SecureShop Secure Internet Credit Card Payment Processing Off-Site Secure Transaction Processing
INTRODUCTION PATHWAY’s SecureShop service product has been developed to help organizations and individuals accept and process credit card payments (Visa, MasterCard and American Express) in Canadian and/or US dollars, in a secure and reliable environment, over the Internet. The services presently supported through SecureShop are: a) Visa, MasterCard and American Express in Canadian dollars through Moneris Solutions throughout Canada (requires Merchant Account issued by Moneris Solutions). b) Visa in US dollars through Moneris Solutions (requires US Visa Merchant Account issued by Moneris Solutions). SECURESHOP SecureShop makes Internet E-Commerce easy, seamless and cost-effective. When you use this service: Your customers pay for goods and services purchased with credit cards, in real time, while they are connected to the Internet. Card payments are processed quickly and safely, in real time and the settlement is done at the end of each business day. Your customer is informed immediately if a payment is accepted or declined. You may access and view various reports relating to payments processed at your web site using a secure username and password, whenever you wish at no extra cost You or your operators may perform transactions (purchase, refund, pre-authorize completion, etc.) using a secure username and password, through an administrative interface accessible over the Internet. This feature is an alternative to the hardware device which you might have it in the store, with the exception that it cannot perform the swiping (imprint) of the credit card but gives you the feature of keeping all the records in a centralized database from which you can request anytime various reports You can process your monthly recurring fees for your existing customers (for which you have the credit card information on file) through a batch file generated by your billing system (customized batch file format required –please ask our sales staff for pricing and technical details)
Version: 3.01
Rev. date: Oct 4th, 2001
Page 1: SecureShop Service – offsite option
WHAT YOU NEED To take advantage of PATHWAY’s SecureShop service, you will need the following: A web site (usually under your own Internet domain name) with an Internet Service Provider or Web Services Provider. A form on your web site that accepts your Internet customers’ order details. An PATHWAY SecureShop off-site account. A Merchant Account with Moneris Solutions through which payments will be processed. Transactions on the other major credit cards (Visa or MasterCard) and American Express (if applicable) will be processed in real time and forwarded by Moneris Solutions to the corresponding Merchant Account (bank) for the settlement. If necessary, PATHWAY would be pleased to assist you in getting in touch with an Account Manager at Moneris Solutions, who will help set up your Merchant Account for processing through our Internet Gateway Payment Server.
HOW SECURESHOP WORKS The order and payment processes are simple: 1. After accessing your web-site and selecting the products or services they wish to buy, your customers will usually complete purchase related functions such as providing “bill-to” and shipping information as well as selecting a payment method. If your customers decide to pay by credit card, they will be asked to click on the “«PAY BY CREDIT CARD»” button, or its equivalent, on your web site. Your web site must be designed by your site designer to include these features. Should you wish to obtain a full E-Commerce Web Site from PATHWAY at highly competitive rates, or would like PATHWAY to design a custom E-Commerce solution for you, please call (416) 214-6363 and speak to one of our Corporate Sales Representatives. 2. When your customer clicks on the « PAY BY CREDIT CARD» button, security software is activated, which prompts your customer for payment information. Your customer enters his/her credit card information: Name on the card Card number/type Card expiry date E-mail address The amount to be processed is automatically obtained from your web site. 3. PATHWAY SecureShop software transmits payment information to the settling Bank, using a private Bank connection. Within seven to forty seconds SecureShop returns the outcome of the transaction to your customer’s web browser screen along with a payment record, which also serves as a confirmation for your customer’s records.
4. Based on the response from the bank, the secure server will immediately send to you and your customer an automated e-mail advising whether the transaction succeeded or not. In addition, a response will be displayed to your customer and any necessary information will be forwarded to your web site.
