Frequently Asked Questions. regarding CIB Bank Zrt. s. ecommerce online card-acceptance service

Transcription

1 Frequently Asked Questions regarding CIB Bank Zrt. s ecommerce online card-acceptance service

2 1. BUSINESS-RELATED QUESTIONS What is the role of the bank in the service? Since it is a financial institution, our bank only provides financial services, that is, it performs the verification of bank cards and the settlement of transactions within the framework of the ecommerce service. Our Bank cannot provide web shop software. We can, of course, recommend third-party providers who can assist you by implementing the web shop or connecting an already developed web shop to the bank s payment page, or by hosting the web shop. What conditions need to be met in order to be able to use the service? In line with our provisions regarding company history, your company must have been operating for at least six months or must have an account-management history with CIB Bank of at least three months. Does the bank specify any content restrictions for web stores that wish to contract with it? Based on our terms of contract, no Card Acceptance Agreement may be concluded with a merchant who maintains a web shop or provides a content service that offers goods or services over the internet that could damage the bank s reputation (e.g. sex and pornography, illicit drugs, arms, gambling, illegal trading, etc.). What is needed in order to use the service? The Application Form that can be found in the Related documents infobox on the ecommerce product page of CIB Bank s website ( must be completed, provided with an authorised signature, and submitted at any branch of the bank or ed to efizetes@cib.hu. If the application meets the conditions for the use of the service, the next step is to conclude a Card Acceptance Agreement and if the applicant does not have an account with our bank, he or she will also need to open a HUF or HUF and EUR current account. What cards can be used for shopping on the internet and what types of card are accepted by the bank? At present, our bank accepts bank cards that belong to the Visa and Mastercard product family and that are suitable for internet shopping. Of these, the following cards can be used on the internet: MasterCard, Visa, Visa Electron and Maestro cards (in the last two cases, the card may be used for online shopping if the card-issuing bank authorises it) and cards specifically issued for the purpose of online payment (e.g. CIB Internet Card). Is settlement in a currency other than forint possible? Currently, our bank performs forint and euro-based settlement. This is also true for transactions carried out using other international cards. The transaction amount is in each case credited to the merchant s forint or euro account kept at our bank. In the case of payment by card in a currency other than those mentioned above, based on the legal provisions currently in effect, the price must be displayed in your web shop in the national currency as well, that is, in forint. Conversion will be made by the financial institution (international card company 2

3 or, if necessary, the card-issuing bank) intermediating in the process of the online authorisation of the transactions, at its own exchange rate. The amount paid for the purchases will be credited to the merchant s account in the currency of the transaction, that is, in forint or in euro. What happens if the card holder pays with a card of a currency other than forint or euro? Depending on the parameters set by the merchant, our bank will request authorisation for the transaction in forint or euro (and so the request for authorisation of the transaction will appear on the card holder s account in forint or euro). Our Bank will then forward the transactions to the card company for settlement in forint or euro. Our Bank does not perform any kind of conversion or exchange. The card company converts the transactions at its own exchange rate to the currency in which settlement is made with the card-issuing bank. The card-issuing bank converts the amount received, debited in foreign currency, to the currency in which the card holder s account is kept. In addition to the above, as a few days pass between the transaction and the debiting, no calculation can be made in advance, as the exchange rate that will be valid on the day of debiting cannot be foreseen. The final amount indicated on the card holder s account statement may differ from the amount indicated on the merchant s/service provider s website due to changes in the exchange rates. Who is competent to respond to complaints regarding the outcomes of card payment? Maintaining contact with the customer (shopper) is in all cases the responsibility of the party contracted for card acceptance. For the purpose of informing customers, the web shop is obliged to display the response code and text received from the bank regarding the outcome of the transaction. Customers can ask for more detailed information from the card-issuing bank s customer service centre by calling the telephone number provided on the reverse side of the card. CIB Bank Zrt. can only provide information regarding transactions for its own contractual partners. Do I get a confirmation of the transaction? Each and every transaction is an irrevocable operation. This means that the customer, i.e. the card holder, as well as the merchant and the card acceptor each receives an immediate confirmation of the transaction in electronic form when it is executed. Card acceptors also receive a paper-based statement called a Merchant s payments and turnover statement, which allows them to see and trace successful transactions. The service includes the option of requesting paper-based Merchant s statements to be issued in electronic format as well. The e-statement contains the data of successful transactions that have been processed on the given day, and can be downloaded via the CIB Business Terminal systems. Is it possible to customise the bank s payment page to match the look of the web shop? We have a function available that enables merchants to customise the payment page so that it is consistent with the look of their web shop, by placing the header or logo of their website on their secure payment page maintained on CIB s server. The above-mentioned page must comply with the prescribed structure and content, and the graphical restrictions related to the bank and to security must be observed. 3

4 What sort of legal regulations are there that relate to e-commerce? The specific rules applicable to e-commerce services are contained in Act CVIII of 2001, but in the course of pursuing these activities, all other legal provisions applicable to traditional trading activities must also be complied with (e.g. consumer protection, advertising, authority permit-related provisions). The latest legal regulations pertaining to e-commerce can be accessed at 4

