Optimizing Airline Profits: Payment management strategies for airlines

Transcription

1 A CyberSource White Paper Optimizing Airline Profits: Payment management strategies for airlines by Dave Glaser VP Professional Services CyberSource Corporation CyberSource Corporation 1295 Charleston Road Mountain View, CA

2 CyberSource Corporation All rights reserved. First Publication

3 Contents OVERVIEW... 3 STRATEGIES TO OPTIMIZE PAYMENT OPERATIONS... 4 ADDING NEW PAYMENT TYPES...4 AUTOMATING THE BOOKING REVIEW PROCESS (FRAUD MANAGEMENT)...5 AUTOMATING RECONCILIATION...7 STREAMLINING PAYMENT SECURITY COMPLIANCE...8 IMPLEMENTATION APPROACH... 9 CYBERSOURCE AIRLINE PAYMENT MANAGEMENT SOLUTIONS Overview Every airline I ve worked with is trying to shift more customers to direct sales channels in an effort to lower their distribution costs and increase revenue. In doing so, more emphasis is being placed on payment management, particularly in four key areas: 1. Adding new payment types 2. Automating the booking review process (fraud management) 3. Simplifying reconciliation 4. Streamlining security compliance However, making these improvements can initially seem quite daunting because of the operational complexity of the business, coupled with the limitations of existing legacy systems. The big questions become what to do businesswise, and how to marry new and existing technologies with the least amount of pain. In my experience, you can achieve some early success by implementing a point solution to address a specific payment need (for instance, adding new payment types or improving the booking review process). But as direct channels become more sophisticated, the most successful airlines are moving to a more integrated, centralized approach to payment management that can scale to support current and future needs while leveraging existing technology. In doing so, payment management goes from being a necessary cost of doing business to a competitive advantage that can enable airlines to adapt quickly to market shifts. In this paper, I ll discuss the tactics I ve seen airlines adopting to improve profit via payment management, as well as the implementation approaches that I ve seen work best CyberSource Corporation. All rights reserved. Page 3

4 Strategies to Optimize Payment Operations The airlines I ve worked with are focusing on building out their direct channels (especially their own websites) to lower distribution costs and increase revenue. According to a study by Edgar, Dunn & Company 1, airlines can reduce their payment-related expenses by up to 25% by optimizing the way payments are managed. If you think of payments as an entire process, where every transaction goes through a stage in a payment pipeline, you can identify broad areas to optimize profits, from the initial reservation request to the funding and reconciliation of a transaction. The airlines I ve worked with have been scrutinizing how they currently manage online payments using this pipeline framework, and devising strategies to streamline payment operations. ADDING NEW PAYMENT TYPES Adding new payment types kills two birds with one stone. First, adding new payment types lowers distribution costs because transaction fees for alternative payment types are generally lower than credit cards. According to the same Edgar Dunn study, each ticket purchased by credit card costs an airline $12.50 in processing, a sizable bite from the bottom line. In contrast, most bank transfers (for example) charge a lower fee per transaction, versus a percentage of the transaction (like credit cards). Second, adding new payment types can increase bookings by addressing customers that prefer to pay using methods other than credit cards both here and abroad. This is especially significant for international markets, where customers may prefer to pay online with bank transfers, direct debit, or some other form of payment. Payment Types Most Airlines Consider The decision to add a new payment type depends on many factors (customer payment preference or transaction fees, for example), and the benefits should be weighed against the implementation costs (back-office integration, additional overhead, etc.). The studies I ve seen indicate an average lift of 14% in online sales conversion when three or more payment types are accepted (cards, Bill Me Later, echeck, etc.). 1 Burg, Pascal, Next Frontier for Airlines: Reducing the $1.5 Billion Expense in Payments, Edgar, Dunn, & Company, February Next to credit cards, PayPal is the most popular online payment method in North America 2. With PayPal, customers pay directly using their address and PayPal password. Funds are sent directly from either the customer s bank account or credit card. Recently, Northwest Airlines, Midwest Airlines and Southwest Airlines have added PayPal as a payment method. One payment type that has attracted several airlines is Bill Me Later, an instant credit account that enables customers to purchase goods and services online without using a credit card. AirTran Airways, Continental Airlines, JetBlue, and USAirways all accept Bill Me Later. Bank transfers, though used rarely in the United States, are popular in both Europe and Asia. If you have international websites with online booking, this may be an ideal way to expand your market. For example, nearly two-thirds of Germans pay online using direct debit; Chinese customers use debit cards to initiate online bank transfers for e-commerce. With online bank transfers, customers are routed to their bank for payment authorization before being returned to the airline s website to complete the reservation. In general, you will most likely see lower transaction fees with all of these payment types versus credit cards. But you can lower your card processing fees by implementing payer authentication services such as Verified by Visa, MasterCard SecureCode, and JCB J/Secure. Some card associations offer lower discount rates to encourage payer authentication adoption, in an effort to fight online fraud. Furthermore, if you have a UK presence, MasterCard SecureCode is mandatory for all Maestro card transactions. With all of these options however, I find most airlines have difficulty adding new payment types because of rigid legacy systems that can only support credit card transactions. Passing relevant information to the PNR, as well as potential changes in authorization and settlement processes (and the associated reconciliation systems) requires thinking about your system architecture differently and building to that with each enhancement you make. I offer suggestions for this later in this paper. 2 AC Nielsen CyberSource Corporation. All rights reserved. Page 4

