Credit Card Acceptance Procedures, Credit Card Chargeback Policy and Risk Management Best Practices

Transcription

1 Credit Card Acceptance Procedures, Credit Card Chargeback Policy and Risk Management Best Practices Credit Card Acceptance Procedures As an alternative to accepting cash, most ARC participating carriers accept credit cards 1 as payment for air transportation and related services. Individual agreements between credit card companies and carriers determine the terms and conditions of credit card acceptance. However, to accept credit cards on behalf of an ARC participating carrier, travel agents are required to do the following: Determine if the carrier accepts the credit card provided by the customer and under what conditions. Identify the ticketing carrier and, at the time of ticketing, obtain an authorization via the GDS for the exact amount of the transaction. If the authorization link through GDS is unavailable, obtain a voice authorization (details follow). Merchants 2 are subject to fines if authorizations are not obtained for transactions that are settled. Validate the card expiration date and effective date, when applicable. When the expiration date has passed, or the effective date has not passed, the card may not be accepted. Note that some card types do not have effective dates or expiration dates. Do not disclose credit card information. Travel agents must not disclose to, or otherwise give, any third party the name or account number appearing on any card, except as may be necessary for a travel agent to perform its obligations under the ARC Agent Reporting Agreement. Do not discriminate among credit card brands. Given that a ticketing carrier accepts the form of payment, travel agents must honor any credit card brand presented as payment on behalf of the carrier. Discrimination among credit card brands is prohibited. Process tickets issued against credit cards through IAR in accordance with the procedures outlined in the Industry Agents Handbook. Failure to follow the above steps may render it impossible for carriers to obtain payment from the credit card companies or result in fees associated with improperly authorized transactions. In such circumstances, individual carriers reserve the right to invoice the sale and any other associated fees (including interchange) back to the travel agent. The requirements outlined above are the minimum requirements. Following these steps does not protect merchants from chargebacks initiated by customers or card issuers. ARC recommends that travel agents review industry best practices and manage the risk of fraud or chargeback. This section includes information about the tools available in the credit card industry that can help travel agents manage risk and loss. 1 Throughout the ARC Industry Agents Handbook, reference to credit cards also includes debit cards and other non-cash forms of payment. 2 In Section 8 of the Industry Agents Handbook, references to merchant refer to the entity accepting payment, including travel agents. 1 P age

2 Types of Credit Cards The following lists all of the credit cards processed by ARC and their respective two character designator. Guidelines for acceptance of all of these card types follow. AX CA CA DS JC TP VI American Express MasterCard Diners Club International Discover Japan Credit Bureau (JCB) International UATP Visa The following is a listing of airline credit cards and their respective two letter credit card designator: AA AS American Airlines Personal Credit Card Alaska Airlines Commercial Card Carrier Credit Card Acceptance Chart The following Carrier Credit Card Acceptance Chart denotes carriers' acceptance of different credit cards. The chart also identifies any restrictions carriers have for accepting credit cards on their behalf. A blank box indicates the carrier does not accept the credit card. Carrier Credit Card Acceptance Codes are used to identify the restrictions carriers place on agents when accepting credit cards on their behalf. Definitions for each of these codes immediately follow the chart. In some cases, the letter E will follow the acceptance code. This means the carrier accepts the credit card, but certain exceptions to the acceptance criteria apply. Carriers' exceptions, when applicable, are listed immediately following the definition of the applicable Carrier Credit Card Acceptance Codes. Agents should refer to the following chart to ensure satisfaction of the ticketing carrier's instructions with respect to credit card acceptance. Page 2

3 CARRIER CREDIT CARD ACCEPTANCE CHART CARRIERS Credit Card Company AMEX CA DCI DS JCB UATP VI ACCESRAIL NR NR NR NR ADRIA AIRWAYS NR NR NR NR AEGEAN AIRLINES NR NR NR NR AER LINGUS AEROFLOT RUSSIAN AIRLINES AEROGAL NR NR NR AEROLINEAS ARGENTINAS NR NR NR NR NR NR AEROMAR NR NR NR AEROSVIT AIRLINES AEROMEXICO NR NR NR NR NR NR NR AIGLE AZUR NR NR NR AIRCALIN NR NR NR NR AIR ASTANA NR NR NR AIR BALTIC NR NR NR NR AIR BERLIN NR NR NR NR AIR BOTSWANA NR NR AIR BURKINA AIR CANADA AIR CHINA NR NR NR NR AIR CHOICE ONE NR NR NR AIR EUROPA NR NR NR NR NR NR NR AIR FRANCE AIR GREENLAND AIR INDIA NR NR NR NR AIR MADAGASCAR AIR MALI AIR MALTA NR NR NR NR AIR MAURITIUS LIMITED NR NR NR AIR MEDITERRANEE AIR MOLDOVA NR NR NR NR AIR NAMIBIA NR NR NR AIR NEW ZEALAND AIR PACIFIC NR NR NR NR AIR SEYCHELLES LTD. NR NR NR NR NR AIR TAHITI AIR TAHITI NUI NR NR NR NR AIR TRANSAT AIRTRAN AIRWAYS NR NR NR NR NR NR NR AIR UGANDA ALASKA AIRLINES ALITALIA AIRLINES Page 3 Key Credit Card Acceptance: Blank = Carrier does not accept card; NR = Card accepted with no restrictions; Codes 1 8 = See definitions following chart.

