card not present transactions
Provided you have received written notification from Lloyds TSB you may accept a telephone or written order from a customer who wishes to pay using a Visa, MasterCard, UK issued Maestro or Solo card.
You must not accept internationally issued Maestro cards for Card Not Present (CNP) transactions. Visa Electron cards can be accepted for CNP, as long as transactions have 100% online authorisation.
The merchant is responsible for any transactions where the card has not been present.
When accepting a CNP order, please take extra care to ensure you have permission to debit the card account and that it is the genuine cardholder who placed the order. Record in writing, all details of the transaction along with the time and date of the conversation. You may be asked to produce this or the cardholder’s authority for a CNP sale if the transaction is disputed at a later date.
The following orders are all acceptable as CNP orders:
Mail orders - written authority from the cardholder, bearing the cardholder’s signature in any form including:
- Completed order forms.
- Facsimile transactions.
Telephone orders – authority from the cardholder by telephone.
If you conduct CNP transactions by mail, for example, advertisements in magazines, the cardholder’s signature must appear on your order form and again, you must retain the instruction for at least 18 months in case the transaction is disputed at a later date.
For all orders received by mail, telephone or fax, goods must be delivered and it is advisable to retain documentary evidence of the delivery address for 18 months.
Important
Under no circumstances can goods paid by mail or telephone be handed over the counter to, or collected by, your customer.
If a cardholder wishes to collect the goods, then he/she must attend your premises in person and produce his/her card. Any sales voucher already prepared must be destroyed and a fresh one completed as a normal over the counter sale. If you have already completed a CNP order you must either cancel the transaction or perform a refund. If you perform a refund, please advise the cardholder that the original transaction, a refund and the over the counter transaction will all appear on his/her statement.
The Address Verification Service (AVS) and Card Security Code (CSC)
You should be aware that as chip and PIN minimises fraud in a Card Present environment, it is expected that fraudsters will increase their activity in Card Not Present transactions. As you are responsible for any transactions where the card has not been present, we recommend you complete these transactions using the Address Verification Service and Card Security Code. (For Internet transactions see Verified by Visa (VbyV) and MasterCard SecureCode.)
What are the Address Verification Service and Card Security Code?
The Address Verification Service is available on all UK issued cards and allows you to check the numerical part of the cardholders post code and statement address with the card issuing bank.
The Card Security Code is the 3 digit number printed on the signature strip on the back of the card, directly after the card number. Please be aware that some cards show the full account number, however, others only show the last 4 digits.
Please remember you remain ultimately responsible should a transaction be confirmed as invalid or fraudulent, even if the AVS and CSC data matches and an authorisation code is given.
Collecting cardholder information for CNP transactions
When a customer is not present for the sale, you must obtain the following information in order to verify their identity and help validate the transaction.
- card number
- cardholder name and initials as shown on the card
- card expiry date
- card issue number (where applicable)
- cardholder statement address (including postcode)
- contact telephone number, (not a mobile number)
This enables you carry out the usual status check so that you can judge whether your customer has the funds to pay you. It also allows you to find out whether or not the card has been reported lost or stolen.
You may be asked to produce this information if the transaction is disputed at a later date.
As telephone orders present the greatest risk, you may also wish to record the time and date of the conversation.
We now recommend that you input some more information to help authenticate the identity of the customer. These new checks involve obtaining the card security code (CSC) and verifying the cardholder’s address (AVS).
Card Security Code (CSC)
One of the two new pieces of information we have now incorporated into our security screening for CNP transactions is the card security code. If your customer can give you this, it indicates that they have the card in their possession while they are ordering from you.
The CSC is printed on the reverse of the card within the signature strip, after the card number. For UK issued cards the code is the 3 digit number that follows directly after the card number. On some cards only the last four digits of the card number are repeated in the signature strip, followed by the 3 digit CSC. This security is mandatory on all cards issued with a “valid from” date of 1 January 1999 or later.
For American Express cards, the CSC is a 4 digit number and it appears above the embossed card number on the front of the card. In the near future these 4 digits will be moved to the signature strip on the reverse of the card.
Address Verification Service (AVS)
Because criminals can use lost or stolen cards to order goods in CNP situations, it’s possible that they might be able to give you the Card Security Code. However, it is less likely that a fraudster would also have the cardholder’s address, so we are now asking for that information as an additional check.
The Address Verification Service is available on all UK issued cards and allows you to check the numerical part of the cardholder’s postcode and statement address with the card issuing bank.
You will need to ask the cardholder for their address as recorded by their card issuing bank and input the relevant numbers as shown in the examples below.
