Merchant Account Application Requirements

Provided your organization is qualified to apply for a US-based merchant processing account and has received an acceptable payment processing proposal, you can commence the application process. There are a number of requirements that need to be met and, to understand why the process is so stringent, you need to understand exactly what is it that you are applying for. A merchant account is a form of line of credit that a merchant processing bank is extending to the applicant. When you accept a transaction, your merchant account bank will "acquire" it, usually at the end of the day, and will automatically deposit the payment amount, after subtracting the interchange fee and its own processing cost, into your checking account. At the same time it will submit a request for payment to your customer's card issuing bank. Your merchant bank will pay you before it gets paid. That is the reason why they have set in place an application process, designed to establish the credit worthiness of both the applicant organization and its principals. Following is a list of requirements that you will have to meet:

• Merchant Account Application. You will provide in this form details about both your business and yourself, including address (business and personal), social security number, tax ID (if applicable), phone numbers, email address, web address, bank account info, etc.
• Personal Guarantee (for-profit businesses only). All new businesses and a great many established ones are required to provide a personal guarantee before establishing payment processing services.
• Articles of Incorporation. Unless your establishment is a sole proprietorship, you will have to provide a proof that it has been legally incorporated.
• Business License. If your business activity is regulated and requires a license, either a federal or a state one, you will need to provide it.
• Business Financial Statements. Unless your organization has been formed recently, you will have to provide its financial statements (typically it is required that you produce financial statements for the two years preceding the application date).
• Personal Financial Statements. Typically requested in place of business financial statements, personal financials might be requested in addition to them. Personal tax returns for the latest two years are typically sufficient.
• Processing Statements. If you are currently processing credit cards and are looking for a new service, you will be asked to produce your three latest processing statements.
• Voided Check. You will need to provide a voided copy of a check for the bank account that you want your money to be deposited into. The check has to have your "Doing Business As" (DBA) name printed on it. If you have not yet received your checks, you will need to provide a signed bank letter stating your account details.

As you see, there are quite a few requirements for applicants to accept credit and debit cards and it is by no means certain that you will be approved. Still, if you provide the needed paperwork and have decent credit history, chance are that you will get your merchant account service.

Merchant Account Qualifications

There are certain requirements that applicants for US-based merchant accounts have to comply with. It is the responsibility of merchant account providers to ensure that all applicants:

• Are legally registered within the US. Applicants for merchant services have to be either incorporated as businesses within the state that they reside in or they have to be registered with the local municipality and obtain a "Doing Business As" (DBA) name. Individuals are not allowed to establish merchant account processing services. Foreign establishments are also excluded from obtaining US-based payment processing accounts.
• Have a physical address and a registered agent within the USA. Applicants for US merchant services need to provide available a contact person within the US and a physical office for the merchant processing bank to inspect.
• Have a bank account with a US bank. The bank account into which the merchant will have his or her funds deposited must be opened with a US bank.

Only if the applicant complies with the above requirements, the merchant account processor will proceed with the application.

eCommerce Merchant Account Rates

ECommerce merchants pay higher processing rates than their retail counterparts. The reason is that card-not-present transactions are more likely to generate customer disputes than card-present ones. Customer disputes, especially if not addressed properly, often lead to chargebacks, which are costly for both the merchant and its payment processing provider. So the premium that card-not-present transactions are charged pays the insurance against possible chargebacks. Following is a list of the components of the eCommerce merchant account processing costs and what we think is a reasonable rate for each one of them:

• Discount rate. Rates for web merchant accounts have fallen substantially over the last few years and you should not be charged more than 2.19% for credit cards and 1.98% for debit cards for consumer types of cards. You should keep in mind that commercial, business, rewards and some other types of cards are charged at a significantly different interchange rate which, as its main component, directly affects the discount rate that you will be offered. When evaluating a pricing proposal, you should be aware of the pricing structure that your prospective merchant account processor is using. There are several types, most of which will give you a flat rate, in one form or another, for all types of credit and debit cards. The problem with these models is that, in order to make money on all transactions, merchant processing banks have to provide a rate that is higher than the highest possible interchange that you are likely to incur. Your best option would probably be the pass-through pricing model which adds your merchant account provider's payment processing costs to the interchange fees, thus ensuring that no transaction is overcharged.
• Transaction fee. Online merchant account users should not pay more than $0.25 per transaction.
• Application and set up fees. You should not pay any set up or application fees!
• Payment gateway fee. Payment processing gateway is the service that will connect your website's shopping cart with your processing bank and will transmit payment information between them. It should be set up for free and the monthly gateway fee should not exceed $15.
• Monthly statement fee. A bank fee that every merchant services provider will charge you. You should not agree to anything higher than $10.
• Support fee. Another monthly fee. You should not pay any such fees.

