Epoch doesn't process for EU customers. Unfortunately.



Last edited by art at Dec 6 2003, 10:05 AM

Glad I was helpfull.

Be sure if You can to share some experience on this subject if You got it as well. Knowledge never hurts You know.
:)

Good posts RedEye

One thing we need to remember when talking about processing is that "EVERYONE is here for the money" - only politicians can fuck with that simple rule.

VISA/MC has no real problem with adult - only times they get mad are:

- when it costs them money
- when their brand is getting bad publicity

VISA/MC do not like 3rd party billers, because it can cost them money, and because they have no control over their brands.

Recurring billing will not go away from the adult industry as long as VISA/MC makes money on it. VISA/MC will (and have) changed "the who and how" behind recurring billing, and it will lead to less people being in the business.



Last edited by Rolo at Dec 6 2003, 09:41 AM

Let me explain.

The processing in the world slowly but seriously moves towards a new protocol of acquiring transactions. The protocol is called 3D Secure.

Basicly as I understand it it's the same as Verify By Visa with the exception that the password for internet purchases by customer is being kept by the customer's bank.

All banks are recommended to support it.

I'll explain.

For example Your bank is Barclays Bank and You have a credit card of that bank. Now Barclays is supposed to contact You and offer You to input a special password for internet purchases on their website. The password is being kept only at their site.

At the time You attempt a purchase in the system which is connected through 3D Secure You will be required to enter the password and it will be matched directly with Your bank.

Therefore it is very difficult to fraud with this protocol because basicly in the majority of cases one would need to hack banks websites to get passwords.

Then the so-called "liability shift" occures. If later You attempt to make a chargeback more than half attempts will be declined and the merchant and the acquirer, and the PSP of course, are no longer liable for chargebacks. To be exact if You say "It was not me" the bank will no longer approve the chargeback.

The most interesting thing is what happens if Your bank does not support 3D Secure but the transaction went through that protocol. I.E. If the PSP has 3D Secure but Your bank doesnt the PSP will still make the transaction the old way but the shift occures anyway and the merchant if he is connected through such PSP is not liable for chargebacks. Why? Because generally it costs 20-30K $ and a couple of monthes for a bank to install 3D Secure and everyone was supposed to do it a year ago, so technically they are reliable for not supporting it.

However, just as with Verify by Visa these protocols seem not to support recurring charges at this time , at least not from the side of processor or PSP. The acquirer MIGHT have a difficult possibility to run recurring payments with 3D Secure but as of yet it's a rumour.

Although 3D Secure is quite new, so not too much is known about it.

Those who want to read more about it could check this: http://international.visa.com/fb/paytech/s...secure/main.jsp

Ofcourse VISA/MC want to increase consumer confidence, so more people will use their credit cards on the internet.

However *IMO* even after 3D have been released and adopted, then recurring will be possible, because its good for business and consumers want it.

You will probably not be able to receive chargeback protection on none qualifying 3D transactions, but you will still be able to process.
VISA/MC will keep lowering chargeback rates, at the same speed as more of the internet business moves to 3D, so in time it might be very risky to "blindly" do recurring transactions.

Quite a few of your assumptions are incorrect redeye, especially in regards to the status of 'third party' billing companies, which are legitimate IPSPs when they are set up correctly. One only has to look to the compliance situation, which is controlled by one entity for the entire Visa system...

I'm out and about now but when I get back I'll pick apart some of your statements for comment if you like. :)

While everybody is talking about cb's.

Anybody have any experience fighting "Product not as described" chargebacks?

I've seen a few of these and am always shocked because it seems like the card issuing bank is involving themselves in what should be a customer service issue. The customer isnt required to return or destroy the product and thus far we have been unable to come up with a compellign argument for reversing the chargeback.

Hooper, is it a tangible or subscription product?

tangible

On those I'd check the URL that the signup originally came from and see if an affiliate is doing something like promising a 50 midget gangbang with Asia Carrerra.
You might not be able to fight it once the person charges back, but you could prevent more.

thx for the input carrie but it's not the kind of product that is confusing. sorry i'm not sharing a bunch of details, but it's for some unreleased things.

Really this is the same as somebody going to amazon, buying a book and then charging back because the reviews werent accurate.

On high dollar transactions clearly you'd initate collections, but what about 20 or 30 buck transactions?

Well, this sometimes work for tangible products, but since you said that you do not require the customer to return the product, then it might be harder than normal?

Let them know that you have not received the product back from the customer. Include any contact you had, with the customer or let them know if the customer has not contacted you.
Also send them a copy of the web page that displays your mailing address and return information/policy, so they can see that you have made it very clear for the customer to contact you and/or return products.

Some banks want to work with you, however most will just process any internet related chargeback their cardholders want - no matter how much proof you got. Sad but true!

