1316 lines
76 KiB
Plaintext
1316 lines
76 KiB
Plaintext
Part one in a series of postings about the workings of the credit card
|
|
industry.
|
|
|
|
DEFINITIONS
|
|
-----------
|
|
|
|
First some terms, along with the meanings they have in the industry:
|
|
|
|
Cardholder - an individual to whom a credit card is issued. Typically,
|
|
this individual is also responsible for payment of all charges made
|
|
to that card. Corporate cards are an exception to this rule.
|
|
|
|
Card Issuer - an institution that issues credit cards to cardholders.
|
|
This institution is also responsible for billing the cardholder for
|
|
charges. Often abbreviated to "Issuer".
|
|
|
|
Card Accepter - an individual, organization, or corporation that
|
|
accepts credit cards as payment for merchandise or services. Often
|
|
abbreviated "Accepter" or "merchant".
|
|
|
|
Acquirer - an organization that collects (acquires) credit
|
|
authorization requests from Card Accepters and provides guarantees
|
|
of payment. Normally, this will be by agreement with the Issuer of
|
|
the card in question.
|
|
|
|
Many issuers are also acquirers. Some issuers allow other acquirers to
|
|
provide authorizations for them, under pre-agreed conditions. Other
|
|
issuers provide all their own authorizations.
|
|
|
|
|
|
TYPES OF CARDS
|
|
----- -- -----
|
|
|
|
The industry typically divides up cards by the business of the issuer.
|
|
So there are bank cards (VISA, Master Card, Discover), Petroleum Cards
|
|
(SUN Oil, Exxon, etc.), and Travel and Entertainment (T&E) cards
|
|
(American Express, Diners' Club, Carte Blanche). Other cards are
|
|
typically lumped together as "Private Label" cards. That would include
|
|
department store cards, telephone cards, and the like. Most private
|
|
label cards are only accepted by the issuer. People are starting to
|
|
divide the telephone cards into a separate class, but it hasn't re-
|
|
ceived widespread acceptance. (This is just a matter of terminology,
|
|
and doesn't affect anything important.)
|
|
|
|
Cards are also divided by how they are billed. Thus there are credit
|
|
cards (VISA, MC, Discover, most department store cards), charge cards
|
|
(American Express, AT&T, many petroleum cards) and debit cards. Credit
|
|
cards invoke a loan of money by the issuer to the cardholder under
|
|
pre-arranged terms and conditions. Charge cards are simply a payment
|
|
convenience, and their total balance is due when billed. When a debit
|
|
card is used, the amount is taken directly from the cardholder's ac-
|
|
count with the issuer. Terminology is loose - often people use "credit
|
|
card" to encompass credit cards and charge cards.
|
|
|
|
A recent phenomenon is third-party debit cards. These cards are issued
|
|
by an organization with which the cardholder has no account relation-
|
|
ship. Instead, the cardholder provides the card issuer with the infor-
|
|
mation necessary to debit the cardholder's checking account directly
|
|
through an Automated Clearing House (ACH), the same way a check would
|
|
be cleared. This is sort of like direct deposit of paychecks, in re-
|
|
verse. ACHs love third-party debit cards. Banks hate them.
|
|
|
|
Another recent addition is affinity cards. These cards are valid
|
|
credit cards from their issuer, but carry the logo of a third party,
|
|
and the third party benefits from their use. There is an incredible
|
|
variety of affinity cards, ranging from airlines to colleges to profes-
|
|
sional sports teams.
|
|
|
|
|
|
HOW THEY MAKE MONEY
|
|
--- ---- ---- -----
|
|
|
|
Issuers of credit cards make money from cardholder fees and from inter-
|
|
est paid on outstanding balances. Not all issuers charge fees. Even
|
|
those that do, make most of their money on the interest. They really
|
|
LIKE people who pay the minimum each month.
|
|
|
|
Issuers of charge cards make money from cardholder fees. Some charge
|
|
cards actually run at a loss for the company, particularly those that
|
|
are free. The primary purpose of such cards is to stimulate business.
|
|
|
|
Issuers of debit cards may make money on transaction fees. Not all
|
|
debit card transactions have fees. Most debit cards exist to stimulate
|
|
business for the bank and to offload tellers and back-room departments.
|
|
To date, third-party debit cards exist solely to stimulate business.
|
|
Providers of such cards make no direct money from their use.
|
|
|
|
Acquirers make money from transaction charges and discount fees. Unlike
|
|
the charges and fees mentioned above, these fees are paid by the ac-
|
|
cepter, not (directly) by the cardholder. (Technically, it is not le-
|
|
gal for the merchants to pass these charges directly to the consumer.
|
|
Some petroleum stations have gotten away with giving a discount for
|
|
cash, and it has survived court challenges so far.) Transaction charges
|
|
are typically in pennies per transaction, and are sensitive to the type
|
|
of communication used for the authorization. Discount fees are a per-
|
|
centage of the purchase price and are sensitive to volume and compli-
|
|
ance to rules. One way to encourage merchants to follow certain
|
|
procedures or to upgrade to new equipment is to offer a lower discount
|
|
fee.
|
|
|
|
Until fairly recently, the only motivation for accepters was to expand
|
|
their business by accepting cards. Reduction of fraud was enough rea-
|
|
son for many merchants to pay authorization fees, but in many cases, it
|
|
isn't worth the cost. (That is, it is cheaper to pay the fraud than to
|
|
prevent it.) Recently, electronic settlement has provided merchants
|
|
with an added benefit by reducing float on charged purchases. Merchants
|
|
can now get their accounts credited much faster than before, which
|
|
helps cash flow.
|
|
|
|
Companies that issue charge cards are real keen on float reduction. The
|
|
sooner they can bill you, the sooner they get their money. Credit card
|
|
companies are also interested in float reduction, since the sooner they
|
|
bill, the sooner they can start charging interest. Debit cards
|
|
typically involve little or no float.
|
|
|
|
Affinity cards usually pay a percentage of purchases to the affinity
|
|
organization. Although it may seem obvious to take this money from the
|
|
discount fee, this doesn't work since the issuer is not always the
|
|
acquirer. The money for this usually comes from the interest paid on
|
|
outstanding balances. Essentially, the bank is giving a share of its
|
|
profits to an organization in turn for the organization promoting use
|
|
of its credit card. The affinity organization is free to use its cut
|
|
any way it wishes. An airline will typically put it into the frequent
|
|
flyer program (and credit miles to your account). A college may put
|
|
the money into the general fund or into a scholarship fund. Lord only
|
|
knows what a sports team does with the money!
|
|
|
|
|
|
THE PLAYERS AND THEIR ROLES
|
|
--- ------- --- ----- -----
|
|
|
|
American Express (AMEX) is a charge card issuer and acquirer. (Their
|
|
other businesses are not important to this discussion.) All AMEX pur-
|
|
chases are authorized by AMEX. They make most of their money from the
|
|
discount fees, which is why they have the highest discount fee in the
|
|
industry. That's one reason why AMEX isn't accepted in as many places
|
|
as VISA and MC, and a reason why many merchants will prefer another
|
|
card to an AMEX card. The control AMEX has over authorization allows
|
|
them to provide what they consider to be better cardholder
|
|
("cardmember" to them) services.
|
|
|
|
VISA is a non-profit corporation (SURPRISE!) that is best described as
|
|
a purchasing and marketing coalition of its member banks. VISA issues
|
|
no credit cards itself - all VISA cards are issued by member banks.
|
|
VISA does not set terms and conditions for its member banks - the banks
|
|
can do pretty much as they please in signing cardholders. All VISA
|
|
charges are ultimately approved by the card issuer, regardless of where
|
|
the purchase was made. Many smaller banks share their account
|
|
databases with larger banks, third parties, or VISA itself, so that the
|
|
bank doesn't have to provide authorization facilities itself.
|
|
|
|
Master Card (MC) is very much like VISA. There are some differences
|
|
that are important to those in the industry, but from the consumers
|
|
standpoint they operate pretty much the same.
|
|
|
|
Discover cards are issued by a bank owned by Sears. All Discover pur-
|
|
chases are authorized by Sears.
|
|
|
|
Most petroleum cards, if they are even authorized, are authorized by
|
|
the petroleum company itself. There are exceptions. Fraud on petro-
|
|
leum cards is so low that the main reason for authorization is to
|
|
achieve the float reduction of electronic settlement.
