Chapter 1

Introduction to the Credit Card Services

The CyberSource® Internet Commerce SuiteSM (ICS) processes financial transactions. This document explains how to use the CyberSource APIs to access the CyberSource ICS Credit Card Services.

Overview of Credit Card Services

The CyberSource Credit Card Services do the following:

•   Provide your business with secure, reliable, real-time credit card payment processing, without requiring you to develop and maintain a complex in-house infrastructure

•   Accept multiple card types in multiple currencies and allow you to connect with multiple banks and processors worldwide

•   Allow you to easily expand your overall order volume and handle seasonal order volume peaks

The CyberSource Credit Card Services are part of the Internet Commerce Suite, which includes electronic payment, fraud management, and verification services. The steps for using ICS services are:

1   You send a request that includes information about your company, the customer, and the services you want to use.

2   CyberSource sends you a reply with information about the services you requested.

3   You use the reply information to interpret the results of your request.

As a user of the CyberSource ICS services, you can use the Business Center, which offers a graphical interface for various functions, including:

•   Processing customers’ payments and credits

•   Viewing details about your transactions

•   Viewing and downloading reports—See Using the Reporting System on the Support Center for tutorials and documentation about CyberSource reports

After you register your merchant ID with CyberSource, you can use the test version of the Business Center at https://ebctest.cybersource.com. After you go live, you can also use the production version at https://ebc.cybersource.com. The username and password that you use to log in to either site is your merchant ID and the password you established when you registered the merchant ID with CyberSource. After you log in to the production or test version of the Business Center, click the Help button on any page for context-sensitive help.

Types of Cards

The CyberSource Credit Card Services can process these types of cards:

•   Credit cards—CyberSource can accept payments made with numerous types of credit cards, including Visa®, MasterCard®, Discover®, and American Express®. These include Visa-branded and MasterCard-branded debit cards, which are processed the same way as credit cards.

•   Private label cards—Private label cards are credit cards that can only be used at the issuing company’s own stores. If you are interested in using CyberSource to process transactions for your company’s private label card, contact your CyberSource account representative for more information.

Note You can process payments with PIN-less debit cards if your business is in one of the acceptable merchant categories where a card-not-present debit transaction is low risk. The categories include educational institutions, insurers, and utilities. Processing PIN-less debit cards is covered in the PIN-less Debit Card Services Implementation Guide.

MasterCard and Diners Club Alliance

In 2004, MasterCard and Diners Club announced an alliance that allows Diners Club cards to be processed as MasterCard cards. This alliance enables merchants who accept MasterCard to automatically accept Diners Club cards.

MasterCard cards have a 16-digit number that begins with 5. Diners Club has two types of cards:

•   Cards issued in North America by Diners Club North America have a 14-digit number that begins with either 30 or 38

•   Cards issued outside of North America by Diners Club International have a 14-digit number that begins with 36

By mid-2005, the Diners Club cards issued in North America were replaced with MasterCard cards, which have the 16-digit number starting with 5. If you process a North American Diners Club card that has a 14-digit number that begins with 30 or 38, the issuer will decline the authorization.

The Diners Club cards issued outside North America are not being replaced by MasterCard cards; they will continue to have the 14-digit number that begins with 36. If you are a merchant outside North America, you should continue to process these cards as Diners Club cards. However, if you are a North American merchant, you must now process these cards as MasterCard cards by setting the card type to MasterCard. It is your responsibility, as the merchant, to determine whether you should process a Diners Club card as a Diners Club card or as a MasterCard card.

CyberSource strongly recommends that you send the card type even if it is optional for your processor. Omitting the card type can cause the transaction to be processed with the wrong card type.

If you are a merchant outside North America, you do not need to change how you process MasterCard or Diners Club cards.

CyberSource Global Payment Service

The CyberSource Global Payment Service enables you to accept worldwide credit cards, such as Visa, MasterCard, and Diners Club, as well as certain regional and country-specific bank cards, such as Carte Bleue, Dankort, and Carta Si. For information about credit card reversals with the Global Payment Service, see Appendix J, Bank Card Reversals for the Global Payment Service.

The CyberSource Global Payment Service also enables you to accept other payment types, such as bank transfers and direct debits. For information about bank transfers and direct debits with the Global Payment Service, see the Global Payment Service Planning and User’s Guide, which is available on the Support Center.