Version: 3.01
Rev. date: Oct 4th, 2001
Page 2: SecureShop Service – offsite option
Following is an example of a generic transaction record:
========= TRANSACTION RECORD ========= Merchant Name Address City, Province, Postal Code, Country Tel: (xxx) xxx-xxxx Fax: (xxx) xxx-xxxx http://www.domainname.com Type: Purchase Credit Card Type: MasterCard Purchaser Name: John Smith Amount (CAN $): 5.65
Transaction Date : 08/24/2000 Transaction Time (EST) : 12:00:03 Reference # : 66001761 0010065749 Authorization # : 004657 Order ID: 2640737 Clerk ID: 002 01 Approved - Thank You 027 Product - Internet Access
M
No Refunds -------------------------------------5. You (the merchant) have access to SecureShop's secure, on-line database running on PATHWAY’s transaction server (located behind an industry standard firewall) to view various reports at any time. This site, similar with a point of sale device, is also used as a secure interface to process refunds in the case of product returns, refusals, etc… Reports of your transaction history are available twenty four hours a day, completely free of charge and may be sorted by time period of your choice (from - to) or by any field from the database, covering: Card holder name Card number/type Card expiry date Payment amount Payments accepted or declined Transaction ID Reference number Authorization # Transaction type Batch number Date/time E-mail address Order ID or other Clerk ID or other For security reasons, the only information not viewable online is the FULL credit card number. However, this information is still entered in a searchable field. The online interface has been designed in this way to
Version: 3.01 Rev. date: Oct 4th, 2001 Page 3: SecureShop Service – offsite option
protect YOU from any false claims that might be made against you. You or your operators may perform transactions (purchase, refund, pre-authorize completion, etc.) using a secure username and password, through this administrative interface accessible over the Internet. This feature is an alternative to the hardware (point of sale) device, which you might have it in the store, with the exception that it cannot perform the swiping (imprint) of the credit card The available options on the merchant administrative interface are the following: a. Proceed with payment b. Purchase correction c. Proceed with refund d. Refund correction e. Proceed with pre-authorization payment f. Pre-authorization completion g. Force payment h. Proceed with close batch i. Search for transactions You can choose to have a customize database with your operators and supervisors, and restrict the options available for the operators to points a. or e. and h. from above (purchase/pre-authorize and search capabilities). The settlement request (close batch) is initiated automatically at the end of the day (shortly before midnight EST) and an e-mail with the totals will be sent to you financial officer (or any other address indicated in the sign-up form). Example of close batch e-mail:
Batch Nr. * 346 * - Visa Purchase transactions on V - Nr: 1 Amount: $ Refund transactions on V - Nr: 0 Amount: $ Correction transactions on V - Nr: 0 Amount: $ ******************************************************** Batch Nr. * 346 * - MasterCard Purchase transactions on V - Nr: 1 Amount: $ Refund transactions on V - Nr: 0 Amount: $ Correction transactions on V - Nr: 0 Amount: $ ******************************************************** Batch Nr. * 346 * - Amex Purchase transactions on V - Nr: 2 Amount: $ Refund transactions on V - Nr: 0 Amount: $ Correction transactions on V - Nr: 0 Amount: $ ******************************************************** BATCH # : 346 PURCHASE: 4 AMT: 23.30 REFUND : 0 AMT: 0.00 CORRECT : 0 AMT: 0.00 BATCH BALANCE: YES 05/23/00 23:57:19
16.04 0.00 0.00 2.50 0.00 0.00 4.76 0.00 0.00
Version: 3.01
Rev. date: Oct 4th, 2001
Page 4: SecureShop Service – offsite option
PRICING Pricing for PATHWAY’s SecureShop service is extremely attractive. Set up fee: There is a one time set up fee for all major credit cards supported by the service: a) $ 450 for one currency (CAN or US) b) $ 850 for both currencies (CAN and US) This includes installation, configuration and set-up of a secure site with a standard interface and PATHWAY’s credit card processing software. A custom payment interface is available for an additional $480 with a maximum of six hours of work A customized clerk database is available for an extra $950 Monthly site fee: A monthly fee as per following schedule covers: payment processing, on-line merchant administrative interface and a form on our secure server for secure site hosting. a) $ 39.95 for one currency (CAN or US) b) $ 69.95 for both currencies (CAN and US) A charge of $0.25 per payment processed, regardless of payment size. This charge is applicable to accepted, declined and reversed payments; administrative transactions (close batch) and is over and above any Merchant account charges levied by the Bank(s). Unlimited technical support related to PATHWAY’s SecureShop payment service is included free of charge. For matters related to product returns or refusals, you will need to liaise directly with your customers. Bank charge-backs, card declines, fees and merchant account issues must be directly addressed with your Merchant Account Manager.