5 2. DEVELOPMENT TASKS What are tasks to be performed by the in-house developer of a store or shop? Our Bank provides a protocol description to the merchant for use with the ecommerce payment module, as well as an encryption and decryption software application required for communication and what is referred to as an individual shop identifier for the specific contracting partner. The developer s task is to implement the conditions required for connection to the bank s payment server; that is, to develop a program for the forwarding and management of data between the web shop and the bank, and to provide technical support to the web shop in connection with development in the future, and so on. Development of the protocol The protocol is an HTTP-based communication regulated by URL parameters. The payment process consists of 3 main parts: transaction initialisation directing the customer (shopper) to the bank inquiring about the transaction outcome The first and the third steps progress similarly: once it has collected and encrypted the required information, the shop sends it (using the software supplied by the bank) as a URL parameter to the bank s server. The bank s server returns a content-type response, using the same encryption method as the inquiry. The second step is slightly different: it is an HTTP rerouting to the bank s payment page, resulting in the termination of the connection with the shop and redirection to the bank's payment page using strong encryption. What kinds of server-side platforms are supported by the bank? Our payment module is platform independent; it can be implemented in any language, and in most cases to date it has been used on a PHP basis. The protocol can be implemented by tools of your own choice. With the technical documentation, we enclose PHP, Java and, for the ekicrypt program supplied by the bank, a model script. What platforms does the encryption program provided by the bank run on? In Unix and Win32 systems. Which server is the payment page on? In all cases, our client s dedicated payment page is located on the bank s server. The payment page cannot be embedded into the client s own website as a frame. What exactly is the process in a secure transaction? 1. The merchant initialises the transaction This step is performed by a URL-call, where the transaction parameters are forwarded to the bank in an encrypted format. The bank returns the result in a similarly encoded format in the content section of the called page. The (RSA-compliant) program required for encryption is supplied by the bank. The program uses 3DES encryption. 2. Redirecting the customer to the payment page 5

6 This step is doubly secure, as the parameters encrypted in the above way arrive to us through redirection to an SSL page. 3. Input of the customer s card data The payment page uses 128-bit SSL technology and the certificate is secured by VeriSign. 4. Redirecting the customer to the merchant The customer is redirected to a predetermined URL by using parameters encrypted by the method described in the first step. 5. The merchant s inquiry concerning the outcome With the help of the URL-call discussed in step one, the merchant can ascertain the outcome of the transaction. What kind of support can the bank provide in the case of a proprietary development? Development support covers all issues related to protocol development, but we cannot help with the basic programming algorithms. Is there a fee to pay for the bank s support? Support is provided free of charge in the development and testing phases, but the merchant must pay a one-off connection fee. Does the bank provide a testing opportunity? Yes. The test system can be used after the contract has been concluded, in the way that is specified in the technical documentation provided. For the card payment function to go live, the bank s approval is needed, which requires at least one successful test by the bank as well. What kind of bank cards need to be used for testing? In the test environment, when simulating a bank-card payment, any card number not in use, beginning with 4 or 5, and any future expiry date can be specified. What are the requirements for the card payment system to go live? Before the online card acceptance function of the web shop can go live, the bank tests the web shop in the test environment. In addition to checking the successful implementation of the payment function, the test includes checking the individual steps in ordering, such as registration, the process of product selection, the existence of communications for informing the customer, etc. In accordance with the current legal provisions, the price must be displayed in forint as well, regardless of the currency used by the web shop for sales purposes. Besides displaying other currencies, it is compulsory to state the fact that the payment will be debited in forint. The card logo provided in the documentation package supplied by the bank, the CIB Bank logo, and the customer information notice on payments must be displayed on the site of the web shop. The outcome of the transaction must be confirmed by displaying the data on the screen and sending it in an . 6

7 It is a requirement that it be possible to link the transaction data to the data of the customer s order in the web shop s administrative or order-tracking system. In practice, this means that it must be possible to retrieve the transaction data related to the payment by card of the ordered product or service. If a time-out occurs in any phase of the transaction, it will be closed by our system as unsuccessful, and it is the task of the web shop to delete the order and to close the transaction on the web shop s page, and to communicate this fact to the customer by displaying it on the confirmation screen or by sending it in an . If the payment transaction is unsuccessful for any reason, it must be possible to restart the payment process. I want to embed CIB s ecommerce service in a web shop system, but I do not have the professional resources required for the development of the service. How can the integration be implemented? If you want to have the CIB Bank card payment module developed by an external provider rather than to develop it in-house, CIB Bank can recommend suppliers who can assist you in implementing the technical integration and thus provide you with a flexible and rapid connection. For more information regarding these development firms and their contact information, go to the product page of the ecommerce service at: Is there a CIB ecommerce module that has been integrated into a web shop system? In cooperation with CIB Bank, CIB ecommerce card payment modules (e.g. oscommerce, VirtueMart) have been developed for certain web shop systems to make integration simpler. These modules are sold and the related technical support is generally provided by the company that develops them. You will find information required for the use of the individual payment modules at the web address given in the previous point. Is it compulsory to indicate the price in forint next to the product or service being sold? Under the prevailing legal provisions, prices must be displayed in forint as well regardless of what currency the web shop wants to sell in. Does the bank indicate the payable amount on the payment page in another currency as well? Yes in the case of forint-based transactions, in dollars and euros (translated at its USD and EUR forex sell rates) for information purposes, and in the case of euro-based transactions, compulsorily in forint and, for information purposes, in dollars too (translated at its USD forex sell rate). As individual card-issuing banks apply different exchange rates for translation purposes, the exchange rates quoted by CIB Bank on the payment page are indicative only. What kind of security solution does the bank provide? The internet is a public network, and for this reason particular attention needs to be paid to data security. We assure data protection through the SSL (Secure Sockets Layer) procedure, the standard encryption procedure for the internet, and as a result the payment information provided 7

8 online moves between the browser and the web server in an encrypted format (with the help of a 128- bit encryption key). Is it possible for customers to provide the card data on the merchant s website and then have the latter forward them to the bank? This procedure is prohibited; the bank offers a payment solution through which the customer can provide the card data directly on the bank s payment page, which ensures the security of card payment. Should you have any further questions in relation to the above, please do not hesitate to contact us at ecommerce@cib.hu. 8