|
|
|
|
|
|
THE BUSINESS RELATIONSHIPS
|
|
--- -------- -------------
|
|
|
|
Card acceptors generally sign up with a local acquirer for authoriza-
|
|
tion and settlement of all credit cards. This acquirer may or may not
|
|
be a card issuer, but certainly will not have issued all the cards that
|
|
the merchant can accept. The accepter does not generally call one
|
|
place for VISA and a different place for MC, for example. At one time,
|
|
this was necessary, but more and more acquirers are connected to all
|
|
networks and are offering a broader range of services.
|
|
|
|
Acquirers generally are connected to many issuers, and pay transaction
|
|
charges and discount fees to those issuers for authorizations. Thus,
|
|
the acquirer is actually making money on the difference between fees
|
|
paid and fees billed. Most acquirers gather together transactions from
|
|
many accepters, allowing them to get volume discounts on fees. Since
|
|
the accepters individually have lower volume and are not eligible for
|
|
those discounts, there is a markup that the acquirer can get away with.
|
|
Acquirers also, of course, provide the convenience of a single contact.
|
|
|
|
Most large banks are issuers and acquirers. Things get real interest-
|
|
ing when it's time to settle up. Some small banks are only issuers.
|
|
There are third parties that are only acquirers.
|
|
|
|
In future episodes, I'll explain how standards help all this chaos work
|
|
together, and give details about how the authorization process happens.
|
|
|
|
Joe Ziegler
|
|
att!lznv!ziegler
|
|
This is part two in a planned six-part series about the credit card in-
|
|
dustry. It would be best if you read part one before reading this
|
|
part. Enjoy.
|
|
|
|
DEFINITIONS
|
|
-----------
|
|
|
|
Some more new terms that are used in this posting.
|
|
|
|
ABA - American Bankers Association
|
|
|
|
ACH - Automated Clearing House - an organization that mechanically and
|
|
electronically processes checks.
|
|
|
|
ANSI - American National Standards Institute
|
|
|
|
Embossing - creating raised letters and numbers on the face of the
|
|
card.
|
|
|
|
Encoding - recording data on the magnetic stripe on the back of the
|
|
card.
|
|
|
|
Imprinting - using the embossed information to make an impression on a
|
|
charge slip.
|
|
|
|
Interchange - sending authorization requests from one host (the
|
|
acquirer) to another (the issuer) for approval.
|
|
|
|
ISO - International Standards Organization
|
|
|
|
NACHA - National Automated Clearing House Association
|
|
|
|
PAN - Personal Account Number. The account number associated with a
|
|
credit, debit or charge card. This is usually the same as the
|
|
number on the card.
|
|
|
|
PIN - Personal Identification Number. A number associated with the
|
|
card, that is supposedly know only to the cardholder and the card
|
|
issuer. This number is used for verification of cardholder
|
|
identity.
|
|
|
|
|
|
THE ORGANIZATIONS
|
|
--- -------------
|
|
|
|
ISO sets standards for plastic cards and for data interchange, among
|
|
other things. ISO standards generally allow for national expansion.
|
|
Typically, a national standards organization, like ANSI, will take an
|
|
ISO standard and develop a national standard from it. National stan-
|
|
dards are generally subsets of the ISO standard, with extensions as al-
|
|
lowed in the original ISO standard. Many credit card standards
|
|
originated in the United States, and were generalized and adopted by
|
|
ISO later.
|
|
|
|
The ANSI committees that deal with credit card standards are sponsored
|
|
by the ABA. Most members of these committees work for banks and other
|
|
financial institutions, or for vendors who supply banks and financial
|
|
institutions. Working committees report to governing committees.
|
|
|
|
All standards go through a formal comment and review procedure before
|
|
they are officially adopted.
|
|
|
|
|
|
PHYSICAL STANDARDS
|
|
-------- ---------
|
|
|
|
ANSI X4.13, "American National Standard for Financial Services -
|
|
Financial Transaction Cards" defines the size, shape, and other
|
|
physical characteristics of credit cards. Most of it is of interest
|
|
only to mechanical engineers. It defines the location and size of the
|
|
magnetic stripe, signature panel, and embossing area. This standard
|
|
also includes the Luhn formula used to generate the check digit for the
|
|
PAN, and gives the first cut at identifying card type from the account
|
|
number. (This part was expanded later in other standards.) Also, this
|
|
standard identifies the character sets that can be used for embossing a
|
|
card.
|
|
|
|
Three character sets are allowed - OCR-A as defined in ANSI X3.17,
|
|
OCR-B as defined in ANSI X3.49, and Farrington 7B, which is defined in
|
|
the appendix of ANSI X4.13 itself. Almost all the cards I have use
|
|
Farrington 7B, but Sears uses OCR-A. (Sears also uses the optional,
|
|
smaller card size as, allowed in the standard.) These character sets
|
|
are intended to be used with optical character readers (hence the OCR),
|
|
and large issuers have some pretty impressive equipment to read those
|
|
slips.
|
|
|
|
|
|
ENCODING STANDARDS
|
|
-------- ---------
|
|
|
|
ANSI X4.16, "American National Standard for Financial Services - Finan-
|
|
cial Transaction Cards - Magnetic Stripe Encoding" defines the
|
|
physical, chemical, and magnetic characteristics of the magnetic stripe
|
|
on the card. The standard defines a minimum and maximum size for the
|
|
stripe, and the location of the three defined encoding tracks. (Some
|
|
cards have a fourth, proprietary track.)
|
|
|
|
Track 1 is encoded at 210 bits per inch, and uses a 6-bit coding of a
|
|
64-element character set of numerics, alphabet (one case only), and
|
|
some special characters. Track 1 can hold up to 79 characters, six of
|
|
which are reserved control characters. Included in these six charac-
|
|
ters is a Longitudinal Redundancy Check (LRC) character, so that a card
|
|
reader can detect most read failures. Data encoded on track 1 include
|
|
PAN, country code, full name, expiration date, and "discretionary
|
|
data". Discretionary data is anything the issuer wants it to be.
|
|
Track 1 was originally intended for use by airlines, but many Automatic
|
|
Teller Machines (ATMs) are now using it to personalize prompts with
|
|
your name and your language of choice. Some credit authorization ap-
|
|
plications are starting to use track 1 as well.
|
|
|
|
Track 2 is encoded at 75 bits per inch, and uses a 4-bit coding of the
|
|
ten digits. Three of the remaining characters are reserved as
|
|
delimiters, two are reserved for device control, and one is left unde-
|
|
fined. In practice, the device control characters are never used, ei-
|
|
ther. Track 2 can hold up to 40 characters, including an LRC. Data
|
|
encoded on track 2 include PAN, country code (optional), expiration
|
|
date, and discretionary data. In practice, the country code is hardly
|
|
ever used by United States issuers. Later revisions of this standard
|
|
added a qualification code that defines the type of the card (debit,
|
|
credit, etc.) and limitations on its use. AMEX includes an issue date
|
|
in the discretionary data. Track 2 was originally intended for credit
|
|
authorization applications. Nowadays, most ATMs use track 2 as well.
|
|
Thus, many ATM cards have a "PIN offset" encoded in the discretionary
|
|
data. The PIN offset is usually derived by running the PIN through an
|
|
encryption algorithm (maybe DES, maybe proprietary) with a secret key.
|
|
This allows ATMs to verify your PIN when the host is offline, generally
|
|
allowing restricted account access.
|
|
|
|
Track 3 uses the same density and coding scheme as track 1. The con-
|
|
tents of track 3 are defined in ANSI X9.1, "American National Standard
|
|
- Magnetic Stripe Data Content for Track 3". There is a slight contra-
|
|
diction in this standard, in that it allows up to 107 characters to be
|
|
encoded on track 3, while X4.16 only gives enough physical room for 105
|
|
characters. Actually, there is over a quarter of an inch on each end
|
|
of the card unused, so there really is room for the data. In practice,
|
|
nobody ever uses that many characters, anyway. The original intent was
|
|
for track 3 to be a read/write track (tracks 1 and 2 are intended to be
|
|
read-only) for use by ATMs. It contains information needed to maintain
|
|
account balances on the card itself. As far as I know, nobody is actu-
|
|
ally using track 3 for this purpose anymore, because it is very easy to
|
|
defraud.
|
|
|
|
|
|
COMMUNICATION STANDARDS
|
|
------------- ---------
|
|
|
|
Formats for interchange of messages between hosts (acquirer to issuer)
|
|
is defined by ANSI X9.2, which I helped define. Financial message au-
|
|
thentication is described by ANSI X9.9. PIN management and security is
|
|
described by ANSI X9.8. There is a committee working on formats of
|
|
messages from accepter to acquirer. ISO has re-convened the interna-
|
|
tional committee on host message interchange (TC68/SC5/WG1), and ANSI
|
|
may need to re-convene the X9.2 committee after the ISO committee fin-
|
|
ishes. These standards are still evolving, and are less specific than
|
|
the older standards mentioned above. This makes them somewhat less
|
|
useful, but is a natural result of the dramatic progress in the indus-
|
|
try.
