Finding the Right Online Credit Card Merchant?

quark2universe asks: "In the world of e-commerce, there are many vendors who offer credit card merchant accounts as gateways to the financial world and there are many factors in determining which one to choose. How much is the setup fee/monthly cost/transaction fee? How robust is the API? Which ones will be around in 1-2 years? How secure are they and do they protect the consumers privacy?"

"I have personally used Cybercash and Ibill for business to consumer type of online transactions and have successfully brought these into production use, but I am about to start a new project where this decision will be needed and would like to know... Which online merchant do you use and why? Also, which merchants do the major players (Amazon, et al) use?

Please spare me the hype about B-2-B and the 2/5/7 trillion dollar industry that it will become. It may become a big deal, but you can bet that the major companies are the ones who will be landing these types of contracts, not you and me. I still think the B-2-C industry is viable and there are many facets that have yet to be explored. There are opportunities for individuals and small companies to "merchantize" Web sites, as long as it is not prohibitively expensive from the online credit card merchant."

Comments

American Express refuses to do business with iBill

[DavidOgg]

I dont know much about the issue, but I think its cocky for a cc to choose what I buy.

PayPal, perhaps?

[Animol]

PayPal is offering (in collaboration with XBank) a new business PayPal account option. I haven't read too much about it, but it's such a unliateral program that it might be worth c hecking into if nothing else.

And, since I gotta, use me (JArtis1@aol.com) as a referrer if you *DO* go that way...

Re:PayPal, perhaps?

[number11]

PayPal is working for me, though I don't do much volume. They're still in the process of getting their act together, and did have some nasty problems a couple of months ago.. some people weren't able to access their account for as much as a week, and there were reports of double-billing, which may have been related to system unresponsiveness (nothing happened, so you push the button again). They currently only accept payment from the US but say they have plans to expand internationally (as one might expect.. their investors include Nokia, Deutsche Bank, and Singapore Telcom). Will they be around in 5 years? Who knows? With their "personal" payment structure (no fees at all to the parties involved) they claim to make their profit from the float. That's a little hard to believe, given that my cc gives me a 1% kickback and is certainly charging _someone_ enough to cover that.

Long-term viability of B2C model

[Jon Erikson]

What can I say? I think you're wrong in assuming that small B2C sites are viable in the long term, and you're going to be wasting your time unless you're offering something that cannot be found elsewhere. And let's face it, this isn't likely. Most specialised market sectors already have thriving international mail order areas, and you'd be competing with those.

Only a few of the major players around today will be the ones to survive the B2C backlash which has begun. Amazon probably will since it has a decent customer base and a good brand name, but smaller sites, such as yours I assume, will find it hard to compete against larger and/or more established competitors that can make savings you cannot.

On top of that the security issue is a major one. As a consultant I've often seen companies involved in managing online financial transactions that could be hacked into by my little sister, let alone someone who knows what they're doing. To be truly secure you either need to go with a large, established player who has a decent reputation or, even better, develop your own. Not easy, but secure and you know nobody's going to be selling your customer's information but you.

---
Jon E. Erikson

Re:Long-term viability of B2C model

[panda]

I was going to moderate you up with "Interesting," but I chose to post a reply instead. I basically agree with you on your B2C comments, but I disagree with you on Amazon and in a subtle way.

Firstly, I don't think Amazon is going to survive long term. Yeah, they'll still be there in another 1-2 years, but to me that's short term. I don't think Amazon is gonna make it another ten years. Anyway, we'll have to wait and see how it plays out. They can't continue to hemorrhage money and stay in business, no matter how many customers they have. It's simple economics. Once the VC cash is spent and there's not profit, there's nothing but Chapter 11.

Secondly, while I don't think that the B2C model has much of a future on the web, I do think that the web offers smaller merchants and individuals an opportunity to reach a larger market with their unique wares for less money than any other currently available method. You're right though, the company or individual must be offering something truly unique in order to survive. However, in the case of individuals or extremely small companies (2-5 people) their survival needs (in terms of income) are modest compared to the big guys, like Amazon. So, it will be easier for an individual to keep an ecommerce site going as long as the balance sheet is positive.

While we're at it, I'll touch on the security issue. Yeah, security is paramount. You must protect the information that the consumer has provided to you from theft by others. This is really a liability issue. You don't want to get sued. As for your statement that no one else is selling your customer's info, well that's just preposterous. Banks, credit card processors, and credit reporting agencies are selling your information all the time. Why do you think you keep getting all those cold calls from companies you've never heard of, trying to sell you crap you don't need? It's because you have a credit card and everything that you've ever bought with it is available to the highest bidder.

You have no privacy, get over it.

