When a fraudulent credit card CNP (Card Not Present) transaction is made, mercha

Question

When a fraudulent credit card CNP (Card Not Present) transaction is made, merchant is liable for the chargeback.

For that reason, our company implemented a policy where we ask a photo of customer's card only showing the last 4 digits before we clear the payment. We ask them to send it via email which I think is a security risk because it could be unencrypted.

Our company provides electronically delivered financial services. So we only ask for billing address, we never deliver physical goods.

What's the better approach of verifying card ownership? (complying to PCI-DSS)

Explanation / Answer

I would suggest implementing Verified by Visa and Mastercard 3DSecure.

Ask your acquirer about enabling these services on your merchant account. Those 2 services will shift the liability to the customer provided that the correct VbV/3DS password/OTP authentication passed.

You could also select to reject cards that do not have VbV/3Ds enabled, or you could pass those transactions and take the chargeback risk.

If the financial services you provide only are "useable" in a specific country due to laws and such, I would suggest putting a geoIP lock on your site, and also ask your acquirer (or set it up in your merchant Control panel if they provide such facility) to lock so only cards issued in country X is accepted.

If you also want to use AVS (Address Verification System), I would suggest the user has to enter their billing address at sign-up, then you send a physical snail-mail with a one-time code required to activate account. Then only this billing address can be used. Changing of billing address deactivates account and sends a new snail-mail code to the new address. This also both adds convenience to the customer (he does not need to enter his billing address all the time), auditability (you have a real address for the customer to give to the police in case of fraud), and security (since the address is both verified by snail-mail and against the credit card).

Related Questions

Navigate

• Browse (All)
• Browse W
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.