|
|
|
|
ISO maintains a registry of card numbers and the issuers to which they
|
|
are assigned. Given a card that follows standards (Not all of them
|
|
do.) and the register, you can tell who issued the card based on the
|
|
first six digits (in most cases). This identifies not just VISA,
|
|
MasterCard, etc., but also which member bank actually issued the card.
|
|
|
|
|
|
DE FACTO INDUSTRY STANDARDS
|
|
-- ----- -------- ---------
|
|
|
|
Most ATMs use IBM synchronous protocols, and many networks are migrat-
|
|
ing toward SNA. There are exceptions, of course. Message formats used
|
|
for ATMs vary with the manufacturer, but a message set originally de-
|
|
fined by Diebold is fairly widely accepted.
|
|
|
|
Many large department stores and supermarkets (those that take cards)
|
|
run their credit authorization through their cash register controllers,
|
|
which communicate using synchronous IBM protocols.
|
|
|
|
Standalone Point-of-Sale (POS) devices, such as you would find at most
|
|
smaller stores (i.e. not at department stores), restaurants and hotels
|
|
use a dial-up asynchronous protocol devised by VISA. There are two
|
|
generations of this protocol, with the second generation just beginning
|
|
to get widespread acceptance.
|
|
|
|
Many petroleum applications use multipoint private lines and a polled
|
|
asynchronous protocol known as TINET. This protocol was developed by
|
|
Texas Instruments for a terminal of the same name, the Texas Instru-
|
|
ments Network E(something) Terminal. The private lines reduce response
|
|
time, but cost a lot more money than dial-up.
|
|
|
|
NACHA establishes standards for message interchange between ACHs, and
|
|
between ACHs and banks, for clearing checks. This is important to this
|
|
discussion due to the emergence of third-party debit cards, as dis-
|
|
cussed in part 1 of this series. The issuers of third-party debit
|
|
cards are connecting to ACHs, using the standard messages, and clearing
|
|
POS purchases as though they were checks. This puts the third parties
|
|
at an advantage over the banks, because they can achieve the same re-
|
|
sults as a bank debit card without the federal and state legal restric-
|
|
tions imposed on banks.
|
|
|
|
In the next installment, I'll describe how an authorization happens, as
|
|
well as how the settlement process gets the bill to you and your money
|
|
to the merchant. After that I'll describe various methods of fraud,
|
|
and how issuers, acquirers, and accepters protect themselves. Stay
|
|
tuned.
|
|
|
|
Joe Ziegler
|
|
att!lznv!ziegler
|
|
Here's part 3 in my six-part series on the credit card industry. This
|
|
part discusses how authorization and settlement work. This is a long
|
|
one. It will help if you have read parts 1 and 2, since I had to leave
|
|
out a lot of overlap to keep this from getting ridiculous. Enjoy.
|
|
|
|
|
|
THE ACCEPTER
|
|
--- --------
|
|
|
|
An important fact to note is that a card accepter does not have to get
|
|
approval for any purchases using credit or charge cards. Of course, a
|
|
merchant is usually interested in actually getting money, and so must
|
|
participate in some form of settlement process (see below). Usually,
|
|
the most acceptable (to a merchant) forms of settlement are tied (by
|
|
the acquirer) to authorization processes. However, a merchant could
|
|
simply accept all cards without any validation, any eat any fraud that
|
|
results.
|
|
|
|
A merchant typically makes a business arrangement with a local bank or
|
|
some other acquirer for authorization and settlement services. The
|
|
acquirer assigns a merchant identifier to that merchant, which will
|
|
uniquely identify the location of the transaction. (This facilitates
|
|
compliance with federal regulations requiring that credit card bills
|
|
identify where each purchase was made.) The acquirer also establishes
|
|
procedures for the merchant to follow. The procedures will vary by
|
|
type of the merchant business, geographic location, volume of transac-
|
|
tions, and types of cards accepted.
|
|
|
|
If the merchant follows the procedures given by the acquirer and a
|
|
transaction is approved, the merchant is guaranteed payment whether the
|
|
card in question is good or bad. The purpose of authorization is to
|
|
shift financial liability from the acceptor to the acquirer.
|
|
|
|
There are two basic tools used - bulletins and online checks. Bulletins
|
|
may be hardcopy, or may be downloaded into a local controller of some
|
|
form. Online checks could be done via a voice call, a standalone ter-
|
|
minal, or software and/or hardware integrated into the cash register.
|
|
|
|
A low-volume, high-ticket application (a jewelry store) would probably
|
|
do all its authorizations with voice calls, or may have a stand-alone
|
|
terminal. A high-volume, low-ticket application (a fast-food chain)
|
|
will probably do most of its authorizations locally against a bulletin
|
|
downloaded into the cash register controller. Applications in between
|
|
typically merge the two - things below a certain amount (the "floor
|
|
limit") are locally authorized after a lookup in the bulletin, while
|
|
things over the floor limit are authorized online.
|
|
|
|
Usually a lot of effort is taken to use the least expensive tools that
|
|
are required by the expected risk of fraud. Typically, communication
|
|
costs for authorizations make up the biggest single item in the overall
|
|
cost of providing credit cards.
|
|
|
|
Large accepters are always a special case. Airlines are usually di-
|
|
rectly connected, host-to-host, to issuers and/or acquirers, and autho-
|
|
rize everything online. Likewise for many petroleum companies and
|
|
large department stores. Some large chains use different approaches at
|
|
different locations, either as a result of franchising oddities or due
|
|
to volume differences between locations. A lot of experimentation is
|
|
still going on as well - this is not a mature market.
|
|
|
|
For voice authorizations, the merchant ID, PAN, expiration date, and
|
|
purchase amount are required for an approval. Some applications also
|
|
require the name on the card, but this is not strictly necessary. For
|
|
data authorizations, the merchant ID, PAN, PIN (if collected), expira-
|
|
tion date, and purchase amount are required. Typically, the "discre-
|
|
tionary data" from track 2 is sent as well, but this is not strictly
|
|
necessary. In applications that do not transmit the PIN with the au-
|
|
thorization, it is the responsibility of the merchant to verify iden-
|
|
tity. Usually, this should be done by checking the signature on the
|
|
card against the signature on the form. Merchants don't often follow
|
|
this procedure, and they take a risk in not doing so.
|
|
|
|
In most applications, the amount of the purchase is known at the time
|
|
of the authorization request. For hotels, car rentals, and some petro-
|
|
leum applications, an estimated amount is used for the authorization.
|
|
After the transaction is complete (e.g. after the gas is pumped or at
|
|
check-out time), another transaction may be sent to advise of the ac-
|
|
tual amount of the transaction. More on this later.
|
|
|
|
|
|
THE ACQUIRER
|
|
--- --------
|
|
|
|
The acquirer gathers authorization requests from accepters and returns
|
|
approvals. If the acquirer is an issuer as well, "on us" transactions
|
|
will typically be turned around locally. As before, the acquirer does
|
|
not have to forward any requests on to the actual issuer. However,
|
|
acquirers are not willing to take the financial risks associated with
|
|
generating local approvals. Thus most transactions are sent on to the
|
|
issuers (interchanged). The purpose of interchange is to shift finan-
|
|
cial liability from the acquirer to the issuer.
|
|
|
|
Typically, an acquirer connects to many issuers, and negotiates differ-
|
|
ent business arrangements with each one of them. But the acquirer gen-
|
|
erally provides a uniform interface to the accepter. Thus, the
|
|
interchange rules are sometimes less stringent than those imposed on
|
|
the accepter. Also, most issuers will trust acquirers to with respon-
|
|
sibilities they would never trust to accepters. The acquirer can
|
|
therefore perform some front-end screening on the transactions, and
|
|
turn some of them around locally without going back to the issuer.
|
|
|
|
The first screening by the acquirer would be a "sanity" test, for valid
|
|
merchant ID, valid Luhn check on PAN, expiration date not past, amount
|
|
field within reason for type of merchant, etc. After that, a floor
|
|
limit check will be done. Issuers generally give acquirers higher
|
|
floor limits than acquirers give accepters, and floor limits may vary
|
|
by type of merchant. Next, a "negative file" check would be done
|
|
against a file of known bad cards. (This is essentially the same as
|
|
the bulletin.) Then a "velocity file" check may be done. A velocity
|
|
file keeps track of card usage, and limits are often imposed on both
|
|
number of uses and total amount charged within a given time period.
