the number of potential fraudulent orders.

Account taken over? – All 3rd party processors introduce a second avenue for fraud that traditional merchant accounts do not have, which is when an account gets hacked and taken over. hacked accounts are not always immediately discovered creating a real chance that you accept payment and ship an order that was placed through a hacked account. As far as I have seen, seller protection is not extended to hacked accounts even though there is no way for you to know if you are accepting payment from a hacked account.

Lastly, since all 3rd party processors have their own dispute resolution systems, a customer actually has 2 chances to make a dispute or chargeback. The first is directly with the 3rd party processor through their dispute resolution system, and the second is directly with their credit card issuer. This gives customers 2 chances to recoup their money if they are unhappy with your services, or are trying to defraud a merchant by making a chargeback after receiving their order.

Paypal

Paypal allows for the most flexibility in the parameters that are required for you to accept a payment. You can specify countries, confirmed shipping addresses, payment types, among many others. For Paypal to provide protection to a seller a number of certain qualifications must be met otherwise Paypal will not cover the cost of a chargeback. Since a merchant can manually change their own requirements for accepting a Paypal transaction, it’s possible to inadvertently remove oneself from seller protection.

Additionally, likely due to the number of people using it, Paypal is probably the #1 avenue that fraud is committed over the internet. Search around and you’ll find thousands if not millions of cases where sellers have lost their money and product, and in many cases complying with all Paypal seller policies. You’ll find an equal number of upset buyers who lost money from an unethical sellers.

  • The transaction must be marked eligible or partially eligible for Seller Protection on the Transaction Details page.
  • The item must be shipped within 7 calendar days of receiving payment to the shipping address on the Transaction Details page, and in accordance with our shipping requirements.
  • In the event a buyer files a claim, you need to respond to our request for documents and other information in a timely manner.
  • The item must be a physical, tangible good that can be shipped. Your primary residence, as listed in your PayPal account, must be in the United States.

With that being said, Paypal does offer reasonable protection for merchants selling tangible products who can meet Paypal’s requirements on a transaction. Once such requirement is proof of shipping, which essentially requires a signature from the actual person whom placed the order. Anyone who has ever shipped for a business knows that the person making the purchase is the same person that signs for the package about 1% of the time, and packages are usually left on a doorstep or with the first person with a pen. In many circumstances, this does not count as verified delivery.

So, while Paypal is by far the most used 3rd party processor, they also offer the least amount of seller protection, and have an uncountable number of negative experiences reported with their customer service, and policies. Paypal’s risk management also leaves something to be desired, and I would say it is inevitable for a merchant’s funds to be help at some point with Paypal. While this is unrelated to seller protection it is a huge pain to send the documents to Paypal and then hope to have your account reinstated. Since Paypal does very little to pre-qualify buyers or sellers, the account-hold situation will forever be an undesired Paypal feature.

Google Checkout

Google offer’s excellent chargeback and fraud protection, however merchants have very little control over buyer requirements. This isn’t necessarily a problem considering that the buyer’s country / location can be a requirement for purchasing through your company via Google Checkout. Google takes a very lenient stance on chargebacks and will rarely charge a merchant for a chargeback or fraud even if the merchant loses. Google as a company has a way of commoditizing products and services and their payment service is no exception. I’ve personally seen Google absorb chargeback costs for merchants, where a merchant account provider or paypal would have billed the merchant every time.

Google’s official policy is as follows:

Guaranteed Payment: Checkout’s Payment Guarantee protects 98% of Checkout orders on average — when an order is guaranteed, you get paid even if it results in a chargeback.

Free Protection: While merchants are typically charged for fraud protection services, Google’s comprehensive protection is free.

Lower Fraud Costs: Checkout’s fraud detection systems reduce fraud and manual review costs by proactively filtering out fraudulent orders.

More Sales: The same systems also help increase sales by identifying legitimate orders that you might otherwise mark as fraudulent.

Fair Treatment: Unlike other services that immediately deduct funds from you for chargebacks, Google does so only after a decision has been made as to who is at fault.

With moderate success, Google applies their typical do-no-evil attitude to the Google Checkout service.

