News and insights

Customer Resource Centre

Card brand changes: June 2021

As your payments partner, we are committed to keeping you up-to-date with industry changes and card brand developments. There are 20 updates and reminders included here. Please scroll to ensure you act upon all which are relevant to you and your payments processing, to avoid potential inclusion in a non-compliance program and potential non-compliance fees.

All card brands – Avoid soft declines as UK deadline changes for Strong Customer Authentication

Although the Financial Conduct Authority (FCA) has extended the deadline for full enforcement of Strong Customer Authentication (SCA) in the UK for eCommerce transactions until 14 March 2022, the ramp-up has already started and non-compliant transactions now risk soft decline.

The FCA announcement, here in full, states the extension is to “ensure minimal disruption to merchants and consumers, and recognises ongoing challenges facing the industry to be ready by the previous deadline.” 
 

What you need to do:

You need to be ready to process SCA-compliant transactions right away in accordance with the agreed UK Finance roadmap. Although full enforcement has been pushed-out, the ramp-up to implementation started June 1, 2021. For example 70% of all in scope transactions will need to be SCA-compliant by September 2021. Transactions will be increasingly checked by issuers and non-compliant transactions risk soft decline. If you aren’t ready to process SCA-compliantly, speak to your Gateway provider.
 

All card brands – Transaction Risk Analysis for exemption to Strong Customer Authentication 
 

Strong Customer Authentication (SCA) means cardholders are better protected from fraud but it has introduced an element of friction into the consumer journey. SCA exemption for qualifying, low-risk online transactions - through Transaction Risk Analysis (TRA) - can eliminate that friction.

TRA can identify the balance between increased security and sales – alleviating cart abandonment brought on by additional security steps at the checkout. Elavon TRA showed transaction approval rates 3.6% above industry averages.
 

All card brands – 3D Secure 1 sunset

3D Secure (3DS) was designed to make online payments more secure by allowing cardholders to authenticate themselves and prove they are the owner of the payment account being used. 3DS 1.0.2 is the original version that was introduced over 15 years ago. The updated version of the specification, EMV® 3DS, was published in October 2016. It offers an improved approach to authentication, a wider range of data which allows for better fraud management and authorisation decision making and an improved online experience, particularly for mobile devices.

From October 2022, Visa, Mastercard and Amex will discontinue support for 3DS 1.0.2 and all related technology. JCB and Diners will also phase out support for EMV 3DS but a sunset date has yet to be announced.
 

What you need to do:

 If you are using an Elavon gateway, you have no action to take as we look after this for you. If you are using a third party gateway and aren’t already processing EMV 3DS, speak to your gateway provider to plan to support EMV 3DS 2.0 in advance of October 2022.
 

Mastercard - NatWest Group to switch all Debit portfolios to Mastercard

Mastercard and NatWest Group recently announced that NatWest Group were converting all the Banking Group’s retail and business debit cards to Mastercard. The agreement includes all NatWest Group brands: NatWest, Royal Bank of Scotland, Ulster Bank and Coutts, totalling 16 million cards. To facilitate the NatWest launch targeted for September 1, 2021, Mastercard have updated their bin files with the new NatWest consumer and commercial Debit Mastercard BINs. A production pilot is already underway, having started June 1, 2021.

A Bank Identification Number (BIN) is a unique reference assigned to an issuer for the purpose of issuing a card product.  Each BIN is unique to one specific offering that a bank has in its portfolio, whether credit, debit, prepaid, commercial.  The BIN is currently shown as the first six digits of the long card number on the front of each card product.

To aid customers that process recurring payments and card-on-file payments, Mastercard has updated the Mastercard Account Billing Updater (ABU) database with both the new Mastercard bins and the legacy Visa bins. Mastercard ABU helps card-not-present (CNP) merchants maintain the continuity of card-on-file and recurring payments, increasing customer satisfaction and reducing customer attrition due to payment disruptions.
 

What you need to do:
 

Mastercard is anticipating a concentrated and focused migration of accounts within a relatively short period of time. It is vital you update your systems with the new Mastercard bins as soon as possible to minimise the risk of authorisation declines on 16 million National Westminster Bank cards. 

If you’re using Mastercard’s ABU you’re strongly recommended to submit the legacy Visa bins (below) in their Mastercard ABU Enquiry files as soon as possible to update your systems with the updated card details.