Make sure to carefully examine the fine print in the merchant processing agreement before signing it and make sure your payment processor does not hide anything from you.

Retail Merchant Account Rates

Merchant account rates are the sum of interchange rates and the processing costs incurred by the merchant bank. Following is a breakdown of retail merchant account processing rates and our suggestions what you should be looking for (or you can just visit our website).

• Discount rate. You should pay no more than 1.69% for credit cards and 1.40% for debit cards. These are the rates for consumer cards which are the most widely used. Various business to business, rewards and other cards often get charged at a higher interchange rate (the base processing rates set by Visa and MasterCard). You need to ask your merchant services provider what pricing structure they are using. The best choice for you will be the pass-through pricing which will ensure that the payment processing costs they add to the interchange fees are the same for all types of cards and you will not get overcharged.
• Transaction fee. You should not agree to anything higher than $0.20 (it will be the same for debit and credit cards).
• Set up fee. You should not pay any set up or application fees!
• Monthly maintenance fee. Every merchant account provider will charge you such a monthly fee, although they might give it different names. You should not be paying more than $10.
• Support fee. Another monthly fee. You should not pay any such fees.

You will also need a payment processing terminal and your merchant account provider will provide you one and configure it to work with their system. You can purchase the terminal from a third party as well. Other than that, be sure to carefully review the whole merchant processing agreement for charges that may make it more expensive than it seems.

Merchant Account Providers

Merchant account providers like UniBul enable businesses to accept credit and debit cards for payment. Whether an organization accepts cards in a card-present or in a card-not-present environment, they need a merchant account to do that.

In order for a company to become a provider of merchant account services, it first has to be authorized by the Credit Card Associations of Visa and MasterCard. The process involves a check of the credit worthiness of both the business and its principals, a review of the applicant's business and marketing plans and the payment of the registration fees which are $5,000 for each Association. Although banks, that are members of Visa and MasterCard, can and do provide merchant processing services, more typically they outsource this responsibility to third parties. By doing so, they become sponsors of these third parties in their applications with Visa and MasterCard. Merchant account processors are known as Independent Sales Organizations ISO) when they are registered with Visa and as Member Service Providers (MSP) when they are registered with MasterCard. Businesses apply for both registrations at the same time, through their sponsor bank. Upon approval of the application, the sponsor bank becomes an acquiring bank for the ISO/MSP. This means that it acquires the sales receipts that the merchants, using its payment processing services, generate and it is then responsible for paying the merchant the transaction amounts, minus its processing costs and the interchange fees. In the mean time the merchant processing bank submits a payment request, through Visa or MasterCard, to the bank that issued the card used in the particular transaction. ISOs and MSPs are obligated to display the name(s) of their acquiring bank(s) on every page of their website and other promotional materials. Usually this sign is placed in the footer of the website.

Once registered, ISOs and MSPs can sign up sales agents to source merchants for them. The sales agents, however, cannot advertise themselves as providers of merchant account processing services. They are only authorized to represent the ISO/MSP and must identify themselves as agents to these companies.

Payment Gateway

Definition. A payment gateway is a web-based service that transmits payment information from an eCommerce website to a merchant processing bank. It is the eCommerce equivalent of the physical terminal used by merchants in card-present payment acceptance environments. The collected information is encrypted to ensure that personal data is transmitted in a secure fashion.

How it works. A payment processing gateway connects the eCommerce website's shopping cart with the merchant processing bank's system. The stages of the process are as follows:

• A customer places an order on an eCommerce website and submits his or her payment information.
• The payment information is encrypted using a secure socket layer (SSL) service and sent to the merchant's server.
• The eCommerce gateway then collects the payment information and, after another SSL encryption, transmits it to the merchant account provider's server.
• The merchant processing bank then sends the payment details to the appropriate Credit Card Network (Visa or MasterCard).
• If the cardholder used a Discover or an American Express card, the payment processing provider serves as an acquiring bank and decides whether or not to authorize the transaction; then forwards the response to the merchant.
• The Credit Card Network forwards the transaction to the card issuing bank.
• The Issuer either authorizes or declines the transaction and sends a response code (through the exact same channel) back to the merchant bank. The response codes for declined transactions provide details for the reason the transaction did not get approved.
• The merchant processing bank then sends the response code (through the eCommerce payment gateway) to the merchant's website and it is presented to the cardholder.
• The whole process, from submitting the payment to receiving the response, takes seconds.
• The merchant then provides the service or ships the product and settles the transaction. It is very important that transactions do not get deposited prior to the product being shipped. If the cardholder notices the charge on his or her card statement or transaction activity (now available online in almost real time), prior to receiving the merchandise, the transaction may be disputed, initiating a chargeback.
• At the end of the business day, all authorized transactions (also called a "batch") are submitted to the merchant processing bank for settlement.
• The merchant bank then deposits the total transaction amount, minus interchange fees and processing costs, into the merchant's bank account.
• The entire process takes approximately 2-3 business days.

