Breadcrumb

Essential Card Not Present Best Practices

Written by

The GoCardless content team comprises a group of subject-matter experts in multiple fields from across GoCardless. The authors and reviewers work in the sales, marketing, legal, and finance departments. All have in-depth knowledge and experience in various aspects of payment scheme technology and the operating rules applicable to each. The team holds expertise in the well-established payment schemes such as UK Direct Debit, the European SEPA scheme, and the US ACH scheme, as well as in schemes operating in Scandinavia, Australia, and New Zealand. See full bio

Last editedMar 20222 min read

For businesses both big and small, figuring out the best ways to accept and process payments is a crucial step in your business plan. And with the rise of e-commerce and more and more customers choosing to shop online, the importance of card not present transactions is growing.

Card not present payments refer to any situation where the customer is not physically using their debit or credit card with a POS system. In other words, this means online or over-the-phone transactions. Taking payments in this way presents a unique set of challenges for small businesses, which is why we’ve put together this simple guide to card not present best practices to help you approach this in the best way.

What is card not present?

Before getting into the specifics of how to handle these situations, it’s important to first establish the card not present meaning and answer the question: what is card not present?

The name can be somewhat misleading, as these transactions do occasionally require a credit or debit card for the customer to reference. Essentially, card not present payments are those where the customer is not physically using their card, and instead is inputting their details either through an online form or over the telephone.

Be aware of fraud

One of the most important considerations for card not present payments is the possibility of fraud. Since the customer is not physically present, it can be more difficult to verify their identity and ensure that a payment is legitimate.

Make sure that you have the right procedures in place to protect against this kind of fraud. For example, verification steps in the payment process are essential, including checking the customer’s address against the billing address given by the card provider, checking the three-digit CVV code and use of tokenisation in the payment process.

Avoid card not present chargebacks

One of the biggest issues that merchants face when it comes to this type of payment is card not present chargebacks. A chargeback occurs when the customer disputes a payment that is made on their card and contacts their issuer, which in turn incurs fees for you as the merchant. If you cannot provide proof of sale, then you will usually be obliged to reimburse the customer.

Chargebacks are expensive and time-consuming, with rates sometimes exceeding 1.0% of the overall transaction cost. For this reason, it’s essential to put some protection in place so that you can avoid this. Make sure to carefully verify the customer’s identity with the aforementioned processes such as CVV code verification and checking addresses.

In addition, you should make sure to use proper documentation. Ensure that you email receipts to your customers and for subscription services, and notify them clearly of the terms of their subscription and the date when this will renew. Having this kind of evidence will help you support any potential legal disputes in the future.

Protect your customers’ data

While it’s important to keep a good record of transactions, you should be careful about how you handle customer information when receiving card not present payments. The Payment Card Industry Data Security Standards, known as PCI, provide a comprehensive guide of how you should protect cardholder data.

Some of the suggestions include ensuring that your company is PCI certified, as well as your payment processor. Any data that you store should be carefully protected using strong encryption methods or services such as tokenization. You should also be sure to encrypt any data that is sent across public networks, including email and phone lines. Finally, make sure that any partners that you work with are also following the same stringent standards to protect sensitive data.

We can help

GoCardless helps you automate payment collection, cutting down on the amount of admin your team needs to deal with when chasing invoices. Find out how GoCardless can help you with ad hoc payments or recurring payments.