Card-Present and Card-Not-Present Transactions

When a customer uses a credit card that is physically present to make a purchase, the purchase is known as a card-present transaction. This type of transaction typically occurs in a retail environment. To process card-present transactions:

• Use the Credit Card Services described in this implementation guide.

• Provide retail data as described in the API for Retail POS Transactions, which is available on the Support Center.

When a customer provides a credit card number, but you do not have access to the physical credit card, the purchase is known as a card-not-present transaction. This type of transaction typically occurs over the Internet or through a call center. To process card-not-present transactions, use the Credit Card Services described in this implementation guide.

Card-not-present transactions pose an additional level of risk to your business because you cannot directly verify the customer’s identification. CyberSource offers features in the Credit Card Services that can reduce that risk by checking the validity of the customer’s information and notifying you when discrepancies occur.

The Payment Industry

This section describes some of the companies in the payment industry and explains how to work with them to accept payments.

Acquiring (Merchant) Banks

An acquiring, or merchant, bank offers accounts to businesses that accept credit card payments. Before you can accept payments, you must have a merchant bank account from an acquiring bank. Your merchant bank account must be configured to process card-not-present or mail order/telephone order (MOTO) transactions.

Note Each acquiring bank has connections to a limited number of payment processors. You must choose a payment processor that your acquiring bank supports. See Payment Processors.

Expect to be charged these fees:

•   Your acquiring bank will charge a fee and collect a percentage of every transaction. The combination of the fee and the percentage is called the discount rate. These charges can be "bundled"—combined into a single charge—or "unbundled"—charged separately—depending on your acquiring bank and other factors.

•   Visa and MasterCard each have a base fee, called the interchange fee, for each type of transaction. Your acquiring bank and processor can explain how to minimize this fee.

•   If customers dispute charges to their accounts, you can incur chargebacks. A chargeback occurs when a charge on a customer’s account is reversed. Your merchant bank will remove the money from your account and could charge you a fee for the chargeback.

If you have a large number of chargebacks, or if a large number of your transactions involve fraud, your acquiring bank might increase your discount rate or revoke your merchant bank account. Contact CyberSource for information about CyberSource products that can help prevent fraud.

Issuing (Consumer) Banks

An issuing, or consumer, bank provides credit cards to and underwrites lines of credit for consumers. The issuing bank provides monthly statements and collects payments. Issuing banks must follow the rules of the credit card associations to which they belong.

Credit Card Associations

Credit card associations manage communications between acquiring banks and issuing banks. They also develop industry standards, support their brands, and establish fees for acquiring banks.

Some credit card associations, such as Visa and MasterCard, are not-for-profit trade associations. These associations do not issue cards; instead, issuing banks are members of the associations, and they issue cards under license from the associations.

Other card companies, such as Discover and American Express, act as the issuing banks for their own cards. Before you use CyberSource to process cards from these companies, you must sign agreements with the companies.

Payment Processors

Payment processors connect CyberSource servers with acquiring banks. Before you can accept payments, you must sign up with a payment processor. Your acquiring bank might require you to use a payment processor with which the bank has a business relationship.

CyberSource does not necessarily support all the features that are offered by each processor. This implementation guide describes the payment processing features supported by CyberSource. The beginning of each feature description specifies which payment processors support the feature.

Your processor will provide you with unique identification numbers for your account. You must provide these identification numbers to Customer Support.

The following table lists the processors and corresponding card types that CyberSource supports for credit card transactions.

Note Only the card types explicitly listed here are supported.

Processing a Credit Card Payment

Authorizing a Credit Card Payment

CyberSource supports authorizations for all processors.

When a customer places an order, you need to request a credit card authorization. The bank does not move money into your account until you capture the authorization and the capture is processed.

Online Authorization

Online authorization means that when you submit an order using a credit card, you receive an immediate confirmation about the availability of the funds. If the funds are available, the issuing bank reduces your customer’s open to buy, which is the amount of credit available on the card. Most of the common credit cards are processed online. For online authorizations, you will typically start the process of order fulfillment soon after you receive confirmation of the order.

Online authorizations expire with the issuing bank after a specific length of time if they have not been captured and settled. Most authorizations expire within five to seven days. The issuing bank determines the length of time.

Note CyberSource is not informed by the issuing bank when an authorization expires. By default, the authorization remains in the CyberSource system for 60 days after the authorization date, even if it has expired with the issuing bank.