Re:Long-term viability of B2C model

[TheReverand]

An open business model like say many eyes = many credit card numbers? Should companies share all their advertising ideas? Should they release "beta commercials" early and often? Has this worked for RedHat? How about Pearl? What are you talking about? For crying out loud, open source barely works in the software world, why would any business want to open up their sales tactics? What does "installing Linux" have to do with open sourcing your business?

You are about as ridiculous as a "let's open source Natalie Portman" post.

Re:Long-term viability of B2C model

[dingbat_hp]

I think you're wrong in assuming that small B2C sites are viable in the long term

Why on earth not ? I think the key here is "frictionless". OK, so that's yet-another piece of Marketroid-speak, but there's a core of truth in it. On the web, the little guy is nothing like as disadvantaged against the big guy as for IRL commerce. If you have a product, web commerce might be just the way to sell it. It's really not that hard to find a product niche that's narrow enough to make you a serious player in that field and the costs of getting on-line are now small.

I think we're going to see a resurgence in small scale manufacturing or importing. One or two people make a product that's distinctive, or can buy a cheap Chinese version of it and sell it with Western marketing (ie marketing by people who understand the Western consumer, not necessarily Western-style). The web hosting gets outsourced, and maybe even much of the fulfillment. Easier than running a physical shop, and you don't have to spend all day sitting behind the counter waiting for customers.

A useful parallel is Japanese outsourced manufacturing in the '70s. Much of the component production or module assembly was done by small family businesses, working in a space the size of a garage. Traditions were such that even large corporates weren't afraid to buy from a tiny supplier, if they could make a product worth buying. In the West we threw these people out of the manufacturing chain from Ford's day to their eventual extinction in WW2.

Re:Long-term viability of B2C model

[density]

Only a few of the major players around today will be the ones to survive the B2C backlash which has begun. Amazon probably will since it has a decent customer base and a good brand name, but smaller sites, such as yours I assume, will find it hard to compete against larger and/or more established competitors that can make savings you cannot.

If you were being asked to invest, it sounds like you'd say no. Which is fine. But you are really talking about the short term viability of B2C, not the long term. There are consumers, there are businesses, therefore, B2C: one does not need to aspire to becoming Amazon; all you need are enough customers to keep you profitable. As a consultant, I'm sure you realize that efficient online marketplaces (called B2B) are what enable efficient B2C. So first forget about that remark you made about "more established competitors can make savings you cannot" -- for the long term. You would have to deny that B2B decreases transaction costs, aka the "economies of scale" in the physical world. The whole point of B2B is to break that down, and B2C will therefore benefit. The huge merger activity we are seing is evidence to the contrary - B2B has not worked yet. Not yet. All the B2B investors think that it will. Long term - we're talking five, ten, twenty, fifty years. Not tomorrow.

Second, the "major players" will never, ever, I repeat, never ever be able to provide worthwhile personalized service (despite AI and buying circles). Big organizations will be focused on the profitability of individual customers if they attempt to maintain a customer relationship rather than being an anonymous storefront. There is - and will be - tremendous opportunity for small B2C outfits organized around real personalized services for specific markets - as small as they wanna be - who tap into online marketplaces and specialize in custom, small quantity one-off manufacturing (remember that efficient B2B thing) to do what no Amazon could ever do. In this way the internet means the destruction of the mass market in the long term, which as B2C written all over it. But long term. Probably not in the next few years.

But you're right to criticize individual B2C outfits today, as B2B is so obviously where it's at, except for half.com, who claims they are C2C (and zero to $300 million in 9 months proves... um, something.)

Re:Long-term viability of B2C model

[Snocone]

So, can you suggest a country in which communism failed that did well under a capitalist system?

Hmmmmmmm... consider the post WWII development of:

East Germany/West Germany.

North Korea/South Korea.

China/Taiwan.

Just how many would you LIKE?

Similarly

[grahamsz]

Does anyone know of a decent merchant that will handle transactions well in uk pounds and preferably with support for euros too?

I'd like to find one that isn't for the sort of 'dumb webadmin' where they run all your shopping carts for you. I want a proper one that I can invoke from my own server, presumably by https that will leave my site feeling proper and professional.

Certainly I'm not overly impressed with some credit card systems online. The worldpay one is ugly and kept spawning new windows and using javascript refresh's to the point that even I (who regularly have about 50 windows open) was struggling to keep the plot. I've had other ones that dont properly track users and due to the fact that my modem connection broke midway through ordering they billed me twice (even though i was using a fixed IP dialup at the time i think). Surely that sort of inefficiency is inexcusable - especially considering 5 months later they STILL haven't refunded the money. Not wanting to name names there are better places to get domain names like www.freeparking.co.uk.

Re:Similarly

[lurcher]

Well we use datacash, http://www.datacash.com works great for us, just a couple of perl scripts to talk to their server, the rest runs on our server. They work with any number of different currency's but we use sterling, usd and euro.

bizrate could probably help you

[pixel fairy]

bizrate rates online merchants and has an extensive database.

