Professional Documents
Culture Documents
Payments 101
Payments 101
Your service connects buyers and sellers, and you want to learn
more about payments. WePay's Platform Payments 101 will help
you discover the realities of facilitating payments on a platform.
Table of Contents
1. Payment Facilitation!...........................................................................2
2. Regulatory Challenges!.......................................................................5
3. Card Network Compliance!................................................................11
4. Fraud and Loss!.................................................................................16
5. Minimizing Chargeback Risk!............................................................25
6. Technical Complexities!.....................................................................30
Chapter 1
Payment Facilitation
Our main character in the pages to follow is a platform with multiple users
looking to let those users accept payments. This hypothetical platform may not
have been active for a very long period of time it may have fewer than a
hundred users or so. Nevertheless, this platform has grand ambitions, and is
exploring infrastructure options that would allow its users to individually process
thousands of dollars, and collectively process tens of millions of dollars.
Flow of funds
When considering how to give its users the power to accept payments, the
platform needs to start with one question: at any point should we take ownership
of our users funds? The answer to this question is critical. It locks the platform
into one of two potential options.
The first (choosing to take control of user funds) is called aggregation. All funds
processed on behalf of the platforms users are collected into one central
account under the responsibility of the platform.
The second option involves processing funds directly to the end user. At no
point are these funds in an account managed by the platform.
If a platform chooses to aggregate the funds of their customers, they may be
defined alternately as a payment facilitator, a payment service provider, a master
merchant, or a third party payment aggregator. These terms are pretty
interchangeable.
2
Chapter 2
Regulatory Challenges
Since the signing of The Electronic Fund Transfer Act by President Jimmy Carter
in 1978, the rights, liabilities, and responsibilities of consumers who make
electronic payments and the companies that offer it as a service have been
governed by a complex web of state and federal regulations.
The extent to which any electronic payment is subject to the various statutes
regulating financial services depends on the specific nature of the transaction
and the risk (financial and otherwise) associated with it. Payment facilitators are
doubly subject to regulation, since they sit in the middle of a decoupled
transaction. They are subject to one set of regulations when charging customers
and another when disbursing funds to merchants. The legal burden is even
heavier for companies that facilitate
payments to overseas merchants or for
regulated goods or services.
Due to the nature and complexity of the
model, payment facilitators often require
specialized staff responsible for ensuring
been known to monitor the public FinCEN list for newly-registered companies
that have failed to register at the state-level.
Money Transmission
MSBs include companies that provide money transmission services, or the
acceptance of currency, funds, or other value that substitutes for currency from
one person and the transmission of currency, funds, or other value that
substitutes for currency to another location or person by any means.
Virtually all states regulate money transmission through an agency or
department located in the consumer affairs or in the financial institutions bureau
of the states executive branch. In most
states, unlicensed money transmission
state has its own unique application and compliance requirements. These
requirements can be very expensive in terms of fees, legal costs, and time.
States often require lengthy and intrusive background checks and disclosure
from senior executives, directors, and investors in order to obtain a Money
Transmission License (MTL). It is not uncommon for a business to take 6 months
and spend over $500,000 to obtain state licenses. Creating nationwide
coverage of MTL licenses can easily take years. In addition, companies are
subject to bonding and net worth requirements which require large deposits of
cash or other assets. This can be a prohibitive roadblock for smaller, early-stage
companies.
Furthermore, obtaining full licensure involves continuing compliance-related
responsibilities and costs, including annual state MTL fees and assessments.
There are ongoing reporting, examination (with concomitant annual
assessments), bonding, minimum capital, qualified investment, and other
compliance requirements from multiple (and in some cases inconsistent)
regulators.
Money transmitters must typically create and maintain compliance-related
Tax Reporting
9
In 2011, the IRS introduced the Form 1099-K to reduce the discrepancy
between the amount of income that people voluntarily report to the IRS and the
total amount of income that they should report. The Form 1099-K only reports
the movement of funds; individual merchants must decide whether these funds
represent taxable income.