If an authorization expires with the issuing bank, your bank or processor might require you to resubmit an authorization request and include a request for capture in the same message.

The following steps take place within seconds when you request an online credit card authorization:

Figure 1 Processing an Online Authorization

1   The customer places an order and provides the credit card number, the card expiration date, and other information about the card.

2   You send a request for authorization over a secure Internet connection. If the customer buys a digitally delivered product or service, you can request both the authorization and the capture at the same time. If the customer buys a physically fulfilled product, do not request the capture until you ship the product.

3   CyberSource validates the order information, then contacts your payment processor and requests authorization.

4   The processor sends the transaction to the card association, which routes it to the issuing bank for the customer’s credit card. Some card companies, including Discover and American Express, act as their own issuing banks.

5   The issuing bank approves or declines the request. Depending on the card type, the bank could also use the Address Verification Service (AVS) to determine whether the customer provided the correct billing address. For information about AVS, see Address Verification Service.

6   CyberSource runs its own tests, then tells you if the authorization succeeded.

Offline Authorization

Offline authorization means that when you submit an order using a credit card, you will not know if the funds are available until you capture the order and receive confirmation of payment. You typically will not ship the goods until you receive this payment confirmation.

Most of the credit cards processed with CyberSource are online cards; a few of the cards processed through the Global Payment Service are processed offline. For more information about these offline cards, see the Global Payment Service Planning and User’s Guide, which is available on the Support Center

For offline credit cards, it will take typically five days longer to receive payment confirmation than for online cards.

Authorization Information for Specific Processors

The following table provides additional information about authorizations for some processors.

Additional Information

See Authorizing a Credit Card Payment for the Simple Order API or Authorizing a Credit Card Payment for the SCMP API.

Reversing an Authorization

CyberSource supports full authorization reversals for these processors:

•   American Express Direct

•   American Express Phoenix

•   Barclays—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   CCS (CAFIS)

•   CyberSource Latin American Processing—Full authorization reversals:
- Are supported only for Visa and MasterCard.
- Must take place within 24 hours of the authorization.
- Are not guaranteed: CyberSource’s acceptance of your full authorization reversal request does not guarantee that CyberSource Latin American Processing will perform the reversal.

•   FDC Germany—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   FDMS Nashville—Visa only

•   FDMS South—Full authorization reversals are supported only for transactions that do not go through a currency conversion. The types of merchants and currencies that are supported are:
- Merchants located in the United States who authorize, settle, and fund in U.S. dollars.
- Merchants located in Canada who authorize, settle, and fund in Canadian dollars.
- Merchants located in Latin America or the Caribbean who authorize, settle, and fund in U.S. dollars.
- Merchants located in Europe who authorize, settle, and fund in the currency for the country in which the merchant is located.

•   GE Capital—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   GPN

•   HBoS—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   Lloyds-OmniPay—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   LloydsTSB Cardnet—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   Streamline—You are responsible for complying with the processor’s specific requirements for full authorization reversals. Contact the processor for more information.

•   TSYS Acquiring Solutions—Visa and MasterCard

The full authorization reversal service releases the hold that the authorization placed on the customer’s credit card funds. Use this service in exceptional situations to reverse an unnecessary or undesired authorization. You can use full authorization reversal only for an authorization that has not been captured and settled. The amount of the reversal must be the same as the amount of the authorization.

Note Each issuing bank has its own rules that determine whether a full authorization reversal succeeds. If your reversal fails, contact the issuing bank to determine if it is possible to perform the reversal by alternate means.

Additional Information

See Reversing an Authorization for the Simple Order API or Reversing an Authorization for the SCMP API.

Capturing an Authorization

CyberSource supports captures for all processors.

When you are ready to fulfill a customer’s order and transfer funds from the customer’s bank to your bank, capture the authorization for that order.

If you can fulfill only part of a customer’s order, do not capture the full amount of the authorization. Capture only the cost of the items that you ship. When you ship the remaining items, request a new authorization, then capture the new authorization.

Due to the potential delay between authorization and capture, the authorization might expire with the issuing bank before you request capture. Most authorizations expire within five to seven days. If an authorization expires with the issuing bank before you request the capture, your bank or processor might require you to resubmit an authorization request and include a request for capture in the same message.