|
|
Sometimes multiple time periods are used, and it can get fairly compli-
|
|
cated.
|
|
|
|
Transactions that pass all the checks, and are within the authority
|
|
vested in the acquirer by the issuer, are approved by the acquirer.
|
|
(Note that, under the business arrangement, financial liability still
|
|
resides with the issuer.) An "advice" transaction is sometimes sent to
|
|
the issuer (perhaps at a later time), to tell the issuer that the
|
|
transaction took place.
|
|
|
|
Transactions that "fail" one or more checks are denied by the acquirer
|
|
(if the cause was due to form, such as bad PAN) or sent to the issuer
|
|
for further checking. (Note that "failure" here can mean that it's be-
|
|
yond the acquirer's authority, not necessarily that the card is bad.)
|
|
Some systems nowadays will periodically take transactions that would
|
|
otherwise be approved locally, and send them to the issuer anyway. This
|
|
serves as a check on the screening software and as a countermeasure
|
|
against fraudulent users who know the limits.
|
|
|
|
Transactions that go to the issuer are routed according to the first
|
|
six digits of the PAN, according to the ISO registry mentioned in an
|
|
earlier section. Actually, it's a bit more complicated than that,
|
|
since there can be multiple layers of acquirers, and some issuers or
|
|
acquirers will "stand in" for other issuers when there are hardware or
|
|
communication failures, but the general principal is the same at each
|
|
point.
|
|
|
|
|
|
THE ISSUER
|
|
--- ------
|
|
|
|
An issuer receiving an interchanged transaction will often perform many
|
|
of the same tests on it that the acquirer performs. Some of the tests
|
|
may be eliminated if the acquirer is trusted to do them correctly. This
|
|
is the only point where a velocity file can actually detect all usage
|
|
of a card. This is also the only point where a "positive file" lookup
|
|
against the actual account can be done, since only the issuer has the
|
|
account relationship with the cardholder. If a PIN is used in the
|
|
transaction, only the issuer can provide true PIN verification -
|
|
acquirers may be able to do only "PIN offset" checking, as described in
|
|
a previous section. This is one reason why PINs have not become
|
|
popular on credit and charge cards.
|
|
|
|
An account typically has a credit limit associated with it. An ap-
|
|
proved authorization request usually places a "hold" against the credit
|
|
limit. If the sum of outstanding holds plus the actual outstanding
|
|
balance on the account, plus the amount of the current transaction, is
|
|
greater than the credit limit, the transaction is (usually) denied.
|
|
Often in such a case the issuer will send back a "call me" response to
|
|
the merchant. The merchant will then call the issuer's number, and the
|
|
operator may even want to talk to the cardholder. The credit limit
|
|
could be extended on the spot, or artificially high holds (from hotels
|
|
or car rental companies) could be overlooked so that the transaction
|
|
can be approved.
|
|
|
|
The difference between the credit limit and the sum of holds and out-
|
|
standing balance is often referred to as the "open to buy" amount. Once
|
|
a hold is placed on an account, it is kept there until the actual the
|
|
transaction in question is settled (see below), in which case the
|
|
amount goes from a hold to a billed amount, with no impact on the open
|
|
to buy amount, theoretically. For authorizations of an estimated
|
|
amount, the actual settled amount will be less than or equal to the ap-
|
|
proved amount. (If not, the settlement can be denied, and the merchant
|
|
must initiate a new transaction to get the money.) Theoretically, in
|
|
such a case, the full hold is removed and the actual amount is added to
|
|
the outstanding balance, resulting in a possible increase in the open
|
|
to buy amount.
|
|
|
|
In practice, older systems were not capable of matching settlements to
|
|
authorizations, and holds were simply expired based on the time it
|
|
would take most transactions to clear. Newer systems are starting to
|
|
get more sophisticated, and can do a reasonable job of matching autho-
|
|
rizations for actual amounts with the settlements. Some of them still
|
|
don't match estimated amounts well, with varying effects. In some
|
|
cases, the difference between actual and estimated will remain as a
|
|
hold for some period of time. In other cases, both the authorization
|
|
and the settlement will go against the account, reducing the open to
|
|
buy by up to twice the actual amount, until the hold expires. These
|
|
problems are getting better as the software gets more sophisticated.
|
|
|
|
Some issuers are also starting to use much more sophisticated usage
|
|
checks as well. They will not only detect number of uses and amount
|
|
over time, but also types of merchandise bought, or other patterns to
|
|
buying behavior. Most of this stuff is new, and is used for fraud pre-
|
|
vention. I expect this to be the biggest effort in authorization soft-
|
|
ware for the next few years.
|
|
|
|
American Express does things completely differently. There are no
|
|
credit limits on AMEX cards. Instead, AMEX relies entirely on usage
|
|
patterns, payment history, and financial data about cardmembers to de-
|
|
termine whether or not to automatically approve a transaction. AMEX
|
|
also has a policy that a cardmember will never be denied by a machine.
|
|
Thus, if the computer determines that a transaction is too risky, the
|
|
merchant will receive a "call me" message. The operator will then get
|
|
details of the transaction from the merchant, and may talk to the
|
|
cardmember as well, if cardmember identity is in question or a large
|
|
amount is requested. To verify cardmember identity, the cardmember
|
|
will be asked about personal information from the original application,
|
|
or about recent usage history. The questions are not the same each
|
|
time. If an unusually large amount is requested, the cardmember may be
|
|
asked for additional financial data, particularly anything relating to
|
|
a change in financial status (like a new job or a promotion). People
|
|
who are paranoid about Big Brother and computer databases should not
|
|
use AMEX cards.
|
|
|
|
|
|
SETTLEMENT
|
|
----------
|
|
|
|
So far, no money has changed hands, only financial liability. The pur-
|
|
pose of settlement is to shift the financial liability back to the
|
|
cardholder, and to shift the cardholder's money to the merchant.
|
|
Theoretically, all authorization information can be simply discarded
|
|
once an approval is received by a merchant. Of course, contested
|
|
charges, chargebacks, merchant credits, and proper processing of holds
|
|
require that the information stay around. Still, it is important to
|
|
realize that an authorization transaction has no direct financial con-
|
|
sequences. It only establishes who is responsible for the financial
|
|
consequences to follow.
|
|
|
|
Traditionally, a merchant would take the charge slips to the bank that
|
|
was that merchant's acquirer, and "deposit" them into the merchant ac-
|
|
count. The acquirer would take the slips, sort them by issuer, and
|
|
send them to the issuing banks, receiving credits by wire once they ar-
|
|
rived and were processed. The issuer would receive the slips, micro-
|
|
film them (to save the transaction information, as required by federal
|
|
and state laws) charge them against the cardholder's accounts, send
|
|
credits by wire to the acquirer, and send out the bill to the
|
|
cardholder. Problem is, this took time. Merchants generally had to
|
|
wait a couple of weeks for the money to be available in their accounts,
|
|
and issuers often suffered from float on the billables of about 45
|
|
days.
|
|
|
|
Therefore, nowadays many issuers and acquirers are moving to on-line
|
|
settlement of transactions. This is often called "draft capture" in
|
|
the industry. There are two ways this is done - one based on the host
|
|
and one based on the terminal at the merchant's premises. In the
|
|
host-based case, the terminal generally only keeps counts and totals,
|
|
while the acquirer host keeps all the transaction details. Peri-
|
|
odically, the acquirer host and the terminal communicate, and verify
|
|
that they both agree on the data. In the terminal-based case, the ter-
|
|
minal remembers all the important transaction information, and peri-
|
|
odically calls the acquirer host and replays it all for several
|
|
transactions. In either case, once the settlement is complete the mer-
|
|
chant account is credited. The acquirer then sends the settlement in-
|
|
formation electronically to the issuers, and is credited by wire
|
|
immediately (or nearly so). The issuer can bill directly to the
|
|
cardholder account, and float can be reduced to an average of 15 days.
|
|
|
|
The problem is, what to do with the paper? Current regulations in many
|
|
states require that it be saved, but there is no need for it to be sent
|
|
to the issuer. Also, for contested charges, a paper trail is much more
|
|
likely to stand up in court, and much better to use for fraud investi-
|
|
gations. Currently, the paper usually ends up back at the issuer, as
|
|
before, but it doesn't need to be processed, just microfilmed and
|
|
stored.
|
|
|
|
Much of the market still uses paper settlement methods. Online settle-
|
|
ment will replace virtually all of this within the next 5 to 10 years,
|
|
because of its many benefits.