Ahh sorry Hooper you were posting "tangible" the same time I was posting my suggestion.
Rolo's advice above sounds right on the money. :okthumb:

Also if you haven't done it yet, you might want to include a page with the invoice and product that outlines your return procedure, mailing address etc, or even a "product registration" card. If they return the card then they're registering the product and are evidently happy with it, yes? Might be more ammo in the event of a future chargeback.

i'm not sure the type of product you are referring to but if it was something along the line of natural penis enlargement pills, breast enlargement pills, or any of these other products which are not much above a scam - i'd say there wouldn't be much defense ... but if it was an actual tangible product that worked and was exactly as described, why the fuck does the customer not have to return it?!?!? that's fucked up!!!

can't really comment much though without knowing what product you are talking about and how you are selling it to the customer ...

Poor Mustafa.......and we thought Ashcroft was bad..... :blink:

I'd love to hear Your comment KK and experience however I doubt that You are correct in this issue.

The processing basicly works under the following scheme in the world (simplified of course):

Issuing Bank - VisaNet - Acquiring Bank - Merchant - Customer.

In between the Acquiring Bank and the Merchant a sales body can be existing: PSP , which is different from IPSP and stands simply for Payment Service Provider. So the chain looks like:

Issuing Bank - VisaNet - Acquiring Bank - PSP - Merchant - Customer.

There are quite a few out there , most if not all do not do anything related to adult.

Examples: WorldPay, SecPay, SureFire, Paysystems and so on.

These companies are authorised by acquiring banks to process transactions on behalf of the bank and to organise more or less sales , since the bank itself is not able to do it due to many reasons (I know of only 1 acquiring bank managing everything inhouse, although I think there are more and that system is Barclays EPDQ), however there must be a direct relationship in between the bank and the merchant and merchants must be on separate MIDs (Merchant IDs, some call them merchant accounts).

There are no exceptions by Visa bylaws and regulations.

Well let me rephrase it, untill a year ago or when was it, there WERE no exceptions.

The reason behind it is very simple , no body in most of the countries of the world (the tribe of hannibals on the island of Lu-Lu is an exception, however their neighbours hannibals from the island of Ku-Ku are adopting bank licenses already :D ) is allowed to operate with third parties moneys unless than body is licensed as a bank in case the funds come from general public or have a limited license if the funds originate from prewritten in the license origins like exact companies which will send them.

The exception however exists in the general laws that if the body is just passing through funds of third parties without ANY interference with them it is allowed to operate without license. I.E. if the company just gets the funds from bank for its clients it is ok. The following applies to Europe where we payed quite a lot to worlds 4th largest legal company for the research on this subject.

However the company may not create or mantain accounts. This is called that funds on DEMAND are prohibited without license.

It is quite complicated. Read it three times to get some understanding of it.
:D
So third party billing companies BY LAW are allowed to exist only as money transfering companies however they do not fit into the processing chain because unless licensed as a bank they will not be able to be plugged into VISA NET directly and therefore will never have a possibility to mantain separate accounts of their own for merchants.

I'll make it simplier - the legal bodies which aggregate clients transactions and route transactions to the VISA NET and make the processing itself (i.e. take the money from the card, put the money on to the merchant account, transfer it further or block it or hold it or whatever) exist and are called acquiring banks.

For a majority of such operations the body has to be either the bank or be licensed as a bank BY LAW and not by Visa regulations.

While the internet evolved the banks were not ready themselves to play by the rules. They still are not ready.
The process of getting a merchant account is still quite complicated.

So nobody cared about companies processing in breach with rules and sometimes law (take PayPal for example or all systems of e-money) because it helped the net to evolve.

However now it has to be fit into normal laws which essentially is good for everyone. When You have a direct relationship with a bank You are protected by LAW that You will in fact see Your money if You are pornographer or not. And everyone else is protected by LAW that if You fuck up it will be You who is liable and not everyone else around You. Of course the bank will not smile to You saying "Hey! You do porn! You're a great client!" but that is the price You got to pay for making more money than the rest of dudes around You - that is normal.

As for IPSP regulations - they are just a way to at least normalise somehow the situation, billing companies have to go away, but slowly without scandals and publicity and other things which can hurt the e-commerce too much and throw it back to the stone age.

The IPSP regulations in fact have been applied only at two acquirers in fact (may be I am wrong here). At FDMS and PAGO in Germany to the existing huge aggregators (Ibill and so on). However they were forced straight away from PAGO and this stuff now is active only at FDMS.

The funny stuff is the following thing which has occured: There is NO other acquiring bank in the world I think now which will require You to get VISA approval prior processing for each URL on Your own merchant account and that is FDMS (through their sales body CardServiceInt). That's right. If You apply for Your own merchant account in FDMS through CardServiceInt You will have to send in just the same way as on Ibill for example all Your URLs prior processing to VISA for approval. The approval takes 1 month by the way.

In all other acquiring banks in the world You get Your merchant account for Your company and run as many sites under it as You want, as long as they are Your sites, You may only be required to show them from time to time.

As I said already - the descrimination laws are quite a serious thing to consider.