Processing charge:
Technical support:
BILLING When you establish your SecureShop account, you will need to provide PATHWAY with information required to set up your account and your own bank account number, to which all set up, monthly and transaction fees will be charged through pre-authorized payment method. Accounts in default will be automatically suspended with a $25.00 reinstatement fee charged. Set up and first and last month’s fees are payable in advance, upon contract signing. Thereafter, all site fees are payable 30 days in advance, consistent with Internet industry practice. Transaction fees are automatically billed to your account at the end of each billing month and will be included with the charge for the next months site hosting. CONTRACT When signing up for your SecureShop service, you will need to read and agree to be bound by PATHWAY’s standard indemnity and conditions of service. SIGNING UP FOR SECURESHOP SecureShop is easy to obtain. Our sales staff will be glad to assist you (you can call 416-214-6363 or simply print the application form on line available at: http://www.secure-shop.net/agreement.pdf, sign it and fax or mail it back to us with your payment information. Our fax number is (416) 214-6238.
Version: 3.01
Rev. date: Oct 4th, 2001
Page 5: SecureShop Service – offsite option
ANSWERS TO FREQUENTLY ASKED QUESTIONS
Here are answers to some Frequently Asked Questions related to SecureShop. Q. What are the advantages of SecureShop? SecureShop has been designed by PATHWAY – a Canadian Competitive Local Exchange Carrier and Data Service Provider and one of the firsts ISPs in Canada authorized to directly offer credit card payment processing over the Internet. We understand the Internet and have designed the service around clients’ needs: security, safety, reliability, price and service. Q. My main Merchant Account is with another bank. Can SecureShop process card payment to my main merchant account? Yes. When you use SecureShop, all payments made at your web site can be deposited in your main Visa, MasterCard or American Express account. The only pre-requisite is that you must have a Merchant Account with Moneris Solutions (through which payments will flow into your bank accounts) and this must be a different major credit card then your main major credit card Merchant Account. For example: if your main Visa Merchant Account is with the CIBC then the pre-requisite is to have a MasterCard Merchant Account with the BMO/Moneris Solutions which will then be your processing bank and will forward the Visa funds into your CIBC bank account with a one business day delay. Please note that the same forwarding to the CIBC will not be possible through the processing bank RBC/Moneris Solutions because of the competitive products offered (Visa Merchant Account). You will then have to direct the processing bank (BMO or RBC) to transfer payments to the relevant bank and account. The BMO or RBC will assist you in setting this process up quickly and easily. You’ll need to provide them with the other major credit card (your main) Merchant Account number and the corresponding bank account information such as bank, transit and account number. Q. What is a processing Bank or a host? A processing bank is the institution that will process in real time all the major credit cards. It will then perform the settlement (deposit the funds into your account) on the next business day for the major credit card that they are representing (i.e. Moneris Solutions is offering both Visa and MasterCard services). In the next step the processing bank will forward the settlements for any other credit cards to the Merchant Account issuer bank with an additional delay of one business day. The host for SecureShop is Moneris Solutions Q. Is SecureShop service approved by Banks? SecureShop has been designed in partnership with the Bank of Montreal (BMO)/Moneris Solutions and the Royal Bank (RBC)/Moneris Solutions and complies fully with all of the Banks’ strictly defined procedures and protocols for credit card payment processing. SecureShop meets all of the Banks’ security and data transmission standards and has been rigorously tested over several months, to ensure that your credit card information is safely stored and conveyed at all times. Q. How does SecureShop ensure the security of my customers’ card information? SecureShop meets the highest standards of security. All information between your customer and PATHWAY’s SecureShop transaction server is encrypted (scrambled) so that if it is intercepted en route, the data is meaningless to the interceptor. Strong (128 bit) encryption and the industry-standard SSL (Secure Sockets Layer) protocol ensure the highest levels of security.