The tax code requires payment facilitators to issue a Form 1099-K to every
merchant that processes over $20,000 and 200 payments in a calendar year
and to file a corresponding form with the IRS. If the company is required to file
over 250 forms in a given year, they must file electronically. The Form 1099-K
requires the merchants Tax ID, legal name, address, and total transactions for
the calendar year. If the company files inaccurate, incomplete, or tardy returns, it
may be fined hundreds of dollars per erroneous filing, with no maximum penalty.
10
Chapter 3
Card Network
Compliance
The Card Associations (e.g. Visa, MasterCard, American Express, and Discover)
publish and regularly update their operating regulations and card-acceptance
policies and procedures. American Express, for example, updates its twohundred page Merchant Regulations at least twice a year. All merchants are
required to follow these rules in order to accept card payments.
Not only must payment facilitators adhere to the operating regulations, they must
force their users to adhere as well. This section outlines a few of the most salient
issues that payment facilitators face.
Payment Aggregation
Some platforms, particularly online marketplaces, charge customers on behalf
of individual merchants. Amazon, for example, only charges a customer once
upon checkout, even though funds are often routed to a diverse group of small
sellers. In this scenario, the platform (not the merchant providing the good or
service) is the merchant of record. These platforms are considered aggregators.
Aggregation introduces additional risk because the payment facilitator is
responsible for accepting and disbursing payments to third-parties, even though
it has little control over the quality or delivery of the good or service these thirdparties provide.
11
The information they must collect and the checks they must perform for
each merchant.
The merchant information and processing data they must report to the
Card Associations.
12
The policies and procedures they must develop and submit to the Card
Associations for approval.
13
Failure to comply with the PCI DSS may result in fines, higher transaction fees,
and/or termination of the relationship between the Card Associations and
delinquent payment facilitator or merchant. Furthermore, platforms that suspect
or confirm the unauthorized access, use, theft, or misappropriation of cardholder
information incur additional obligations, including the responsibility to notify the
relevant authorities and conduct a thorough forensic investigation, potentially by
a reputable third-party forensic investigator. The vast majority of individual states
have also passed laws that require companies to report data breaches to the
affected parties.
Convenience fees
The Card Associations have developed strict rules for how and when merchants
can charge transaction fees, which are often an important source of revenue for
platforms that facilitate payments between merchants and their customers.
The Card Associations prohibit merchants from prioritizing one payment method
over another or applying surcharges that dissuade cardholders from using a
payment card. They do, however, permit merchants and payment facilitators to
14
charge convenience fees for the privilege of paying for a product or service
using an alternative payment channel.
Unfortunately, the policies that determine what constitutes a compliant
convenience fee vary by Card Association (and also by applicable state laws).
According to Visa, certain criteria must be met in order for a merchant to charge
a convenience fee. For example, the fee must be disclosed prior to payment,
presented as a flat fee (i.e. not a percentage of the sale), and applied to all
means of payment accepted in that channel.
Brand Rules
The Card Associations establish rules, which payment facilitators must enforce,
that restrict merchants from engaging in activities that harm or degrade the card
network brands.
Determining whether a merchant has followed the official guidelines for
displaying an Association logo is fairly straightforward, but ensuring that
merchants do not engage in illegal activity, fraudulent, deceptive, or unfair
business practices, or the sale of goods or services prohibited by the
Associations (e.g. adult digital content, loans, or gambling services) can be
quite difficult.
Payment facilitators must also ensure that individual merchants establish
policies (returns, refunds, customer service, disclosures, etc.) in accordance
with the operating regulations and that they convey these policies to
cardholders.
15
Chapter 4
Chargebacks
When a cardholder disputes a charge with their bank (the issuing bank), the
bank reverses the payment and refunds the cardholder. This is called a
chargeback.
Cardholders are protected from the financial liability of unauthorized credit card
transactions by Regulation Z of the Truth in Lending Act and unauthorized debit
card transactions by Regulation E of the Electronic Fund Transfer Act. Card
Associations have even broader rules with further added protections. When
16
17
18
Numbers of real businesses) to bilk cardholders and acquirers of more than $10
million.