And of course You can NOT setup a new IPSP. You cant do it correct or incorrect - it's impossible because there is simply no such thing as IPSP towards other companies than Ibill, CCBill and Epoch. May be Verotel recently as well.

I know about SG & FDMS and the way IPSPs are setuped , I also know that recently a very powerfull team including CEO in the near past of the biggest of those billing companies has applied to SG & FDMS for a new IPSP account and of course were declined. The stuff applies only to existing companies which are too big to be shut down immediately at least in FDMS in USA, as You know in PAGO it happened very easily.

KK do You stand for KimmyKim excuse me for my ignorance? If so I know of Your obsession (in the good sense of the word) with IPSP rules, we even met couple of times in debates on this subject on GFY, my nickname there is "Incognito". When You were in CCBill I didnt like Your approach so I might have been a bit too rude, please excuse me, because I thought it was just ignorant promotion of CCBill, however when You quit that company I have changed my mind because I understood that You are simply very very interested in the subject.

By the way I have those rules , a copy of IPSP rules from VisaInt , London on my computer.

So whenever You are trying to understand what is right or what is wrong just look on the following chaing again:

Issuing Bank - VisaNet - Acquiring Bank - PSP - Merchant - Customer.

It is the only correct chain.
And whenever You apply for a merchant account , if it's NOT for adult , be sure that the body claiming that it is an Acquirer is indeed and Acquiring Bank.

There is a shit load of fraud right now on the net because so many people look for merchant accounts with no real understanding of how the stuff really is that everything is possible.
:)

For adult though, in most cases now, the link looks like:
Issuing Bank - VisaNet - Acquiring Bank - SomeBullshit - PSP - Merchant - Customer.

Where SomeBullshit is a company which belongs to the Acquiring Bank and is happilly called either a gateway or a designated bank processor or some other word or a PSP. The Banks are scared to open real direct merchant accounts right now so they put a company in between and open Your merchant account in that company so You dont have direct relationship.

It's completely off the rules book as well however at this moment it's not really dangerous cause Visa doesnt seem to complain about it as long as merchants go on separate merchant accounts whomever holds them and it's the bank which is behind it anyway so everything is fine. That's what they now do in offshore banks acquirers and in Israel.
The only thing You have to be sure of is that it is indeed the banks establishment. Because there are a lot of frauders there. Examples of popular frauders:
Ecommerce Services UK , QwikPay, CEE KEy, EdenCom.

An easy way to find out is simply if You see the bank name somewhere in the process of running that merchant account. There always is a contract of SOME sort or an application to the bank or contact with the bank even if the merchant account is opened in this intermediary company.
Companies like Ecommerce Services UK open You a merchant account in their own gateway and DO NOT let You see the bank behind it. If WHEN You are approved (prior to approval a lot of companies hide the bank name, although some do not) You find out that You are not allowed to see ANY bank at all in Your processing - it's fraud.

Also dont be suprised that frauders often areserious employees of banks, acquirers , known billing companies (Epoch, Ibill, CCbill as well) in the past of present.

One of the worst frauders for example WAS Edencom from France. Edencom processed for a shit load of russian lolita paysites year ago. Most of smaller billing companies were plugged into it (like BillCards, just smaller)

Know what?

The person who was forwarding webmasters (russian as well) to Edencom, an intermediary between Edencom and other dudes is a CURRENT employee in the Netherlands of a very respected acquirer from Sweden - Netgiro.
The guys who worked in Edencom were all previous employees in Coca-Cola.

As I said the best way to see if it's fraud or not - if they allow You to see the bank.

In normal e-commerce , non adult, there is a lot of similar fraud as well.
There is a shit load of PSPs plugged in to other PSPs and so forth. Which is not allowed as well.
In normal e-commerce the chain is very simple and looks only like this:

Issuing Bank - VisaNet - Acquiring Bank - PSP - Merchant - Customer.

Whatever is in between means charging You more money and against the rules.

Hope I was helpfull.
Again if anybody wants to share experience, lets do it.
:D

I'd love to hear Your comment KK and experience however I doubt that You are correct in this issue.

The processing basicly works under the following scheme in the world (simplified of course):

Issuing Bank - VisaNet - Acquiring Bank - Merchant - Customer.

In between the Acquiring Bank and the Merchant a sales body can be existing: PSP , which is different from IPSP and stands simply for Payment Service Provider. So the chain looks like:

Issuing Bank - VisaNet - Acquiring Bank - PSP - Merchant - Customer.

There are quite a few out there , most if not all do not do anything related to adult.

Examples: WorldPay, SecPay, SureFire, Paysystems and so on.

These companies are authorised by acquiring banks to process transactions on behalf of the bank and to organise more or less sales , since the bank itself is not able to do it due to many reasons (I know of only 1 acquiring bank managing everything inhouse, although I think there are more and that system is Barclays EPDQ), however there must be a direct relationship in between the bank and the merchant and merchants must be on separate MIDs (Merchant IDs, some call them merchant accounts).

There are no exceptions by Visa bylaws and regulations.

Well let me rephrase it, untill a year ago or when was it, there WERE no exceptions.