Online bank...

[deefer]

This is the most important step in the consumerisation of the net. What businesses need online is a quick, easy way of getting hard cash from your pocket. Some netizens don't mind putting their credit card details into a form on the web, some don't. Myself, I can tell if the website is secure enough, but a lot of places redirect you 5 times before you can actually put your details in. I though about this a while back, and it's not the work of a cheeky little dotcom startup (damn, better cancel the order for that Ferrari! :). Let's call this deeferbank.com.
Because of the global nature of the net, currency variations will kill this idea quickly. Say I put money into my deeferbank, in UK pounds. When I buy something, I can quote my bank details & do the encryption dance. The website I have just bought stuff from then gets sent the money in local currency from deeferbank. This is necessary for the small business who don't want to have to accept 10 different currencies online - deeferbank takes care of it all. So, at deeferbank, I am now exposed to the various vagaries of the currency markets. That is not the area for a dotcom to be in.
So I am shocked that some of the major banks haven't jumped on this already.

The world needs a new currency, which for the sake of argument I will call the eQuid.
You buy eQuids at the prevailing exchange rate, similar to the Euro. Online, everyone is therefore equal, small business are insulated from the worst swings in currency speculation, and consumers get to pay the price that the website stated, without any weird FX shift stuff when the bill finally arrives. Every site knows what an eQuid is, and where they are brokered.
So, there we have it. Introduce a new currency for online trading; it's the only way to ensure a level playing field for small and big business alike.

Strong data typing is for those with weak minds.

Various options

[rjwoodhead]

If you're accepting credit cards online, you basically have 3 options:

1) traditional merchant account (about $30 a month) + lower discount (% of each charge, usually 1.5%-3%) + per-charge flat fee ($.25 to .35).

All the major players have decent methods for integrating their system into your site, everything from hosting the whole shopping cart to various flavors of "your cgi page calls our cgi page, we do the transaction, we redirect back to some cgi of yours with the results". The hackery involved is trivial.

After having problems with one provider who had an annoying habit of randomly double-charging customers, I settled on Anacom and they've been flawless. They've also been around a while.

Option 2 - charge without a Merchant Account. You pay about 1% more on the discount, but unless you're doing $3000 a month in sales or more, you still come out ahead. ProPay seems to be the leader here, but I have no personal experience with them [some of my SelfPromotion.com users have recommended them, though.

3) Indirect, using a web-bank service like PayPal, which just announced a business service. The rates seem a little better if memory serves, but the downside is that people have to be paypal users to use it. My advice is that you should offer PayPal as an OPTION along with (1) or (2) above.

Best,R

Re:Various options

[BBspot]

I use method #2 on my website for selling t-shirts. For this I use CCNow and have been happy with their service so far. They charge 9% commission, and they offered everything I was looking for.

1. Ability to handle international transactions.
2. Integration into my own site.
3. No monthly fees.
4. Freedom from worry about sales taxes.

Brian
"A witty saying proves nothing."

Small companies get B2B

[GreenLantern]

I must first of all comment about B2B and small companies. We are small and most (80%) of our customers are B2B. In fact these are the businesses we target as they can actually afford to build a "REAL" website.

On the CC Front, we have a reseller agreement with a local merchant account company. One of our employees specializes in this area. We have connected our customers sites with both CyberCash and AuthorizeNet. We actually prefer AuthorizeNet. They have a virtual terminal customers can use to run cards manually, a real plus. I have read reports about up time problems with Authorizenet but I have had very few problems. AuthorizeNet is also more cost effective than CyberCash.

Credit Cards...

[DustyHodges]

As far as things like this are concerned, I'm not really a big fan of Credit Card Companies... I would much prefer to use something like PayByCheck.com, much as Tom Smith does. They charge you less, and more people can buy your product. Sounds like a good deal to me.

Re:Credit Cards...

[Junks Jerzey]

As far as things like this are concerned, I'm not really a big fan of Credit Card Companies... I would much prefer to use something like PayByCheck.com, much as Tom Smith does. They charge you less, and more people can buy your product. Sounds like a good deal to me.

That's not a smart business decision, at least not right now. The majority of people are comfortable using credit cards and would prefer them over a service they aren't familiar with. A business owner can't afford to say "I hate credit cards; I'm not going to let my customers use them."

Re:Credit Cards...

[pucker up]

They actually charge you more. The standard fee per transaction is over a dollar. If you deal directly with a bank (bypassing cybercash, etc., who go through a bank anyway) you can get rates as low as 1-2%, and transaction fees become highly negotiable as sale volume increases.

Ones to avoid...

[pixelix]

In my admittedly limited experience of setting up online merchant accounts for people (ie. I've done it twice) I've found a couple of stinkers.

These are, netbanx.com and planetpayment.com.