|
|
|
|
This was pretty long, but there is a lot of information, and I skimmed
|
|
over a lot of details. Future installments should be shorter. Coming
|
|
up next is a discussion of fraud and security, and then a special dis-
|
|
cussion of debit cards. Hang on, we're halfway through this!
|
|
|
|
|
|
Joe Ziegler
|
|
att!lznv!ziegler
|
|
This is part four of a planned six-part series on the credit card in-
|
|
dustry. It will be helpful if you have read parts one through three,
|
|
as I use a lot of terminology here that was introduced earlier. Enjoy.
|
|
|
|
WARNING
|
|
|
|
This installment describes various methods of perpetrating fraud
|
|
against credit and charge card issuers, acquirers, and cardholders. Le-
|
|
gal penalties for using these methods to commit fraud are severe. The
|
|
reason for sharing this information is so that consumers will be aware
|
|
of the importance of security and be aware of the procedures used by
|
|
financial institutions to protect against fraud. Neither I nor my em-
|
|
ployer advocate use of the fraudulent methods described herein.
|
|
|
|
All the information here is publicly available from other sources. Un-
|
|
necessary detail is purposely not included, particularly as it applies
|
|
to detection and prevention of fraud.
|
|
|
|
|
|
CARDHOLDER FRAUD
|
|
---------- -----
|
|
|
|
The most common type of fraud against credit cards is cardholders fal-
|
|
sifying applications to get higher credit limits than they can afford
|
|
to pay, or to get multiple cards that they cannot afford to pay off.
|
|
Sometimes this is done with intent to defraud, but most often it is
|
|
done out of desperation or sheer financial ineptitude. Those who in-
|
|
tend to defraud generally use the multiple-card approach. They give
|
|
false names and financial data on several (sometimes as many as hun-
|
|
dreds) of applications. Often, the address of a vacant house that the
|
|
crook has access to is given, making it difficult to track the crook's
|
|
real identity. Once cards start showing up, the crook uses them for
|
|
cash advances or charges merchandise that is easy to sell, like con-
|
|
sumer electronics. The crook will run all the cards up to the limit
|
|
immediately, and will generally move on by the time the bills start ar-
|
|
riving. This type of fraud is not applicable to debit cards, since
|
|
they require an available account balance equal to or greater than any
|
|
purchases or withdrawals.
|
|
|
|
Protecting against this type of fraud, either intentional or otherwise,
|
|
is exactly the purpose of credit bureaus such as TRW. Issuers have be-
|
|
come more aware of the need for careful screening of applications, and
|
|
are using better techniques for detecting similar applications sent to
|
|
multiple issuers. More sophisticated velocity file screening can also
|
|
be used to detect possibly fraudulent usage patterns. Since this is a
|
|
method of fraud that can be used to gain really large amounts of
|
|
money, it is a high priority with issuers' security departments.
|
|
|
|
A variant of this scheme is much like check kiting. Can you use your
|
|
VISA to pay your MasterCard? Well, you might be able to manage it, but
|
|
if you're doing it with intent to defraud, you can be prosecuted. Kit-
|
|
ing schemes typically don't last long, have a low payoff, and are very
|
|
easy to detect.
|
|
|
|
Another type of cardholder fraud is simply contesting legitimate
|
|
charges. Most often, retrieving the documents gives pretty convincing
|
|
proof. Frequently, a family member will be found to have used the card
|
|
without the cardholder's permission. Such cases are usually pretty
|
|
easy to resolve. In the case of an ATM card, cameras are often placed
|
|
at ATMs (sometimes hidden) to record users of the machine. The camera
|
|
is usually tied to the ATM, so that a single retrieval stamp can be
|
|
placed on the film and the ATM log. If a withdrawal is contested, the
|
|
bank can then retrieve the picture of the person standing at the ma-
|
|
chine, and conclusively tie that picture to the transaction.
|
|
|
|
A type of cardholder fraud that is endemic only to ATMs is making false
|
|
deposits. You could, theoretically, tell the ATM that you are deposit-
|
|
ing a large amount of money, and put in an empty envelope. Most banks
|
|
will not let you withdraw amounts deposited into an ATM until the de-
|
|
posit has been verified, but some will allow part of the deposit to be
|
|
withdrawn. Typically, you can't get away with much. If you have any
|
|
money actually in your account, the bank has easy, legal recourse to
|
|
seize those funds. Most banks have no sense of humor about such
|
|
things, and will remove ATM card privileges after the first offense.
|
|
|
|
|
|
THIRD-PARTY FRAUD
|
|
----------- -----
|
|
|
|
The simplest way for a third party to commit fraud is for them to get
|
|
their hands on a legitimate card. There is a large black market for
|
|
credit cards obtained from hold-ups, break-ins and muggings. Perhaps
|
|
one of the cruelest methods of getting a card is a "Good Samaritan"
|
|
scam. In such a scam, credit cards are stolen by pick-pockets,
|
|
purse-snatchers, etc. That same day, someone looks up your number in
|
|
the phone book and calls you up. "I just found your wallet. All the
|
|
money is gone, but the credit cards and your driver's license are still
|
|
here. It just happens that I'll be in your neighborhood next Wednesday
|
|
and I'll drop it off then." Since the cards are found, you don't re-
|
|
port them stolen, and the crooks get until next Wednesday before you're
|
|
even suspicious. If such a thing happens to you, ask if you can come
|
|
and pick the cards up immediately. A true good samaritan won't mind,
|
|
but a crook will stall you. If you can't get your hands on the cards
|
|
immediately, report them as stolen. Most issuers will be able to get
|
|
you a new card by next Wednesday, anyway.
|
|
|
|
Often stolen cards will be used for a time exactly as is. The best
|
|
tool for preventing this is verification of the signature, but this is
|
|
ineffective because most merchants don't consistently check signatures
|
|
and some people don't even sign their cards. (I guess these people
|
|
figure that all purse snatchers are accomplished forgers as well.)
|
|
Many cards will eventually be modified as the various security schemes
|
|
start catching up.
|
|
|
|
It is a very easy matter, for example, to re-encode a different number
|
|
on the magnetic stripe. Since the card still looks fine, a merchant
|
|
will accept it and run it through the POS terminal, completely ignorant
|
|
of the fact that the number read off the back is not the same as that
|
|
on the front. Although the number on the front would fail a negative
|
|
file check, the number on the back is one that hasn't been reported
|
|
yet. A card can be re-encoded almost any number of times, as long as
|
|
you can keep coming up with new valid PANs. To protect against this,
|
|
some merchants purposely avoid using the magnetic stripe. Others have
|
|
terminals that display the number read from the stripe, so the cashier
|
|
can compare it to the number on the card. Some issuers are experiment-
|
|
ing with special encoding schemes, to make re-encoding difficult, but
|
|
most of these schemes would require replacing the entire embedded base
|
|
of POS terminals. An interesting approach I've seen (it's probably
|
|
patented) uses a laser to burn off the parts of the magnetic stripe
|
|
where zeroes are encoded, leaving only the ones. This severely limits
|
|
the changes you can make to the card number. Some issuers use the
|
|
"discretionary data" field to encode data unique to the card, that a
|
|
crook would not be able to guess, to combat this type of fraud.
|
|
|
|
Since an ATM doesn't have a human looking at the card, it is especially
|
|
susceptible to re-encoding fraud. A crook could get a number from a
|
|
discarded receipt and encode it on a white card blank, which is easy to
|
|
obtain legally. Many people use PINs that are easy to guess, and the
|
|
crook has an easy job of it. Most ATMs will not give you your card
|
|
back if you don't enter a correct PIN, and will only give you a few
|
|
tries to get it right, to prevent this type of fraud. Velocity file
|
|
checks are also important in detecting this. You should always take
|
|
your ATM receipts with you, pick a non-obvious PIN, and make sure that
|
|
nobody sees you enter it.
|
|
|
|
One place that a crook can get valid PANs to encode on credit cards is
|
|
from dumpsters outside of stores and restaurants. The credit slip
|
|
typically is a multipart form, with one copy for you, one for the mer-
|
|
chant, and one for the issuer (ultimately). If carbon paper is used,
|
|
and the carbons are discarded intact, it's pretty easy to read the num-
|
|
bers off of them. Carbonless paper and forms that either rip the car-
|
|
bons in half or attach them to the cardholder copy automatically are
|
|
used to prevent this.