The reason behind it is very simple , no body in most of the countries of the world (the tribe of hannibals on the island of Lu-Lu is an exception, however their neighbours hannibals from the island of Ku-Ku are adopting bank licenses already :D ) is allowed to operate with third parties moneys unless than body is licensed as a bank in case the funds come from general public or have a limited license if the funds originate from prewritten in the license origins like exact companies which will send them.

The exception however exists in the general laws that if the body is just passing through funds of third parties without ANY interference with them it is allowed to operate without license. I.E. if the company just gets the funds from bank for its clients it is ok. The following applies to Europe where we payed quite a lot to worlds 4th largest legal company for the research on this subject.

However the company may not create or mantain accounts. This is called that funds on DEMAND are prohibited without license.

It is quite complicated. Read it three times to get some understanding of it.
:D
So third party billing companies BY LAW are allowed to exist only as money transfering companies however they do not fit into the processing chain because unless licensed as a bank they will not be able to be plugged into VISA NET directly and therefore will never have a possibility to mantain separate accounts of their own for merchants.

I'll make it simplier - the legal bodies which aggregate clients transactions and route transactions to the VISA NET and make the processing itself (i.e. take the money from the card, put the money on to the merchant account, transfer it further or block it or hold it or whatever) exist and are called acquiring banks.

For a majority of such operations the body has to be either the bank or be licensed as a bank BY LAW and not by Visa regulations.

While the internet evolved the banks were not ready themselves to play by the rules. They still are not ready.
The process of getting a merchant account is still quite complicated.

So nobody cared about companies processing in breach with rules and sometimes law (take PayPal for example or all systems of e-money) because it helped the net to evolve.

However now it has to be fit into normal laws which essentially is good for everyone. When You have a direct relationship with a bank You are protected by LAW that You will in fact see Your money if You are pornographer or not. And everyone else is protected by LAW that if You fuck up it will be You who is liable and not everyone else around You. Of course the bank will not smile to You saying "Hey! You do porn! You're a great client!" but that is the price You got to pay for making more money than the rest of dudes around You - that is normal.

As for IPSP regulations - they are just a way to at least normalise somehow the situation, billing companies have to go away, but slowly without scandals and publicity and other things which can hurt the e-commerce too much and throw it back to the stone age.

The IPSP regulations in fact have been applied only at two acquirers in fact (may be I am wrong here). At FDMS and PAGO in Germany to the existing huge aggregators (Ibill and so on). However they were forced straight away from PAGO and this stuff now is active only at FDMS.

The funny stuff is the following thing which has occured: There is NO other acquiring bank in the world I think now which will require You to get VISA approval prior processing for each URL on Your own merchant account and that is FDMS (through their sales body CardServiceInt). That's right. If You apply for Your own merchant account in FDMS through CardServiceInt You will have to send in just the same way as on Ibill for example all Your URLs prior processing to VISA for approval. The approval takes 1 month by the way.

In all other acquiring banks in the world You get Your merchant account for Your company and run as many sites under it as You want, as long as they are Your sites, You may only be required to show them from time to time.

As I said already - the descrimination laws are quite a serious thing to consider.

And of course You can NOT setup a new IPSP. You cant do it correct or incorrect - it's impossible because there is simply no such thing as IPSP towards other companies than Ibill, CCBill and Epoch. May be Verotel recently as well.

I know about SG & FDMS and the way IPSPs are setuped , I also know that recently a very powerfull team including CEO in the near past of the biggest of those billing companies has applied to SG & FDMS for a new IPSP account and of course were declined. The stuff applies only to existing companies which are too big to be shut down immediately at least in FDMS in USA, as You know in PAGO it happened very easily.

KK do You stand for KimmyKim excuse me for my ignorance? If so I know of Your obsession (in the good sense of the word) with IPSP rules, we even met couple of times in debates on this subject on GFY, my nickname there is "Incognito". When You were in CCBill I didnt like Your approach so I might have been a bit too rude, please excuse me, because I thought it was just ignorant promotion of CCBill, however when You quit that company I have changed my mind because I understood that You are simply very very interested in the subject.

By the way I have those rules , a copy of IPSP rules from VisaInt , London on my computer.

So whenever You are trying to understand what is right or what is wrong just look on the following chaing again:

Issuing Bank - VisaNet - Acquiring Bank - PSP - Merchant - Customer.

It is the only correct chain.
And whenever You apply for a merchant account , if it's NOT for adult , be sure that the body claiming that it is an Acquirer is indeed and Acquiring Bank.

There is a shit load of fraud right now on the net because so many people look for merchant accounts with no real understanding of how the stuff really is that everything is possible.
:)

For adult though, in most cases now, the link looks like:
Issuing Bank - VisaNet - Acquiring Bank - SomeBullshit - PSP - Merchant - Customer.

Where SomeBullshit is a company which belongs to the Acquiring Bank and is happilly called either a gateway or a designated bank processor or some other word or a PSP. The Banks are scared to open real direct merchant accounts right now so they put a company in between and open Your merchant account in that company so You dont have direct relationship.