Reasons:

Netbanx: thoroughly unprofessional, aimed at the idiot using Frontpage or Actinic Catalog, no answer whatsoever at technical support (that's both email and phone, folks), took 2 MONTHS to set up the account, obscene charges, takes 60 days for Netbanx to release payments to the account holder.

Planet Payment: have been trying to set this account up for over 5 MONTHS now, have been sent usernames and passwords for their 'payment gate' only to find that they don't work - to be issued with some more, again not working passwords, very US centric, and obscene requirements (we had to fax copies of the director's damn PASSPORTS to them!).
--
jambo
system.admin.without.a.clue

Why use CC? Use Pay-pal & E-Gold?

[MikeFM]

CC's f^%* over both the merchant and the consumer so why bother? Use PayPal, they can handle credit cards in their backend I believe. Myself I like E-Gold. Has anyone managed to get the MD5 signature from an E-Gold transaction to match up? Doing it under PHP4 doesn't seem to work.

Re:Why use CC? Use Pay-pal & E-Gold?

[MikeFM]

Which again makes me wonder why a vendor, especially small vendors, would want to go through the expense and hassle of dealing with credit cards. For the small home business they are expensive and hard to break into with a long list of risks and hassles.

As a consumer (and someone who has had to stoop to selling credit card packages from time to time) I also have to note that a lot of credit cards aren't nearly all they claim to be. Sure they protect the people in the better programs but often they screw over anyone they don't think would have enough $ to make a decent lawsuit against them.

There is no good deal for CCs on line

[Trinition]

A recent study, I think by the Gartner Group (I don't have the link handy), discovered that online transactions are charge, on average, $1 more per transaction than similar transactions in brick & mortars.

So, choose who you want, but you won't get a good deal.

shameless pitch

[Sensor]

Well I work for an e-commerce consultancy in the UK and we have developed a payment gateway which is available either as a boxed product of as a managed service. Its currently in use in serveral contries as the back end card processor for several major Telco e-commerce offerings.

Integration is via a very simple thin API (using Baltimore libraries to protect card details in transmission if its a remote site) - we have language bindings in C, Perl, Java, TCL (I think), ColdFusion and a COM object for ASP's on win32 platforms.

Assuming that you want a managed service then we charge is a flat 1% of transaction revenue (on top of whatever your aquirer charges) and provide secure online authorisation, settlement, credit and reversal functionality - the ability to process a large number of different card types (MC, Visa, Amex, JCB, Delta, etc...).

In addition the bureau provides fraud detection functionality (card velocity checking, blacklists, max/min order values etc...)

If you're interested then take a look at

http://www.commercelink.co.uk/
(appologies for the ugly site - its being rebuilt)

or drop me an email

cheers

Tom

Check out datacash.com in the UK

[Paul Crowley]

UK side people might want to check out my employer, DataCash Ltd (www.datacash.com). We provide credit and debit card clearing to quite a few big players in the UK, including Tiny Computer Ltd., Epson UK Ltd., Breathe.net and QXL. We do multi-currency, and we support lots of clearing houses (Barclays, NatWest, Amex, Bank of Scotland, Royal Bank of Scotland, HSBC, Girobank)

As far as I can tell, we're the most clueful PSP in the UK. I think we're the only ones to have done a proper re-implementation of the banking protocols, and our solutions are implemented using Perl running on Linux. Our client-side code is all open sourced using the X11 license, and we provide Perl, C, and Java implemetations for Unix and NT, as well as more than one shopping cart implementation. And we have some really cool stuff lined up, including eFalcon fraud detection and some other things I can't talk about just now.

My work address is what you might guess (the local part is "paul"), so feel free to mail me any questions, though where appropriate I reserve the right to pass them on to the enquiries address in London!
--

Serious Advice

[AndrewD]

On two points:

First, Whoever you go with, read the terms and conditions before you sign up. They do differ, and if you're in the US, your protection against unfair contract terms is very weak indeed (by the standards I'm used to). A couple of hours patient and careful reading (using a photocopier to blow the small print up to A3 helps lots) and comparison will pay dividends. It's rarely harder to understand than source code, and usually a lot easier.

If there's anything you don't understand, that's what lawyers are for (and, incidentally, pitching up with a prepared list of questions will endear you no end to your lawyer and take quite a lot off the bill.).

Second, If you're in the UK, or for that matter anywhere in the EU that has already implemented the Data Protection Directive (I think everywhere has), then you have an obligation to make sure (no further than asking, nicely, for a warranty that this is so) that the card supplier has proper data protection in place.

I've had more than a couple of these across my desk in the last three months, and most of them refer to the last Data Protection Act (the 1984 one now nearly completely defunct) and none at all - prior my ministrations - spoke at all of the need for someone in the relationship to take care of the obligation to process data fairly.

