Card scheme and regulatory changes: October 2020

As your payments partner, we are committed to keeping you up-to-date with industry changes and card scheme developments. There are 11 updates and reminders included here. Please scroll to ensure you act upon all which are relevant to you and your payments processing.

All Card Brands - Online Refunds

In order to build a better foundation for future enhancements, solutions in all transaction environments will be required to send their refund transactions online for issuer approval in real-time. All credit/return transactions must obtain an authorisation. Those without authorisation will be subject to an authorisation processing integrity fee, unless exempt. 

Visa, Mastercard and Diners have granted merchants located in Europe exemption until April 2022 to implement this change. Visa have reserved the right to retract this exemption, so Elavon recommends customers adopt this protocol sooner rather than later. 

Exemptions:  

• Airline MCCs have been exempted by Visa and Diners Club.
  
• Mass transit models (commuter travel) are exempt for Visa.

When it comes to manipulating date on a declined transaction to reattempt to authorisation, Visa will update their rules to allow more flexibility. The new rules will allow 15 attempts in a 30-day period, except for Category 1 declines - which should never be retried.

Fees could be incurred in the future where proper declined authorisation procedures are not followed.

Customer action:

If you are not using an Elavon terminal, please ensure your supplier is aware and is working to ensure this functionality is updated. If you’ve already certified for refund transactions, you’ll need to ensure your terminal estate is capable of receiving back the card scheme data. Talk to us or your terminal supplier about this if you’re unsure.

...................

All Card Brands - Electric Vehicle Charging Transaction Flows

Elavon will support customers that provide Electric Vehicle Charging (EVC) points, whether the charge is stored in a battery or a hydrogen fuel cell.

From 16 October 2020, the following processing procedures – which follow the existing general pre-authorisation flow – will apply to EVC transactions:

Obtaining authorisation before charging begins

1.     Inform the cardholder of any estimated amount for which authorisation will be requested (for example, on a screen display or sticker at the terminal) and obtain the cardholder’s consent before initiating the authorisation request. The estimated amount may be the terminal’s maximum dispense amount or a specific amount requested by the cardholder.

2.     If the preauthorisation request contains the partial approval support indicator, and the issuer provides a partial approval response, then the final transaction amount must not exceed the partial approval amount provided.

3.     If the transaction is finalised for an amount that:

            a.     Exceeds the authorised amount, then you must send an additional authorisation request for the unauthorised amount;

            or

            b.     Is less than the authorised amount, then within 24 hours of finalisation, you must either send a partial reversal for the excess authorised amount or submit the transaction clearing record.

4.     If the transaction is cancelled by the cardholder, you must send a full reversal within 24 hours of cancellation.

Obtaining authorisation after charging is completed

If the authorisation is initiated after charging is completed, then the authorisation request must be identified as a final authorisation.

...................

Visa – Fraud Disruption Blocking

Visa Payment Fraud Disruption service has created new capabilities for issuers to block transactions using nearly any transaction data field. This granular blocking capability ensures that fraud blocks can be surgically applied to stop fraud with minimal impact to genuine cardholder authorisations. It is for the protection of all industry end-points.

Customers are advised that at this time the decline will simply be returned as a general decline – no new codes or processes are being introduced. We are asking customers to bear this in mind when reviewing your decline data, as new patterns of declines emerging could be a sign of attack by fraudsters.

Additionally, the service may notify Elavon of significant attacks. In this event, Elavon will contact you to seek clarifications on the reported data.  Your immediate response will help ensure risks and your financial exposure is minimised.

...................

Visa – Consumer Bill Payments

Visa is launching its Consumer Bill Payment Service (CBPS) - an optional service for third party consumer bill pay providers who aggregate a consumer’s electricity, gas, phone, broadband, etc.

Currently, consumers often have to log on to multiple sites to pay their bills, many of which do not accept card payments. CBPS providers simplify the process by allowing consumers to pay all bill payments via card and via a single channel.

The CBPS program is intended to provide greater visibility and accuracy of transactions and will be governed by rules that are similar to those covering payment facilitators (aka aggregators).

CBPS has a participation fee and offers a set interchange rate (varies by region and country).

If you are offering consolidated bill payments to consumers, please contact Elavon through your relationship manager or our customer service channels.

...................

Mastercard – Automated Fuel Dispenser Changes

To help ensure that Mastercard cardholders will enjoy a convenient and globally consistent acceptance experience when conducting Automated Fuel Dispenser (AFD) transactions, Mastercard is establishing Standards for AFD transaction processing.

From 16 October 2020, AFD locations in Europe will use the following processing procedures when the merchant initiates an authorisation request before fuelling begins:

1.     The cardholder initiates an AFD transaction through a swipe, dip, tap, or in-app request.

2.     The acquirer sends an initial authorisation request identified as a pre-authorisation, in one of the following amounts:

        a.     An estimated amount representing the terminal’s maximum dispense or shut-off amount, which must be no less than the amount for any other payment brand accepted at the location

        b.     A specific amount requested by the cardholder (for example, the merchant may offer the option for the cardholder to increase and/or decrease a displayed default amount, or allow the cardholder to input a specific amount).

Note:

In the European Economic Area (EEA), an AFD merchant is required to inform the cardholder of the amount to be authorised before the authorisation message is sent, such as by means of a sticker or screen display. Such notification is strongly recommended as a best practice in all other locations.

3.     Upon issuer approval, the AFD activates so that fuel can be dispensed. The pump will generally shut off when the approved amount is dispensed. If both the AFD and the issuer support partial approvals, and the issuer provides a partial approval response, then the pump should stop when that partial approval amount is reached.