Card payment processors typically provide eCommerce gateways as part of the merchant account. They charge a monthly fee for the service ($10 - $25) and may charge a fee for the set up as well. Every major online payment gateway supports the latest fraud prevention solutions, including the Address Verification (AVS) and Card Verification (CVC2, CVV2, CID) services.

Here is our solution.

What Is a Merchant Account?

Definition. A merchant account is a payment card processing service that a merchant bank provides to a merchant (it is the type of service UniBul provides). It represents a form of line of credit that the merchant bank extends to the merchant and it allows the merchant to accept the card brands, specified in the processing agreement.

How it Works. When a merchant accepts a cardholder's payment information, it is transmitted to the merchant bank. The merchant bank then pays the merchant the transaction amount, minus the interchange fees and the processing costs, and submits a payment request to the bank that issued the card used to make the purchase. The issuing bank then pays the merchant bank the transaction amount, minus the interchange fees, and posts the transaction on the cardholder's monthly statement. The cardholder then pays the issuing bank to close the cycle.

Types of Merchant Accounts. There are a number of different merchant account types but the most widely used are:

• Card-Present Merchant Accounts. This type of merchant account service includes all payment processing solutions that use payment terminals to read the account information from the magnetic stripe of a card that is swiped through. Because the merchant is in actual possession of the card (hence, card-present) as the payment is being made, these merchant accounts are considered less likely to generate fraudulent transactions and enjoy lower processing rates.
• Card-not-Present Merchant Accounts. Included in this group are all card payment processing services where the card account information is manually entered into the merchant bank's system, using a web browser or a telephone keypad. The card itself is absent (hence, card-not-present). Because the merchant is never in possession of the card and the information is given to him or her, card-not-present transactions are considered more likely to generate fraudulent activity or processing errors and are processed at higher rates. There are two distinct sub-groups here:
  
  • ECommerce Merchant Accounts. These merchant accounts are used by web-based merchants and enable consumers to enter their payment card information into a payment form on the merchant's website. Once submitted, the payment details are automatically transmitted, via a payment gateway, to the merchant bank.
  • Mail Order and Telephone Order Merchant Accounts. Also known as MO/TO merchant accounts, these payment acceptance solutions enable merchants to enter the payment information, provided to them by their customers into a form on the merchant bank's payment system's website or, using a telephone keypad, to call it into the merchant bank's system.

Interchange Fees

In the payment card industry interchange is the fee that an acquiring bank pays to a card issuing bank when a card (issued by the card issuing bank) is used to pay for a product or a service, provided by a merchant who has a merchant account with the acquiring bank. The issuing bank pays the acquiring bank the transaction amount minus the interchange fee. The acquirer then pays the merchant the transaction amount minus both the interchange fee and its own payment processing cost.

Interchange rates are published annually by both Credit Card Networks - Visa's and MasterCard's and are available for everyone to see. They represent the largest chunk of the total transaction processing costs that merchants pay for accepting payment cards. Various estimates put their share at anywhere between 70% - 90%. Interchange rates are typically comprised of a percentage of the transaction amount (for example 1.94%) plus a fixed fee (for example $0.10). Various factors come into play when interchange fees are established. Generally, payments taken in a card-not-present environment are processed at a higher interchange than payments taken in a card-present environment. That is the reason why eCommerce merchant account and MOTO merchant account users pay higher processing fees than, say, retail merchant account users.

Since interchange rates are set by Visa and MasterCard, merchants have no leverage over them. It is, however, important to know what they are, so that, when negotiating with prospective merchant account providers, you will know exactly what you are being offered. There are several merchant processing pricing structures and this article will not go over all of them but probably the best model is the pass-through one. It works by simply adding your merchant services provider's processing cost to interchange, ensuring that every single transaction is processed at the same rate. You will only have to make sure that these processing costs are not inflated and a simple referral to the interchange chart will help you do just that.

See how we have structured our own interchange pricing model.

Merchant Requirements for Securing Cardholder Information

To protect your merchants, cardholders, and the integrity of the payment system, each of the credit card processing companies has in place a set of requirements governing the safekeeping of account information (UniBul very much included). Following is a brief overview of the most critical aspects of those requirements.