Amazon Payments
Amazon offers protection similar to Google Checkout. Amazon’s official statement is:

If a seller follows the Amazon.com Community Rules when listing, selling and shipping their item and, can document shipment to the customer or that the buyer received the correct item, Amazon.com usually does not hold the seller responsible for the reimbursement of the claim. Otherwise, Amazon.com will usually debit the reimbursement for the claim from the seller’s account.

The gotcha here is again the “document shipment to the customer”. As with Paypal, it is very difficult to actually prove that the person placing the order received the package.

Amazon payments is still a newcomer to the payments business, and has positioned themselves somewhere between Google and Paypal. Something that neither Paypal or Google Checkout have, Amazon has the huge benefit of millions of active Amazon.com customers, many with years of history purchasing from Amazon. This pre-qualification goes a long way in reducing fraudulent orders and chargebacks. Going out on a limb, I think it’s fairly safe to say that accepting payments from Amazon is going to be safer than any other payment method because of this existing relationship.

As far as potential customer service blunders, one thing to be careful of here is Amazon customers expect a certain degree of service when it comes to product delivery and return/refunding orders. Amazon’s policies on these are far more lax than most online retailers, so there’s definitely the potential for conflict if a customer wants to return a product outside a business’s normal policies.

Non-tangible goods

There’s very few processors who handle payments for non-tangible goods like digital downloads, consulting, and other services very well, 3rd party processors are hardly an exception. This is because a customer can make a chargeback with their card issuer for a number of reasons that are virtually un-challengable. Chargebacks like “product not as described” are almost impossible to beat even with superb descriptions, disclaimers, and anything else merchants try to throw at their customers. Until Visa/MC/Amex issuers change their chargeback policies, it’s unlikely that merchants will receive any relief from these types of chargebacks for non-tangible goods and services where the accuracy of the description is easily interpretable. Amazon is currently making the most public push to cater to digital sellers, and of the 3 they offer the most options and protection for this type of service.

Integration

Integration is likely an afterthought for the business owners, but is the most important feature for a developer. All 3 providers offer integrations ranging from simple to advanced allowing developers to create unique and completely customized checkout systems. The most simple integrations require only pasting HTML into an existing website, while the advanced methods use API (Application programming interface) which allows for a seamless connection from an existing website to the processor. API’s allow for passing information like shipping and tax, in addition to a number of other data possibilities, directly to and from the website’s shopping cart.

Paypal

Paypal is probably the easiest to integrate with. There are literally thousands of scripts online, and just about every shopping cart software is ready to go with Paypal out of the box. Paypal offers several methods of integration.

  • Website Payment Standard (HTML buttons to place on a website or blog)
  • Express Checkout or Website Payment Pro (API integration for simple and advanced payments on an existing shopping cart)
  • PayPal payment gateway (ex-Verisign’s Payflow gateway)

The most simple Paypal integration is the buy now buttons that almost anyone could paste in their website to allow a customer to purchase an item from them.

Most website owners would want to use the express checkout or payments pro integration methods. These offer the cleanest user experience. I personally recommend the express checkout method of integration. Your customers start and end on your website, offering the best opportunity for the customer to complete a purchase and the least confusing checkout method possible. The API integration methods allow for uploading shipping and shopping cart information directly into Paypal, and offers support for calculating shipping and tax if the customer changes their address while on Paypal’s website. While the information and code samples that Paypal provides are severely lacking in documentation and organization, the pre-made scripts are a good start for many to get some of the more advanced checkout features going. My personal opinion on the pre-made scripts is that the code is grossly overdone, good programmers or those with a large number of website visitors, should really look into writing their own code to save system resources and reduce complexity.

The Paypal gateway is the former Verisign Payflow link and pro payment gateways. Using these requires a merchant to sign up for a more traditional merchant account through paypal. A merchant still needs to use one of the other integration methods to accept direct paypal payments from their customers.

Recently Paypal has been making huge advancements in developing their integration platforms. Developers are beginning to gain access to systems allowing for aggregation, mobile payments, and a variety of other advanced payment resources. Paypal is pushing the front-line of web and mobile payment development and is desperately trying to get developers to buy into their platform, which in my opinion is working.

Google Checkout

Google also offers several methods of integration from the most simple paste in scripts to very advanced API functions. Google also offers email invoicing, and the Google checkout shopping cart, through their administration panel.