4 CARRIER CREDIT CARD ACCEPTANCE CHART CARRIERS Credit Card Company AMEX CA DCI DS JCB UATP VI ALL NIPPON AIRWAYS 2E 2E 2E 2E 2E 2E 2E AMERICAN AIRLINES AMTRAK ANDES LINEAS AEREAS ANTRAK AIR ARIK AIR NR NR ARKIA ISRAELI NR NR ASERCA AIRLINES ASIANA AIRLINES AUSTRIAN AIRLINES AVIANCA 6E 6E 6E 6E 6E 6E 6E AVIOR NR NR NR AZERBAIJAN AIRLINES NR NR NR B & H AIRLINES BAHAMASAIR NR NR NR NR NR NR NR BANGKOK AIRLINES NR NR BIMAN BANGLADESH AIRLINES BULGARIA AIR BOUTIQUE AIR INC NR BRITISH AIRWAYS 3E 3E 3E 3E 3E 3E 3E BRITISH MIDLAND AIRWAYS BRUSSELS NR NR NR NR NR CARIBBEAN AIRLINES 3E 3E 3E 3E CATHAY PACIFIC AIRWAYS 6E 6E 6E 6E 6E 6E 6E CAYMAN AIRWAYS NR NR NR NR NR CHINA AIRLINES CHINA EASTERN AIRLINES NR NR NR NR CHINA SOUTHERN AIRLINES 6E 6E 6E 6E CONDOR NR NR NR COPA CORSAIRFLY NR NR NR CROATIA AIRLINES NR NR NR NR CSA CZECH AIRLINES CYPRUS AIRWAYS NR NR DELTA AIR LINES DUTCH ANTILLES EXPRESS NR NR EGYPTAIR EL AL ISRAEL NR NR NR NR NR NR EMIRATES ERA AVIATION 2E 2E 2E 2E 2E 2E ETHIOPIAN AIRLINES NR NR NR NR Page 4 Key Credit Card Acceptance: Blank = Carrier does not accept card; NR = Card accepted with no restrictions; Codes 1 8 = See definitions following chart.

5 CARRIER CREDIT CARD ACCEPTANCE CHART Credit Card Company CARRIERS AMEX CA DCI DS JCB UATP VI ETIHAD AIRWAYS NR NR NR NR EUROSTAR NR NR NR EVA AIRWAYS FINNAIR OY FLEXFLIGHT NR NR FLYBABOO NR NR NR NR NR FLYBE AIRLINES NR NR NR NR NR FRONTIER AIRLINES GARUDA INDONESIAN AIRWAYS GEORGIAN AIRWAYS GREAT LAKES AVIATION NR NR NR NR NR NR NR GULF AIR NR NR NR NR NR HAHN AIR NR NR NR HAINAN AIRLINES NR NR NR NR NR NR NR HAWAIIAN AIRLINES HELI AIR MONACO NR NR NR NR HELLENIC IMPERIAL AIRWAYS HONG KONG AIRLINES NR NR NR NR IBERIA OPERADORA ICELANDAIR INSEL AIR INTERNATIONAL BV NR NR ISLAND AIR NR NR NR NR NR JAPAN AIR LINES JAT AIRWAYS NR JET AIRWAYS NR NR NR NR JETBLUE AIRWAYS KENMORE AIR HARBOR KENYA AIRWAYS NR NR NR NR KOREAN AIR KUWAIT AIRWAYS CORP LACSA AIRLINES LAM MOZAMBIQUE LAN AIRLINES S.A. NR NR NR NR NR NR NR LAN ARGENTINA NR NR NR NR NR NR LAN ECUADOR NR NR NR NR NR NR NR LAN PERU LIAT LTD. NR NR NR NR NR NR LOT POLISH AIRLINES 3E 3E 3E 3E 3E 3E LUFTHANSA GERMAN AIRLINES 3E 3E 3E 3E 3E 3E 3E MALAYSIA AIRLINES SYSTEM Page 5 Key Credit Card Acceptance: Blank = Carrier does not accept card; NR = Card accepted with no restrictions; Codes 1 8 = See definitions following chart.