Version: 3.01 Rev. date: Oct 4th, 2001 Page 6: SecureShop Service – offsite option
PATHWAY’s own Transaction Server resides behind a high quality Internet firewall that is managed, maintained and monitored on a 7/24 basis. The real-time connections between PATHWAY’s Transaction Server and the banks are established through Bank approved, secure data lines. Q. Can I obtain details about payments processed at my site? Yes, very easily. You simply connect to PATHWAY’s Secure Merchant Services Site and log in using a User ID and Password that we assign you. Your personal site is available twenty-four hours a day, seven days a week and offers a whole range of reports that you may view and print, using your web browser. You may also use this site to process customer refunds when required. There are no limits to the number of times that you may access payment reports and there are no additional charges for use of this service. Q. Whom do I call if I have problems? There could be several reasons why you or your customers cannot process card payments at your web site. These include, but are not limited to: Incorrect or improper set up or changes to your web site Data transfer problems over the Internet Your Internet Service Provider’s hardware or software The fact that a customer is not using a JavaScript compliant browser Issues with the customer’s Card/Bank We recommend that you ask your ISP to first check whether there are any problems at his/her end, before calling PATHWAY . If the problem does not pertain to any of the above reasons, please feel free to e-mail us at: support@secure-shop.net or call our Corporate Technical Support Dept. at (416) 214-6363. We’ll be pleased to assist you with any of the following issues: Site set up Access to your transaction reports Billing queries Technical support *****************************
Version: 3.01
Rev. date: Oct 4th, 2001
Page 7: SecureShop Service – offsite option
SETTING UP SECURESHOP
To start accepting credit card transactions over the Internet with SecureShop you need to complete three steps: STEP 1: Register with PATHWAY for the SecureShop off-site service. STEP 2 Set up a Merchant Account with Moneris Solutions. If you already have a Merchant Account with Moneris Solutions, you must contact your Merchant Account Manager so that the required modifications to your account may be made in order to allow credit card payments over the Internet through PATHWAY’s Payment Server. You will need to provide your Merchant Account Manager with bank information about any other Merchant Accounts that you may have. This information will include bank number, transit number and account number. STEP 3 Set up your web site to process credit card payments. Please note that if SecureShop off-site will be combined with one of PATHWAY’s corporate bundled packages such as ValuePath, PremiumPath or SimpleLAN64 with an additional shopping basket module, or with a customized solution designed by PATHWAY then this step will be also performed by PATHWAY
EACH OF THESE STEPS IS DESCRIBED IN DETAIL BELOW
Version: 3.01
Rev. date: Oct 4th, 2001
Page 8: SecureShop Service – offsite option
SETTING UP SECURESHOP STEP 1 Register for the SecureShop service
To register for PATHWAY’s SecureShop on-line credit card processing service: 1. Print out the sign-up form, which is available at the following Internet website: http://www.secure-shop.net/agreement.pdf or ask our sales staff to send it by fax or mail. You can reach us at (416) 214-6363 or toll free 1-877-410-6363 Complete this form, sign it, and fax (or mail) it to PATHWAY , at (416) 214 6238. 2. Your SecureShop account will be set up within five business days provided we have received all the information required. The initial set-up will be done within the SecureShop test environment and another day will have to be allocated for a test prior to switching to the production server.