It's completely off the rules book as well however at this moment it's not really dangerous cause Visa doesnt seem to complain about it as long as merchants go on separate merchant accounts whomever holds them and it's the bank which is behind it anyway so everything is fine. That's what they now do in offshore banks acquirers and in Israel.
The only thing You have to be sure of is that it is indeed the banks establishment. Because there are a lot of frauders there. Examples of popular frauders:
Ecommerce Services UK , QwikPay, CEE KEy, EdenCom.

An easy way to find out is simply if You see the bank name somewhere in the process of running that merchant account. There always is a contract of SOME sort or an application to the bank or contact with the bank even if the merchant account is opened in this intermediary company.
Companies like Ecommerce Services UK open You a merchant account in their own gateway and DO NOT let You see the bank behind it. If WHEN You are approved (prior to approval a lot of companies hide the bank name, although some do not) You find out that You are not allowed to see ANY bank at all in Your processing - it's fraud.

Also dont be suprised that frauders often areserious employees of banks, acquirers , known billing companies (Epoch, Ibill, CCbill as well) in the past of present.

One of the worst frauders for example WAS Edencom from France. Edencom processed for a shit load of russian lolita paysites year ago. Most of smaller billing companies were plugged into it (like BillCards, just smaller)

Know what?

The person who was forwarding webmasters (russian as well) to Edencom, an intermediary between Edencom and other dudes is a CURRENT employee in the Netherlands of a very respected acquirer from Sweden - Netgiro.
The guys who worked in Edencom were all previous employees in Coca-Cola.

As I said the best way to see if it's fraud or not - if they allow You to see the bank.

In normal e-commerce , non adult, there is a lot of similar fraud as well.
There is a shit load of PSPs plugged in to other PSPs and so forth. Which is not allowed as well.
In normal e-commerce the chain is very simple and looks only like this:

Issuing Bank - VisaNet - Acquiring Bank - PSP - Merchant - Customer.

Whatever is in between means charging You more money and against the rules.

Hope I was helpfull.
Again if anybody wants to share experience, lets do it.
:D[/b][/quote]
Serge thanks for the new recruit. I like this guy.
He dont act like hes got some mystical processing powers!.

Post away RedEye!! I dare say we all are interested in this topic.

RedEye i love all this information and it is a learning experience for me. Thank you so much for posting it.

I have my own merchant account which I use for non adult. Would it be a good idea to start looking into processing some of my adult transactions through it or not? My bank didn't mention anything about Adult transactions at all and I don't want to mention it to them.

That depends on where Your merchant account is and what volume.
But generally - no. It's not a good idea.

Each transaction is supposed to carry an MCC code, which is a descriptor code showing VISA what product was purchased.

Adult has it's own code (who remembers it? 5567 or some shit like that) and processing adult transactions on a different code is a violation so You'd have to talk to bank first.

However it depends on the bank and Your relations with them and the volume You have in adult.

If You know them for years and Your volume is around 50 000$ a month or so , not half a million You know, chances are they wont give a fuck about VISA rules cause nobody but them is going to notice it ever.

A guy I know has a rape fantasy site for 5 years in USA. One of the first sites like that in the net. He was kicked out from Ibill and CCBill and Paypal but he always used them secondary and processes his primary sales FOR FIVE YEARS already through his own USA merchant account and I doubt that unless FBI will come anyone ever going to stop him from the bank side.

But You will have to ask the bank. Dont do it without asking.
For sure. Cause the gateway and the bank will probably see what kind of transactions You have pretty soon and for sure when chargebacks come.

But generally I know quite a lot of people who process their own adult sites on non adult merchant accounts.

At the same time some acquirers are obsessive about it.

By the way , this MCC Code stuff, is the main problem of all gaming merchants. VISA will kick Your ass worse than if You sell child pornography featuring Ben Laden if You run a gaming site with generic MCC code because in this case US gamers are able to play, which they are not supposed to because US banks block gaming transactions right by that code.

Wasn't KimmyKim supposed to come in here and pick all of this to pieces?

:agrin:

Of course it's definetely not a good idea to do anything like that in an acquirer like CSI (FDMS) where VISA stays at day and night with a SWAT team ready for intrusion.
:D
There though it's gonna be relatively easy to change the merchant account to adult MCC coding.

By the way, does anybody know how is it possible to put different MMC codes on one merchant account? It must be possible, because in the system as far as I know the code applies to a transaction, not to the whole merchant account.

:D

Nice info Redeye - Good reading... reminds me of the old ynot and netpond days.... (small tear runs down my chin)


Anywho... since you seem to know your stuff about this I have a few questions/corrections for you.

1. PBS in Denmark, you say they are still open for adult transactions right?
- They are not. PBS Do process for adult still but its only for Dankort which is like a danish Amex. VISA/Mastercard was taken down this year.