6 CARRIER CREDIT CARD ACCEPTANCE CHART Credit Card Company CARRIERS AMEX CA DCI DS JCB UATP VI MALEV HUNGARIAN AIRLINES NR MERIDIANA AIRLINES NR NR NR NR MESA AIR LINES MEXICANA AIRLINES NR NR NR NR NR NR MEXICANA CLICK MIDDLE EAST AIRLINES NR NR NR MOKULELE AIRLINES NR NR NR MONTENEGRO AIRLINES NORWEGIAN AIR SHUTTLE ASA OLYMPIC AIRWAYS OMAN AIR NR NR NR NR NR OPEN SKIES NR NR NR NR PACIFIC WINGS NR NR NR NR NR NR PAKISTAN INT L AIRLINES NR NR PEGASUS NR NR PENAIR 2E 2E 2E 2E 2E PHILIPPINE AIRLINES PORTER AIRLINES NR NR NR PRECISION AIR PROFLIGHT ZAMBIA NR NR NR PUBLICCHARTERS.COM NR NR NR NR NR QANTAS AIRWAYS QATAR AIRWAYS NR NR NR NR NR ROYAL AIR MAROC ROYAL BRUNEI AIRLINES NR NR NR ROYAL JORDANIAN AIRLINES S7 NR NR NR NR NR NR SAFI AIRWAYS NR NR SANTA BARBARA AIRLINES NR NR NR SATA INTERNATIONAL NR NR NR SAUDI ARABIAN AIRLINES NR NR NR NR NR NR NR SCANDINAVIAN AIRLINES SEAPORT AIRLINES NR NR NR NR SEABORNE AIRLINES NR NR NR NR SENEGAL SINGAPORE AIRLINES 6E 6E 6E 6E 6E 6E SILVER AIRWAYS NR NR NR SOUTH AFRICAN AIRWAYS 3E 3E 3E NR 3E 3E SOUTHWEST AIRLINES 1E 1E 1E 1E 1E 1E 1E Page 6 Key Credit Card Acceptance: Blank = Carrier does not accept card; NR = Card accepted with no restrictions; Codes 1 8 = See definitions following chart.

7 CARRIER CREDIT CARD ACCEPTANCE CHART Credit Card Company CARRIERS AMEX CA DCI DS JCB UATP VI SPANAIR S.A. SRI LANKAN AIRLINES SUN AIR INTERNATIONAL SUN COUNTRY NR NR NR NR NR SURINAM AIRWAYS SWISS TAAG ANGOLA AIRLINES NR NR NR NR NR TACA INT L AIRLINES TACV-CABO VERDE AIRLINES TAM AIRLINES NR NR NR NR NR NR NR TAME AIRLINES TAP AIR PORTUGAL TAROM ROMANIAN AIR THAI AIRWAYS INT L 6E 6E 6E 6E 6E 6E 6E TIARA AIR ARUBA NR NR TRANSAERO AIRLINES NR NR NR NR TRIP LINHAS AEREAS NR TURKISH AIRLINES 2E 2E 2E 2E 2E 2E 2E TUNISAIR NR NR NR NR NR UKRAINE INTERNATIONAL NR NR NR NR UNITED AIRLINES US AIRWAYS UT AIR NR NR NR NR NR VARIG AIRLINES V-AUSTRALIA NR NR NR NR NR VIETNAM AIRLINES NR NR NR NR VIRGIN AMERICA AIRLINES NR NR NR NR VIRGIN ATLANTIC AIRWAYS VLADIVOSTOK AIR WESTJET NR NR NR NR WINDWARD ISLAND AIRWAYS NR NR NR NR NR NR XIAMEN NR XL AIRWAYS NR NR XTRA AIRWAYS NR NR NR YAKUTIA YEMENIA YEMEN AIRWAYS NR NR NR Page 7 Key Credit Card Acceptance: Blank = Carrier does not accept card; NR = Card accepted with no restrictions; Codes 1 8 = See definitions following chart.

8 Carrier Credit Card Acceptance Codes The following are definitions for the codes used in the Carrier Credit Card Acceptance Chart: Code NR Definition No restriction. 1 Valid for air transportation only. Exceptions: Air Transat All segments must be routed on Air Transat. Southwest Airlines All segments must be routed on Southwest Airlines. Aeroflot Russian Airlines Aeroflot does not accept US Airways UATP card transactions. Sri Lankan Airlines Sri Lankan Airlines tickets should be issued only with fares extended/owned by UL. Fares published by other carriers between Colombo (CMB) and the United States with Sri Lankan Airlines segment should not be ticketed on Sri Lankan Airlines. 2 At least one segment must be routed on ticketing carrier. Exceptions: All Nippon Airways At least one international segment must be routed on an All Nippon Airways flight. Era Aviation In lieu of the above, one segment routed on AS flights 4800 through 4899 is also acceptable. Pen Air In lieu of the above, one segment routed on AS flights 3200 through 3299 is also acceptable. Turkish Airlines Where transoceanic travel is a part of the itinerary, at least one transoceanic segment must be routed on Turkish Airlines. 3 At least one segment must be routed on ticketing carrier. Valid for air transportation only. Exceptions: British Airways Credit card may be accepted for tours or land arrangements in connection with British Airways travel only. LOT Polish Airlines Where transoceanic travel is a part of the itinerary, at least one transoceanic segment must be routed on LOT Polish Airlines. Page 8