As usual, this is general advice - and on the first point about as general and obvious as "don't forget to eat, sleep and breathe" - not specific recommendations for your circumstances (which I'm almost certainly not licensed to give in your jurisdiction). Anyone daft enough to rely on stuff they find on the web when making decisions that might cost them money or liberty is probably dim enought to try suing in spite of a clear disclaimer, so I'm not really sure why I bother with this.

From the processors point of view...

[n2Brian]

My company is a small company that has been processing credit card for several years now. We have the same certifications as a Cybercash/Verisign but we're much much small and can charge much less.

There are a number (over a dozen) small companies like ours that offer credit card processing and do it better (in many cases) than the big guys. You get better rates and MUCH better customer service will a smaller company.

There are other things you need to watch for that credit card merchant providers don't tell you:

1) Many merchant accounts have a ratio of USA to International credit cards they can accept (example, you must processes 5 US cards for every 1 international card to maintain the lowest rate).

2) There are always hidden fees, make sure you understand them. The common fees including a minimum monthly amount, statement fees, address verification, voice processing, chargeback research, mailing fees, keyed vs non-keyed rates, etc....

3) There are a lot of people that advertise low merchant rates but they are quoting "Merchant is present, you see the card and you have checked the person's ID" rates. The fine print might state that the "MOTO" (mail order-telephone order) rate is a full percent higher (and more in some cases)

4) Make sure your gateway uses some form of encryption. Many gateways out there, including some very popular systems, provide binary files for their API and you have no way of knowing how it works and if it is secure or not.

Plug:
We private label our API seprately and as part of our instant e-commerce builder at http://www.n2plus.com. Lowest rates around. E-mail me directly if you have more questions, I've been processing credit cards on the net for 6 years as a business.

Moderate up--Online Merchant Accounts explained

[BoLean]

For those who haven't tried running a retail business online, here is a basic description of how it usually works.

1. Customer clicks link to add item to shopping basket.
2. When order is complete customer submits order to CGI based program for processing. This could include adding tax or shipping. This may also pass them to a secured gateway. Personal information, shipping information and credit card info is entered.
3. Customer hits the final order button and the order is processed through the secure gateway.
4. Request is sent by the CGI program to the merchant services and order details sent to your company.
5. You process the order, when ready for shipping you contact the Merchant Services and "Batch" or process the credit transaction to recieve funds. In most cases you should not charge the account until order is shipped. Most merchant services require you to batch nightly or they will charge you extra/ charge you a extra fee.

For you, the retailer, there are many important issues involved. You have the shopping basket application, secure CGI gateway, Merchant services, order processing and tracking, inventory and payment/order integration into your backend accounting package. This amounts to a lot of work especially for a smaller retail operation. There is a lot of responsibility involved (read liability) in handling credit card information. There is a lot of somewhat difficult programming involved integrating your frontend into the merchant account backend and providing a secure ordering environment. And last, but certainly not least, entering the transactions and inventory changes into your accounting/inventory software.

When looking for a good merchant services company there are many things to consider besides what fees are involved. Many merchant companies are adding extra value by providing extra services that make things easier for you. Maintaining your website, filling orders, maintaining inventory and keeling you accounting books current is quite a bit of work. Messing with CGI and worrying about order security are somthing you should look to your merchant services provider for.

With all that said, the best, easiest system I've been thus far is GoEmerchant. They provide the secure payment gateway and merchant services. They can even host your website with little extra charge. They will custom format emailed sales reports so you can easily import them into your accounting package backend. This product is realted to Cybercash. No, I'm not a salesman, but I've done a lot of research after having tried it the hard way with traditional merchant services. Just check these guys out along with the other services that are appearing to make life easier for Online retailers.

Re:How does PayPal do it?

[John Murdoch]

Hi Dan!

Funny you should mention this. The question of whether PayPal is liable in the event of a fraudulent auction is very much in the news (here is the article on MSNBC.

Short version: some wise guy auctions off hard drives on Yahoo! to a steady stream of customers. Encourages auction "winners" to pay by PayPal. Those who paid by check got their mail back from the U.S. Postal Service saying no such address exists--those who paid by PayPal got zip.

PayPal is emphasizing that they are a means of facilitating exchange between two parties--they are not a credit card, and they are not a bank. Their terms of service explicitly deny any responsibility to either party in a transaction if the other fails to do something (like ship the goods).

In other words, PayPal is covered legally. How PayPal will fare in the court of public opinion may be another question. And yet another question is whether PayPal will be able to escape the attention of the U.S. government. What PayPal is doing, after all, looks very very much like a bank processing EFT (electronic funds transfer). The courts are going to laugh at Indianapolis regulating video games--but they won't have any problem at all with the idea of the federal government banking authorities regulating an e-business that looks, walks, and sounds like a bank.

I'll reply in another note on a slightly different thread.

