CARD PAYMENTS

If you are an online payments newbie, no doubt you’re getting lost in all new expressions, phrases, definitions. That’s why we come to your rescue with this 3-part introduction to payments safety. Today, we set off with CVV2.

There’s no doubt that paying with cards is one of the safest online payment methods. One of its maid advantage is chargeback – a return of funds. Thanks to this, a customer can get their money back if they don’t recognize a given transaction or think the merchant scammed them.

This kind of an ‘insurance’ allows customers to get a refund, regardless of the entity that collected the payment, without taking them to court. Chargeback is the last resort for a customer. Banks wouldn’t take the liberty of accepting many of them (they are not fully automated), and reporting each chargeback would be of a nuisance for customers.

That is why the safety of card payments is ensured in several ways. Using a specific method can depend on numerous factors, starting with a country, card issuer, ending on merchant’s decision.

It is advisable that both clients and merchants are familiar with such solutions. The former, as not to be surprised when asked for some details, the latter, to know what they can offer and how they can improve their security.

CVV2

CVV2 code is one of the most common types of protection. It is made up of 3 digits, which are visible next to the signature on card reverse – the exception are American Express cards, which have 4 digits above the card number.

We can be asked to enter the CVV2 code when giving card details at an online shop (e.g. the number or expiry date). This simple safety net is used to check whether a client physically owns a given card, or just has its details. It is reliable, as no entities (merchant, acquirer etc.) can keep the CVV2 code in their database, if they are PCI DSS compliant. That is why it is worth checking a merchant before finalising the transaction – they usually display a PCI DSS logo on their website.

The name ‘CVV’ is used by Visa – in general, the code is called CSC (or CSC2). However, merchants (or other entities) often use the term CVV2, as they don’t always distinguish between card issuers. The ‘2’ stands for the generation of the security code.

Various card institutions name the CSC2 code as following:

• Visa – CVV2
• MasterCard – CVC2
• American Express – CID
• Discover – CID

Some merchants, like Amazon, don’t require entering the CVV2 code while shopping. It can cause problems if a card issuer doesn’t allow payments without verifying CVV2 – the enthusiasts of Jeff Bezos’s shop have sure heard of such incidents. The only solution then is to use a different card, without that security requirement.

CVV codes described in the previous part aren’t the only way to make your transactions secure. There are forms of security, which are based on the payer’s localization. However, you may also come across simpler solutions, where only entered data is verified.

An example of that could be AVS – its mechanism compares your address info given in the shopping order with details of the card holder. Depending on the degree and type of eventual errors, AVS returns an appropriate error code, which are the base of estimating the probability of a fraud. Contrary to appearances, it is not inconvenient to clients – the system can tell the difference between a real scam and a situation when a buyer made a spelling mistake.

Unfortunately, AVS has been so far available only in some countries, such as the USA, Canada or Great Britain.

Determining the actual localisation of the payer is something completely else. The GeoIP mechanism can find out plenty of information just from the client’s IP number. It allows to raise the fraud score for payments in some regions.

A more sophisticated form of security is the analysis of localisation history, which allows to determine the fraud score in accordance with various types of aberration. For example, if payments from one card have always been done from the Paris area, but suddenly an activity in South America is detected, it will definitely be looked into (although, it doesn’t necessarily mean that the payment will be declined). At the same time, if a card has always been used around the world, an activity on the other side of the globe will not be surprising, as it may mean the card holder travels frequently.

Another example would be card activity that is physically impossible – when payments are done in Europe, Americas or Asia within minutes of each other. Then, it is clear that they were not done by the same person.

The above mentioned methods are not the whole list of possible types of security, but they can be considered the most common ones. The applied mechanisms are not 100% fraud proof, as they are usually used to assess the fraud risk, and sometimes even the sellers can determine when and which transaction could be labeled as risky. And that is their individual business decision.