5 AUTOMATING THE BOOKING REVIEW PROCESS (FRAUD MANAGEMENT) Though many airlines do not have a fraud problem per se, nearly all have a fraud management problem the way in which fraud is managed is typically costly, human intensive, does not scale, and results in rejection of valid bookings or needlessly compromises inventory. As airlines pursue strategies to take more business direct and optimize payment operations, more emphasis is being placed on automating and tuning more of the screening process. The goal is to streamline the review process to achieve a lower valid reservation rejection rate and better inventory control, so analyst time is focused on reviewing only those reservations that truly require review. To illustrate the business issues involved, consider the customer experience during the reservation booking process. If fraud is not detected, or you reject a valid booking, you lose revenue. Also, each time you suspend a booking for review you tie-up inventory. If the suspended reservation is determined to be fraudulent, the seat must be released and is often sold at a distressed price, thus forfeiting revenue. This places profits at risk and reduces scalability. To address these types of issues, the trend is to implement automated screening and case management systems, including rule systems that leverage airline PNR data and can easily adapt to changes in fraud patterns and schemes. Many airlines have also implemented Verified by Visa and MasterCard SecureCode payer authentication systems as a first step towards better managing fraud. To see why your peers are taking this action, it is helpful to understand common fraud schemes, and the pros and cons of various tools and approaches that might be applied to managing that risk. Common Fraud Schemes Against Airlines I ve seen an emerging pattern where fraudsters book a reservation with a child or infant (a lap child), and then cancel the infant seat. This skirts some typical fraud checks, since the passenger profile check has typically focused on singlepaying customers. Yet often fraud and suspicious person checks are the same. I ve also seen a dramatic rise in fraud with airline gift card programs. With gift cards, a third party is typically buying for someone else (i.e., parents buy gift cards for their college-bound son to travel home for the holidays). The traveler and purchaser are almost never the same. Traditionally valid airline checks (reviewing time to departure, destination codes, etc.) aren t tied to the initial credit card transaction, since the purchaser and the traveler are different. The traveler may not have even booked any flights. In practice, fraud checks should be linked to the gift card, but in my experience, gift cards are processed differently, where the sophisticated checks normally used with credit cards are not in place. So, gift cards can be purchased using stolen credit card information, without the traveler being linked to the purchaser. Certain types of promotional packages are also heavily targeted by fraudsters. For example, winter bird flights to/from Jamaica are very popular. Some fraudsters are even known to have secured frequent flyer numbers to help legitimize their reservation. These fraud schemes cannot be effectively addressed using a single tool, or even the array of tools supplied by card companies. Some require use of PNR data to accurately detect fraud and more efficient case management systems to speed review of the bookings that have been suspended. Here s a review of the tools my clients are using and considering. Fraud Screening Techniques The industry trend is to lift conversion rates and streamline the review process on inbound reservation requests, so that fewer reservations are pulled for manual review. Due to the nature of the airline business, there are several data elements and a combination of factors that can be used to uniquely assess the risk of a cardnot-present (CNP) transaction. The most common of these screening techniques are the fraud tools supplied by the card associations. Address verification service (AVS), available in the U.S., Canada, and UK, enables the airline to verify the billing address to the address on file at the issuer. AVS availability in Canada and the UK are more recent, so the reliability and accuracy of the service are still being enhanced CyberSource Corporation. All rights reserved. Page 5