Storage of Cardholder Information	Do not store the following under any circumstance: Full contents of any track from the magnetic stripe on the back of the card. Card-validation code-the three-digit value printed on the signature panel of a MasterCard, Visa, Discover Card, JCB, or Diners Club card, and four-digit code printed on the front of an American Express card. Store only that portion of the customer's account information that is essential to your business-i.e. name, account number or expiration date. Store all material containing this information (e.g., authorization logs, transaction reports, transaction receipts, car rental agreements, and carbons) in a secure area limited to authorized personnel.
Destruction of Cardholder Information	Destroy or purge all media containing obsolete transaction data with cardholder information.
Use of Agents or Third Parties (Vendors, Processors, Software Providers, Payment Gateways, or Other Service Providers)	Advise each merchant account provider or credit card processing contact (representing each of your card brands) of any agents that engage in, or propose to engage in, the processing or storage of transaction data on your behalf-regardless of the manner or duration of such activities. Make sure these payment processing agents adhere to all rules and regulations governing cardholder information security. Any violation by your card processing agent may result in unnecessary financial exposure and inconvenience to your business.
Reporting a Security Incident	In the event that transaction data is accessed or retrieved by any unauthorized entity, notify the merchant services provider or merchant processing contact for each card brand immediately. This report will not only minimize risk to the payment system, but protect your customers in the most responsible manner. Systems and procedures are in place to immediately stop the unauthorized use of compromised data, but are effective only when you (and every small business merchants accounts provider) do your part to promptly report a security incident.

Recurring Payments

What are Recurring Payments? Recurring payment plans exist when a cardholder authorizes a merchant to charge his or her credit or debit card on a regular basis (e.g., monthly, quarterly or annually). Payment amounts can be fixed or they can vary and the plan exists until it is canceled by the cardholder. A good example of a recurring payment plan would be an auto insurance policy that has been set up so that the insured's credit card is charged monthly and the service will be provided indefinitely, or until it is canceled by the consumer. All merchant processing accounts support this feature.

Benefits for Merchants:

• Providing additional payment processing options. Customers like having payment options at the checkout.
• Increasing enrollment in online payment processing. It is a great time-saving tool.
• Reducing customer service calls. By automatizing the process merchants ensure less payment-related issues.
• Improving cash flow. Recurring payment card processing plans ensure that less mistakes will be made and less payments will be returned.
• Reducing delinquencies. Setting up the payment schedule beforehand ensures less delinquencies.
• Improving collections. Since the payments are processed automatically, they are easier to collect.
• Increasing customer retention. Consumers, too, enjoy the convenience of recurring payment plans.

Benefits for Cardholders:

• Convenience of setting up the payments once. It's fast, easy and simple. You don't have to go over it again.
• Time savings. Once the plan is set up, you are done. Payments are made automatically thereafter.
• Stress relief. You don't have to keep on checking when the bill is due and worry about being late on a payment.
• Cost savings. No more post stamps to stick on payment envelopes.
• Earning points on rewards program. Some merchants qualify for various credit card reward programs.

Depending on the type of merchant account that you have, recurring payment plans may be set up differently. Ask your credit card processing provider for assistance if you are not sure how it is done.

Merchant Payment Account Easy Payment Service

Visa's Easy Payment Service (VEPS) for merchant payment account users enables face-to-face retailers from more than 98 percent of Merchant Category Codes (MCCs) to accept credit cards and other bank cards without the need for a signature and only need to print out a receipt upon a request from the customer.

The VEPS program offers retailers the potential to speed up the check-out process at the point of sale, improve customer satisfaction and provide operating efficiencies for merchant payment account users. It can also help increase customer retention by helping cardholders use their bank cards quickly, securely and easily.

Merchant Payment Account Easy Payment Service Advantages

For qualifying payments, the VEPS program:

• Eliminates the need for card acceptors to obtain a signature.
• Eliminates the transaction receipt requirement, unless specifically requested by the cardholder.
• Eliminates the necessity for retailers to store sales receipts and bans issuers from placing retrieval requests.
• Provides strong chargeback protection against fraudulent transactions and for the receipt requirement.

Which Transactions Qualify

Transactions qualify for the VEPS service if they comply with all of the following criteria:

• The transaction takes place at a qualified merchant payment account user.
• It is a purchase (as opposed to credit) transactions with a valid card.
• It is a card-present environment (for amounts of $25 and lower) or unattended environment ( for $15 and under).
• Payments are authorized.
• Applies to all MCCs except those explicitly excluded (list is provided below).
• All card types are eligible, including magnetic-stripe, chip-and-PIN and proximity payments.
• The POS device must read and transmit unaltered magnetic-stripe, chip, or contactless payment information.
• The information must be transmitted in the authorization message.