• Visa Bins
   

  NATWEST Visa Debit → DMC
  VISA BIN	MC BIN
  475747	537301
  475751	537301
  431937	537302
  475746	537303
  475113	537305
  475113	537305
  459668	537307
  459668	537307
  475114	537308
  475114	537308
  475115	537309
  475115	537309
  428583	537310
  475110	537310
  475111	537310
  475112	537310
  431931	537313
  431932	537313
  431933	537313
  475748	537315
  475750	537315
  476239	537316
  476238	537316
  408376	537317
  475116	537317
  475117	537317
  475118	537317
  475119	537317
  475126	537317
  475123	537318
  475124	537318
  476237	537323
  428586	537410
  475127	537410
  475128	537410
  475129	537410
  475130	537410
  475131	537410
  475132	537410

   

Mastercard - Revised Standards for the Mastercard Site Data Protection program and forensic investigations

Mastercard is updating its standards for the Mastercard Site Data Protection (SDP) Program. It’s applicable to you as merchants and service providers, providing clarification around forensic investigations conducted by a Payment Card Industry Security Standards Council (PCI SSC) Forensic Investigator (PFI) following an account data compromise (ADC) event or potential ADC event.

The updates will also introduce the PCI Software Security Framework (SSF) that will eventually replace the PCI Payment Application Data Security Standard (PA-DSS), which will expire in October 2022.

The update also outlines a new risk based approach to the Level 2 Merchant compliance requirements and the PCI Data Security Standard (PCI DSS) Validation Exemption Program’s eligibility requirements.
 

What you need to do: 

The new PCI Software Security Standard will replace the Payment Application Data Security Standard (PA DSS) by 2022. All PCI Level 1 and Level 2 Service Providers must validate that any third party-provided payment application or payment software that they use is listed on the PCI SSC website as compliant with either the PA-DSS or the PCI Secure Software Standard, as applicable.

You should also note:

Enhancements to Level 2 Merchant Requirements and PCI DSS Validation - Exemption Program Eligibility Requirements

There is no longer a requirement for you to conduct an annual on-site assessment or self-assessment with a PCI SSC-approved Qualified Security Assessor (QSA) or PCI SSC-certified Internal Security Assessor (ISA) if you are using EMV1 payment tokens from token service providers (TSPs) compliant with Mastercard TSP Standards

Revisions Relating to Forensic Investigations

Be ready to provide all required information to support PFI investigations. Timescales for the provision of PCI Forensic reports to card schemes in the event of data breach will be shortened from 20-10 business days within which Mastercard must be provided with a final forensic report detailing the findings, conclusions, and recommendations of the PFI at the conclusion of the PFI’s investigation.
 

Mastercard - Data integrity for Credential on File transactions

Mastercard has initiated monitoring for the correct usage of the Credential on File (COF) indicator across all the Mastercard programs

COF is the process where cardholder details are stored against an account for use in future purchases and the COF indicator was adopted across the industry to allow you to communicate this pre-existing relationship with a cardholder to the issuer. The presence of the COF indicator will improve cardholder experience in eCommerce with higher approval rates and fewer false declines at digital merchants used frequently by a given cardholder.

Mastercard’s monitoring is to ensure that all Recurring Payments are flagged with the COF indicator.
 

What you need to do:

You should ensure that all Recurring Payments you process are flagged with the COF Indicator to avoid inclusion in compliance programs.  If you are using an Elavon gateway or POS Terminal, you have no action to take as we look after this for you. If you are using a third party gateway or POS Terminal, you should contact your service provider to ensure you are already compliant with this article.
 

Mastercard - Data Integrity for In-App payments

Mastercard has initiated monitoring for the correct usage of the Digital Secure Remote Payment (DSRP) cryptogram.

In August 2020, Mastercard announced the introduction of a new field to carry the DSRP cryptogram generated during authentication of remote commerce transactions such as via a mobile phone, key fob or any other token. This was to allow for the separation of the DSRP Cryptogram and the 3-D Secure Cryptogram also known as the UCAF data or Accountholder Authentication Value (AAV). This separation enables you to take advantage of the security of both the token and 3D Secure cryptographic data by allowing for the validation of both the authentication of the cardholder and the authentication of the token.

Mastercard’s monitoring is to ensure the correct population of the DSRP Cryptogram and the 3D Secure Cryptogram when a transaction contains both a token-generated cryptogram and an Identity Check AAV.
 

What you need to do:

If you are using an Elavon gateway, you have no action to take as we look after this for you. If you are using a third party gateway you should contact your gateway provider to ensure that the In-App Digital Payment Cryptogram Field is being used to carry the DSRP Cryptogram and the standard AAV field is being used to carry the 3D Secure Cryptogram when a transaction contains both a token-generated cryptogram and an Identity Check AAV.
 