9 Code Definition Lufthansa German Airlines Where transoceanic travel is a part of the itinerary, at least one transoceanic segment must be routed on Lufthansa. Mexicana Airlines Credit card may be accepted for tours or land arrangements in connection with Mexicana Airlines travel only. South African Airways Where transcontinental travel is part of the itinerary, at least one transcontinental segment must be routed on South African Airways % or more of the segments must be routed on ticketing carrier % or more of the total fare value must be routed on ticketing carrier % or more of the total fare value must be routed on ticketing carrier. Exceptions: Avianca Airlines Cardholder signature (and credit card imprint when applicable) required on charge forms for all credit sales. Any financial loss incurred due to a card not present transaction is the responsibility of the travel agency issuing the ticket/document for which the loss is incurred. A debit memo issued by Avianca to a travel agency in connection to an incurred loss by the travel agency (chargeback or other), must be paid by the travel agency upon receipt of the debit memo. Avianca will not extend a debit memo payment due date, despite any ongoing investigative and/or collection effort by the responsible travel agency. Cathay Pacific Airways 50% of the total fare value or a minimum of one transpacific segment must be routed on Cathay Pacific or Dragonair. China Southern Airlines 50% of the total fare value or a minimum of one transpacific segment must be routed on China Southern Airlines. Singapore Airlines 50% of the total fare value or a minimum of one transpacific or one transatlantic segment must be routed on Singapore Airlines. Thai Airways Will not accept any one charge in excess of $10, % or more of the total fare value must be routed on ticketing carrier. Valid for air transportation only. 8. Miscellaneous Bangkok Airlines Credit card payments are only accepted for a minimum of two Bangkok Airlines segments. Page 9

10 Credit Card Authorizations Travel agents must obtain credit card authorizations on all credit card transactions. Credit card authorizations are to be obtained through a Global Distribution System (GDS) at the time of ticketing. By doing this, travel agents can ensure that the appropriate carrier is properly identified, the transaction date and authorization date match, and the data included in an electronic authorization response message can be included in the transaction by the GDS, thereby reducing authorization related inquiries or chargebacks. In a situation where the authorization link is unavailable through the GDS, agents may obtain credit card authorizations by calling the appropriate credit card company authorization service. The following are the phone numbers and instructions: Airline Credit Cards As with other credit card transactions, all sales paid for with airline online credit cards must be authorized and the approval codes entered on all ticketing records. Obtain authorization with the following are instructions: Alaska Airlines Commercial Card (AS) 1 (206) % of the total fare value must be on Alaska Airlines. For cardless accounts, travel agents must obtain identification from unknown customers and contact the Alaska Airlines Commercial Card voice authorization center at (206) to confirm that the customer is authorized to use the account. American Airlines Personal Credit Card (AA) 1 (800) The ticket must be validated on, and at least one segment routed on American Airlines. Sabre agents receive automated authorizations. If Sabre generates a referral response, or the system is unavailable, call (800) (6 a.m. 11 p.m. Central Time, Monday Saturday; 7 a.m. 6 p.m. Central Time, Sunday). American Express 1 (800) The American Express Voice Authorization Service offers the ability to obtain basic credit card authorizations, to do address verification (AVS) and to do cardholder name verification. When calling the American Express Voice Authorization Service, have the following information available and follow the voice prompts: 1. American Express card number 2. Expiration date To use Address Verification, have the cardholder street address, city, state and zip code available. To use the Name Verification option, have the cardholder s first and last name. Page 10

11 JCB International 1 (800) When calling JCB, provide the authorizer with the following information: 1. JCB merchant number JCB account number and expiration date 3. Amount of transaction MasterCard and Visa 1 (888) The MasterCard and Visa Voice Authorization Service offers the ability to obtain basic credit card authorizations, to do Address Verification (AVS), to do Card Security Verification (CSV), and to obtain additional information to support a credit card transaction. Use of these fraud management tools does not provide protection in the event of a credit card chargeback. The following details the process and the options for using the Voice Authorization Service. Follow these steps as directed and enter the pound (#) following each step: 1. Enter merchant number the merchant number is 890 followed by the three (3) digit ticketing carrier code (ex ). 2. Select the transaction type (Press the number): (1) Request an authorization. (2) Request an authorization with AVS(enter numeric portion of the address as prompted). (3) Request an authorization with CSV. (4) Request an authorization with AVS (enter numeric portion of the address as prompted) and CSV. (5) Request AVS (enter numeric portion of the address as prompted) only. (6) Obtain additional information about an account. (7) Request the card issuing bank phone number. 3. Enter card number. 4. Enter card expiration date (MMYY). 5. Press one (1) if the card is present. Press two (2) if the card is not present. 6. Enter transaction amount with dollars and cents (ex. for $525.65, enter 52565). 7. Verify the amount press 1 if correct, press 2 if incorrect. 8. The authorization (a.k.a. approval) code will be provided. Discover Network 1 (800) Have the following information available: 1. Merchant number: Page 11