Everyday, fraudsters are getting better at obtaining the information necessary to
assume false identities (e.g. birth certificates, government-issued IDs, credit
reports). It is impossible to definitively verify the identity of an online merchant,
since any information that legitimate users present to prove their identities can
be obtained by an imposter. The true identity of an online merchant simply
cannot be ascertained with total certainty.
In some cases, fraudsters use money
mules to obfuscate their illicit activities.
A typical scam involves the fraudster
charging stolen credit cards and settling
the proceeds to a mule. The mule keeps
a percentage of the money and transfers
the remainder to the scam operator,
typically located in another country.
Mules are often unaware that these
funds are the product of illicit activity.
They are usually hapless victims duped
It is impossible to definitively
verify the identity of an online
merchant, since any
information that legitimate
users present to prove their
identities can be obtained by
an imposter.
19
consuming than anticipated, etc.), customers will likely charge back their
payments.
The payment facilitator is liable for these chargebacks if they cannot recover the
funds from the entrepreneur. Even though the payment facilitator is not issuing
entrepreneurs a loan, per se, it is incurring risk based on the creditworthiness of
that entrepreneur or his business (presumably not that great, given the fact that
most companies raising money on crowdfunding platforms are startups).
chargebacks from customers that never received their orders. And if Pebble
could not make good on these chargebacks, the payment processor (Amazon in
this case), would have been liable for over $10 million.
Processors generally frown on young companies that accept pre-orders or
deposits long before they fulfill orders because the greater the amount of time
between payment and fulfillment, the greater the risk that merchants fail to
deliver and the larger the financial liability. It is therefore not surprising that some
payment processors are simply unwilling to support the use-case.
21
In this scenario, a fraudulent customer uses a stolen credit card (or a card
established with a stolen identity) to purchase a product from a legitimate
merchant. By the time the real cardholder discovers the fraudulent charges, the
fraudster already has possession of the goods.
While cardholders may not be liable for
unauthorized transactions, merchants
have no such protection. When the real
cardholder inevitably reverses the
payment, the merchant is out the cost of
fulfilling the order, the revenue of the sale,
22
These buyer-fraudsters can be very savvy in the techniques they use to prey on
merchants. Imagine a scenario where a legitimate seller is trying to rent out his
apartment on Craigslist. Out of the blue, somebody calls him and says that
they'll send him the rental money via a payment facilitator like WePay. The seller
sets up a WePay account, and receives "the buyer's" credit card number for one
month's rent. The renter then "accidentally" overpays the seller or decides that
they don't want to live in the apartment anymore. They ask the seller to refund
them by sending a check or wiring the money (or by any other means other than
refunding the credit card). The seller sends them the refund, and a few weeks
later the real cardholder disputes his fraudulent charge. WePay is forced to
target the innocent apartment owner (who unknowingly charged the stolen
card).
Friendly Fraud
Friendly fraud is similar to buyer identity fraud save for a few important
differences. In both cases, the merchant is the victim of a fraudulent buyer, but
with friendly fraud, the buyer is actually the cardholder. The cardholder duly
authorizes the payment, but reverses it once they have received the product or
service. The cardholder gets the goods for free, and the merchant gets stuck
holding the bag.
Friendly fraud is nearly impossible to detect because the payments themselves
are actually legitimate. Worse still, merchants accepting card-not-present
payments really have no way to prove that cardholders authorized the
payments, since they never swipe a physical card or receive a signature from
the cardholders.
23
24
Chapter 5
Minimizing
Chargeback Risk
For a payment facilitator, preventing losses is equivalent to preventing
chargebacks. This may seem like a relatively simple goal: reduce chargebacks
to an absolute minimum. Unfortunately, the means to achieving this goal is
incredibly complex.
As discussed in Chapter 4, many scenarios can result in chargebacks. The
process of preventing chargebacks is not as simple as detecting the use of
stolen credit card numbers. Each type of fraudulent or risky behavior
necessitates its own set of protections. This means that for a payment facilitator,
loss prevention is an inherently complex process.
25
Once identity has been assigned a given probability, payment facilitators may
still face problems with false positives (a valid merchant marked as fraudulent)
and false negatives (a truly fraudulent merchant that is allowed to process
transactions). PayPal has been widely criticized for their decisions to freeze
accounts when theyve assumed false positives.