Unqualified Merchants

The following business types are not qualified for VEPS:

• Wire Transfer Money Orders.
• Insurance Services.
• Automated Fuel Dispensers.
• Travel Related Arrangement Services.
• Catalog Merchants.
• Combination Catalog and Retail Merchants.
• Outbound and Inbound Telemarketing Merchants.
• Continuity / Subscription Merchants.
• Manual and Automated Cash Disbursements.
• Financial Institutions - Merchandise and Services.
• Betting, including Lottery Tickets, Casino Gaming Chips, Off-Track Betting, and Wagers at Race Tracks.
• Intra-Government Purchases.
• International Automated Referral Service.
• GCAS Emergency Services.
• Intra-Company Purchases.

There are no program registration requirements. If a merchant payment account user is eligible, they should just run the transaction as they normally would, skipping the signature, and offering the sales receipt as an optional service.

(Read more.)

E-Commerce Merchant Account Chargeback Requests

A chargeback, as previously stated, is the reversal of a portion, or the entire amount, of a card transaction that is being disputed, resulting in a refund to the issuer and debit to the e-commerce merchant account provider or the retailer in the amount listed to the dispute. Chargebacks can be initiated as a result of a processor's or retailer's failure to provide a complete and on-time response to a sales ticket retrieval request or for the failure of the retailer to follow applicable credit card processing procedures.

If the card issuer has sufficient evidence that supports a dispute of a transaction, the e-commerce merchant account provider will not require the submission of a ticket retrieval request prior to initiating a chargeback request. An image of the sales receipt supporting the chargeback request must be submitted to the processor within five business days of the issuer initiating it, except for disputes related to authorizations where the evidence is saved as an electronic record. The content of a processor's or retailer's response to a retrieval request may constitute sufficient evidence needed to resolve the dispute.

Each chargeback request needs to contain the following pieces of information:

• Details of any correspondence between the customer and the retailer documenting the authenticity of the chargeback request; or
• Sufficient evidence supporting the dispute.

Additionally required information regarding some types of transactions may include the following:

• For airline e-commerce merchant account transactions, the original ticket if a paper ticket was produced, a copy of the original ticket with adequate proof that the consumer did not use the ticket or evidence of the sale of an electronic ticket (such as the confirmation code);
• Assignment of claim by a consumer that received a refund; and
• Other documentation that may be requested by the processor.

Upon receiving the chargeback request from the issuer, each processor or retailer is required to repay the amount of the resulting Chargeback to the Association (Visa or MasterCard). If the evidence proves that the chargeback was indeed improper, they should request a re-presentment.

If Visa or MasterCard does not receive sufficient evidence supporting the chargeback request from the card issuer within the time-frame stated (five business days) or if the Association does receive a request that is not compliant with the above requirements, a chargeback may not be processed or if it had done so already, the Association may process a re-presentment.

(Learn more here.)

Where Is My Debit Discount? by UniBul on 5/10/2012  The retailers had promised us lower prices at the checkout, once the fees they are charged for accepting debit cards were reduced. Well, these fees were cut by no less than 45 percent. So where is my promised discount? Read more.

You Can’t Get in Trouble with Prepaid by UniBul on 5/11/2012  That may not be the official tagline for the campaign that has been launched to tout the virtues of the latest American Express prepaid card, but it sure could be. The way I see it, prepaid cards, even the best among them, are still very much the payment cards of choice for the unbanked. Read more.

EMV, NFC, Mobile Wallets and Credit Card Fraud Liability by UniBul on 5/8/2012  Beginning in October 2015, merchants who have not upgraded to chip-and-PIN-compliant point-of-sale (POS) terminals, will be liable for the full amount of any fraud losses, which will, incidentally, hugely benefit mobile wallet operators. Read more.

The More You Use Your Debit Card, the Lower Your Credit Score by UniBul on 5/15/2012  That is the conclusion of a recent study by two researchers from the Federal Reserve Bank of Boston. The economists say that they set out to verify the anecdotal negative relationship between the use of debit cards and credit scores and have indeed confirmed the validity of this common assumption. Read more.

Prepaid Cards Keep Getting Better by UniBul on 5/14/2012  Chase is the latest big bank to enter the prepaid card market in a serious way. AmEx's prepaid card is still the best option for everyone with a poor FICO score whose primary goal is to get back into the credit system, because it offers a path to a charge card. Everyone else, however, now has a choice between two very good prepaid cards. Read more.

Increased Lending, Higher Balances Lead to Lower Credit Card APRs by UniBul on 5/16/2012  That is how two Cleveland Fed researchers interpret the fall of credit card interest rates in the past two years. They find an inverse relationship between the changes in the interest rate and the outstanding credit card debt. Read more.