12 2. Card account number 3. Card Identification Data (see below) 4. Expiration date 5. Transaction amount UATP 1 (855) Have the following information available and follow the instructions provided via the automated response system followed by the pound (#) key for each step. 1. Three (3) digit ticketing carrier code 2. Eight (8) digit agency code number 3. UATP account number and expiration date (if applicable) 4. Amount of transaction (including dollars and cents) Disclosure of Terms and Conditions The terms and conditions of sale (i.e., deadlines, penalties and/or fees for canceling, refunding, or exchanging tickets) must be disclosed to the cardholder prior to the transaction taking place. To minimize the risk of financial liability in the event of a credit card chargeback associated with the terms and conditions, obtain acknowledgement in writing from the cardholder that the terms and conditions of sale have been made disclosed. Travel agents may be required to show proof that the cardholder, prior to the completion of the sale, accepted the terms and conditions of the sale. This is also true for sales initiated via the Internet or the telephone, i.e. card not present transactions. Internet travel agents are encouraged to clearly and concisely state the terms and conditions of the sale and require cardholders to click to accept the terms and conditions. E mail or verbal disclosure of the terms and conditions of sale to the cardholder is not accepted by the credit card companies as a legitimate defense against credit card chargebacks related to a cardholder s claim that the terms and conditions of sale were not disclosed prior to the sale taking place. Page 12

13 Guide to the Preparation of the Universal Credit Card Charge Form 1 Obtain the signature of the cardholder and compare it with the signature on the credit card. 2 Enter the three (3) digit carrier code. 3 Imprint the date of sale and the agency Identification. 5 Enter the name of the passenger and connection with the subscriber, if other than the cardholder. 7 Enter the authorization/approval code received from the credit card company. 8 Enter the airport/city code, fare basis and carrier codes of the ticket routing (if applicable). 9 Enter the credit card name or two letter alpha code. 10 Enter the carrier code and ticket number(s) of tickets issued. 11 Imprint card. 12 Enter fare, tax and total of all tickets issued. Note: Retain the signed, imprinted form in a secured location at the issuing travel agency for a period of two years. Page 13

14 Credit Card Chargeback Policy The Credit Card Chargeback Policy takes into account credit card company rules for merchants in the travel industry, as well as point of sale technology currently available through the travel agencies and their GDSs. As credit card company rules change and/or technological infrastructure changes are made, ARC will update this policy accordingly. The purpose of this Credit Card Chargeback Policy is to relieve travel agents of liability for a debit memo issued as a result of a fraud related chargeback when a travel agent follows proper card acceptance procedures at the point of sale. Therefore, absent evidence of negligence or fraud on the part of travel agencies, their employees, sales representatives, or agents of the agencies, travel agencies will be relieved of liability for debit memos issued as a result of a fraud related chargeback, provided adherence to the card acceptance procedures outlined below. Credit Card Acceptance Procedures Failure by agents to follow the two step process outlined in this policy, and respond to carriers' requests for legible supporting documentation substantiating compliance with the Credit Card Chargeback Policy within the following timeframes, will result in agents being held financially liable for disputed transactions. Carriers reserve the right to request that travel agents provide documentation substantiating compliance with the credit card acceptance procedures and the credit card chargeback policy for a timeframe of two years. Agents must ensure that carriers receive requested documentation via fax or other means within five (5) business days following the date of the request if it is received electronically or via fax. Agents must ensure that carriers receive requested documentation within seven (7) business days if the original documentation was received by mail. Step #1 Follow the instructions and procedures included in the Credit Card Acceptance Procedures portion of this handbook and the Credit Card Chargeback Policy. Step #2 Complete at least one of the following procedures. 1. Manual credit card imprint and cardholder signature Obtain and enter on the credit card charge form a complete and legible manual imprint of the credit card, as well as the cardholder s signature. The credit card charge form must be physically imprinted and signed. Compare the signature on the charge form to that on the signature panel of the credit card and verify that the two are reasonably similar. An example of a Credit Card Charge form is on page 13 of this section. Order forms from ARC through the ARC Document Services order process. Retain signed and imprinted charge forms on file in a secure location for a period of at least two years from the sale date. 2. Limited Power of Attorney Agreements applicable to UATP and Alaska Airlines online cards only Have in place at the time the transaction takes place, an original, valid, executed Limited Power of Attorney Agreement (example follows). Note that a Limited Power of Attorney Agreement will relieve travel agents of liability for a credit card chargeback resulting from a cardholder claim that use of their account was not authorized. Page 14