Google’s most basic integration is the Checkout Store Gadget and buy now buttons,which allow website owners to visually create products and buy now buttons and then past them into their website. Multiple options can be added to a product and once clicked on the buyer can quickly make a purchase through the Google checkout system. The store gadgets are a great way to add a few products to a website, but if a store owner has an existing website or a full catalog of products, they’ll want to use one of the more advanced integration methods.

Google’s API offers advanced shopping cart integration and many features to streamline the purchasing process. Google also provides a number of well designed integration scripts in just about every language to get programmers off to a quick start. The API supports fully uploading a customer’s shopping cart items and descriptions, and allows for custom shipping and tax calculations, sales, discounts, coupons and just about anything else a website owner can come up with. Google Checkout is a moderately difficult service to integrate with, but the pre-made scripts are great and most medium level programmers shouldn’t have too much trouble once familiar with Google’s API.

Once a user is setup with a Google checkout account, it takes about 2 clicks total to make subsequent purchases. This is very important to help sales, as 3rd party checkout systems offer a mixed bag of conversion rates compared to an on-site checkout.

Amazon Payments

Amazon offers several methods of integration again ranging from simple paste-in code, to the most advanced API integration.

Amazon’s most simple method of integration is the Amazon Simple Pay, which is similar to Google and Paypal’s button creating features. Again like Paypal and Google, most website owners with more than a handful of products will want to use the more advanced integration methods.

Amazon’s API’s are very robust and offers a number of very advanced features. To list them all would be a post in itself, but they offer just about anything a business owner could want from pre and post transaction payments, variable amount donations, recurring payments, aggregation, 3rd party payments, credit card authorization and capturing, and all of the normal features a payment system would have. With the huge amount of features comes a the burden of trying to integrate Amazon’s system into a website, and I again stress that it is no easy task once a website moves past the basics.

The typical method that most merchants will want to use is Checkout by Amazon, which allows for a merchant to include shipping and tax information when their customer completes a purchase on Amazon’s checkout page. Checkout by Amazon will meet the needs of the majority or websites, and includes several sub-checkout methods for different situations, one allowing for a very quick conversion. The Amazon PayPhrase requires only that a customer enter their secret phrase on the checkout button, and the purchase is complete! Checkout by Amazon will not cater to developers with very special checkout needs, which is there Amazon’s most robust API comes into play, however 98% of website should be perfectly fine with Checkout by Amazon.

Amazon Flexible Payments represents the pinnacle of ecommerce payment technology at this point. Amazon Flexible Payments is also the obvious reason why Paypal has invested millions in their platform as it is truly a huge step ahead of anything out there. Amazon Flexible Payments allows for developers to create very complex payment mechanisms involving multiple parties and/or very flexible payment time-frames and parameters. Want to bill one customer, pay another and take a cut, Amazon Flexible Payments. Need to charge a customer a month after they download your software, Amazon Flexible Payments. If you can think it up, Amazon Flexible Payments can probably do it. However, with the huge set of features comes the difficulty in implementing them, and as stressed above is not an easy task. Amazon Flexible Payments is the most difficult payment system to integrate with, and is one of the more difficult API’s I’ve ever encountered. Amazon Flexible Payments supports only more advanced integration methods like SOAP (If you don’t know what this means, don’t worry, you don’t need to know). Realistically most beginning and even some intermediate and advanced level programmers will have a very difficult time integrating with many of Amazon’s more advanced services. The benefits for the right business are worth it, but most websites will be better suited with Checkout by Amazon.

Concluding thoughts

I cannot make a judgment on which 3rd party payment method is better because in the end it all comes down to your customers. Naturally you should use what your customers want to pay with, and for hopes of better conversion, it is a good idea to offer your customers alternate payment methods in case they do decide to use them. In the almost 10 years I’ve been running ecommerce websites, I can still honestly say that nothing beats straight credit card acceptance, through a payment gateway, at least for tangible products. Paypal makes a very strong statement if your business sells very-tech related products. If I were to pick 2 payment methods that I think every ecommerce website will benefit from, it would be direct credit card acceptance through a merchant account / payment gateway and Paypal. Just based on the usage, these 2 are absolutely essential. Google and Amazon have some amazing features, usability, and speed, but until more customers want to pay with them, they are still not on a comparable level.


Page 5 of 33« First...34567...102030...Last »