2. This is a question.
- I know that Interpay the dutch gateway, which supposely are owned by Mastercard and some dutch banks are putting off processing for their adult merchants if you run sites such as pissing, bondage etc in that niche.
And this is not a ruling by VISA but by InterPay itself. Is there any truth to this?

3. It has been said that InterPay will stop all adult merchants that process bestiality in the first months of 04, that's atleast the rumours. The other rumours are they wont as they are affraid of lawsuits, which one is it?

I have more questions, but it's late here and I need my beauty sleep lol.

So hopefully you have answered my questions by the time I return.



Last edited by Mystery Man at Dec 7 2003, 09:25 PM

I hate posting on forums about existing companies.
I'm not sure if it was said, but I run a lot of things including Russia's largest adult webmaster board , Serge reffered to it once - Krutop.

I already had a bad experience trying to setup cc processing in Russia when I came in to the biggest Russian acquirer (huge bank, big even by western standarts, the main promoter of VISA in Russia) to the vice head of E-Commerce department and have been speaking for 30 minutes about processing opportunities , our dutch companies, been trying to explain what "high risk commerce" means and when I went on to the subject of IPSP rules in USA, this vice head of e-commerce whom I never met before, suddenly said

"Yep I read about this IPSP stuff. Somewhere on Crutop. Hello RedEye."
:zoinks:

Anyway, back to subject:

1. I never said PBS does adult. Quite on the contrary.
PBS doesnt do adult for already several years after one of three big billing companies in USA fucked them for millions and millions.

2 & 3. You got it all wrong a bit.
InterPay Nederlands is not a gateway. "Gateway" usually means Payment Service Provider (PSP). InterPay Nederlands is not exactly a payment service provider , :D , it is one of a few largest acquiring banks in Europe. InterPay is owned by dutch banks including ABN Amro and ING which are among top 20 banks in the world.
InterPay is a sole representative of MasterCard in Netherlands and is a major co-owner of MasterCard Europe.

Sometimes when MasterCard comes somewhere officially to establish processing it's the InterPay which really comes.

There are several gateways (PSPs) plugged into InterPay at this moment of which only 1 officially allows adult and that is vxsbill.com which is Your best way to InterPay. There is one other , which is the largest non adult PSP in Europe and it is Ogone.nl, company mentioned along with Bibit in the e-commerce researches of the European Bank which issues Euros, I dont remember it's name, Ogone and Bibit are huge guys, if I am correct Ibill & CCBill are much smaller, but Ogone will take Your merchant account on their gateway only on a very strict case per case basis, although it has been done before. In any case You need Your own merchant account in InterPay which is again difficult to get unless You are dutch.

InterPay has a problem that most of it's adult clients are extreme sites, the problem comes from a very simple fact that InterPay is Dutch and in Netherlands almost all kinds of porn are legal. Therefore the first guys who got problems with processing during these years all went there (zoo, rape , incest and so on).

Generally InterPay does not like porn either. Being dutch does not make them porn lovers You know. In fact they dont love e-commerce too much as well.

They also have as client one of known third party billing companies out there , so together with vxs dudes , who are quite nice by the way if You are nice Yourself, they got it all shared over there and would not like any extra attention, this is one other reason they hate extreme sites. And more or less it's quite natural they dont want anyone to get into their small kingdom.

The problem lies also in the fact that Netherlands is a very legal country so to say. It's the home of Haag, headquarters of law in Europe. If the extreme sites are legal there it is very difficult to cancel services for them due to the fact that InterPay is a monopolist in Netherlands and has enough of bad publicity about that. Besides that, Netherlands is a very small country. Basicly InterPay has a few webmasters who use them whom InterPay and the "kingdom" around it hates (as any kingdom , kings like people to crawl, and hate those who refuse) but is still not able to cancell them. So they have the same game VISA has with Ibill and CCBill - just smaller. Making new rules every day, which probably makes the life in Netherlands less boring for all of them.
:D :D :D

Whom the rules come from by the way, them or VISA/MC is always very difficult to tell.
You have to understand that VISA/MC are membership organisations. Nobody has direct relationships with VISA but acquirers. Acquirers have NDAs with VISA and therefore are never able to release any information which passes in between VISA/MC and the acquirer. That's the answer by the way on the question "why nobody ever saw god damn VISA rules :D we all heard so much about".

To summarise I'd say that InterPay is the best rock solid solution one can find for a direct merchant account for adult these days. However Your acceptance there purely relies if people there like You. Your volume does not matter there unlike other places since InterPay or VXS do not want to have 100 000 000 from adult by tomorrow. They have enough already.

You will not be able to play games like dutch guys do with extreme sites and laws about them, because You are not dutch. Laws do exist and for a dutch person their authorities may indeed prosecute whomever they want to for breaking those laws. This does not include foreigners in the majority of cases with minor exceptions .
:D

By the way, one thing I wanted to add.

You dont have to be mad on the billing companies always behaving like Credit Card processing is some secret science magic which can not be explained to mere mortals , the Gandalf way of talking.
:D :D :D

The problem is that in the Acquiring banks themselves quite often employees can not figure out what the fuck this rule means and what the fuck that and which one applies and which one doesnt.