15 A Limited Power of Attorney Agreement will not, however, relieve travel agents of liability for a credit card chargeback that is the result of a fraud committed by an individual whose identity was not verified by the agent to be the same as that of the cardholder. Therefore, in order for a Limited Power of Attorney Agreement to be considered valid, travel agents must demonstrate that procedures were followed to verify that the person who executed the Limited Power of Attorney Agreement was acting on behalf of the corporate account, and the individual(s) purchasing the ticket(s) was authorized by the corporate account to do so. ASTA's SAMPLE LIMITED POWER OF ATTORNEY AGREEMENT I am a client of Travel Agency. I hereby appoint the owner, manager, and all employees of Travel Agency to be my attorneys-in-fact for the purpose of signing any documents necessary to purchase and issue airline tickets and to charge these purchases to my credit card, account #, expiration date. I authorize any of my attorneys-in-fact to sign credit card authorizations on my behalf, and intend such signature to bind me the same as if I had personally signed, for the purchase of airline tickets whenever any of them receives a telephone call reasonably believed to be from me or someone acting on my behalf, requesting that they issue airline tickets for me or anyone else and charge those tickets to the above identified credit card account. I agree that I will pay for all such purchases and will not hold the Travel Agency responsible for any of its actions pursuant to this power of attorney. This Limited Power of Attorney shall remain in full force and effect until terminated by me in writing, such termination to be effective only with respect to ticket purchases occurring after the time that the written termination is delivered to Travel Agency. Notarized: Signature Date Printed Name (Reprinted with permission from the American Society of Travel Agents, Inc.) Page 15

16 Credit Card Acceptance Risk Management Best Practices and Frequently Asked Questions The goal of this section is to provide information to help travel agents make informed decisions about credit card acceptance and the associated risk of fraud. Given that (1) most travel agency transactions are initiated in a card not present environment and (2) airline tickets are generally electronic (i.e., paperless) in nature, travel agents are encouraged to use all of the tools, and all of the data available to them, to evaluate the risk of fraud and make informed business decisions about whether or not to complete a sale. When accepting credit cards, it is not only important for travel agents to confirm the card is valid and active by securing an authorization/approval code (procedures outlined above), but also to validate the identity of the cardholder. Given the previous two points, keep in mind, the more information a travel agent has to confirm the identity of the cardholder, the less likely the agent is to receive a debit memo for a fraud related credit card chargeback. Credit card companies have developed several tools designed to help credit card merchants manage risk; however, no single tool will eliminate fraud. The best practice in the industry is to use all of the tools available, along with all the data available about the cardholder and the transaction, to evaluate risk of fraud. As part of the process of managing risk, any merchant accepting credit cards, including travel agents, must determine acceptable levels of risk. Ever since credit has been offered as a form of payment by merchants, it has been the responsibility of the merchant to validate the identity of the customer. This concept hasn t changed since local drug store or department store merchants started to allow customers to put transactions on account to be paid later. With the introduction of credit cards, the credit card companies defined who would accept liability should a credit card transaction be identified as fraudulent. In general, the determination was that if a merchant received authorization from the card issuer, obtained an imprint of the card (or a card swipe, which is the modern day equivalent of a manual knucklebuster imprint) and a signature from the customer (reasonably similar to the signature on the card), they had collected the information necessary to prove that they had validated the identity of the cardholder. In the event of a fraud chargeback, if a merchant can provide a signed and imprinted charge form, the financial liability shifts to the entity that issued the credit card. This standard still exists today. Another option for many merchants is to obtain a successful swipe of a card s magnetic stripe. Since the travel agencies point of sale systems lack the ability to obtain a magnetic strip read, a card imprint is still required. Over the years, merchants, including airlines and travel agencies, have changed the way products and services are made available to consumers. Initially, the trend moved toward phones and then to the Internet, both of which are considered card not present sales channels. By choosing to support card not present sales channels, merchants no longer have the information required by the credit card companies (i.e., a signed and imprinted charge form) should a transaction result in a fraud chargeback. As merchants consciously broaden the distribution of their products and therefore increase the risk of accepting fraudulent sales, merchants must implement risk management strategies to accept more good sales than bad sales and thereby increase profitability. As the distribution of products changes, credit card companies created new tools to help manage fraud. Whether putting holograms on cards, photos on cards or making changes to the magnetic stripe, credit card companies have worked to address the fraud concerns of the time. With the prevalence of card not present transactions, credit card companies continue to develop tools to assist merchants in managing the risk associated with credit card acceptance. While Verified by Visa and MasterCard SecureCode offer a shift in liability from the merchant in some situations, to date credit card companies have not developed a tool that provides a shift in liability for card not present transactions, for all card types, for soft goods such as airline e tickets. Given that the liability for card not present transactions falls on the merchant, many travel agents and carriers have developed sophisticated systems to manage risk. These systems generally include the use of several credit card company fraud management tools in Page 16

17 conjunction with third party transaction scoring tools, and other data available about the cardholder and the transaction, to assist in making a decision about whether or not to accept the transaction. This approach has become a well established best practice for managing fraud. The information that follows describes some of the credit card company tools that can be used to manage the risk of fraud and chargebacks. The use of these tools does not offer a shift in liability in the event a sale results in a fraud chargeback. Credit Card Authorization All credit card companies require merchants to obtain a credit card authorization for every transaction in the travel industry. Without an authorization, for some card types, credit card companies can initiate an immediate chargeback and assess a fee to the merchant. This is the most basic verification that a card number is valid and that the funds (a.k.a. open to buy ) are available on the account. Simply obtaining an authorization doesn t provide a merchant with protection against fraud or chargebacks. Address Verification Service (AVS) Address Verification Service (AVS) is a tool offered by American Express, Discover, MasterCard, Visa, JCB and Diners Club International. It allows merchants to verify that the billing address provided by the customer matches the billing address associated with the card. AVS can be an effective tool for validating customer identity because, in many instances, individuals perpetrating fraud do not know the customer billing address. However, it is important to note, in some cases, individuals perpetrating fraud may know the customer billing address. Using AVS doesn t provide a merchant with protection against fraud or chargebacks. AVS is available through the following GDSs by card type (Note that these tools may not be available on all platforms within the GDS; therefore, to obtain information about the availability of these tools on your specific platform, contact your GDS representative): GDS American Diners Club Discover JCB MasterCard Visa UATP Express International Amadeus X X X X TravelPort X X X X Sabre X X X X Page 17

