MasterCard/Discover New Partial Authorization Rule

Authorize Net, one of the web's largest online payment gateways sent out an email to all their merchants that as of May 1 2010 Master Card and Discover were going to go live with a new processing rule that would require virtually ALL merchants to allow partial payments and multiple payment transactions. (There are a some exceptions, but few fit the profile) Yes you read that date right. This notice went out right about the time the rule was to go into effect, and the rule states that if the merchant was found to not be in compliance they would be hit with a penalty!

The first thought that jumped to mind was "What the !$#!@$!@!" - Fortunately even MasterCard realized you can't announce a new rule that will fundamentally change the way EVERY shopping cart website on the web processes credit cards and realistically expect this quick of a response. So Authorize Net got an extension for their merchants that pushes the deadline out to June 30th 2011. It appears that other gateway provides are getting such extensions as well. Best check with your gateway provider to see what they say on this.

So what does it mean?
A quick Google search on the topic brings up a lot of hits, but clicking on the results just takes you to a lot sites and blogs that just regurgitate the word for word content of the email notice which can be read here. Not a lot of helpful "what do I do" content to be found.

What's it really mean?
I'm not going to go into detail repeating the same thing that is available in the email or on on the Auth Net site, that can be found here:

• New MasterCard/Discover Processing Requirements
• MasterCard/Discover Partial Authorization FAQs
• http://www.authorize.net/support/AIM_apiupdates.pdf.

I'd recommend reading over these thoroughly!

Fortunately over the years we have developed a very good relationship with Authorize Net, we refer a lot of business their way, So I had a direct line to call. Talking to my contact at Authorize Net led to two conclusions;

1. They were on it and trying to be as responsive as they could
2. And that they had almost as many questions as I did

So we arranged a conference call with one of the lead techs working on the updates to their API to discuss what all this really meant from a technical standpoint. The call cleared up a lot of questions, but it also raised a number of concerns that still needed to be addressed. My contact at Authorize Net called me back the next day to ask if I would be involved in another conference call, this time with ten or twelve other eCommerce community leaders and if prior to the call I would email my primary concerns and questions so they could be covered during the call. So we had a "LiveMeeting" presentation and conference call with lead Authorize Net API techs and a number of eCommerce developers around the country.

So the big question: How's this impact my eCommerce web site?

It's is pretty simple to visualize. Assuming you are using Authorize Net or a similar real-time payment gateway, the way your web site works now is like this

Current Process

The payment is submitted to the payment gateway, if there's sufficient funds available on the card the payment is competed and the transaction is complete. If there are insufficient funds the transaction is terminated. In other words a single payment attempt is made and it will pass or fail. If it fails due to insufficient funds the user must start over.

New Payment Process

If the card submitted has funds available, but not enough to complete the full transaction, the available funds will be captured and the cart must allow the customer try with another card to pay the balance due.

• Merchants must accept multiple payments for individual orders
• Number of payments not known in advance
• Payment software must recognize multiple payments

While this is easy to visualize it's not an easy technical change! As you can see, this is a fundamental shift in he way virtually EVERY shopping cart site on the web will have to behave! This is going to take some pretty extensive programing to adapt the flow of the cart checkout process to allow for multiple attempts, and to clean up the mess of partial payments if a user decides to bail out in the middle of the process.

So, can we just opt out and do things the way we are now?

Well from a technical standpoint, yes. To prevent sites all over the web from breaking, "non compliant" sites will continue to work just as they do now.

Good, no problem then right? Wrong!

MasterCard will penalize merchants whose sites are found to be non compliant! How much is the penalty? No body is telling! Everyone just points to someone else. But some of the figures being passed around range from significant to bloody outrageous! To the point where the immediate reaction is "how can that even be legal!" I'm still digging to see if I can get somebody to give me a straight answer and will report as soon as I do, but suffice it to say that MasterCard & Discover are serious about this and they aren't going to make it easy to ignore. They are going to force you into one of three choices. Comply, No longer accept Discover or MasterCard, or shut down.

What about just not taking MasterCard or Discover anymore? Well some may choose to do this, but the hand writing is on the wall! Even though they are not being required to do so Authorize Net is preemptively building this functionality into their system for Visa and AmEx as well. They are pretty much expecting them to follow suit.

Why don't we hear more from all the gateway providers about this? Don't worry, you will. PayPal is already hard at this and making information available to developers. All other gateways will fall into line. Many of them are likely waiting to see what Authorize Net does, since many of them offer Auth Net emulation and their APIs work pretty much the same.

So, what next?

Fortunately we have some time. We are working closely with Authorize Net and will be releasing updates to users of current the version of Cartweaver for Authorize Net, and depending on what paths some of the other gateways take, we will release other updates as we can. We will stay on top of the changes and keep you informed.

To stay updated on how this progresses check back here or follow us on Facebook and Twitter. We will release up to the minute information there.