Americans Are Slashing Credit Card Debt and Other Facts by UniBul on 5/12/2012  We've been tracking the various credit card statistics in real time on our blog, but I thought that we could all benefit from a summary of what has taken place so far and from some historical perspective. So here are some charts for you. Read more.

Screening New Merchants

Before signing a merchant agreement, acquiring banks must verify that the merchant that is applying for a merchant account is a valid business. Such verification must include at least all of the following:

• Credit check, background investigations, and reference checks of the merchant.
  
  If the credit check of the merchant raises questions, the acquirer also should conduct a credit check of:
  
  
  
  
  
  
  
  • The owner, if the merchant is a sole proprietor; or
  
  
  
  • The partners, if the merchant is a partnership; or
  
  
  
  • The principal shareholders, if the merchant is a corporation.



• Inspection of the premises and records to ensure the merchant has the proper facilities, equipment, inventory, agreements and personnel required and if necessary, license or permit and other capabilities to conduct the business. If the merchant has more than one outlet, the acquirer must inspect at least one outlet from which it will acquire card transactions.



• Inquiry to the Member Alert to Control (High-risk) Merchants (MATCH) system. If an acquirer chooses to enter into a merchant agreement with a merchant that is listed in the MATCH system, the acquirer will be responsible for all fraudulent transactions.



• Investigation of the merchant’s previous merchant agreements.

An acquirer is not required to conduct a credit check of a public or private company that has annual sales revenue in excess of $50 million (or the foreign currency equivalent), provided the acquirer reviews, and finds satisfactory, the most recent annual report of the merchant, including audited financial statements. A private company that does not have a recent audited financial statement is subject to a credit check and inspection even if its annual sales revenue exceeds $50 million.

MasterCard Fraud Loss Control Program Standards

In order to be eligible for counterfeit loss reimbursement, a member bank must make a good-faith attempt to demonstrate the existence and use of meaningful controls to limit total fraud losses and losses for all fraud types.

Acquirer Fraud Loss Control Programs

An acquirer's fraud loss control program must meet the following minimum requirements, and preferably will include the recommended additional parameters. The program must automatically generate daily fraud monitoring reports or real-time alerts. Acquirer staff trained to identify potential fraud must analyze the data in these reports within 24 hours. To comply with the fraud loss control standards, acquirers also must transmit complete and unaltered data in all card-read authorization request messages, and also CVC 2 for all card not present (formerly MO / TO), voice, and e-commerce transactions.

Additionally, acquirers with high fraud levels must:

• Install "read and display" terminals in areas determined to be at high risk for fraud or counterfeit activity, or
  
• Install EMV chip terminals.
  

Acquirer Authorization Monitoring Requirements

Daily reports or real-time alerts monitoring merchant authorization requests must be generated at the latest on the day following the authorization request, and must be based on the following parameters:

• Number of authorization requests above a threshold set by the acquirer for that merchant.
• Ratio of non-card-read to card-read transactions that is above the threshold set by the acquirer for that merchant.
• PAN key entry ratio that is above threshold set by the acquirer for that merchant.
• Repeated authorization requests for the same amount or the same cardholder account.
• Increased number of authorization requests.
• "Out of pattern" fallback transaction volume.
  

Acquirer Merchant Deposit Monitoring Requirements

Daily reports or real-time alerts monitoring merchant deposits must be generated at the latest on the day following the deposit, and must be based on the following parameters:

• Increases in merchant deposit volume.
• Increase in a merchant's average ticket size and number of transactions per deposit.
• Change in frequency of deposits.
• Frequency of transactions on the same cardholder account, including credit transactions.
• Unusual number of credits, or credit dollar volume, exceeding a level of sales dollar volume appropriate to the merchant category.
• Large credit transaction amounts, significantly greater than the average ticket size for the merchant's sales.
• Credits issued subsequent to the receipt of a chargeback with the same account number and followed by a second presentment.
• Credits issued to an account number not used previously at the merchant location.

90-day Rule

The acquirer must compare daily deposits against the average transaction count and amount for each merchant over a period of at least 90 days, to lessen the effect of normal variances in a merchant's business. For new merchants, the acquirer should compare the average transaction count and amount for other merchants within the same merchant code (MCC) assigned to the merchant. In the event that suspicious credit or refund transaction activity is identified, if appropriate, the acquirer should consider the suspension of transactions pending further investigation.

150% Recommendation

To optimize the effectiveness of fraud analysis staff, merchants that appear in the monitoring reports should exceed the average by 150% or more. However, the amount over the average is at the acquirer's discretion.

