New Auth.net Processing Requirements

Hi there, we received an email from Authorize.net regarding new processing requirements for MasterCard and Discover and wanted to pass it along. Keep up the great work.

---

Dear Authorize.Net Merchant:

MasterCard and Discover are modifying their rules concerning the processing of debit, prepaid and gift cards. This e-mail includes important information about the new requirements and the timelines regarding Authorize.Net's support of the requirements, so please read it thoroughly.

MasterCard's rule changes go into effect May 1, 2010, and Discover's rule changes go into effect April 16, 2010. However, Authorize.Net, MasterCard and Discover have worked together to extend these dates for all merchants using Authorize.Net solutions. Our merchants will now have until June 30, 2011, to implement support for the requirements within their systems.

What are the requirements?
MasterCard and Discover are requiring that all merchants support the following:

Balance response transactions — For prepaid and gift cards, once the card has been used, the remaining account balance will be transmitted along with the authorization response. The remaining balance must be printed on the customer receipt, displayed on the Web page or point-of-sale terminal, or both.

Partial authorization transactions — When a customer's transaction amount exceeds the balance available on their debit, prepaid or gift card, instead of declining the transaction, a partial authorization for the amount available to the customer will be returned. This will allow the customer to pay for the remaining amount with another form of payment. This is called a split-tender transaction.

Authorization reversals— An authorization reversal is a real-time transaction initiated when the customer decides that they do not want to proceed with the transaction, or if the merchant cannot complete the transaction for any reason. Authorization reversals free up the customer's available balance on their debit, prepaid or gift card.

What steps is Authorize.Net taking to support these requirements?
Authorize.Net will be updating our systems over the coming months to support the requirements, but will be dependent on each processor's readiness. For a table of when we anticipate we will support the requirements with each processor, please visit http://www.authorize.net/support/pafaqs/#when.

What do I need to do to support the requirements?
The steps that you will need to take to support the requirements depend on how you connect to the payment gateway. For example, if you connect using a shopping cart, point-of-sale device, or other solution, you will need to contact your solution provider to confirm that they will be supporting the requirements. If you connect using a direct integration, you should contact your Web developer for assistance. Please direct your Web developer to http://www.authorize.net/support/pafaqs/#do for information on the changes they will need to make.

Do I have to support the requirements?
MasterCard and Discover are requiring all merchants to support the requirements with the exception of merchants that exclusively process transactions via batch uploads, mail order/telephone order (MOTO), or recurring payment transactions. Your Merchant Service Provider (MSP) is ultimately responsible for determining if the requirements apply to your business, so please contact them for assistance in determining if your company is exempt.

Once again, these requirements will not be enforced for Authorize.Net merchants until June 30, 2011. However, we wanted to bring them to your attention now so that you have plenty of time to plan for their implementation.

For more information on the requirements, including how they affect our value-adding services, please visit our FAQ page at http://www.authorize.net/support/pafaqs/.

Thank you for your attention to these important changes and for being an Authorize.Net merchant.

Sincerely,
Authorize.Net

Deadline on this is approaching.. Anyone have any solutions?

well I guess if you call a year approaching. Plus it from the wording it doesn't even look like authorize themselves have implemented this in their api yet.

And its only for debit, prepaid and gift cards. I don't think I've ever had anyone buy anything from me with any of those in 6 years of ecommerce business. Not to say it isn't important. But not the end of the world either.

I agree, the likelyhood that anyone will use gift cards and prepaid cards with our site is slim to nill. However I think the real concern here is that our store could be shut down by Mastercard or Discover if we're not in full compliance with their rules, a move which could potentially delay or lose us $.

Is this a legitimate concern? Anyone know what's the move here?

Thanks!
Seth

Yeah, I was going to ask about this as well. (And I also, like Seth, thought the deadline was *this* year, until I called Authorize.net to ask them a question about it.)

It's my understanding that if you accept M/C or Discover at all, whether or not anyone's ever tried to use a gift card or prepaid card at your store, you're still required to meet this standard. So it might be wise for someone really adept at coding (ie, not me) to try to solve this one.

Since I made the switch from a hosted solution to OC, I've been wondering if I might be able to get around (or "meet") these requirements by simply posting a notice at checkout that if someone wants to use a gift card or pay using two different sources of payment to call. I can process two different sources of payment directly through my gateway.

I wonder if that will be good enough to meet their requirements??

And Q, you've probably had LOTS of sales made using debit cards. I use my debit card almost exclusively for online purchases.

I'm sure before the deadline this will get updated. from the letter above it says the deadline is June 30, 2011. It also basically says that at the time of the writing of that letter it would be impossible for you to comply since they didn't even have their api for the functionality done.

Karen wrote: And Q, you've probably had LOTS of sales made using debit cards. I use my debit card almost exclusively for online purchases.

I've never once sold a debit card order. Debit cards are dead in USA since check cards took over, and although I do get a lot of overseas business, debit is foreign to me. Not sure where the customer enters their PIN. I don't even have the debit service on my Auth.net account as I think it costs extra.

Qphoria wrote:I've never once sold a debit card order. Debit cards are dead in USA since check cards took over, and although I do get a lot of overseas business, debit is foreign to me. Not sure where the customer enters their PIN. I don't even have the debit service on my Auth.net account as I think it costs extra.

I wonder whether M/C needs to clarify what they mean by a "debit card", then (and maybe I should ask Authorize.net)? Because if they meant use of a debit card only when the PIN was required, they should say it that way. None of my customers (or me, actually) think of our debit cards with a credit card logo as anything other than a debit card.

Debit cards, as I would define them, and as my bank defined them came out in the mid 90s and were only usable at ATMs or Gas Stations and always required PINs. A few years later banks started using "Check" cards which in addition to the PIN option, would appear to work as if they were credit cards as far as the retailer was concerned. They could be "charged" and signed for like a normal credit card. The only difference was that the money was pulled directly from the checking account instead of charged to your credit card company.

So I know of no bank that still offers just "debit" cards anymore.. perhaps the word "check card" is regional tho and "Debit Card" means the same thing now to others. But "Check" cards have no special handling compared to a credit card from what I understand. Aside from the location of the actual funds, they are functionally the same.

Karen wrote:Yeah, I was going to ask about this as well. (And I also, like Seth, thought the deadline was *this* year, until I called Authorize.net to ask them a question about it.)

Haha! Oh wow, I totally missed that the date is 2011! Thanks pointing that out!!

Seth