Note CyberSource is not informed by the issuing bank when an authorization expires. By default, the authorization remains in the CyberSource system for 60 days after the authorization date, even if it has expired with the issuing bank.

Unlike authorizations, a capture does not happen in real time. All of the capture requests for a day are placed in a batch file and sent to the processor. In most cases, the batch is settled at night. It usually takes two to four days for your acquiring bank to deposit funds in your merchant bank account.

See Figure 2 for more information about processing a capture.

Automatic Partial Authorization Reversals

CyberSource supports automatic partial authorization reversals for these processors and card types:

If the capture amount is less than the authorization amount, CyberSource automatically performs a partial authorization reversal before it sends the capture request to the processor. The results of a successful partial authorization reversal are:

•   The settlement amount matches the new authorization amount.

•   The hold on the unused credit card funds might be released.

Note Not all issuers act on a request for a partial authorization reversal. Therefore CyberSource cannot guarantee that the funds will be released.

The automatic partial authorization feature can be enabled or disabled at your request. To do this, contact Customer Support.

Interchange Optimization

CyberSource offers automatic interchange optimization to merchants performing Visa transactions on GPN. This feature helps you reduce your interchange fees. Interchange optimization consists of:

•   Automatic authorization refresh—If the capture request occurs six days or more after the date of the original authorization, CyberSource automatically obtains a fresh authorization for the capture amount.

•   Automatic partial authorization reversal—If the capture does not need a fresh authorization but the capture amount is less than the authorization amount, CyberSource automatically performs a partial authorization reversal which releases the hold on unused credit card funds and ensures that the settlement amount matches the authorization amount.

To enable interchange optimization, call Customer Support to have your account configured for this feature.

Capture Information for Specific Processors

The following table provides additional information about captures for some processors.

Additional Information

See Capturing an Authorization for the Simple Order API or Capturing an Authorization for the SCMP API.

Crediting a Payment

CyberSource supports credits for all processors.

Request a credit when you need to give the customer a refund. When your request for a credit is successful, the issuing bank for the credit card takes money out of your merchant bank account and returns it to the customer. It usually takes two to four days for your acquiring bank to transfer funds from your merchant bank account.

Warning Carefully control access to this service to prevent unauthorized credits. Do not request this service directly from your customer interface. Instead, incorporate this service as part of your customer service process.

You can perform two types of credits:

•   Follow-on: A follow-on credit is linked to the original charge in the CyberSource system. You can request multiple follow-on credits against a single charge. You must request all follow-on credits within 60 days of the original charge.

•   Stand-alone: A stand-alone credit does not link the credit to a previous charge. There is no time limit for submitting stand-alone credits.

Credit requests are batched in the same manner as captures.

The following steps take place when you request a capture or credit:

Figure 2 Processing a Capture or Credit

1   You send a request for capture or credit over a secure Internet connection.

2   CyberSource validates the order information, then stores the capture or credit request in a batch file.

3   After midnight, CyberSource sends the batch file to your payment processor.

4   The processor settles the capture or credit request and transfers funds to the appropriate bank account.

Note The processor does not notify CyberSource if a transaction is declined. To make sure all captures and credits are processed, reconcile your system’s reports with the reports from your processor. See Reconciliation for more information.

Credit Information for Specific Processors

The following table provides additional information about credits for some processors.

Additional Information

See Crediting a Payment for the Simple Order API or Crediting a Payment for the SCMP API.

Voiding a Capture or Credit

CyberSource supports voids for all processors except:

•   CyberSource Global Payment Service

•   Lynk

Request a void when you want to cancel a capture or credit request that you have submitted to CyberSource. A transaction can be voided only if CyberSource has not already submitted the capture or credit information to your processor. Usually CyberSource submits that type of information to your processor once a day, so your window for successfully performing a void is small. CyberSource will decline your void request if the capture or credit information has already been sent to the processor.

When you void a transaction, the transaction is at the end of its life and cannot be the source of another follow-on capture or credit. For example, if you authorize and capture a transaction, and then you void the capture, you cannot submit another capture request that uses the authorization code or CyberSource request ID from the original authorization. If you still want to capture that transaction, you must re-authorize the transaction and capture the new authorization. You cannot perform a follow-on credit for a transaction that has been voided.

You cannot undo a void.

Additional Information

See Voiding a Capture or Credit for the Simple Order API or Voiding a Capture or Credit for the SCMP API.