Recommended Additional Acquirer Monitoring

MasterCard recommends that acquirers additionally monitor the following parameters:

• Fallback methods.
• Credit transactions (such as refunds) and merchant authorization reversals.
• Transactions conducted at high-risk merchants.
• Personal account number (PAN) key-entry transactions exceeding ratio.
• Abnormal hours or seasons.
• Inactive merchants.
• Transactions with no approval code.
• Transactions that were declined.
• Inconsistent authorization and clearing data elements for the same transactions.

Reporting Fraudulent Use of Cards

All MasterCard member banks must report accurately and completely the fraudulent use of MasterCard cards to the System to Avoid Fraud Effectively (SAFE) at least once a month and within 60 days from the date of the transaction, or 30 days from the date of cardholder notification. If there are no fraudulent transactions to report during the month, member banks must submit a Fraud Negative Report (FDN) Record when transmitting their transactions to SAFE or use the Report No Fraud feature of SAFE OnLine.

Reporting by the Issuer

MasterCard issuers must submit all fraudulent transactions on its MasterCard accounts to SAFE on a monthly basis. For the benefit of all members, MasterCard analyzes the data and produces statistics relating to the fraudulent use of MasterCard accounts and all chargebacks that originate from transactions using accounts with a fraud status.

An issuer must report fraudulent transactions even if it recovered losses through chargebacks, compliance cases, restitution, insurance, or any other means.

Reporting by the Acquirer

An acquirer receiving a transaction that cannot be identified by a MasterCard BIN or member ID is liable for that transaction. If it is determined that the transaction is a fraudulent or counterfeit MasterCard transaction, the acquirer must notify, in writing, the Security and Risk Management Department of such an occurrence. This notification must include all mandatory information as described in the Security Systems Specifications manual.

MasterCard Rewards for Capturing a Card

The acquirer may pay the merchant reward for capturing a MasterCard card in accordance with local practices. The acquirer must follow these Standards when paying a reward:

• Pay no less than $50 to the merchant capturing a card listed on the Electronic Warning Bulletin file or in the Warning Notice.
• Pay the merchant $100, if a merchant initiates an authorization call because of a suspicious transaction or captures a card not listed in the Electronic Warning Bulletin file or in the Warning Notice.
• Pay a reward to a financial institution for the capture of another issuer's card if it is the acquirer's practice to pay its tellers rewards for picking up its own cards. The amount of the reward should be the same amount paid for the capture of the acquirer's own cards.
• Charge the issuer for reimbursement of the reward paid upon dispatching each captured card. The Fee Collection / 1740 message with an IPM message reason code (data element 25) equal to 7601 will settle the reward.

Reward Amounts

The acquirer should follow these guidelines for determining reward amounts.

IF the capture…	THEN pay this amount…
Resulted from a “Merchant Suspicious” phone call	$ 100
Did not result from a “Merchant Suspicious” phone call	$50
Leads to the capture of additional cards	$ 50 for each card captured, with a maximum total of $250 for any one incident

The recovering member bank may collect an administrative fee of $15 for expenses incurred in processing the captured card. The capturing member may add this fee to the amount of the reward reimbursement or collect the fee independently, using the Fee Collection / 1740 message.

Reimbursement of Rewards

The following specifications apply to reward reimbursement:

• Upon returning the card to the issuer, the acquirer will obtain reimbursement for the reward paid and the $15 fee by processing the Fee Collection / 1740 message.
• If an acquirer returns a card to an issuer and a reward is not paid, the acquirer may collect a $15 fee by processing a Fee Collection / 1740 message record.
• Upon receipt of the Interchange Card Recovery Form (ICA-6), the issuer should match it to the Fee Collection / 1740 message record based on the acquirer member ID, account number, and recovery date comparisons.
• If an exempt member has an electronic reward payment processed, clearing receives the record by an information slip. The transaction is part of the Net Settlement System for settlement purposes.

Point-of-Sale (POS) Card Retention

Acquirers and merchants are required to recover a card by reasonable and peaceful means if:

• The card issuer advises the acquirer or merchant to recover the card in response to an authorization request.
• The Electronic Warning Bulletin file or an effective regional Warning Notice lists the account number.

After recovering a card, the merchant must notify its authorization center or its acquirer and receive instructions for returning the card. If mailing the card, the merchant first should cut the card in half through the magnetic stripe.

Returning Recovered Cards

The acquirer must follow these procedures when returning a recovered card to the issuer:

• If the merchant has not already done so, the acquirer must cut the card in half vertically through the magnetic stripe.
• The acquirer must forward the recovered card to the issuer within five calendar days of receiving the card along with the first copy (white) of the Interchange Card Recovery Form (ICA-6). The additional copies are file copies for the acquirer's records. A recovered card must be returned to the security contact of the issuer.
  