All card brands – Reminder: Contactless magnetic-stripe sunset

Contactless magnetic-stripe data (MSD) transaction processing has been discontinued in Europe on new terminals since January 2012, and on new or replacement card issuance since September 2014.

This industry change was driven by the higher incidence of fraud associated with these payments.

This is a reminder that acceptance devices should not accept transactions using the contactless MSD path and should not flag transactions (sales or refunds) as if they had been processed as contactless MSD.  
 

What you need to do:

You should ensure transactions (sales and refunds) are not flagged as Contactless MSD.

If you are using an Elavon POS Terminal, you have no action to take as we look after this for you. If you are using a third party POS Terminal, you should contact your service provider to ensure you are already compliant with this article.  

All card brands – Reminder: How to avoid growing declines on your EMV terminals

After 20 years of industry-wide investment and proliferation of increased security, including contactless payments, card issuers are now declining unsecure face-to-face transactions (those performed by mag-stripe or keyed, where Chip & PIN would have been expected).

While general exceptions exist for transport, parking and toll-related merchants, all other card-present (face-to-face) environments are expected to have contactless-enabled terminals in place.

We are seeing relatively high approval rates on keyed and magnetic stripe transactions today, these decline rates are expected to increase throughout the remainder of 2021.

What you need to do:

If you are using an Elavon POS Terminal, you have no action to take as we look after this for you. If you are using a third party POS Terminal, you should contact your service provider to ensure you are properly certified to reduce the risk of fraud and subsequent declines.

If you have not yet deployed Chip & PIN or contactless technologies, you should do so as soon as possible to avoid declines and minimise fraud risk.

Below are some additional recommendations to optimise your approval rates for face-to-face transactions.

Visa - Point of Sale updates to support SCA requirements 

From April 16, 2022, acquirers and merchants in the European Economic Area (EEA) and the UK must ensure that point-of-sale (POS) devices comply with the latest contactless terminal implementation guidelines. This mandate does not apply to unattended POS terminals for transit fares and parking fees.

Visa previously announced that

• All newly deployed and updated contactless POS terminals in Europe must comply with version 1.5 of the contactless terminal guidelines effective September 14, 2019.
• All POS terminals in Central and Eastern Europe (Czech Republic, Hungary, Poland and Slovakia) must comply with version 1.5 of the contactless terminal guidelines effective September 14, 2019.
• Acquirers must be able to support Response Codes 1A and 70.

Since the SCA face-to-face regulation took effect in the majority of countries, Visa has monitored the usage of these response codes and their effectiveness at the point of sale. The outcome at the POS is generally positive with a contactless soft decline being followed by a successful PIN verified transaction.

Visa is requiring all POS devices across the EEA to be updated to comply with Visa Europe Contactless—Terminal Requirements and Implementation Guidelines, Version 1.5 no later than 16 April 2022; however, Visa strongly advises clients to update POS terminals as early as possible. Early adoption will as non-compliant transactions risk soft decline.
 

What you need to do:

If you are using an Elavon POS Terminal, you have no action to take as we look after this for you. If you are using a third party POS Terminal you should contact your provider to schedule upgrade to Version 1.5 as soon as possible; as early adoption optimises the customer experience at the POS and reduces unnecessary customer friction and declines, thereby benefiting both retailers and consumers. If early adoption is not possible, you should schedule this upgrade before April 2022.
 

Mastercard – Reminder: Correct use of POS terminal PAN Entry Mode

The POS Terminal Capability must be set only once for each terminal, and never changed. It should be based on the most sophisticated transaction type the terminal will be handling. All transactions – whatever type – must have that same POS Terminal Capability recorded against them. 

For example, if the terminal device capability is for Contactless transactions, but processing occasional MOTO transactions. Even those MOTO transactions should be tagged to correspond to the POS Terminal Capability of Contactless.

Mastercard issued this reminder as correct usage of POS Terminal Capability is checked by some compliance programs.

What you need to do:

If you are using an Elavon gateway or POS device, you have no action to take as we look after this for you. If you are using a third party gateway or point-of-sale terminal provider, you should check with your service provider to ensure you are properly certified and sending these values correctly to reduce the risk of increased fees or inclusion in non-compliance programs. 

Mastercard - PSD2 eCommerce approval rate optimisation program

Mastercard is launching a new program to optimise approval rates of eCommerce transactions that are subject to Payment Service Directive 2 (PSD2). Under PSD2 most eCommerce transactions require SCA unless an exemption or exclusion (like Merchant Initiated Transactions) is applied. Mastercard will monitor all intra-European Economic Area (EEA), plus UK, eCommerce transactions to check if EMV 3DS is used subsequent to a valid authorisation soft decline to avoid soft declines resulting in lost sales.
 

