With the widespread prevalence of e-commerce shopping sites, the occurrences of fraud have risen in recent years. To prevent fraudulent payments from costing your business valuable time and money, you should take the necessary precautions to ensure the integrity of each cardholder’s account during web transactions. Below, we’ve compiled some best practices for verifying the validity of a credit or debit card that is remitted for online payment.

• For web transactions, be sure to request the type of credit card (i.e. Visa or MasterCard) and the full account number. Each card type has a dedicated beginning digit(s) that distinguishes it from other types. If your validation technology detects that the card type and beginning account number don’t match one of the combinations below, do not accept the card as a form of payment.
  

  Card Type	Beginning Digit(s)
  American Express	37
  Visa	4
  Master Card	5
  Discover	6
  Diner’s Club	3000-3059,3600-3699,3800-3899

• Instead of populating the expiration date fields with a default date, leave the fields blank and require that the customer manually chooses a month and year from a drop-down menu. Include validation logic that will not allow the payment to process until the expiration date is selected.

• Include a field requesting entry of the three-digit card validation code that appears next to the signature line on the back of the card. This helps to minimize the unauthorized use of account numbers by requiring that the customer has the actual card when making their purchase.

• Don’t allow your customer service personnel access to credit card account numbers in their entirety. Instead, only disclose the last four digits of the card number. Full account numbers should only be revealed by entry of a secure password entered by management.

• For all online payments, keep account information on a dedicated server that is protected by a secure firewall.

• Clearly convey your return and order cancellation policy within the customer service portion of your e-commerce site. At some point during the checkout process, present a terms and conditions page and require that the customer take some form of action, such as clicking a checkbox, to indicate that they have been made aware of the policy. In the event of a return or cancellation, process a reversal of charges as a credit to the customer’s account.

• Establish business rules to flag orders as potentially fraudulent. Common triggers used by e-commerce engines include excessively high order totals, a high volume of a certain type of product, multiple transactions using the same card account number, and discrepancies in shipping and billing addresses.

• Implement reliable fraud prevention technology that screens each online customer for a potential history of fraudulent behavior. If a customer’s records match those provided by a past perpetrator of fraud, do not accept the card as a method of payment.

• Upon order completion, clearly convey that the order has been successfully processed to avoid the customer taking steps to duplicate the order. In the event that an identical order is processed multiple times, take steps to contact the customer promptly to verify the validity of the recurring orders.

• Set up an email confirmation system that notifies the customer immediately after the order has been processed. This email should include the following information:

   

  • The name of the online business

  • The amount of the order total, including any applicable tax or shipping charges

  • A listing of the items included in the order

  • The expected date of shipment for each item, and any applicable backorder notification

  • Details of your company’s return policy and/or the web address of where the policy can be found online

  • Contact information for your customer service department, including a toll-free number, email address, and a live chat URL, if applicable.

For more information on internet and card not present processing please visit Visa’s recommendations at: http://usa.visa.com/merchants/risk_management/card_not_present.html