Re:How does PayPal do it?

[John Murdoch]

Hi Dan!

The way PayPal works is that each person is depositing money with PayPal. You can deposit money with PayPal by writing a check, by charging your credit card, or by giving PayPal permission to charge your card. PayPal permits you (the whole point is to encourage you) to trade PayPal play money with your friends--such as on auction sites. PayPal promises that any time you want your money back, they'll send it--by crediting a credit card, or sending a check, etc. The result is that PayPal is the merchant that is charging the credit card--not the seller in an auction. Both the buyer and the seller are PayPal customers.

Note that PayPal is free. How do they make money? MSNBC notes that they have racked up 2.4 million customers. If each has $50 in PayPal credits, that's $120 million of no-interest capital that PayPal has to play with. Given the number of semi-pro computer hardware merchants on EBay that are hyping PayPal, I'd bet that they have even more money than that. Even at a meager 5% return on investment, that's $6.0 million per year in revenue. Not bad for a B2C e-commerce business.

I'm asking because I'm looking for a way to do something similar myself--to be able to process CC transactions without requiring my (very small) customers to each get merchant accounts.

I have looked into the same thing. I'm a (very minor) official of the U.S. sanctioning body for one of the horse sports. Our competitions are organized by local promoters--each promoter will typically run one or two events a year. A lot of organizers want to take entries over the Web--but accepting credit cards is a stumbling block. (More precisely, paying a $35 monthly fee 12 months out of the year in order to accept payments in the month of August puts a lot of people off.)

The financial and technical solution is to have the sanctioning body act as the merchant--the money is paid to the sanctioning body, which in turn transfers funds simultaneously to accounts managed by the local organizer. This is much more palatable for the credit card processors--they get a large organization processing hundreds of thousands of dollars per month. BUT--it requires a measure of trust between the local organizers and the sanctioning body. That's why I said we have the financial and technical solution, as opposed to the political solution. (The organizers pay fees to the sanctioning body--they fear, probably correctly, that some day some bright light is going to realize that the sanctioning body could just take the fees right off the top. They want their money, and they want to determine how much gets paid to the sanctioning body at what time.)

If this looks at all like your situation, I think the financial and technical part is easy. The really big question is the political one--is there a strong bond of trust between the small not-quite-merchants and the parent entity? If there is, then the solution works. If there is not, I'd strongly recommend not pursuing this--just a little bit of mistrust can lead to terrible squabbling.

Signio...

[mandelbaum]

We use Signio...I mean VeriSign payment services, they are really good. flat monthly fee, really good and easy API that can also support checks and corporate cards if you like. They support all kinds of platforms, and they even have a pure java client. They process very quickly too..

We also use Wells Fargo for the acquiring bank which doesn't do a per transaction fee.

http://www.signio.com/
http://biz.wellsfargo.com/products/merchant/inte rnet/internet.jhtml

I use paypals

[www.sorehands.com]

I have had no problem using paypals.

There is no cost to it, but it does take 3-5 days to transfer money in your paypals account to your linked bank account.

I'm not complaining, but are trying to use the float to make money. I'm not blaming them, I'd do the same myself.

Field Report: Intuit

[BaronCarlos]

Inside the walls of the QuickBooks Technical Support Network, I know of VeriSign (formerly Signio) which is the outsource for the merchant account servies for Quickbooks, and Quicken I believe. They are already building a reputation for service, and reliability AND they take American Express.

But, in my experience, it is not going to be the organizations themselves that will be the deciding factor, but rather the software. (At least in the public sector). If you are a developer, or designing your own, it definatly is the company.
*Carlos: Exit Stage Right*

"Geeks, Where would you be without them?"

Setting up my website right now...

[pjrc]

It was interesting seeing this on slashdot.

<shameless plug>
I'm in the process of setting up on-line ordering on my website right now. Most of the website is technical resources for building electronic projects using embedded processors. A recent addition, that we expect to need the on-line ordering for, is the open source MP3 player, which today is a primitive first generation design, but hopefully soon I'll have a nicely redesigned version.
</shameless plug>

Fortunately, my partner is an accountant, which has really helped. She set up a proper visa merchant account with our bank. It cost $100 up front. They take $0.65 per sale, plus approx 3%. There's a minimum $15 monthly charge, so hopefully we'll actually sell at least $500/month. The visa charges are entered using a touch-tone phone, so we didn't have to buy any equipment. They offer a terminal, for (I think) $450. With the terminal, we would get a per-sale charge of $0.07, and a little lower percentage of the sale, about 2.5% as I recall. They let you buy and add the terminal anytime you want.