Version: 3.01
Rev. date: Oct 4th, 2001
Page 9: SecureShop Service – offsite option
SETTING UP SECURESHOP STEP 2 Set up a Credit Card Merchant Account The next step is to set up a Bank of Montreal MasterCard Merchant Account or/and a Royal Bank Visa Merchant Account or the new option is to get both merchant accounts from a single source: Moneris Solutions. If you already have that, a modification will be required towards your Merchant Account in order to be able to process credit card transactions electronically trough PATHWAY’s Payment Server. To do this: 1. Please call any Moneris Solutions Merchant Account Representative: • At Moneris Solutions please call merchant customer service toll free at 1-866-319-7450 OR Complete the on-line sign up form for a Visa and/or Mastercard Merchant Account at http://www.moneris.com/signup.html Your Account Manager will contact you with details on setting up your Merchant Account.
2.
IMPORTANT SecureShop allows you to process Visa, MasterCard and American Express card payments. To accept these major credit card payments, you need for each one a merchant account with a suitable financial institution in Canada, which represents the card. All payments made at your web site will be automatically deposited into your Visa, MasterCard or American Express account through the host (Moneris Solutions). The pre-requisite is that you must have at least one merchant account with the processing host –Moneris Solutions
You’ll need to provide to the processing bank the other major credit card Merchant Account numbers and the corresponding bank account information such as bank, transit and account number.
Please note that the processing bank will process the funds for the transactions in respect to the major credit card it is representing and will forward only the funds for different major credit cards. (i.e. RBC/Moneris will process Visa funds and will forward MasterCard and Amex funds to your other bank accounts).
Version: 3.01
Rev. date: Oct 4th, 2001
Page 10: SecureShop Service – offsite option
SETTING UP SECURESHOP STEP 3 SETTING UP YOUR WEB SITE FOR CREDIT CARD PROCESSING
We have designed SecureShop with the intention of reducing programming and site set up time and effort for you and your web site designer. There are several important elements that need to be addressed and set up properly, to ensure that your customers can safely, easily and reliably pay for goods and services with their credit cards, at your web site. Should you have any questions or need help setting up, please feel free to call us, at (416) 214-6363. Note: You can find information on-line about best practices for conducting business on the Internet at www.secure-shop.net/RBCbestpractices
BEFORE YOU BEGIN Please note that to reduce programming and site set up time for you and your web designer, all card payments are processed on PATHWAY’s secure servers and NOT at your ISP’s web server.. Your customers MUST be told to use a Java-enabled browser to make payments at your web site. Though versions 3.0 of Internet Explorer and Netscape will work, we recommend that they be asked to use versions 4.0 and higher. Without a Javaenabled browser, your customers will NOT be able to make payments at your web site, as the payment software uses JavaScript.
To ensure that things proceed as planned, please make a copy of this section (“Setting up your web site for SecureShop”) and provide it to your web site designer.
Version: 3.01
Rev. date: Oct 4th, 2001
Page 11: SecureShop Service – offsite option
SETTING UP YOUR WEB SITE FOR SECURESHOP The payment process and requirements for SecureShop are briefly described below: Please note that if SecureShop off-site will be combined with one of Pathway’s packages with an additional shopping basket module, or with a customized solution designed by PATHWAY then this step will be also performed by Pathway.
STEP 1 We strongly recommend that each sale at your web site be assigned a unique sale identifier (“orderID”). This is a unique string which identifies each separate sale transaction at your web site and will help you keep track of your SecureShop transactions. The orderID should consist of unique regular alphanumeric characters only, and will be passed to Pathway’s secure server as a parameter in a URL. (see Step 3 below). STEP 2 Create a <
> button on your web site. This button (you may call it something else if you wish) should be available to your customer only after they have completed the ordering process and when they are ready to make payment. STEP 3 The <>button on your web site should be referenced to the following URL: https://www.secure-shop.net//credit.taf Note that you’ll have to pass the following arguments in a hidden field through “POST” method: ➧ ➧ “amount” is the total dollar amount (including taxes, shipping, handling, etc.) that will be charged to the customer’s card. “orderID” is the unique sales ID as assigned by your application.