18 Card Identification (CID), Card Verification Value (CVV2) and Card Verification Code (CVC2) Visa, MasterCard, Discover and American Express each provide a valuable service that allows agents to validate the unembossed code (three or four digits) on a credit card. Validating the unembossed number on the card matches the number associated with the card helps to demonstrate that the customer has a valid card in his/her possession. This prevents individuals with stolen credit card numbers from using the numbers to make fraudulent purchases. This tool has been proven to be a valuable risk management tool; however, as with AVS, in some cases individuals perpetrating fraud have the code. Using CID, CVV2 or CVC2 doesn t provide a shift in liability in the event of a chargeback. The following is an example of how CID is represented on a Discover card. It is similar with other cards, but in the case of American Express, the CID is on the front of the card. Note: Never write down or retain the unembossed number associated with a customer s card. CID, CVV2 and CVC2 are supported by the GDS for the following card types GDS American Express Discover/Diners Club MasterCard Visa UATP International and JCB Amadeus X X X N/A TravelPort X X X X N/A Sabre X X X X N/A 3 D Secure Online fraud management tools (Verified by Visa and MasterCard SecureCode) Both Visa and MasterCard offer online tools that allow Internet merchants to authenticate the identity of a cardholder through a cardholder generated PIN (personal identification number) associated with the account. These online tools facilitate authentication by providing an interface directly to the card issuer to validate the PIN. Online merchants that use Verified by Visa and MasterCard SecureCode have built the infrastructure into their websites to interface through these tools directly to the card issuer. Merchants who use 3 D Secure receive a shift in liability for fraud chargebacks for consumer card transactions when PIN authentication is attempted. In other words, there is a shift in liability even when the card issuer and/or cardholder do not participate in the program. It is important to note that there isn t a shift in liability for corporate card transactions. It is also important to note that, the infrastructure required via the GDS through ARC is not in place to support the shift in liability should travel agencies use 3 D Secure. If you are an Internet agency using Verified by Visa or MasterCard SecureCode and would like to use it for airline ticket sales, please contact the ARC Credit Card Services department at (703) Page 18

19 Third Party Scoring Tools Several third party transaction scoring tools are available to help merchants effectively manage their fraud risk by flagging transactions that appear high risk. These real time, transaction scoring tools use existing credit card company tools, data about the customer, and data about the transaction, to provide merchants with information they need to manage risk. The scoring tools use all of the data available to flag high risk transactions and then provide the information to the merchants, usually through an online tool, so they can identify transactions that require additional review. Many of the largest travel industry merchants use these third party scoring tools, which have helped to prevent tens of millions of dollars in fraudulent bookings. Other Tips for Detecting Fraud Information is key when evaluating the risk of fraud. By evaluating all of the data available about a transaction and the customer, a merchant can determine if the data suggests a risk of fraud higher than the merchant is willing to take. The following are examples of information often available about a transaction that helps evaluate the identity of a cardholder and/or the risk that the transaction could result in a fraud chargeback. Please note that none of these items alone provides a full evaluation of the customer or the transaction, but the elements are best used together to paint a complete picture. Customer information o Passenger name Validate that the passenger name matches the cardholder name. If none of the passenger names match the cardholder name, the risk of fraud increases. o Customer history Determine if the customer is a previous customer of the agency and if the experience was positive or negative. If the customer initiated a chargeback previously, you may not want to work with the customer again. If you have a long and positive history with customer, the risk of fraud decreases. o E mail address E mail addresses from free services are easy to obtain and difficult to trace and therefore easy for individuals perpetrating fraud to use. o Caller ID If Caller ID shows a customer calling out of area or has no information at all, this could be an indication of a higher risk customer. o New customer A customer may be higher risk when the initial contact is via e mail, Internet or TTY service (for the hearing impaired). o Customer not local If a customer is calling your agency for the first time, determine how they heard about the agency and if they are available to come into the agency. If not, the risk of fraud increases. o Multiple credit card numbers provided If the first credit card is declined and another credit card is provided, this could indicate a problem. Transaction information o Last minute travel A date of departure near the date of issue can indicate an increased risk of fraud. o International travel International travel tends to be higher risk than domestic travel. o High risk city pairs Some itineraries have higher fraud rates. o Departure city A departure city that isn t near the cardholder s billing address is a higher risk. Chargeback Management Consumers in the United States have a guarantee that if they are not involved in a transaction that has been billed to their account or they did not receive the product or service promised, they have the ability to question the charge and/or charge it back. Credit card merchants are required to engage in a process to respond to these Page 19