It looks like there's a free software package called CCVS - Credit Card Verification System which allows your linux (or unix) box to emulate a terminal (requires a dedicated modem)... but there's a catch. It needs to be loaded with an encryption key. Redhat sells these keys for approx $1000. If anyone knows someone who can provide a key for CCVS for less, please contact me. Robin found a similar windoze based program, where they wanted a monthly charge and some percentage of the sale, on top of the percentage taken by the bank! Not cool, but I wouldn't run a windows server even if it was affordable.

Setting up the SSL stuff on the webserver is relatively easy, but you need a cert. VeriSign charges $350, so we went with Thawte, who only wanted $125 (even though they're now owned by Verisign). Again, robin did most of the work there. I generated the CSR from the server software, and she faxed them copies of our LLC papers and other business stuff. About a week later we got the cert. The cert lasts for only one year, you it looks like we have to pay $125 every year. I hope they don't jack their price up to Verisign's level!

Robin ran a test charge onto her credit card a couple days ago, and it seems to be working very nicely. The merchant appears as "PJRC.COM, LLC", which I think is much cooler than "ibill...some number".

For the on-line shopping cart, I looked at a couple of them, but they didn't have that look and feel that I want for my website, so I've been rolling my own. It's turned out to be a bit more coding than I originally thought, but still not too bad, and I'm really happy with the results. When the order is confirmed, the code just sends Robin and I an email, and makes sure the data stored in our database really matches what they filled out on the form.

I'm putting the final finishing touches on the cgi scripts right now, and hopefully it'll be on-line later tonight!

My two cents (minus 14% transaction fee)

[aiken_d]

This is a much more complicated question than it sounds like.

As several people have noted, you basically can choose to get your own merchant account, or use a third party to effectively resell your goods or services. That's the easy part.

Getting a merchant account for an online-only business is very difficult. If you've been in business for at least two years in the real world, it will be easier.

However, I would strongly advice against the merchant account approach unless you're willing to provide real live customer service at least 12 hours a day, 5 days a week. 24/7 is better.

A key metric that credit card companies look at is chargebacks. Chargebacks are when a consumer disputes a charge, claiming either that they didn't make the charge or that the goods/services were not as advertised.

If you go over 1% in chargebacks, watch out. If you hit 2%, you're all but certain to get your merchant account revoked.

That sounds easy (just run an honest business, right?), but it's not. Credit card companies exist to serve the consumer, not businesses. Many consumers have found that it's easy to get free stuff by disputing lots of charges, especially internet charges. The burden of proof is on you to show that every one of these people did actually get and use your goods/services.

Hopefully I've convinced you to use a third party processor. Now, the question is who. This comes down to three key elements:

1) Are you selling goods, services, or both? Services include web site access ir intellectual property.

2) Are you in the adult entertainment industry?

3) What monthly transaction volume do you expect to do?

The first question is critical. Paypal only does tangible goods, Ibill only does services. You've got to find a processor that handles your kind of transaction.

The second question is important. Many processors refuse to to business with adult entertainment companies because, let's face it, many of those companies are unscrupulous, unprofessional, and untrustworthy.

Chargebacks are typically higher with adult content, both because many adult businesses are misleading ("FREE! Just give us your CC# to prove your an adult" often turns into a $59.99 charge), and because consumers are more likely to dispute adult charges ("No, Honey! I would never have signed up at cumslurpingteens.com! Someone must have found my credit card on the internet! I'll dispute the charge!")

And, finally, the third question (processing volume) will determine how seriously you are taken by your processor. If you can pull about us$20,000/month or more, you'll start to get some special treatment which will reduce chargebacks and generally make life easier. If you're going to be doing this kind of business, ask your processor if they have a premium accounts department, and what the threshold is to qualify.

Ok, so we've covered picking a processor based on your needs. Now let's move on to things to look out for:

1) Retroactive fees/chargebacks. One of the large processing houses really screwed its clients over a year or two ago by imposing huge, retroactive fees. Basically the processor (DMR, if I recall correctly) got in trouble with Visa for too many chargebacks, and Visa levelled a multi-million dollar fine, as specified in the merchant contract. Rather than eat this fine, DMR passed it on to their clients -- by withholding their revenue until they had met their portion of the fine. Ouch! It was ugly. Check to make sure your processor won't do this. Look for language in the contract that is fishy.

2) Financial stability. See #1. Do some research to ascertain that the processor is stable, pays on time, doesn't bounce checks, etc. Ask for references, how long they've been in business, etc.

3) Internet connectivity. If people can't get to your processor, they can't pay you. Is your processor colocated on both the east and west coasts at a Tier 1 provider? Or do they have a 384kbps frame from Joe's Internet Service in Milwaukee?

4) Internet political considerations. Ibill has been in several well-publicized scrapes with the RBL, but it looks like that may be over. That probably means the RBL will turn their attention to other processors. Much as I think the RBL is a bunch of power-hungry thugs, they bear paying attention to. Check that your provider has anti-spam policies, doesn't specialize in hosting spammers' accounts, and ask if they promise to capitulate to any demand the RBL may make. It's ugly, but there's not much you can do about it.

