Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why do credit card forms ask for Visa, Mastercard, etc.?

ux.stackexchange.com

Post reply on HN
Print view View original

61–70 of 99 posts

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#61

Post by pkteison »

wcfields wrote: post #2

Could someone who deals with PCI compliance please explain some other nuances of credit cards that I've been curious about: * Fault/Decline Codes returned from processors like CyberSource. How are these factored? How do processors do Regex on names/addresses? [1][2] * CVV numbers and what they mean/how they are treated in the system? If CVV number is included does this increase chargeback protection? * How CHIP cards…

1a) Varies by issuing bank. Your processor sends the transaction viaVisa & MasterCard ("network") which passes along the transaction to the issuer (a large bank), which in turn decided to approve or decline the transaction and passes back a code. Your processor may map that specific code to a more general code, which behavior will often vary per client - some clients just want to get back "Declined" while some want "Invalid expiration date". Unfortunately since decline code behavior varies -by issuer-, it's possible to get back wrong codes, so you can't trust them really. For example, you might see a Mastercard with an invalid zipcode come back as invalid expiration date, while another mastercard with an invalid zipcode comes back with invalid AVS. Then if you present "invalid expiration date" to your end user, they will be confused because the expiration date is fine. In my experience, detailed decline codes are more trouble than they're worth, the customer will have to call their bank to fix anything regardless so just tell them declined - call bank.

1b) Numbers only. See for example http://en.wikipedia.org/wiki/Address_Verification_System and understand that "street address" just means whatever numbers are there at the beginning of the address. Also understand that this is frequently incredibly low quality data, all you can really rely on is the zipcode match part, trying to do any better will result in a lot of false negatives.

2) There are multiple names for this. In the beginning, on mag stripes, CVV/CVC (name varies by network) was developed and it was a way to validate that somebody didn't build a mag stripe based on just knowing the card numbers - it's data that exists only on the mag stripe and is not printed on the card. Then, CVV2/CVC2/CID/etc was developed and it is a way to validate that somebody has seen the actual card - it is data that is printed on the card but is not in the stripe. People usually don't know about the difference and are talking about CVV2/CVC2 when they say CVV or CVC. The key thing that makes this work is that merchants are restricted from storing the CVV2/CVC2/CID data (and they already weren't supposed to store mag stripes, so CVV/CVC also), so if somebody gets a database dump of a bunch of credit cards it shouldn't have CVV2/CVC2 data in it. It also doesn't come for free from an automated skimmer because it isn't on the mag stripe. And, way back in the day, it wouldn't have been on the carbon copies because it was in flat type. So, this really does add some security to a transaction. So what it does for chargeback protection is make it more likely that you are dealing with someone who physically has the card in front of them, because that little bit of data is harder to steal than the other bits of data. It still doesn't let you win a chargeback - for that, you need a signature, which you won't have if you're doing ecommerce, so you'll lose. It just makes the chargeback less likely in the first place.

Additionally, if you are classified as doing ecommerce, some issuers will simply decline any transaction that doesn't have CVV2/CVC2. Varies by merchant category and by issuer.

3) Don't know, I processed cards in America. Debit cards when used with PIN have a completely different technology behind their security, and a completely different set of laws covering them than credit cards do, but I don't know about chip-and-pin.

4) Don't know, because Internet.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#62

Post by 1337Coder »

If anyone is curious about the luhn algorithm, here is one I made in C# from the example in the question:

static bool IsValidLuhn(string numbers) { if (numbers == null) throw new ArgumentNullException("number", "number must have a value.");

var allNumbers = numbers .Where((c) => c >= '0' && c (i % 2 == 1) ? ((Convert.ToInt32(c) - 48) * 2).ToString() : c.ToString());

return allNumbers.Count() > 0 ? allNumbers.Aggregate((x, y) => x + y).Sum((c) => Convert.ToInt32(c) - 48) % 10 == 0 : false; }

Edit: Can sum one link me to HackerNews markdown?

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#63

Post by bigd »

kevinconroy wrote: post #29
michaelt wrote: post #19

Earlier quoted context omitted.

Can I piggyback on this and ask an unrelated question I'm curious about? Let's say an online merchant gets a transaction they very strongly suspect is a stolen credit card (perhaps it's from a customer with a long history of using stolen cards) but it validates just fine. Is there any provision in the interface for merchants to ask the credit card company to perform extra fraud checks, like calling the cardholder?

No, there are no such provisions. The card companies have their own fraud prevention/detection departments which mine transactions and look for abnormal behavior. If they spot something out of the ordinary (big purchase, foreign purchase, etc) then they will call you to validate.

Which is why, every time I travel, I end up with all the cards blocked. I hate you visa.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#64

Post by dsl »

Domenic_S wrote: post #8

I'd like to see an A/B test between the 2 options. It sounds plausible that a less-sophisticated buyer might see the Visa logo light up after they've typed the first digit of their card and get confused ("WHAT WITCHCRAFT IS THIS").

Conversion rate isn't the only thing you optimize for. I helped a company reduce its fraud/chargeback rate by asking for the type of card without error correction. A type mismatch was one of a dozen or so scoring items that, if over a specific threshold, tripped a second level of verification.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#65

Post by mjwhansen »

Domenic_S wrote: post #8

I'd like to see an A/B test between the 2 options. It sounds plausible that a less-sophisticated buyer might see the Visa logo light up after they've typed the first digit of their card and get confused ("WHAT WITCHCRAFT IS THIS").