Example: Form Example Note you’ll have to provide us the public IP address where your application resides. The above information will be passed by your form, CGI or equivalent application from a similar address provided by you like the following one: ex. 196.168.0.1 IMPORTANT: Your web site designer needs to provide Pathway with the exact public IP address from where the payment processing information will be passed to Pathway’s transaction server. Please complete the Pathway Agreement available on-line at http://www.secure-shop.net/agreement.pdf with the appropriate information required for the set-up process or alternatively forward this information to the following address: setup@secure-shop.net
Version: 3.01
Rev. date: Oct 4th, 2001
Page 12: SecureShop Service – offsite option
STEP 4 When your customer clicks on the <> button, he/she will temporarily leave your web site and connect to Pathway’s Secure Payment Server. Note that you cannot use frames (if you are doing so on your main web site) once the amount is passed to the secure form. STEP 5 At Pathway’s Secure Payment Server, your customer will enter the following information: • • • • • Cardholder Name Credit Card number Card expiry date Credit card type E-mail address
Note that the “amount” will be automatically obtained from your web site from STEP 3 above. As a security measure, the customer will not be permitted to change payment information at the secure payment site. Cardholder e-mail address is required for receiving a carbon copy of the transaction record and is kept afterwards into the Payment Server’s Database. STEP 6 Pathway’s secure server will perform the following functions: • • • • • • Validate information entered. Store data in Pathway’s secure transaction database. Pass card information to the Bank for payment authorization & processing. Copy approval/decline data from the Bank into the transaction database. Return approval/decline information to your customer (transaction record). Return approval/decline information to your web site(for details see step 8).
STEP 7 Pathway’s secure server will provide the customer with on-line confirmation as to whether the payment has been accepted, declined or there was a communication error. This will include the following information: • • • • • • • • Merchant’s contact information Transaction date and time Whether the transaction was approved or declined. Total amount charged to the card Credit card type Reference number, response code Order ID Clerk ID or other information specified by the merchant (optional)
The customer will be prompted to print this confirmation at his local computer. For an on-line demo please visit: http://www.secure-shop.net/demo/
Version: 3.01
Rev. date: Oct 4th, 2001
Page 13: SecureShop Service – offsite option
STEP 8 Pathway’s secure server will provide your web site through “POST” CGI method with card payment return, decline or communication error information for your records. This will comprise of the following information: • • • • “transactionID” – transaction number which is unique identifier for a transaction “orderID” sent initially at step 3 “amount” sent initially at step 3 “response” - whether the transaction was approved or declined (APPROVED/DECLINED/ ERROR)
The above information will be passed to your CGI (or equivalent) application to a similar address provided by you like the one below: http://www.yourdomainname.com/cgi-bin/your-cgi-read-response-application.cgi Note: • • “yourdomainname.com” refers to your fully qualified Internet domain name. “/cgi-bin/your-cgi-read-response-application.cgi” is the path to your application which will receive the parameters
IMPORTANT: Your web site designer needs to provide Pathway with the exact path to the directory where the payment processing information should be returned by Pathway’s transaction server. Please complete the Pathway Agreement available on-line at http://www.secure-shop.net/agreement.pdf with the appropriate information required for the set-up process or alternatively forward this information to the following address:setup@secure-shop.net STEP 9 If, for any reason, the customer’s connection with Pathway’s secure payment server drops after the submission of the credit card transaction form and prior to completion of the payment process, Pathway’s secure site will send to you and to the cardholder an automated E-mail indicating the details of the transaction (same as a normal transaction record). STEP 10 Perform a test (script provided by Pathway) within the SecureShop test environment. STEP 11 Pathway will revise the test results and according to that, your account will be switched to production. STEP 12 You will have to perform another short test in production as per the documentation sent to you with the test script
Version: 3.01
Rev. date: Oct 4th, 2001
Page 14: SecureShop Service – offsite option