Customer not present mailorder credit card processing and credit card payments

Let’s talk about “customer not present” credit card processing for mail order and telephone order credit card payments. In the industry this is known as CNP (customer not present, not to be confused with Chip and Pin, of course) and the phrase MOTO, which stands for Mail Order and Telephone Order.

This is the one remaining area of the payment industry where the creators of integrated retail management systems really struggle against suppliers and legislation to produce a credit card solution that actually works.

In the good old days, a customer filled their credit card in on a form and posted it to you, or they phoned you up and gave their card details over the telephone. You probably wrote them down on a form, or a bit of paper, and then keyed the transaction manually into your card processing machine.

Some years ago, as computers become more involved in retail EPOS solutions, it become reasonable to expect that we could type the card details into the computer whilst taking them from the customer, and process them later.

Companies like Commidea sprung up with software that allowed computerised retail EPOS systems to take money against stored credit cards. The retail software would either take the money straight away, or they would charge the card later, depending on what the retailer wanted. The card details were held in a database, and little thought was given to security. The card details could be sent by the retail EPOS software to the 3rd party card processing software, which took care of all the business of getting an authorisation and charging the card.

And then the great Internet revolution came along and hit use. This was closely followed by the chip and pin revolution. Suddenly, retailers had all manner of technologies available to protect themselves from fraud with Internet transactions and customer present transactions. Systems like chip and pin, 3d Secure and verified by visa help everyone involved in retail feel safer about internet and customer present retail transactions.

The banks hate mail order. MOTO. If the banks had their way, nobody would do something as inherently risky as read a credit card over the phone. A couple of pathetic bits of technology came along to try and patch this gap. The CVC code on the back of the card and the AVS – address verification software. I will deal with the inadequacies of these two system elsewhere, but they really don’t help.

The banks have now forced PCI-DSS compliance upon the whole payment industry. This makes it very awkward to store card details (probably a good thing) and also make it impossible to store the CV2. So, if you want to take a customer credit card details over the phone, including the CV2 card, and then charge their card later, when you dispatch the goods, you’ll find you can’t. You can’t because you can’t store the CV2 code. You have to ring up the customer and ask for it again. That makes for a good workflow. Not. So why not take the money up front when the order is placed? Again, this sounds attractive, but the banks would have you only do this if, and I quote, you have a reasonable expectation of dispatching the goods in a reasonable period of time at the point of taking the order. That sounds like a big woolly mess to me.

This problem doesn’t really have a neat solution. The card processing software companies have now started offering secure wallet services to the retail EPOS system software houses. This means that the retail software can take the card details, and transmit them to a safe storage area. They can make subsequent charges against this wallet. But they still not have the security and preferential rates enjoyed by a transaction with a CV2 code.

This situation is set to continue until CVC code gets discarded for a more reliable system, AVS is forgotten and ultimately, everything is paid for without recourse to something as Victorian as a plastic card.