20 inquiries, or chargebacks. The following is a list of suggestions for travel agents to respond to inquiries or debit memos for chargebacks: Contact your customer to explain the charge. If there has been a misunderstanding on the part of the customer, request that they contact their bank to rescind the inquiry or chargeback. In all cases, provide the most professional, legible and detailed documentation available to back up the charge. It helps to include a typed letter on company letterhead that provides details of what the transaction represents and what the customer received. In addition, include all relevant documents such as itineraries, invoices, copies of tickets, signed terms and conditions, e mails, etc. Respond as quickly as possible and within five (5) business days. If you believe your customer has perpetrated fraud and received services for something that has not been paid, seek legal counsel to identify the best way to manage the customer. Things to include in your response: Copy of ticket Details of itinerary Copies of invoices provided to customer Signed acknowledgement of terms and conditions Signed and imprinted Universal Credit Card Charge Form, when available On your agency letterhead, typed details of experience with the customer, including dates Payment Card Industry Security Standards Any ARC participant that accepts credit cards as payment for goods and/or services is expected to keep all credit card numbers and personal information secure whether in hard copy or electronically and be compliant with the Payment Card Industry Data Security Standard (PCI DSS). Conclusion Many tools are available to help merchants manage the risk of credit card fraud, they don t offer a shift in liability from the merchant to the card issuer for all card types with the exception of a signed and imprinted credit card charge form or a limited power of attorney agreement for specific card types. For card not present transactions, tools like Address Verification (AVS), Card Identification verification (CID, CVV2 and CVC2), Verified by Visa and MasterCard SecureCode, when used in conjunction with other red flags for fraud, allow merchants to review transactions and evaluate fraud risk. It is up to the individual merchant to determine what level of risk they are willing to take when accepting credit cards. Page 20

21 Frequently Asked Questions 1. Why are travel agents held to a different standard for credit card acceptance than airlines? Travel agents are not held to a different standard for credit card acceptance than airlines. Both airlines and travel agents evaluate the risk associated with accepting a credit card as a form of payment and must determine their own risk tolerance. It is worth noting that many airlines have additional technological infrastructure available, which makes their credit card acceptance procedures and requirements slightly different. For example, for card present transactions, many airlines have magnetic stripe readers, which allow them to obtain an electronic read of the card instead of a card imprint. In addition, for card not present transactions some airlines have implemented 3D Secure (Verified by Visa and MasterCard SecureCode) on their websites, which offers them some protection against fraud chargebacks. 2. What are credit card companies doing to help online merchants validate the identity of the cardholder and thereby reduce the risk of fraud? Credit card companies are always looking for new ways to help merchants validate the identity of cardholders and reduce fraud. 3D Secure (Verified by Visa and MasterCard SecureCode) is a PIN based tool available for online, customer facing, consumer card transactions. This tool is not applicable for corporate card transactions. 3D Secure works by linking directly from the merchant website to the card issuer to validate the cardholder PIN. When a merchant attempts 3D Secure, they are relieved of liability for the applicable transactions, regardless of the participation of the card issuer and the authentication of the PIN. 3. Why is there no longer protection for using Address Verification with Visa and American Express? Previously Visa and American Express offered a shift in liability when actual paper tickets were sent to the cardholder s billing address. With e ticketing, the protection is no longer available because paper tickets are no longer sent to the billing address. 4. Why is it that when I shop with other card present merchants, they aren t required to obtain an imprint of my card? Most card present merchants have the infrastructure in place to read a magnetic stripe of a card. The reading of a magnetic stripe as part of the authorization process replaces the need to obtain a manual imprint. Studies validated that a large majority of travel agency transactions were card not present. Therefore, the infrastructure to place magnetic stripe readers in travel agency offices for airline ticket sales was not developed. 5. Will I be protected if I require my customer to fax a copy of a signed charge form? No. In a card not present environment, it is important to obtain as much information about the customer as possible to manage risk; however, only an actual imprint of the card on a credit card charge form will offer a shift in liability for a fraud chargeback. 6. Will I be protected if I obtain a copy of the front and back of my customer s credit card along with a copy of the front and back of their driver s license? No. In a card not present environment, more information is better for managing the risk of fraud. However, only an actual imprint of the card on a credit card charge form will offer a shift in liability for a fraud chargeback. 7. What should I do when presented with a credit card that doesn t have raised numbers and therefore can t be embossed? In general, credit card companies require that merchants provide proof that the card was present when providing support for a fraud chargeback. Since the infrastructure to obtain a card swipe isn t in place via the GDS, the only way to validate that the card was present is to obtain a card imprint. Given that an imprint cannot be obtained on Page 21

22 an unembossed card, travel agents must evaluate the risk of fraud and determine if they are willing to accept the transaction. Agents unwilling to accept the risk that the transaction could be fraudulent should request a different form of payment. Page 22