Unfortunately I don't have a linkable source for this, but the Democratic fundraising platform ActBlue gave a talk on A/B testing donation forms and it turns out that when they removed the "select card type" field, donations went -way- down. You'd think that the Law of Forms would apply (fewer fields = higher conversions), but it doesn't. Apparently people assumed that there was something wrong with the form and therefore didn't trust it (when they removed that field, they also had a huge uptick in people submitting reports of things wrong with the form).

I'm hoping someone from ActBlue's dev team sees this and can jump in. They run a lot of fascinating tests on credit card forms.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#66

Post by mjwhansen »

kevinconroy wrote: post #29
michaelt wrote: post #19

Earlier quoted context omitted.

Can I piggyback on this and ask an unrelated question I'm curious about? Let's say an online merchant gets a transaction they very strongly suspect is a stolen credit card (perhaps it's from a customer with a long history of using stolen cards) but it validates just fine. Is there any provision in the interface for merchants to ask the credit card company to perform extra fraud checks, like calling the cardholder?

No, there are no such provisions. The card companies have their own fraud prevention/detection departments which mine transactions and look for abnormal behavior. If they spot something out of the ordinary (big purchase, foreign purchase, etc) then they will call you to validate.

Anecdote: I used to work with donation processing, and we had a situation where we had transactions that I knew we're identity theft (email addresses were the same, IP the same, but zip, CVV, name correct, and all submitted in a short timeframe). I refunded the transactions and called the banks to report that the cards had been stolen, and the banks basically threw their hands up in the air.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#67

Post by bjconlan »

1337Coder wrote: post #62

If anyone is curious about the luhn algorithm, here is one I made in C# from the example in the question: static bool IsValidLuhn(string numbers) { if (numbers == null) throw new ArgumentNullException("number", "number must have a value."); var allNumbers = numbers .Where((c) => c >= '0' && c (i % 2 == 1) ? ((Convert.ToInt32(c) - 48) * 2).ToString() : c.ToString()); return allNumbers.Count() > 0 ? allNumbers.Aggregat…

I also did one in javascript (i've requested it be ammended to the accepted response but we'll see how it reviews) anyway here it is:

  function validateCC(ccNumber) {
    var ccNumber = ccNumber.replace(/ /g, '');

    console.log(
      /^3[4|7]\d{13}/.test(ccNumber) ? 'AMEX' :
      /^6011\d{12}/.test(ccNumber) ? 'Discover' :
      /^5[1-5]\d{14}/.test(ccNumber) ? 'MasterCard' :
      /^4[\d{12}|\d{15}]/.test(ccNumber) ? 'Visa' : 'Unknown',
      ccNumber,
      ccNumber.split('').reverse()
        .map(function (v, i) { return v * (1 + i % 2) })
        .reduce(function (agg, v) { return agg + v; }, '').split('')
        .reduce(function (agg, v) { return agg + +v; }, 0) % 10 === 0 ? '(valid)' : '(invalid)');
  }
btw to markup simply append 2 spaces to the front of the newline

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#68

Post by pbreit »

danmanstx wrote: post #18
pbreit wrote: post #12

Earlier quoted context omitted.

Not taking Amex for cost reasons is almost always a bad move. First, it annoys the person giving you money (always a bad move). Second, Amex cardholder spend way more than average (frequently a bad move). They may still spend as much when asked to use Visa instead, but maybe not.

We do stress that point, that the barrier to donate should be as low as possible. Still, some churches go as far to say donations can't/shouldn't be made on credit do to their individual beliefs, and would only take ACH transfers as they pull directly from a bank account.

Merchants are now seeing a lot of payments by debit card which are not loans (direclty out of bank account). And there are still a lot of Amex cards out there that require full payment each month which is not really a loan.

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#69

Post by pbreit »

michaelt wrote: post #19
pbreit wrote: post #7

Earlier quoted context omitted.

Checks are typically very simple, no regex-ing involved. First, names are not really checked. For addresses, usually only the number (and sometimes just first three digits) are checked as well as the zip. Generally the processor tries to decline as few txns as possible and instead deliver the information to the merchant to make a decision. The merchant can usually pre-configure error codes that it would like the proc…

Can I piggyback on this and ask an unrelated question I'm curious about? Let's say an online merchant gets a transaction they very strongly suspect is a stolen credit card (perhaps it's from a customer with a long history of using stolen cards) but it validates just fine. Is there any provision in the interface for merchants to ask the credit card company to perform extra fraud checks, like calling the cardholder?

Can't resist a shout out for a friend's new company that makes a lot of sense: http://chargeback.com (outsourced chargeback handling).

Re: Why do credit card forms ask for Visa, Mastercard, etc.?

#70

Post by pbreit »

thomaslangston wrote: post #36
henrikschroder wrote: post #22

Earlier quoted context omitted.

> charge more for missing or incorrect CVVs. Wait, what? Can transactions still go through without the CVV, except the merchant's transaction fee is a bit higher? They're just not declined outright?

Yes, the CVV is not required. If you think about it, it is obvious CCV isn't since many self-serve card swipe machines (gas stations, grocery stores, fast food restaurants) don't ask you for it.

CVV is unnecessary for offline payments because the physical card is being presented.
Post reply on HN