|
|
|
|
There are a lot of scams for getting people to tell their credit card
|
|
numbers over the phone. Never give your card number to anyone unless
|
|
you are buying something from them, and make sure that it is a le-
|
|
gitimate business you are buying from. "Incredible deal!! Diamond
|
|
jewelry at half price!! Call now with your VISA number, and we'll rush
|
|
you your necklace!!" When you don't get the necklace for four weeks,
|
|
you might start to wonder. When you get your credit card bill, you'll
|
|
stop wondering.
|
|
|
|
There are other, more sophisticated ways to modify a credit card. If
|
|
you're skillful, you can change the embossing on the card and even the
|
|
signature on the back. For most purposes, these techniques are more
|
|
trouble than they're worth, since it's not difficult to come up with a
|
|
new stolen card, or fake ID to match the existing card.
|
|
|
|
|
|
MERCHANT FRAUD
|
|
-------- -----
|
|
|
|
There are many urban rumors of merchants imprinting a card multiple
|
|
times while the cardholder isn't looking, and then running through a
|
|
bunch of charges after the cardholder leaves. I don't know of any case
|
|
where this is an official policy of a merchant, but this is certainly
|
|
one technique a dishonest cashier could use. The cashier can then take
|
|
home a bunch of merchandise charged to your account. Although some
|
|
people are afraid of this happening in a restaurant, where a waiter
|
|
takes your card away for a while, it's actually less likely there,
|
|
since there isn't anything the waiter can charge against your card and
|
|
take home.
|
|
|
|
A merchant could also make copies of charge slips, to sell the PANs to
|
|
other crooks. (See above for use of PANs.) Most credit card investi-
|
|
gation departments are sensitive to this possibility, and catch on real
|
|
fast if it's happening just by looking at usage history of cards with
|
|
fraudulent charges.
|
|
|
|
A merchant is also in a position to create many false charges against
|
|
bogus numbers, to attempt to defraud the acquirer or issuer. These
|
|
schemes are usually not too effective, since acquirers generally re-
|
|
spond very quickly to an unusual number of fraudulent transactions by
|
|
tightening restrictions on the merchant.
|
|
|
|
|
|
ACQUIRER AND ISSUER FRAUD
|
|
-------- --- ------ -----
|
|
|
|
The place to make really big bucks in fraud is at the acquirer or is-
|
|
suer, since this is where you can get access to large amounts of money.
|
|
Fortunately, it's also fairly easy to control things here with audit
|
|
procedures and dual control. People working in the back offices, pro-
|
|
cessing credit slips, bills, etc. have a big opportunity to "lose"
|
|
things, introduce false things, artificially delay things, and tempo-
|
|
rarily divert things. Most of the control is standard banking stuff,
|
|
and has been proven effective for decades, so this isn't a big problem.
|
|
A bigger potential problem to the consumer is the possibility of an em-
|
|
ployee at the issuer or acquirer selling PANs to crooks. This would be
|
|
very hard to track down, and could compromise a large part of the card
|
|
base. I know of no cases where this has happened.
|
|
|
|
Programmers, in particular, are very dangerous because they know where
|
|
the data is, how to get it, and what to do with it. In most shops, de-
|
|
velopment is done on completely separate facilities from the production
|
|
system. Certification and installation are done by non-developers, and
|
|
developers are not allowed any access to the production facilities.
|
|
Operations and maintenance staff are monitored very carefully as well,
|
|
since they typically have access to the entire system as part of their
|
|
jobs.
|
|
|
|
Another type of fraud that is possible here is diversion of materials,
|
|
such as printed, but not embossed or encoded, card blanks. Such mate-
|
|
rials are typically controlled using processes similar to those used at
|
|
U.S. mints. Since most of the cards issued in the United States are
|
|
actually manufactured by only a handful of companies, it's not too hard
|
|
to keep things under control.
|
|
|
|
There are many types of fraud that can be perpetrated by tapping data
|
|
communication lines, and using protocol analyzers or computers to in-
|
|
tercept or introduce data. These types of fraud are not widespread,
|
|
mainly because of the need for physical access and because sophisti-
|
|
cated computer techniques are required. There are message authentica-
|
|
tion, encryption, and key management techniques that are available to
|
|
combat this type of fraud, but currently these techniques are far more
|
|
costly than the minimal fraud they could prevent. About the only such
|
|
security technique that is in widespread use is encryption of PINs.
|
|
|
|
The next episode will be devoted to debit cards, and the final episode
|
|
will talk about the networks that make all this magic happen.
|
|
|
|
|
|
Joe Ziegler
|
|
att!lznv!ziegler
|
|
Part 5 - Debit Cards
|
|
|
|
EVOLUTION OF DEBIT CARDS
|
|
--------- -- ----- -----
|
|
|
|
The debit card originated as a method for bank customers to have access
|
|
to their funds through Automatic Teller Machines (ATMs). This was seen
|
|
as a way for banks to automate their branches and save money, as well
|
|
as a benefit for customers. A secondary intent was for the card to be
|
|
used as a method of identification when dealing with a human teller.
|
|
Although that idea never really caught on, it has seen renewed interest
|
|
from time to time.
|
|
|
|
One problem with using cards to access bank accounts is that federal
|
|
regulations required a signature be used for each withdrawal transac-
|
|
tion. After much debate, the concept of a Personal Identification Num-
|
|
ber (PIN) was invented, and federal regulations were modified to allow
|
|
PINs for use in place of signatures with bank withdrawals. ATMs also
|
|
faced many other regulatory difficulties. In many states, for example,
|
|
there are limitations on the number of branches a bank can have. In a
|
|
conflict that only a lawyer could conceive of, a ruling was required
|
|
about whether an ATM constitutes a bank branch or not. Since such rul-
|
|
ings were made on a state by state basis, it varies across the country.
|
|
This results in some very odd arrangements in some states, because of
|
|
requirements placed on bank branches.
|
|
|
|
In early attempts, the card actually carried account information and
|
|
balances. The cardholder would bring the card into a branch, and bank
|
|
personnel would "load" money onto the card, based on the customer's ac-
|
|
tual account balance. The cardholder could then use the card at a
|
|
stand-alone machine that would update the information on the card as
|
|
money was withdrawn. The information was stored on track 3 of the mag-
|
|
netic stripe, as mentioned in an earlier installment. This approach
|
|
had many problems. It was far too susceptible to fraud, it could not
|
|
reasonably handle multiple accounts, and it could not be used as a ve-
|
|
hicle for other services. Since it was pretty much limited to with-
|
|
drawals, it didn't even automate much of the bank branch functions.
|
|
|
|
The online ATM offered a solution to the problems of the early ATM
|
|
cards. Since the ATM was connected to the bank's host, it was no
|
|
longer necessary to maintain account balances on the card itself, which
|
|
removed a major source of fraud. Also, access to multiple accounts be-
|
|
came possible, as did additional services, such as bill payment.
|
|
|
|
Once banks started buying and installing ATMs, they quickly realized
|
|
that it is very expensive to maintain a large number of machines. Yet
|
|
customers began demanding more machines, so they could have easier ac-
|
|
cess to their funds. Since many banks in an area would have ATMs, the
|
|
obvious solution was to somehow cross-connect bank hosts so that cus-
|
|
tomers could use ATMs at other banks, for convenience. The lawyers
|
|
struck again. Does a shared ATM count as a branch for both banks? Does
|
|
a transaction at a shared ATM mean that one bank is doing financial
|
|
transactions for another, which is not allowed? If two banks share
|
|
ATMs, but refuse to allow a third bank, is that monopolizing or re-
|
|
straint of trade? Strange restrictions on shared ATM transactions re-
|
|
sulted.
|
|
|
|
Soon interchange standards began to evolve, and ATM networks became a
|
|
competitive tool. Regional and national networks started to emerge.
|
|
And the lawyers struck again. If a network allows transactions in one
|
|
state for a bank in another state, isn't that interstate banking, which
|
|
was at the time forbidden? Should an ATM network that dominates a re-
|
|
gion become a regulated monopoly? Should an ATM network that gets re-
|
|
ally big be considered a public utility?
|
|
|
|
Today, the regional and national networks continue to grow and offer
|
|
more services and more interconnections. All of the regulatory issues
|
|
have not been resolved, and this is creating a lot of tension for eas-
|
|
ing banking restrictions.
|
|
|
|
An ATM card is just an ATM card, regardless of how many ATMs it works
|
|
in. Most banks long ago saw an opportunity for the ATM card to be used
|
|
as a debit card, presumably to replace checks. A tremendous number of
|
|
checks are used each year, and it costs banks a lot of money to process
|
|
them. Debit card transactions could cost less to process, given an ap-
|
|
propriate infrastructure. Some of the costs could potentially be
|
|
passed on to the merchants or the consumers, who are notoriously reluc-
|
|
tant to directly pay the cost of checks. So far there have been many
|
|
trials of using ATM cards as debit cards at the point of sale, but they
|
|
have, in general, met with consumer apathy. In some areas, where banks
|
|
have aggressively promoted debit, things have gone better. Still, gen-
|
|
eral acceptance of debit seems a ways off.