What you need to do:

It’s important that you implement a mechanism to automatically retry with an EMV 3DS authentication following a soft decline or always using EMV 3DS before sending an authorisation to avoid breaching performance thresholds, implemented June 1, 2021, which may result in your business being included in a non-compliance program.

If you are using an Elavon gateway you have no action to take as we look after this for you. If you are using a third party gateway, you should contact your service provider to discuss these changes. 
 

Mastercard - Revised standards for POI currency conversion/Dynamic Currency Conversion

Mastercard has revised the rules relating to the point of interaction (POI) currency conversion, also referred to as Dynamic Currency Conversion (DCC), for eCommerce and unattended transactions. The main rule changes are as follows:

For eCommerce:

When POI currency conversion is offered for an eCommerce transaction and the currency conversion option is pre-selected, the cardholder must be informed of the pre-selection and provided with the means to decline the currency conversion.

Before the cardholder is asked to select a currency in which the transaction is to be completed, the merchant’s website must clearly disclose the following language, verbatim, to the cardholder during the checkout process:

“Make sure you understand the costs of currency conversion as they may be different depending on whether you select your home currency of the transaction currency.”

For Priority/Express checkout:

Before initiating POI currency conversion for a priority check-out transaction, you must have an agreement with the cardholder that specifies all of the following:

The cardholder has been offered a choice of currencies for payment, whether a transaction should be completed in either the local currency or the billing currency;

• The cardholder has agreed that POI currency conversion will take place;
• The specific transaction currency agreed by the cardholder;
• That the cardholder expressly agrees to POI currency conversion;
• Any currency conversion commission, fees, or mark-up on the exchange rate; and
• If applicable, that the exchange rate will be determined by the merchant at a later time, without additional consultation with the cardholder.

If the cardholder actively chooses POI currency conversion, the transaction receipt must include the same disclosures previously provided to the cardholder.
 

What you need to do:

If you are using an Elavon gateway or POS device, you have no action to take as we look after this for you. If you are using a third party gateway or point-of-sale terminal provider, you should contact your service provider to discuss these changes.  
 

Visa - Best practices to mitigate risk of account takeover fraud

Visa is providing information about common account takeover fraud techniques, along with best practices to mitigate the risk of such fraud.
 

What you need to do:

Familiarise yourself with the most common account takeover fraud techniques and how you can best protect your business and customers here. 
 

Visa - Indicator required for consumer bill payment service transactions

Visa is launching its Consumer Bill Payment Service (CBPS) - an optional service for third party consumer bill pay providers who aggregate a consumer’s electricity, gas, phone, broadband, etc.

Currently, consumers often have to log on to multiple sites to pay their bills, many of which do not accept card payments. CBPS providers simplify the process by allowing consumers to pay all bill payments via card and via a single channel.

The CBPS program is intended to provide greater visibility and accuracy of transactions and will be governed by rules that are similar to those covering payment facilitators (aka aggregators).

CBPS has a participation fee and offers a set interchange rate (varies by region and country).
 

What you need to do:

If you are offering consolidated bill payments to consumers, please contact Elavon through your relationship manager or our customer service channels.
 

Visa - Deferred authorisations

Deferred authorisation occurs when a merchant cannot complete an authorisation at the time of the transaction due to connectivity, systems issues or other limitations, and completes the authorisation later.

As we advised previously, Visa has created a new indicator to be included in all deferred authorisation requests, with an implementation date from April 2021.
 

What you need to do:

Elavon systems were updated to support the indicator from mid-October 2019. If you are using an Elavon gateway, you have no action to take as we look after this for you. If you are using a third party gateway, you should contact your service provider to discuss these changes. 

You are also reminded to ensure adherence to general rules for the submission of deferred authorisations, namely:

• Deferred authorisation must be submitted within one day of the actual transaction date.
• Exceptions to this are businesses with a Merchant Category Code (MCC) of 4111 (Local and Suburban Commuter Passenger Transportation, Including Ferries); MCC 4112 (Passenger Railways); and MCC 4131 (Bus Lines). For these MCCs, transactions should be submitted for authorisation within four days of the actual transaction date.
   

Visa - Shared data security responsibilities when using a cloud service provider

With cloud infrastructure gaining popularity, if you outsource payment-related services to cloud service providers, it is important to understand the roles that both they and service providers play in the protection of Visa account data.