6 While helpful, an AVS match is not necessarily an indicator of a valid account, as the fraudster likely already has the correct billing information. Similarly, an AVS mismatch may not accurately point to fraud; statistically, if you relied only on AVS match results, you would reject 160,000 valid bookings out of every million processed. Another fraud check uses the card verification number (CVN, CVC2, CVV2, CID) typically found on the signature line on the back of a credit card. CVN data is generally available worldwide, and is more reliable than AVS. Also, CVN data is not publicly available (unlike address records) and is more stable the CVN stays the same even if the customer moves. While CVN is more reliable than AVS, it still carries false positive and false negative risks as well. The card brand fraud tool gaining the most recent interest from airlines is payer authentication (Verified by Visa, MasterCard SecureCode, and JCB J/Secure). Payer authentication is a good foundational tool to help address online fraud, and several of my clients have already implemented it. Depending on the card scheme, and the region and program administration, you can benefit from complete protection against fraud loss and interchange discounts. However, you are still subject to monitoring against the actual fraud rate, so you must still aggressively manage fraud. Payer authentication is not a silver bullet though. I ve seen examples where fraudsters move from the online channel (with payer authentication implemented) to call centers, where they can book reservations with a stolen card. I ve also seen situations where fraudsters can literally buy and sell identities, complete with payer authentication passwords. Beyond these card-supplied tools, my clients are also using other validation services such as geolocation, a technique that compares the purchaser s location, as indicated by their IP address, to booking information like the bill-to address. Such a test can be helpful, but the typical (i.e., good ) behavior of an airline customer can minimize its effectiveness. For example, if customers book reservations outside their home billing address (i.e., from a remote location while traveling), such a test would result in a valid booking rejection. For all the reasons above, I ve found airlines need to use airline-specific data (in conjunction with these other tools) to effectively screen for fraud and minimize rejection of valid bookings. Such data spans PNR and reservation data, including: passenger profiles, time to departure (i.e., checking if departure time is less than twenty-four hours away), and purchasing behavior associated with airport destination and departure codes (as specific routes and/or codes exhibit more risk than others). To illustrate how this is used, one Eastern European airline that I worked with experienced a high fraud rate on routes to London Heathrow and Gatwick, with passengers booking within 48 hours to departure time, typically flying during the weekends. The ability to build automated screening rules based on the reservation data was effective in detecting this fraud scheme. I ve also found that incorporating passenger frequent flyer data can significantly improve fraud screening. Frequent flyer numbers, length of enrollment, and number of site visits (for example) help to validate the identity of the passenger. Implementing Fraud Management Solutions As discussed above, effective airline fraud checks now rely on gathering reservation data and comparing it to financial and customer data. Depending on your IT environment, this can be difficult to obtain. You will need to consider how to pull or pass information among your various systems including GDS systems which house some of the data required. I recommend creating a middleware layer to pull legacy system data and GDS data together, as an end-state vision (see last section). This approach has proven effective in several of my clients environments. While this end-state vision is optimal, most of my clients start with implementing payer authentication services and a rules system that can grow over time, as more PNR and reservation data can be provided. Supplementing this with a case management system to speed review provides the foundation for automating fraud management. Such an approach ensures that fewer valid reservations are rejected, less inventory is discounted, and overhead is minimized. It also allows you to scale more easily as direct sales volume grows CyberSource Corporation. All rights reserved. Page 6

7 AUTOMATING RECONCILIATION As you grow direct business and take on new payment types and currencies, reconciliation becomes a scalability and cost issue. For this reason, airlines that are focusing on payment management include reconciliation automation as a key optimization strategy. The typical reconciliation operation involves manually pulling reports from your systems and auditing against the reports sent by banks and processors. It s slow-going and difficult to tie to the original transaction, since reports lack common reference data and reporting formats. It becomes a bottleneck with unnecessary overhead (see top diagram). As volumes grow and new payment types, currencies and markets are added, automated reconciliation provides scalability without increasing costs. It also provides a holistic view of transaction funding status and actual revenue. To simplify reconciliation and chargebacks in a typical manual setup, all of the payment information would have to pass from one system to the next. So, when processor reports are received, they can be matched to your systems. For instance, flight information, billing, and other data captured on your online reservation would flow to the reservation system/gds to create the PNR. All the information would be appended to the PNR, which would then be passed to your Typical Manual Reconciliation Process financial systems. This imposes a large load on every transaction and reservation record generated and this may not even be possible to do with legacy systems. A more effective approach, and one that many airlines are adopting, is to centralize all of the payment information in a separate system. I ll discuss what this looks like from a technical perspective later on, but in a nutshell, this repository holds both the reservation payment data and the reports from banks and processors on payment activity. Your PNR can be tied directly to bank/processor reports by a common reference number. So you can automate reconciliation and chargeback management, since the repository holds all the necessary data. The only thing handled manually are the exceptions (see bottom diagram). Instead of passing full payment data from one system to the next as you would in a manual configuration, you simply pass a payment reference token back and forth among your financial and reservation systems (which also enhances security and streamlines dataflow). This limits the amount of data being passed along to each system, and minimize impact on transaction processing times. The overall impact of this strategy is that it makes operations more scalable and decreases overhead costs Log-on Download Update Sort and to Site Report(s) Tracking Assign Tools Streamlined Reconciliation Process Gather Reservation Data Review for Action Take Action Update Reservation for Each System and Case Reconciliation Tools 1 2 Automated Review and Reconcile Exceptions Update Exceptions Using a Single System 2007 CyberSource Corporation. All rights reserved. Page 7