|
|
|
|
One interesting twist to the debit card story, as mentioned earlier, is
|
|
the emergence of third party debit cards. Issuers of these cards have
|
|
no real account relationship with the cardholders. Instead, they ob-
|
|
tain permission from the cardholders to debit their checking accounts
|
|
directly through the Automated Clearing Houses (ACHs), the same way
|
|
checks are cleared. (Think of it as direct deposit, in reverse.) Oil
|
|
companies first started experimenting with this a couple of years ago,
|
|
and it has met with surprising success. Banks dislike this concept,
|
|
because it competes directly with their debit cards, but isn't subject
|
|
to the same state and federal regulations. ACHs like this, because it
|
|
bolsters their business, which otherwise stands to lose a lot by
|
|
acceptance of debit cards. Merchants generally like this, especially
|
|
the large retailers, because it allows them to get their payment sys-
|
|
tems out from under the control of the banks.
|
|
|
|
|
|
THE ATM
|
|
--- ---
|
|
|
|
An ATM is an interesting combination of computer, communication, bank-
|
|
ing, and security technology all in one box. A typical machine has a
|
|
microprocessor, usually along the lines of an 8086, a communications
|
|
module (which may have it's own microprocessor), a security module
|
|
(also with a microprocessor), and special-purpose controllers for the
|
|
hardware. The user interface is typically a CRT, a telephone-style
|
|
keypad, and some soft function keys. Typically there is a lot of
|
|
memory, but no disk. The screens and program are usually downloaded
|
|
from the host at initialization, and are stored in battery-backed RAM
|
|
indefinitely. The machine typically interacts with the host for every
|
|
transaction, but it can operate offline if necessary, as dictated by
|
|
the downloaded program. The downloaded program is often in an
|
|
industry-standard "states and screens" format that was created by
|
|
Diebold, a manufacturer of various banking equipment, including ATMs.
|
|
|
|
Most machines can use a few IBM protocols (bisync, SNA, and an outmoded
|
|
but still used "loop" protocol), Burroughs poll/select, and perhaps
|
|
some others, depending on which communications module is in place.
|
|
This allows the manufacturer to make a standard machine, and plug in
|
|
different communications hardware to suit the customer. The IBM bisync
|
|
and SNA protocols are most common, with most networks moving toward
|
|
SNA.
|
|
|
|
The security modules do all encryption for the ATM. They are separate
|
|
devices that are physically sealed and cannot be opened or tapped with-
|
|
out destroying the data within them. In a truly secure application, no
|
|
sensitive data entering or leaving the security module is in cleartext.
|
|
Arranging this and maintaining it is more complicated than I can go
|
|
into here.
|
|
|
|
Most ATMs contain two bill dispensers, a "divert" bin for bills, a
|
|
"capture" bin for cards, a card reader, receipt printer, journal
|
|
printer, and envelope receptacle. Some ATMs have more than two bill
|
|
dispensers, and can even dispense coins.
|
|
|
|
When an ATM is dispensing money, it counts the appropriate bills out of
|
|
the bill dispensers, and uses a couple of mechanical and optical checks
|
|
to make sure it counted correctly. If the checks fail, it shunts the
|
|
bills into the divert bin and tries again. Typically, this is because
|
|
two bills were stuck together. I've seen ATMs have sensor faults, and
|
|
divert the total contents of both bill dispensers the first time a user
|
|
asks for a withdrawal. "Gee, all I did was ask for $50, and this ma-
|
|
chine made all kinds of funny whirring noises and shut down." Most
|
|
banks will put twenty-dollar bills in one of the dispensers and five
|
|
dollar bills in the other. Some use tens and fives, or tens and twen-
|
|
ties. Depending on the denominations of the bills, the size of the
|
|
dispensers, and the policy of the bank, an ATM can hold tens of thou-
|
|
sands of dollars.
|
|
|
|
The journal printer keeps a running log of every use of the machine,
|
|
and exactly what the machine is doing, for audit purposes. you can of-
|
|
ten hear it printing as soon as you put your card in or after your
|
|
transaction is complete.
|
|
|
|
When you put an envelope into an ATM, the transaction information is
|
|
usually printed directly on the envelope, so that verifying the deposit
|
|
is easier. Bank policies typically require that any deposit envelope
|
|
be opened and verified by two people. In this, you're actually safer
|
|
depositing cash at an ATM than giving it to a human teller.
|
|
|
|
A card will be diverted to the capture bin if it is on the "hot card"
|
|
list, if the user doesn't enter a correct PIN, or if the user walks
|
|
away and forgets to take the card.
|
|
|
|
On some machines, the divert bin, capture bin, envelope receptacle, and
|
|
bill dispenser bins are all separately locked containers, so that re-
|
|
stocking can be done by courier services who simply swap bins and re-
|
|
turn the whole thing to a central site.
|
|
|
|
The entire ATM is typically housed in a hardened steel case with alarm
|
|
circuitry built in. These suckers have been known to survive dynamite
|
|
explosions. The housing typically has a combination lock on the door,
|
|
and no single person knows the entire combination. The machine can
|
|
thus be opened for restocking, maintenance, or repair, only if at least
|
|
two people are present.
|
|
|
|
DEBIT CARD PROCESSING
|
|
----- ---- ----------
|
|
|
|
Debit card processing is fairly similar to credit and charge card pro-
|
|
cessing, with a few exceptions. First, in the case of ATMs, the ac-
|
|
cepter and acquirer are usually the same. For debit card use at the
|
|
point of sale, the usual acquirer-accepter relationship holds. In gen-
|
|
eral, acquirers may do front-end screening on debit cards, but all ap-
|
|
provals are generated by the issuer - the floor limit is zero. This
|
|
makes it possible to eliminate a separate settlement process for debit
|
|
card transactions, but places additional security and reliability con-
|
|
straints on the "authorization". Often a separate settlement is done
|
|
anyway.
|
|
|
|
One problem that has caused difficulties for POS use of debit cards is
|
|
the use of PINs. Many merchants and cardholders would rather use sig-
|
|
nature for identity verification. But most debit systems grew out of
|
|
ATM systems, and require PINs. This is an ironic reversal of the early
|
|
ATM card days, when people were trying to avoid requiring signature.
|
|
Other than the PIN, the information required for a debit transaction is
|
|
the same as that required for a credit transaction.
|
|
|
|
One last installment on the networks that tie this all together, and
|
|
the Credit Card 101 course will be complete. There will be no final
|
|
exam - you will be graded entirely on classroom participation. Most of
|
|
you are failing miserably...
|
|
|
|
|
|
Joe Ziegler
|
|
att!lznv!ziegler
|
|
Part 6 - Networks
|
|
|
|
|
|
ACCESS NETWORKS
|
|
------ --------
|
|
|
|
For most credit card applications, the cost of the access network is
|
|
the single biggest factor in overall costs, often accounting for over
|
|
half of the total. For that reason, there are many different solu-
|
|
tions, depending on the provider, the application, and geographical
|
|
constraints.
|
|
|
|
The simplest form of access network uses 800 service, in one of its
|
|
many forms. Terminals at merchant locations across the country dial an
|
|
800 number that is terminated on a large hunt group of modems, con-
|
|
nected directly to the acquirer's front-end processor (FEP). The FEP
|
|
is typically a fault-tolerant machine, since an outage here will take
|
|
out the entire service. A large acquirer will typically have two or
|
|
more centers for terminating the 800 service. This allows better
|
|
economy, due to the nature of 800 service tariffs, and allows for di-
|
|
saster recovery in case of a failure of one data center. An advantage
|
|
of 800 service is that it is quite easy to cover the entire country
|
|
with it. It also provides the most effective utilization of your FEP
|
|
resources. (A little queuing theory will show you why.) However, 800
|
|
service is quite expensive. It always requires 10 (or 11) digits di-
|
|
aled, and in areas with pulse dialing it can take almost three seconds
|
|
just to dial 1-800. The delay between dialing and connection is longer
|
|
for 800 calls than many other calls, because of the way the calls get
|
|
routed. All of this adds to the perceived response time at the mer-
|
|
chant location, even though the acquirer has no control over it.