4.     After the fuel is dispensed, and within 60 minutes of receiving the issuer’s approval response, the acquirer sends an advice message containing the final transaction amount. If the cardholder does not pump the fuel or otherwise cancels the transaction, the acquirer either sends an advice message for a zero amount or initiates a full reversal.

5.     Within 60 minutes of matching the advice message to the pre-authorisation message, the issuer must release any excess hold on cardholder funds.

If a merchant chooses to initiate authorisation of an AFD transaction after the fuel is dispensed, then the AFD transaction authorisation request must be identified as a final authorisation.

Customer action:

We believe most of our AFD customers are already using this process.  If you are not, and require support please contact Elavon, or your terminal supplier, to plan the necessary changes and re-certification.

...................

Automated Fuel Dispenser Liability Changes

Mastercard is aware that many fuel merchants currently support the use of PIN as a cardholder verification method (CVM) at their Automated Fuel Dispenser (AFD) terminals. To help these merchants maximize the benefit from their EMV chip investments, Mastercard will revise its Standards and consider PIN enablement of the AFD terminal as a relevant factor in fraud-related chargeback liability.

Mastercard will support the use of the CAT 1 indicator in all AFD transactions where PIN is a valid CVM option.

As a reminder, customers are advised to ensure that PIN-capable, chip-enabled AFD terminals using MCC 5542 have dual capability to function as either CAT 1 or CAT 2:

• Always uses CAT 1 functionality when a chip card is used, or when a contactless transaction occurs for an amount exceeding the applicable contactless CVM limit (a high-value contactless transaction); and
• Only uses CAT 2 functionality when a magnetic stripe card is used, or a contactless transaction occurs for an amount equal to or less than the applicable contactless CVM limit.

In using CAT 1 functionality, the AFD will prompt the cardholder to enter a PIN whenever a chip card is dipped for a transaction of any amount, or a contactless-enabled card is tapped for a high-value contactless transaction.

The AFD terminal should also use CAT 1 functionality when a contactless-enabled mobile payment device is tapped for a high-value contactless transaction, and the CVM results data in DE 55 show that a CDCVM was successfully performed on the device.

When a magnetic stripe card is swiped or a contactless card or mobile payment device is tapped for a transaction amount not exceeding the applicable CVM limit, then the AFD terminal should use CAT 2 functionality. This will allow the transaction to proceed with 'No CVM' as the CVM.

Customer action:

Ensuring these indicators are properly used in your transactions will ensure that transactions (from 16 October 2020) are better protected from chargebacks.

...................

Mastercard – Passing SCA During an Authentication Outage

PSD2 Regulatory Technical Standards (RTS) stipulate that Strong Customer Authentication (SCA) be performed on all transactions, with a limited set of exemptions.

Whenever an exemption is applied, it is important for issuers to know or they may decline the transaction.

In order to flag when an exemption has been applied, and to explain the absence of SCA data in those transactions, Mastercard created a new indicator called Multi-Purpose Merchant Indicator in 2019 to allow customers to flag transactions accordingly.

With effect from 16 October, 2020, Mastercard is adding a new value to this indicator that can be used to flag when transactions are missing SCA due to an outage of the authentication network (3DSecure or Identify Check, for example).

Customer action:

Contact your 3DS provider for more information.

...................

Visa – Contactless Increases to Return to Pre-COVID Limits

In order to reduce contact with payment terminals, various local regulators and all of the card schemes announced increases to the contactless CVM limits across the European landscape.

In most cases those changes were permanent, but there are a few that are only temporary, and we must now plan to change these back to their original state as restrictions in countries normalise.

During *October 2020, and for Visa transactions only, Elavon will revert the following countries back their original, pre-COVID CVM limits, as shown.

(*Timings may change as pandemic conditions within countries continue to adapt)

All other changes for all other card schemes are to be treated as permanent until otherwise notified.

Customer action:

Card-present customers should expect contactless limits to decrease during October and should ensure front-end staff are aware.

Additional information for partners:

Terminal vendors must ensure that these limits are changed as soon as possible on or after 7 October 2020, and no later than 31 October 2020 in countries where restrictions have been lifted.

...................

All Card Brands – Contactless Single-Tap Requirement

Changes to contactless transactions, made in September 2019 as a result of the Payment Service Directive 2 (PSD2), require card issuers to trigger PIN verification when an amount or transaction count limit is reached. This can happen at any time, during any contactless transaction.

It is important to ensure that the cardholder can enter their PIN without having to present their card to the device a second time, whether by a second tap or by inserting the card into the reader.

The table below shows the deadlines by country of terminal location.

Customer action:

You must re-certify your POS solution in order to comply with this requirement. Contact your Elavon representative or your terminal vendor/supplier to arrange this.

...................

Mastercard Austria – Cashback Limit Increase

For card-present locations in Austria, Mastercard will increase the maximum cashback amount to €200 with effect from 16 October 2020, across all Mastercard card types.

As a reminder:

• Cashback can only be offered on domestic transactions (on cards issued in Austria) alongside a purchase.
• Visa allows cashback only on debit cards to a maximum of €200.

...................

Pre-Authorisation and Reversal Processing Requirements for Merchants

Estimated/initial pre-authorisations give eligible merchants the ability to better process transactions when the final amount of a transaction is not known at the start.

For qualifying customers, having the ability to estimate the transaction amount gives flexibility to adjust the transaction amount as conditions change or if additional charges accrue.

Visa has published a best practice guide, covering all aspects of estimated authorisations, incremental authorisations, and reversal messages which aims to help you maximize the benefits of these capabilities, while creating the best experience for you.