8 STREAMLINING PAYMENT SECURITY COMPLIANCE Headlines about stolen customer data at leading companies, coupled with the cost of maintaining PCI compliance have compelled most of my airline clients to be more vigilant in how they manage, protect, and store customer payment information. While PCI compliance is mandatory for airlines, according to a Deloitte study 3, nearly 24% of airline internal auditors were not aware of new PCI compliance standards and how that would impact their business. By strengthening security practices around payment information, you can mitigate customer concern about buying tickets online, as well as streamline PCI compliance. But ensuring and monitoring PCI compliance, as well as staying current on payment security practices and identifying security gaps, can be a costly endeavor. To address this, I ve seen airlines move towards centralizing their payment systems to minimize the number of places where payment data is stored. Even more notable is the adoption of a new processing paradigm: data out payment models that remove as much payment data as possible from their network. All airlines use SSL to secure the payment transmission between customers and themselves during the reservation booking process, as well as between themselves and their payment processor (or GDS). But securing the connection is generally not the issue it s the transmission, processing and storage of the payment data. In the standard SSL model, you bear all of the risk of handling payment data. A security breach could make you liable for heavy penalties, not to mention bad publicity and loss of customer confidence and sales. One of the most straightforward ways to reduce the risk of handling payment data is to simply not store it. By moving data out, you can remove nearly all of the cost, complexity and risk of securing payment data and maintaining compliance. This model does not remove any functionality or flexibility. Implementation of this token-based approach lets you transact, issue credits, etc. just as you would if you stored the data onsite. 3 Airline Fraud Survey 2006, Deloitte, April 2007 Airline does not store payment data. Payment Network Payment Data Airline Systems Payment Form Customer Secure Storage Facility Reservation Page PAY Data Out Models Payment Data Storage Airline does not handle nor store payment data. Payment Network Payment Data Airline Systems Reservation Page PAY Payment Data Handling Payment Data Storage Web-based Secure Storage With web-based services, airlines are avoiding storing virtually all payment or related personal data. Instead of storing payment information on your systems, you would store it in PCIcompliant data centers within the banking and processing network (diagram on left). Your reservation system transmits the passenger payment data to the banking network at the time of initial payment acceptance, and then receives a response and payment token to be used as a reference for the transaction for future billing actions. All you store is the secure token which is worthless to hackers. Hosted Payment Acceptance To accept online payments without handling payment data, you can use payment fields hosted by and residing within the banking and processing network, served up as part of your online booking process. With this approach, you d never handle nor store payment data (diagram on right). This is implemented in a variety of ways: 1. As processor-hosted payment fields residing within your own online reservation page; 2. As a fully hosted payment page with the look and feel of your online reservation page; 3. As a link to a payment page hosted by the processor, carrying the processor s brand. These secure storage and hosted acceptance solutions can be implemented using the approaches I discuss in the next section CyberSource Corporation. All rights reserved. Page 8