Returning Counterfeit Cards

The acquirer or merchant must return counterfeit cards to the issuer by following the instructions provided by its authorization center. The following information identifies an issuer:

• The issuers bank identification number (BIN) embossed on the front of the card.
• The member ID imprinted in the Card Source Identification area on the back of the card.

Sales Receipt Requirements

Below is a list of the types of sales receipts discussed in this post:

• Retail sale.
• Credit.
• Cash disbursement.
• Information.

If the merchant uses a manual imprinter, the produced sales receipt is called a formset or slip. If a transaction begins at an electronic terminal, the merchant may substitute a terminal receipt for a formset. Terminal receipts have no prescribed physical specifications but must be numbered sequentially for reference purposes.

Formset Contents

Each copy of a retail sale, credit, or cash disbursement formset must satisfy minimum statutory and regulatory requirements in the jurisdiction in which the slip originates and any applicable regulations, issued by the U.S. Board of Governors of the Federal Reserve System or other regulatory authorities, and must contain the following:

• In the case of retail sale and credit slips, a space for the description of goods, services, or other things of value sold by the merchant to the customer and the cost thereof, in sufficient detail to identify the transaction.
• Adequate spaces for:
  
  • Customer's signature.
  • Card imprint and the merchant or bank identification plate imprint.
  • Date of the transaction.
  • Authorization number (except on credit slips).
  • Sales clerk's or teller's initials or department number.
  • Currency conversion field.
  • Merchant's signature on credit slips.
  • Description of the ID supplied by the cardholder on cash disbursements and retail sale slips for certain unique transactions.
• A legend clearly identifying the slip as a retail sale, credit, or cash disbursement and identifies the receiving party of each copy.
• On the customer copy of the formset, the words (in English, local language, or both): "IMPORTANT—retain this copy for your records," or words to similar effect.
• Such other contents as are not inconsistent with these rules.

It is recommended that each retail sale, credit, and cash disbursement slip identify the member bank that distributed the slip to the merchant.

Terminal Receipt Contents

A terminal or other device at a point of sale (POS) must not display magnetic stripe track data other than card account number, expiration date, and cardholder name. Each copy of a POS terminal receipt must contain the following information:

• Doing Business As (DBA) merchant name, city and state, country, or the point of banking location.
• Transaction date.
• Card account number.
• Transaction amount in the original transaction currency.
• Adequate space for the customer's signature (required on merchant copy only).
• Authorization approval code (except on credit receipts). Optionally, the acquirer also may print the transaction certificate, the application cryptogram, or both for EMV chip card transactions.
• Merchant's signature on credit receipts only.

Each receipt must clearly identify the transaction as a retail sale, credit, or cash disbursement.

Primary Account Number Truncation

ATM acquirers must truncate a minimum of four digits of the Primary Account Number (PAN). PAN truncation is also required for all receipts generated at Cardholder-Activated Terminals (CATs). PAN truncation is permitted for receipts generated at all other points of sale.

The cardholder receipt generated by point of sale (POS) terminals, whether attended or unattended, must reflect only the last four (4) digits of the PAN. All preceding digits must be replaced with fill characters that are neither blank spaces nor numeric characters, such as "X," "*," or "#."

Truncation Considerations

Truncating a greater number of digits, when compared to the total number of digits in the PAN, increases the effectiveness of the effort. However, it also increases the confusion and difficulty that cardholders may have reconciling their ATM terminal receipts to their monthly statements. The following practices are recommended:

• Truncation of the routing BIN alone, while helpful, may not prevent duplication of the PAN. It is possible to observe the card in use in order to obtain issuer identification.
• Truncating the check digit and several other digits does not improve PAN security. Absent the check digit, calculation of several missing digits within the PAN, especially if the routing BIN also is truncated, is substantially more complicated and time consuming.
• Truncating a small number of digits, when compared to the total number of digits in the PAN, reduces the effectiveness of the effort. It is possible to reconstruct a few missing digits by using a trial-and-error approach.
• Truncating a greater number of digits, when compared to the total number of digits in the PAN, increases the effectiveness of the effort.

Electronic Signature Capture Technology (ESCT)

An acquirer using Electronic Signature Capture Technology (ESCT) must ensure that:

• Proper electronic data processing (EDP) controls and security are in place, so that digitized signatures are recreated on a transaction-specific basis. The acquirer may recreate the signature captured for a specific transaction only in response to a retrieval request for the transaction.
• Appropriate controls exist over employees with authorized access to digitized signatures maintained in the acquirer or merchant computers. Only employees and agents with a "need to know" should be able to access the stored, electronically captured signatures.
• Digitized signatures are not accessed or used against applicable standards and regulations.