Because of their exposure to chargebacks, if a payment facilitator makes a false
negative and allows a fraudulent merchant to process transactions, they risk
having to write off all of those transactions as losses. Even more distressingly,
fraudulent behavior is rarely limited to one merchant. Fraudulent users often test
a systems weaknesses by working together in large, anonymous fraud rings
across multiple accounts. If these fraudsters are successful, a payment
facilitator will lose large amounts of money very quickly.
Unfortunately, any safeguards put in place to slow down fraudulent or risky
activity will also get in the way of good merchants that want to receive their
money as quickly as possible. There is a natural tradeoff between providing an
enjoyable user experience and building protections against fraud. Traditional
merchant accounts involve multi-page applications, credit checks, and waiting
periods before a merchant is allowed to accept payments. Because they are
required to maintain a good user experience, payment facilitators can rarely use
those same protections.
26
27
Managing Disputes
Not only should payment facilitators implement sufficient safeguards to prevent
fraud and recognize suspicious activity, they must also implement processes to
manage and resolve disputes between buyers and sellers.
As the merchant of record, payment facilitators receive chargeback notifications
from acquirers and must reconcile the chargeback to its original transaction. In
addition to recovering funds from merchants, payment facilitators are also
responsible for notifying merchants and providing a means by which merchants
can defend themselves against chargebacks.
split between the merchant, who fulfills the order, and the payment facilitator,
who authenticates and verifies the cardholder.
Some payment facilitators have productized the dispute-resolution process to
preempt formal chargebacks. In this scenario, buyers dispute payments through
the payment facilitator before filing a complaint with their issuing bank. The
payment facilitator then attempts to resolve the dispute between the buyer and
seller directly without involving the issuing bank or the acquirer. There is
28
29
Chapter 6
Technical Complexities
Even before a platform or a payment facilitator has to worry about fraud, they
have to figure out how to process payments from a technical perspective.
For developers, the act of processing payments has been relatively simple for
quite some time. Payment-specific APIs have existed since before the advent of
PayPal, though theyve grown in sophistication and reliability over the past 15
years. Processing thousands of payments into one single merchant account isnt
very complicated. For a payment facilitator, it is routing thousands of payments
to a variety of merchant accounts that introduces the real challenge.
If a payment facilitator is
interested in processing
payments directly to their end
merchants, a payment
gateways basic offerings
may not be sufficient.
31
Even though a payment facilitator only has to interact with a few APIs, money is
arriving into its accounts from a variety of financial institutions. American
Express, for example, operates its own network. When a platform charges an
AmEx card, AmEx sends the money directly to that platforms account via the
AmEx network. Other card networks may settle their transactions through the
payment facilitators acquiring bank. ACH payments may arrive through yet
another channel.
Payments that arrive in a payment facilitator's account will probably belong to a
various merchants. Small pieces of the payments, however, may belong to
parties that assisted in facilitating the transaction. Card networks, acquiring
Chargebacks once again make life difficult. As chargebacks and refunds are
forcibly withdrawn from a payment facilitators accounts, the facilitator must
choose how to fund those charges. In the process of fighting the chargeback, at
what point should it be considered a loss and written-off? How can this loss be
tracked effectively in order to better combat it? At a certain level, these
fundamental questions become accounting problems as well.
33
34
request may take days to process. If it ultimately fails, this too must be recorded
and communicated.
For a single merchants withdrawal, three pieces of information might exist in the
payment facilitators database (initial withdrawal request, initial withdrawal
Idempotence is a hugely
important concept in online
payment APIs because
multiple, unintentional
charges can destroy a
payment companys
reputation.
to make a judgment call. These situations can be even more tricky than
communicating a high-level error message to a user, because the problem is
really the absence of information. Fail-safes and protections against these
problems are a hugely important piece of any payment facilitators payment
processing code.
Some modern payment gateways embrace new developments in hiding these
problems, and are better about, for example, not charging a card a second time
when re-submitting after a network error left the originating system unsure of
whether the payment was authorized.
36