High Risk Merchant Account Guidelines

The increase in popularity of mail order and telephone order (MO / TO), as well as e-commerce and other high risk merchant account channels equals higher numbers of retailers that are now processing credit card transactions in settings where both the card and the cardholder are not present - and fraud can be hugely difficult to detect. This is the reason card acceptance procedures for such transactions are quite different from procedures for face-to-face transactions, but need to still allow retailers to establish - to the highest extent possible - the customer's identity and the legality of the purchase.

The following procedures outline the basic fraud prevention guidelines and best practices for high risk merchant account users.

Authorize All Card-not-Present Transactions

Authorization approval is required on all card-absent transactions. Card-not-present payments are all "zero floor limit" sales. Authorization should be done prior to any merchandise being shipped or service performed.

Get the Card Expiration Date

Any time it is possible, high risk merchant account users should ask consumers for their card expiration date and enter it in their authorization requests. Adding the date helps validate that the card and payment are legitimate. A MO / TO or e-commerce order, featuring an invalid or missing expiration date, can be an indication of a counterfeit card or other unauthorized use.

Get the Security Code

The card security codes are three-digit security numbers printed on the back of Visa, MasterCard and Discover cards and four-digit codes on the front of American Express cards that help verify that a consumer is in possession of the card at the time of the order.

Research shows that high risk merchant account users who include security codes in their authorization requests for card-absent transactions can limit their fraud related chargebacks, and should use the codes as a fraud detection tool.

Billing Address Verification with AVS

The Address Verification Service (AVS) permits card-absent retailers to check a cardholder's billing address with the one at the card issuer. An AVS request features the numeric portion of the billing address (street address and / or ZIP code). It may be transmitted in one of two ways:

1. As part of the authorization request, or
2. On its own. The AVS service checks the address data and sends back a result code to the retailer that shows whether the address provided by the cardholder is identical to the address on file with the card issuer.
AVS can be used to validate addresses only in the U.S., and Canada. In other regions, card issuer support is unreliable.