10 things to know if you’re taking card payments

If you’re a business that accepts card payments, it’s important to understand the steps you can take to increase security and reduce fraud. Elavon, our payments acceptance partner, has shared this useful guide to help you manage the risks.

1. Authorisation doesn't guarantee payment. It only confirms that the card has enough funds available and hasn't been reported as lost or stolen at that point in time. If a transaction turns out to be fraudulent, you may be liable for chargebacks. You shouldn't enter an authorisation code provided by the cardholder. Authorisation codes can only be obtained from a cardholder’s bank (either from a machine or gateway, or Authorisation Line).

2. Your account can only be used for what it was approved for.

• It can’t be used as a personal banking machine.

• It can’t be used to sell your own personal property.

• It can’t be used to take payments on behalf of another business.

This means any changes to your account setup must be pre-approved by your provider.

3. Credit card terminals must be stored in a secure manner. This is to make sure they can’t be accessed by fraudsters or removed from the premises. Take regular inventory of your terminals and if one is missing, contact your provider immediately.

4. Vigilance is the first line of defence against fraud attacks. Fraudsters may attempt to distract you during a transaction, allowing them time to alter the amount, use a stolen card, enter a card number manually or issue a refund. As soon as the transaction receipt is printed, check it for any variances, such as ‘keyed’ or ‘*’ for swiped or chip-and-PIN cards. They might indicate that the card used was copied.

5. Set up a password on your terminal for refunds and make sure only key personnel have access to it. This will make sure no unauthorised refunds will be processed by fraudsters.

6. Always remember to issue a refund to the same card from which the original sale was taken.

7. If you suspect that a fraudulent transaction has been processed, you may still be able to void it, provided you haven't performed an ‘end of day’ on the terminal. Call your terminal provider and ask them to walk you through the steps of voiding a transaction.

8. Mail order and telephone (MOTO) transactions represent the highest risk due to the difficulties in validating that the cardholder is who they claim to be. Use chip and PIN or contactless where possible and consider participation in pay-by-link if your business model requires MOTO processing. Pay By Link is a convenient eCommerce tool that merchants can use to give customers an alternative way to pay for goods and services online. Talk to Elavon if you’d like to find out more about this.

9. Complete a sense check on incoming orders.

• Is the order unusually large for a single customer?

• Are they looking to use multiple cards to pay?

• Should the goods be available closer to where they are located?

• Are they organising their own courier to collect the goods?

• Is the shipment address a third-party address (e.g. hotel, service station, etc)?

These may be indications of fraud and if you’re not comfortable to proceed with the order, you should ask the customer to come to the store and perform a chip-and-PIN transaction.

10. For eCommerce processing, work with your gateway to make sure that you have up-to-date fraud prevention measures in place to prevent fraud attacks and to deter card testing on your website (also known as carding).

You can contact Elavon to explore ways to take payments from your customers, including face to face, over the phone, online or on the move with Elavon’s payments acceptance solutions. Or if you’d rather request a callback from a specialist at Elavon, they can guide you through the options available.