Cardholder Address | Card Security Code | Post Code Numerics | Street Numerics* | Details to be entered into your terminal |
|---|---|---|---|---|
20 High Street Any Town Any County TN26 2BN | 123 or 7594 | 262 | 20 | 12326220 or 759426220 |
Flat 1a 25 London Road Any Town Any County BN4 6RJ | 123 or 7594 | 46 | 125 | 12346125 or 759446125 |
Rose Cottage Mill Lane Any Town Any County SS21 3HP | 123 or 7594 | 213 | 'leave blank' | 123213 or 7594213 |
Flat 12A 1067 Main Road Any Town Any County RG12 4UB | 123 or 7594 | 124 | 12106 | 12312412106 or 759412412106 |
* Maximum of 5 digits (if over 5, take the first 5 digits)
Authorisation Responses
If there are available funds and the card hasn’t been reported lost or stolen, you will receive one of the standard responses shown on the table below. You may also receive these responses if the transaction is declined or referred.
It is your decision whether or not you wish to progress a CNP transaction and this additional information will help you decide. However, please remember that you remain ultimately responsible should a transaction be confirmed as invalid or fraudulent, even if the data matches and an authorisation code is given.
Response | Definition | Preferred Actions |
|---|---|---|
Data matches | This means that both the AVS and CSC match the card issuing bank’s records. | As long as you have been given an authorisation code, and you are satisfied that the transaction is genuine, unless there are other suspicious circumstances that concern you, you are likely to want to go ahead with this transaction. However, as with all CNP transactions, payment is not guaranteed and you bear the risk if the transaction is disputed at a later date. |
Data non match | The card security code and one or both of the address details don’t match with the card issuing bank’s records. | There is the possibility that this is a fraudulent transaction. Further enquiries with the cardholder should be made. It could also be that the details have been entered incorrectly. |
CSC match only | Only the CSC matches and either one or both of the address details don’t match with the card- issuing bank’s records. | The address given must match the address recorded by the card- issuing bank, so in this case there is a possibility that the transaction is fraudulent. However, it could also mean that the cardholder has changed their address without notifying the card issuing bank or the card -issuing Bank doesn’t support AVS. Another possibility is that the details have been noted incorrectly. Therefore you would probably want to verify the address again with the cardholder. |
AVS match only | Both address and post code match, or just the postcode in cases where the home address has a house name rather than a number. However the CSC doesn’t match. | There is the possibility that this is a fraudulent transaction, however, it could be that the cardholder has given you an incorrect CSC number by mistake. It could also be that the details have been noted incorrectly. Therefore, before taking any further action, you may want to verify the CSC again with the cardholder. |
Not checked | This means that neither the CSC nor the AVS has been checked. | This could be because the card -issuing bank doesn’t support either of the services, or their system is down. If this happens you will have to make a decision based on the information you have, as you do now. We would recommend that you make further checks before going ahead with the sale |
Next Steps
- If the transaction has been authorised but you are not happy to continue with a transaction you should process a reversal or refund immediately to reinstate available credit to the cardholder.
- If the transaction is a referral, the CSC and AVS information may be returned by your terminal so that you can verify the transaction with the Authorisation Centre by telephone
Card Not Present authorisation 01268 823 100
Important Information
Please read the points detailed below. These points explain a few things that you should be aware of when processing CNP transactions.
This information should answer some of the questions you may have about the new processes, but if you have further queries, please call the Cardnet Helpline on 01268 567100
1. Guidance Only
Please remember the use of CSC and AVS services is not a guarantee of payment. They are there to help you establish if the card is present at the time of the transaction and that you are dealing with the genuine cardholder.
2. Transaction approval criteria
The CSC and AVS checks are in addition to the overall card status check. The over-riding criteria are still the availability of funds and card status
3. Delivery address
If you deliver goods to a different address other than the one checked using the AVS service you are taking an additional risk.
4. Destroying records
If you keep records of your transactions in any format other than the Cardnet mail order schedule, you must ensure that you do not keep any records of cardholders’ card security codes. This information must be destroyed once the transaction has been authorised.
5. Software systems
If you have your own software solution and you are interested in this service, you will need to make sure your software is compliant. Your software provider should have supplied you with instructions on how to carry out CNP transactions using this service. If they have not, you should contact them as soon as possible.
6. Overall responsibility
It is your decision whether or not you wish to progress a CNP transaction and this additional information will help you decide, however, please remember that you remain ultimately responsible should a transaction be confirmed as invalid.
7. Declined transactions
Even if the CSC and AVS data matches, never process a declined transaction.