Click to show/hide contact information.

Loading...

PCI-DSS: Card Not Present - Overview

What to Know
Objectives

Completing the reading in this section will enable you to:

  • Safely and effectively process card-not-present transactions, including international and internet transactions.
  • Identify and successfully react to suspicious transactions.
Overview

Every day, the number of purchases conducted via mail, telephone, and internet increases. These transactions are significantly different from traditional in-store sales, in that neither the customer nor the credit card are present at the merchant location during the transaction, making it especially difficult to detect fraud.

Of necessity, card acceptance procedures for these “card-not-present” transactions are different from in-store, i.e. "card present" purchases. UCSC employees who conduct card-not-present transactions must exercise extreme caution and follow procedures precisely in order to verify — to the greatest extent possible — the cardholder’s identity and the validity of the purchase.

Many credit card processors require card-not-present merchants to ask customers for their Card Verification Value 2 (CVV2) number as an additional security measure.  See:  Security rules for additional information on CVV2 requirements.

This section covers basic card acceptance procedures for mail, telephone, and internet transactions. It also includes resources and best practices that all card-not-present merchants can use to prevent fraud and chargebacks.

Merchant web site requirements

The Payment Card Industry Standards require that certain content or features be included on your Web site. The following elements are intended to promote ease of use for online shoppers and reduce cardholder disputes and potential chargebacks.

Complete description of goods and services.

  • Remember you have a global market, which increases opportunities for unintended misunderstandings or miscommunications. For example, if you sell electrical goods, be sure to state voltage requirements, which vary around the world.

Customer service contact information.

  • This includes e-mail address and phone number. Online communication may not always be the most time-efficient or user-friendly for some customers. Including a customer service telephone number as well as an e-mail address promotes customer satisfaction.

Return, refund, and cancellation policy.

  • This policy must be clearly posted on the merchant Web site.

Delivery policy.

  • UCSC Merchants set their own policies about delivery of goods, that is, if they have any geographic or other restrictions on where or under what circumstances they provide delivery. Any restrictions on delivery must be clearly stated on the web site.

Country of origin.

  • The permanent address of your establishment must be listed on the web site including the street name, number, city, state, country, and zip code.
 
Best practices for the web

Suggested best practices for UCSC Merchant Web sites include:

  • Encourage cardholders to retain a copy of the transaction.
  • Indicate when credit cards are charged.
  • Provide order-fulfillment information.
    • State timeframes for order processing and send an e-mail confirmation and order summary within one business day of the original order.
    • Provide up-to-date stock information if an item is back-ordered.
  • Explicitly state customer service timeframes.
    • Ideally customer service e-mails or phone calls should be answered within two business days.
  • State directly on the main Web site which security controls are used to protect customers.
    • For instance, UCSC Merchants should clearly state that UCSC is PCI compliant.
Back to Code 10 Calls | On to Suspicious Transactions