You'll note that nowhere in here do I mention rates. Expect to may almost 15% for a respectable processor that also handles customer service. Yes, that's a lot. But it's cheaper than having a full time employee to answer the phone (Visa and MasterCard merchant account contracts explicitly say that real live people must be available by phone). As volume increases, you'll pay less. But it's worth it at 15%.

Hopefully that's been helpfull. I have a lot of experience in this area, and would be happy to share more specifics. Drop me an email if interested.

AuthorizeNet and other experiences

[MrJ]

I'm developing the CC backend for a company and we went with AuthorizeNet. We tried using Ibill for a short time, but their customer service was terrible (responsive but mean) and the restrictions were ridiculous. We were also harassed by a CardServices "agent" who called us a "dictator" like "Hitler or Saddam Hussain" and insisted that we have relationships problems with women when we refused to sign up, so we really look down upon that company. I couldn't find an e-mail address on the main CardServices site to complain to, which seems very bad for a company that does business online.

AuthorizeNet has done pretty well and has reasonable response time on their support. However they did have a several hour outage last week for unknowns reasons. They never told us what happened before, during, or after. (I assume an NT-powered database crashed and took half the day to reboot/restore.) Other than that it's been real nice. They have several interfaces you can use, although the documentation isn't complete yet. We're using the one where we accept the credit card info (for recurring billing later) over our secure server and then send it to their secure server gateway with an https POST. They process it and send back a simple delimited response about how well it went. This is easily implemented in perl, and I'm in the process of rewriting our current interface to their system as a perl module.

Avoid IBill, Cardservice is mediocre

[Tim Macinta]

I run kmfms.com and I've been trough two merchant providers so far. IBill was the first and the worst. I was aghast to encounter some of the bugs in their system that they left unchecked. A particularly nasty bug (no pun inteded) was that my customers would have pornographic items appear in their shopping carts, and that is certainly not what I'm selling. The first time it happened I thought some script kiddie was messing with the system so I yelled at him and yelled at IBill for letting him put things in his cart which I don't sell (IBill would have actually billed him for this too if I hadn't caught it). I reported the bug to IBill and they said they would get right on it, but of course it remained unfixed weeks later (and perhaps still). I felt really bad later when I found out it was totally IBill's fault. I was testing some changes to my website and for the heck of it I tried submitting an order. Lo and behold, what did appear? Pornographic items in my cart! Well, after unsuccessfully trying to deal with IBill's unresponsive support, I dropped them and moved on. For those of you wondering why porn would randomly appear in the shopping carts, I read somewhere that the vast majority of IBill's merchants sell adult products. My guess at what was happening was that their code was so poorly written that different users' sessions got mixed together (perhaps they were generating non-unique cookies for user ids).

Shortly after IBill I switched to Cardservice. I was a lot more impressed with the flexibility of their system right off the bat, and I would still say that is one of their best qualities. The problem that I had with them was that the person who set up my account, Michael Wentzell, did so improperly such that all of my transactions were creditted to a different user's account (funny thing, though, they had no problem deducting the montly fee from the account that was supposed to have been creditted). After a month of not recieving any credits (it was supposed to take around 48 hours after a sale, but I wasn't sure of this) I called Michael Wentzell up to see what was going on. He said that he was sorry about the problem, that he had found it, and it would be fixed within a week. Well, it wasn't fixed. I called him back about two weeks later and he told me the same thing. This game of me calling him and him telling me it was fixed now went on for several months until I got sick of it and went over his head to Cardservice's corporate headquarters. It was an absolute nightmare trying to get them to fix this as they refused to take responsibility for the problem or even help me figure out what the problem was. I kept getting bounced between Cardservice and Authorize.net (Cardservice resells Authorize.net's services) because nobody at either place actually wanted to help me, it seemed. Well, I finally got ahold of somebody at Cardservice who said they could fix the problem and she yelled at me for not reporting the problem right away (apparently, in her mind I was responsible for their salesman's lack of action)! Anyway, that finally got straightened out and I was too sick of dealing with people like this to try switching again. Their service works OK now that it works (it's down sometimes), and at least porn doesn't magically appear in my customers' carts. I don't know what their other salespeople are like, so maybe Michael Wentzell is an anomoly.

Making money from the float

[lordsutch]

Actually, making money from the float has been quite viable. Several states fund legal aid programs from the float of money that's held in escrow by lawyers (although Cato argues this violates the takings clause of the Constitution, as it is compulsory; you can't request that you get the interest, and it can be spent on things to which you might be philosophically opposed). And my bank (USAA) seems to make money enough off float to rebate ATM charges, give a 0.5% cashback award on debit card purchases, etc. Granted, some of the cash comes from not building a branch every 1/4 mile, but float is nice.