9 Implementation Approach From a technical perspective, you can start addressing a specific payment need in the near term by implementing it as a one-off solution. But ultimately a long-term scalable and flexible architecture is the ideal approach. All of the alternatives I ve outlined earlier can be implemented standalone, or can be added to a centralized payment management platform. In fact, many of the airlines I ve worked with use a phased approach, starting with point solutions (i.e., adding payer authentication) and moving towards a fully centralized payment management infrastructure. This architecture utilizes a centralized payment management platform, which integrates with and works alongside GDSs and legacy systems. PHASE I: POINT SOLUTION IMPLEMENTATION Most of my airline clients start by quickly implementing point solutions using an API that interfaces to external services for the specific capabilities desired. The advantage to doing this is that you can start realizing operational gains right away. However, I recommend that you keep a long-term architecture in mind as you build capabilities. While initially efficient, prudent and pragmatic, implementing point solutions is not the best long term approach. With point solutions, adding new capabilities requires building separate connections to each and every system impacted. For instance, to add payer authentication, you d build connections to the front-end web application, the GDS or other reservation system, financial systems, etc. If you add new payment features later on, you ll need to do the same thing. So you ll have multiple connections to manage and maintain, which can become operationally quite complex. GOAL: CENTRALIZED PAYMENT MANAGEMENT As I ve shown in the diagram, you can quickly add new payment features with minimal impact to your existing systems with a centralized payment management platform. This platform interfaces with multiple processors, payment channels and systems, managing the workflow among them. It is architected so that it can interface with systems using proprietary APIs, MQ-style messaging, Web services, HTTP posts and even file transfers. Internet GDS/ Reservation Systems Reservations CENTRALIZED PAYMENT MANAGEMENT PLATFORM Call Center Payment Services Banks/Processors New Payment Types Fraud Services More Financial Systems A flexible IT architecture to quickly and easily add new payment services to address current and future needs. You can quickly add new payment services with this architecture: Adding new payment types the platform can call third-party services for PayPal, Bill Me Later, bank transfers and more. Adding payment types or currencies becomes more a business activity than an IT project, since all systems are already connected to this common platform. Automating fraud screening and streamlining reconciliation because the platform links to reservations and banking systems, the data from these systems can be consolidated to automate and streamline reconciliation, chargeback and fraud management. It also supports centralized and hierarchically managed operations across many subchannels, geographies or lines of business. Streamlining payment security compliance you can connect to a secure storage service to house sensitive payment information, and access it when needed by passing a secure token to and from the secure storage service managed by the payment platform. Since data is centrally handled, there is less to manage and secure. In addition, administration screens can be serviced by this centralized platform, allowing fraud analysts and accounting personnel to manage and control all operations centrally instead of interfacing with multiple disparate systems and reports CyberSource Corporation. All rights reserved. Page 9

10 CyberSource Airline Payment Management Solutions CyberSource provides systems and services to manage epayments throughout your entire Payment Pipeline to capture more profit in your online and call center channels. Contact us today to learn how we can help you lower your distribution costs, streamline your payment operations, and integrate with your systems. For details call or visit us online at Profit optimization at every stage in the payment pipeline. Add New Payment Types Worldwide Lower your distribution costs and extend your markets globally by adding new payment types. In addition to bank cards, CyberSource enables you to accept alternative payment types worldwide, including UATP, Bill Me Later, PayPal, bank transfers, and more. Automate Payment Fraud Management Lower review costs, optimize inventory and gain better scalability by automating fraud management. The hosted Decision Management System automatically screens reservations with airline-specific rules created by you or a CyberSource Fraud Analyst, minimizing manual review and increasing booking conversion. The portal provides access to over 100 global validation services and tests, with case management to help you keep track of outstanding issues. CyberSource also offers Verified by Visa and MasterCard SecureCode services, providing chargeback protection and lower discount fees from card associations. Scale Accounting Operations Identify opportunities to capture additional payment and reduce burden on your staff with automated reconciliation and streamlined chargeback management. Our Professional Services team integrates booking, banking and payment processing data, for easier scaling and less manual work. Streamline Payment Security Compliance Manage payments without storing data using Secure Storage; accept and transact payments using CyberSource-hosted payment fields within your online booking application. We also provide PCI consulting and remediation services, and complimentary PCI vulnerability scanning to help you maintain PCI compliance. Scale Payment Capabilities on Demand For additional operating gains, we can provide technology and integration to centralize payment across your direct channels and between frontend and back-office systems. Only CyberSource combines deep airline industry experience with proven payment processing knowledge. Simplify Implementation and Management: Airline Savvy Professional Services Team A single integration to CyberSource provides access to all services, including multiple processors worldwide. Our solutions are available modularly or as a fully centralized payment system, and all are available as fully outsourced managed services, with performance guarantees. CyberSource Professional Services has worked closely with leaders in the airline industry to integrate multiple payment solutions. We reduce implementation headaches by working hand in hand with airline accounting and finance groups to minimize impact on back-office systems CyberSource Corporation. All rights reserved. Page 10

11 About CyberSource CyberSource Corporation is the world s first payment management company. CyberSource solutions enable electronic payment processing for Web, call center, and POS environments. CyberSource also offers industry leading risk management solutions for merchants accepting card-not-present transactions. CyberSource Professional Services designs, integrates, and optimizes commerce transaction processing systems. Approximately 20,000 businesses use CyberSource solutions, including half the companies comprising the Dow Jones Industrial Average. The company is headquartered in Mountain View, California, and has sales and service offices in Japan, the United Kingdom, and other locations in the United States CyberSource Corporation. All rights reserved.

12 2007 CyberSource Corporation. All rights reserved.