We couple of times called to Visa London to the department which issued IPSP rules. Beleive it or not , since the person who signed those rules was unavailable, they coulnt find a single living soul to explain ANYTHING.
:D
Although I spoke to several risk management department managers, to VISA CEMEA and EU reps and this kind of people. And You have to understand - that headquarters for fucks sake!

So what do You want?

Ibill CEO or Epoch CEO coming out here saying: "Hey guys! I got no FUCKING idea what they mean by "principal" , where the fuck Cyprus and Gibraltar are located according to them, what the fuck is 3D Secure and how the fucking hell we now calculate chargebacks according to the latest rules and regulations. Excuse me for not knowing this shit. By the fucking way, guys where should I keep Your 80 million? My top pick is BNP ParisBas guys, but Serge called and said their fees are crap so now what ?"

Remember how Epoch and Ibill did press releases how they gonna run transactions on Verify by Visa and never did? Well...take a hint...

But it's impossible to blame them for it, cause they are not the people who are supposed get the rules and explain them from card associations.

3rd party processing may evolve into "ticketmaster" type companies due to new rules by VISA/MC, which would also solve alot of the problems ahead (banking rules, VAT/sales taxes, and content laws), but the "ticketmaster" processing will have greater risk of getting closed if they have rotten apples + it will take options away from site owners.

VISA/MC wants too know who they are doing business with... The games which have been played the last 3-4 years will end. VISA/MC might work slow at times, but they are getting there. However that doesn´t mean that we will see the last of those who will push the rules, which will make it harder for all of us.

Some excellent infor here welcome to the gumbo, Redeye... B)

HAHAHAH Yea right!

1. The ticketmaster type of registration if I am not mistaken is bs, just the same as "third party billing" in relation to VISA rules.

The point is very clear - You can not aggregate transactions which belong to different clients into one merchant account.

You are free so to say to develop ticket software being used by many clients, but each client will have to have a separate merchant ID.

The same applies to all virtual money systems (PayPal, E-Gold).

Moreover, on virtual money systems while they still exist the appropriate MCC codes must be applied at this moment on submerchants.

All systems that are working like claming that for example several sites of different clients are in fact theirs or that they sell tickets for access or that their clients are their providers and they are distributors have one drawback - as long as they publicly (via website) get their clients, it's against the rules.

2. VISA/MC does not want to know each merchant. Thats not entirely correct. Why should they want to know? They are a membership type of organisation for a good reason. :D Unprofitable by the way , as far as the russian sites says (all money invested into further development). I dont think anyone being ok in the head will ever want to have a beautifull chance of looking through and making due diligence on 100 000 porn paysites. :D

They just want each acquiring bank to know each of their merchants. That's one of the things they get payed for. "Know Your client" and stuff...
:D

The exception is IPSP with FDMS exactly because VISA didnt like the way FDMS used to know each of their clients.
:D



Last edited by RedEye at Dec 8 2003, 06:31 AM

I could forsee more complex solutions, then just doing the same as 3rd party billers do today, and then call it "ticketmaster". You are right about it not being a good solution, but if/when 3rd party processors will be pushed, then this will be the next logic step, if they were to try and survive.

Because of stories like this:

http://news.com.com/2100-1023-244881.html

Yes, I´m sure that the VISA/MC board members do not sit around surfing adult sites (well some of them might in their own private time), but acquiring banks do need a place to share information...

that IS my mantra and the wisest of words.

redeye, i believe cardservice now has wells fargo as an acquiring bank as well. although it may only be for their nonadult customers.

Is this a VISA USA rule or VISA Int'l too?


RedEye, have you heard of a company called TranSecure?

Is this a VISA USA rule or VISA Int'l too?


RedEye, have you heard of a company called TranSecure?[/b][/quote]
1. There is a constant mislead here according to forums as I understand it. You probably meant VISA USA and VISA EU.

Because I beleive VISA USA just as VISA EU are all just parts of an association called Visa International Service Association headquartered in London.

Check out yourself, lost 2 minutes to find anything on topic on the USA site:
http://usa.visa.com/personal/legal/?it=ft_...personal/legal/

Visa Int rules apply to all regional VISAs beleive it or not. Quite a shock ain't it?
There are no 2 Visas.
There are 6 regions though (USA, EU, CEMEA and so on, I dont remember the rest of them).

Eeach region has it's own association of bankers members of VISA who represent the region and combined are 21 000 of VISA members in the world.

The rules are confidential and are open only to the members of VISA which are issuing and acquiring banks.

The merchant receives only the rules of the bank he uses which are based on the rules of VISA/MC and does not have any direct relationship with VISA.

Are the rules the same in between regions between acquirers and VISA? Most probably some are and some are not. My guess is that all e-commerce rules are the same because the real region is the same (internet). In one region the rules MUST be the same otherwise there is a constant danger of the same story which happened in USA when VISA was sued for millions of USD by Keymart or Walmart.