|
|
|
|
Large acquirers prefer to offer some form of local access service. In
|
|
this service, terminals at the merchants dial a local telephone number
|
|
to gain access to the acquirer. Typically, the local number actually
|
|
connects to a packet network, which then connects to the acquirer. If
|
|
the packet network is a public network, the terminal must go through a
|
|
login sequence to get connected across the packet network. Typically,
|
|
local calls are much less expensive than 800 service calls, and local
|
|
calls typically connect faster than 800 calls. The cost of those calls
|
|
are absorbed by the merchants directly. In those few remaining areas
|
|
where local calls are still free from a business line, this works out
|
|
well for the merchant. Otherwise, the merchant can end up spending a
|
|
lot of money on phone calls. Usually, the acquirer has to offer lower
|
|
prices to accepters who use local calls, to help offset this. Even so,
|
|
these networks are generally much less expensive for the acquirers.
|
|
Such networks are difficult to maintain, due to the distributed nature
|
|
of the access network. Since most packet networks are much more likely
|
|
to experience failures than the phone network is, the merchant's POS
|
|
terminal is usually programmed to dial an 800 number for fallback if
|
|
the local number doesn't work. Also, it is generally not cost-effec-
|
|
tive to cover every free calling area in the entire country with access
|
|
equipment, so some 800 service is required anyway. There is also an
|
|
administrative headache associated with keeping track of the different
|
|
phone numbers that each merchant across the country needs to dial.
|
|
When you have tens of thousands of terminals to support, this can be
|
|
formidable.
|
|
|
|
Acquirers are beginning to experiment with Feature Group B (FGB) ac-
|
|
cess. FGB access was the method of access used to get to alternative
|
|
long-distance carriers before "equal access" was available. The
|
|
tariffs are still on the books, and they are favorable for this appli-
|
|
cation. FGB access provides a single number, nationwide, for all mer-
|
|
chants to dial in order to gain access to the acquirer. The call has
|
|
simpler (hence, presumably, faster) routing than 800 service, and the
|
|
call is charged to the acquirer, not the accepter. FGB access does
|
|
have to terminate on equipment that is physically located in the Local
|
|
Access Toll Area (LATA) where the call originated, so there is the
|
|
problem of having distributed equipment, as above. This also implies
|
|
that it is not cost-effective to deploy FGB access everywhere, as well.
|
|
There are also some technical oddities of FGB, due to its original in-
|
|
tent, that have made it difficult to implement so far.
|
|
|
|
The other big switched access capability that is likely to have an im-
|
|
pact in the future is ISDN. So far, this has been inhibited by limited
|
|
availability and lack of adequate equipment on the merchant end, but it
|
|
could be very beneficial when these problems are solved.
|
|
|
|
Private-line networks are pretty straightforward applications of
|
|
point-to-point and multipoint private lines. Since private lines are
|
|
quite expensive, engineering of the networks is challenging. Usually,
|
|
sophisticated software is used to determine the optimum placement of
|
|
concentrators in order to minimize costs. Since tariffs, real estate
|
|
prices, and business needs change frequently, maintaining a stable,
|
|
cost-effective network is hard work. A typical asynchronous private
|
|
line network will have multiplexers at remote sites, with backbone
|
|
links to companion multiplexers at a central site. Synchronous private
|
|
line networks may use multiplexers, or remote controllers, or remote
|
|
FEPs, depending on the application and the availability of real estate.
|
|
|
|
INTERCHANGE NETWORKS
|
|
----------- --------
|
|
|
|
Interchange networks physically consist mostly of point-to-point pri-
|
|
vate lines. In many of the large interchange networks, there is a cen-
|
|
tral "switch" that takes transactions from acquirers (thereby acting as
|
|
an issuer), and routes them to issuers (thereby acting as an acquirer).
|
|
Often the switch provider will actually be an acquirer or issuer as
|
|
well, but this is not always the case. Usually, the provider of the
|
|
switch defines standard message formats, protocols, and interchange
|
|
rules. These formats and protocols usually comply with national and
|
|
international standards, but sometimes do not. Often the switch will
|
|
provide translation between different message formats and protocols.
|
|
|
|
The switch provider is generally very concerned that settlement com-
|
|
plete successfully. Failure to settle with one or more large issuers
|
|
can leave the switch provider with an overnight deficit of a couple
|
|
million dollars. Even though this is a temporary situation, it has
|
|
significant financial impact.
|
|
|
|
In some current networks, authorization and settlement take place on
|
|
completely separate facilities, with separate hosts in some cases.
|
|
This is mainly due to the history of the industry in this country. Re-
|
|
call that authorizations were originally done by voice calls, and
|
|
settlement was done by moving paper around. These two processes were
|
|
automated at different times, by separate means. Thus VISA has a BASE
|
|
1 network for authorization, and a BASE 2 network for settlement.
|
|
Likewise, MasterCard has INET and INES, one for authorization and one
|
|
for settlement. These functions are becoming less and less separated
|
|
as communication and computer facilities evolve, and will probably be
|
|
completely integrated over the next five to ten years.
|
|
|
|
Interchange networks are probably the most volatile part of the ATM
|
|
market right now. There is currently a shakeout going on in much of
|
|
the market, with larger, more aggressive regionals buying out
|
|
standalone networks and smaller regionals. This causes local banks to
|
|
change local and national network affiliation from time to time. So a
|
|
card may work in a given ATM one day, but fail in that machine the
|
|
next, which confuses many consumers. Most large regional and national
|
|
networks have operating regulations requiring labeling of ATMs and
|
|
cards, so that if you see the same logo on your card and the ATM, you
|
|
can be pretty sure it will work.
|
|
|
|
Some regionals are interconnected, and others are not. The two biggest
|
|
nationals, Cirrus and Plus, have operating regulations that effectively
|
|
prohibit a member of one network from connecting to the other. But a
|
|
regional on Cirrus could be connected to a regional on Plus. In that
|
|
case, whether a machine will take your ATM card depends on the routing
|
|
algorithm used. In most cases, the acquirer will have a table of issu-
|
|
ers that are directly connected, and will send anything else to the re-
|
|
gional switch. The regional switch will have a table of each issuer
|
|
it is directly connected to, and tables of which cards are acceptable
|
|
to other regionals it interchanges with. Anything else goes to the na-
|
|
tional switch. The same process happens in reverse from there. Often
|
|
the order of search in the routing tables is determined by fee scales,
|
|
not geography, so transactions can be routed in completely non-obvious
|
|
ways.
|
|
|
|
So the easiest way to tell if your card will work in a given ATM is to
|
|
stick the card in and try. I don't know of any machine that will eat a
|
|
card just because it can't route the transaction - it will generally
|
|
give some non-specific message about being unable to complete the
|
|
transaction and spit the card back out. Of course, if the transaction
|
|
is completed from a machine that you're not sure of, you also aren't
|
|
sure what the fee is going to be if your bank passes those fees on to
|
|
you. Sometimes the fee will be printed on the receipt, but usually it
|
|
isn't. If you do the transaction in a foreign country, you may not
|
|
know the exchange rate used. (I once couldn't balance my checkbook for
|
|
a month until I got a statement with the transaction I did at Banc du
|
|
Canada in Montreal.) But if you need the money and are willing to pay
|
|
the fee, you have little to lose by trying out just about any ATM.
|
|
|
|
This completes the course in Credit Card 101. Hope you all found it
|
|
enjoyable and informative.
|
|
|
|
|
|
Joe Ziegler
|
|
att!lznv!ziegler
|
|
|
|
|
|
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
|
|
|
|
Another file downloaded from: NIRVANAnet(tm)
|
|
|
|
& the Temple of the Screaming Electron Jeff Hunter 510-935-5845
|
|
The Salted Slug Strange 408-454-9368
|
|
Burn This Flag Zardoz 408-363-9766
|
|
realitycheck Poindexter Fortran 415-567-7043
|
|
Lies Unlimited Mick Freen 415-583-4102
|
|
Tomorrow's 0rder of Magnitude Finger_Man 415-961-9315
|
|
My Dog Bit Jesus Suzanne D'Fault 510-658-8078
|
|
New Dork Sublime Demented Pimiento 415-566-0126
|
|
|
|
Specializing in conversations, obscure information, high explosives,
|
|
arcane knowledge, political extremism, diverse sexuality,
|
|
insane speculation, and wild rumours. ALL-TEXT BBS SYSTEMS.
|
|
|
|
Full access for first-time callers. We don't want to know who you are,
|
|
where you live, or what your phone number is. We are not Big Brother.
|
|
|
|
"Raw Data for Raw Nerves"
|
|
|
|
X-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-X
|