For example, cloud service providers typically maintain the physical security of the infrastructure, but you may be responsible for protecting the way the information is accessed. When moving payment-related activities to the cloud, an organisation must maintain a clear view on the scope of the cloud service provider’s involvement with regard to storing, processing or transmitting Visa account data. While the customer may outsource the maintenance of some controls to the cloud service provider, the overall responsibility for securing Visa account data remains with the customer.
 

What you need to do:

When moving payment-related activities to the cloud, customers must be aware of PCI DSS responsibilities that are shared across services and system components in order to ensure coverage in those areas. To avoid ambiguity and disputes, roles and responsibilities of each party must be assigned and agreed upon in writing. You are advised to document policies and procedures to support these agreements.

It is critically important that an evaluation by a PCI Qualified Security Assessor (QSA) or a knowledgeable staff member is performed to adequately determine PCI DSS scope. To document PCI DSS compliance, you may provide an Attestation Of Compliance (AOC) for your own environment along with an AOC from the cloud service provider demonstrating how data is protected in both. Together, these AOCs should cover the entire Cardholder Date Environment (CDE) and associated PCI DSS responsibilities. Taking these steps will help your business to avoid liability for losses resulting from an account data compromise.|
 

Visa - Updates to the current Credential on File Visa mark

Visa is requiring that all partners, acquirers and online merchants update outdated Visa marks used for credential-on-file, stored credential and online transactions.

In 2017, Visa introduced the updated Visa Brand Marks below (solid Visa Blue against a white card shape or solid white against a Visa Blue card shape) to be used for credential-on-file (COF), stored credential or online transactions. Merchants were given until April 2018 to implement the COF Visa marks. 

A recently conducted audit on eCommerce merchants around the world found that half (50%) are still displaying outdated versions of Visa brand marks (Visa Blue with Visa Gold wing).

New COF Visa Marks For Immediate Implementation

What you need to do:

Immediate action is required from all partners and online merchants to implement either version of the new Visa COF mark above in their stored credential / COF / online checkout locations as soon as possible if this has not already been done. This action will avoid the possibility of inclusion in any future compliance programs.

Up-to-date digital marks and brand guidelines can be downloaded from the Visa Merchant Fulfilment website here.

All card brands (except Amex) – Reminder: Eight-digit BINs 

A Bank Identification Number (BIN) is a unique reference assigned to an issuer for the purpose of issuing a card product.  Each BIN is unique to one specific offering that a bank has in its portfolio, whether credit, debit, prepaid, commercial.  The BIN is currently shown as the first six digits of the long card number on the front of each card product.

Due to a shortage of available numbers, all card brands are now working towards expanding the available ranges by implementing 8-digit BIN codes across their networks, beginning in April 2022.

By this date, all acceptance points will be expected to be able to correctly recognise an 8-digit BIN series, and to process the card accordingly.

What you need do:

Elavon is already working towards this goal with both our internal systems and the products we offer.

If you use BINs to drive your promotions and other solutions, you will need to ensure that your process can handle both 6- and 8-digit BINs in order to correctly identify new card products and most effectively target your promotions.

Examples of potential impact areas where six-digit BINs are used are listed below. Please note that this is not a comprehensive list.

• Transaction processing
• Merchant servicing and disputes
• Fraud management
• Data warehousing and reporting

Visa has developed a Numerics Initiative page as an additional resource to help prepare for this change.

Visa - New Visa rules on authorisation decline reason codes

Effective since April 2021, Visa has introduced new rules which:

• Cluster existing decline response codes into four categories and require issuers to use descriptive values when they are unable to approve a transaction
• Limit authorisation reattempts to a maximum of 15 over 30 days
• Data Quality – Category 3 declines exceed 25,000 attempts in a 30-day rolling period in Europe

In October 2021 Visa increases the rule to:

• Prohibit reattempts against certain response codes (Category 1)
• Require consistent use of the following key data elements in Merchant reattempts

o    Acquirer or Merchant Country
o    Merchant Category Code (MCC)
o    POS Condition Code
o    POS Environment Field
o    POS Entry Mode
o    Electronic Commerce Indicator (ECI) codes

What you need to do:

You will find all changes here, including new decline response reason codes, as advised by Visa. Please refer to the manual for the actions that you will need to implement to ensure compliance with the new Visa rules.

Please ensure that you amend your procedures and potentially systems to reflect the new Visa rules and to prevent re-attempting declines that may break the rules and result in increased fees. If you are using an Elavon gateway or POS device, you have no action to take as we look after this for you. If you are using a third party gateway or point-of-sale terminal provider, you should contact your service provider to discuss these changes.