Therefore if a certain ipsp claims that "ticket system" is OK according to the VisaInt rules we have to assume that their acquing banks contract allows this kind of operation and their bank has different rules than US banks do and have no way to check or say otherwise. However if in the same region the rest of acquirers present another version of the rules You can guess it all Yourself.

Speaking about the rules themselves, there are no rules I ever saw prohibiting "third party billing" or "ticket billing systems" or "virtual money" or "supplier - distributor system",
the rule I saw was pretty clear: it is strictly forbidden to run transactions on behalf of other merchants through Your merchant account. Another thing I saw is that the rule along with cross boarding acquring prohibition rule (hello Kimmy! :D) is applied world wide.

It doesnt matter how You name it. If You run transactions for third parties through an aggregate merchant account call it whatever You wish - it is forbidden.
Nobody will forbid You making an online store of tickets to the local theaters or cinemas. No one will forbid You to lease Your billing software (if it's authorised by a real PSP of the bank) to separate merchants, no one will forbid You to make a website for selling programs developed by independent programmers, but if You build a commercial system based on the accepting card payments from other merchants through Your merchant account, whatever name You give it - it is forbidden.

Sometimes the rules are really different as it seems. For example I doubt that in USA any acquirer has it's own chargeback ratio with rules applied to it. I beleive it's strictly on per merchant case.

When in Russia the acquirer itself seems to have it's own chargeback allowed ratios and is itself at risk if it's clients go over thresholds.

2. Never heard about TranSecure.

Thanks for the response RedEye. Definitely one of the more informative threads out there.

What about this scenario:

You say "it is forbidden to run transactions for a third party through an aggregate merchant account".

What if company A loses its merchant accounts, it goes to company B and says "hey, run my transactions and I'll make a side deal to give you a small percentage on the back end".

Thus it looks like the site(s) of Company A are now under the "ownership" of company B. Yet they are really just under the "processing umbrella" of company B.

I guess neither Visa nor the acquiring banks can really police the "aggregating of 3rd party transactions".even if they track the ownership of each individual url.

I mean to comment on it, but its alot of stuff to read and I've been superbusy all weekend and playing catchup today. Soon tho.

Let me explain.

The processing in the world slowly but seriously moves towards a new protocol of acquiring transactions. The protocol is called 3D Secure.

Basicly as I understand it it's the same as Verify By Visa with the exception that the password for internet purchases by customer is being kept by the customer's bank.

All banks are recommended to support it.

I'll explain.

For example Your bank is Barclays Bank and You have a credit card of that bank. Now Barclays is supposed to contact You and offer You to input a special password for internet purchases on their website. The password is being kept only at their site.

At the time You attempt a purchase in the system which is connected through 3D Secure You will be required to enter the password and it will be matched directly with Your bank.

Therefore it is very difficult to fraud with this protocol because basicly in the majority of cases one would need to hack banks websites to get passwords.

Then the so-called "liability shift" occures. If later You attempt to make a chargeback more than half attempts will be declined and the merchant and the acquirer, and the PSP of course, are no longer liable for chargebacks. To be exact if You say "It was not me" the bank will no longer approve the chargeback.

The most interesting thing is what happens if Your bank does not support 3D Secure but the transaction went through that protocol. I.E. If the PSP has 3D Secure but Your bank doesnt the PSP will still make the transaction the old way but the shift occures anyway and the merchant if he is connected through such PSP is not liable for chargebacks. Why? Because generally it costs 20-30K $ and a couple of monthes for a bank to install 3D Secure and everyone was supposed to do it a year ago, so technically they are reliable for not supporting it.

However, just as with Verify by Visa these protocols seem not to support recurring charges at this time , at least not from the side of processor or PSP. The acquirer MIGHT have a difficult possibility to run recurring payments with 3D Secure but as of yet it's a rumour.

Although 3D Secure is quite new, so not too much is known about it.[/b][/quote]
Redeye, great posts mate, except your last statement about how it makes it very difficult to fraud with credit cards using 3dsecure.

Can't this still be done : And if the answer is "yes" then chargebacks will still be done as usual.

1. I build a fake join page on my site that has all the same info as 3dsecure and looks and acts to the user as if it was a normal page, it pops up the 3dsecure page info and all the rest and requests the user to input his 3dsecure "password". All that data is then sent to a relay via form and then to my email address.

So if this is possible as it surely is right now what is 3dsecure really going to change?

Thanks a lot for all the info Redeye thats great stuff man



Last edited by Driven at Dec 8 2003, 09:49 PM

Just reread my post, sorry didn't mean to say that your post was wrong or bad, but it came out that way oops :)

Just interested as i've never seen 3dsecure and because of the ability to build fake websites to look just like any normal legit website I thought it would be super easy to keep stealing credit cards and because cards are easily stolen along with passwords it wouldn't allow chargebacks to be denied.

Wow fantastic reading i'm glued to this stuff and have read almost every word.