0

I recently made a purchase from a merchant (the city of Los Angeles). During the checkout process on their web site I had to enter my credit card information. One of the fields in the credit card form was labeled "Card Present". It was a checkbox which was checked and disabled meaning that I could not change it.

It seems pretty obvious to me that this is the very definition of a card not present transaction. It's over the internet and I'm not swiping or inserting my card. For all they know I could have generated the number on my computer or stolen it.

Is this PCI-compliant? Am I misunderstanding the meaning of "card present"? This seems very manipulative to me.

Improve this question

2 Answers 2

Reset to default
2

As far as you're concerned, it's a card-not-present transaction. Which is to say, if you wish to dispute the charge, they cannot produce evidence that you presented your card - they don't have an imprint of your card and they don't have your signature on a slip. As such, you will win the dispute.

That lopsidedness is one reason that the rate they pay their processor for card-not-present transactions is usually higher than the rate for card-present... the potential for fraud is higher when the potential defrauder ("you", no offense) wins by default, and the rate that they pay their processor for the two different scenarios reflects the risk. Just like insurance - more risk, higher payments.

Now, they may very well have hardwired their site to mark card-not-present transactions as card-present. That's an issue between them and their processor - maybe they're cheating the processor out of fees, maybe their fees are the same either way and it's a meaningless checkbox.

Either way, it does not impact you as the cardholder. Your card-not-present rights are guaranteed by the Card Brands and the Dispute process. Card imprints and signatures make it card-present. Failure to provide that evidence in a dispute will cause them to lose the dispute, which is the significant difference that card-not-present makes in your life. The card brand dispute process doesn't even take externals like UPS delivery signatures into account - it's not going to care about a checkbox on a web form.

Improve this answer
3

This could have been a dummy field on the form.

Card present indicates that both the card and the customer are present at the time of sale, most payment processors also charge lower fees if the card is swiped vs typed in.

That being said, when a card is swiped there is extra information on the magnetic strip that isn't typed in. Payment processors usually receive the raw data from the card, which they then use on their end to execute the transaction.

So either this form input is a dummy, or they're using a card processor that allows them to claim the card was present. If you could post a link to the merchants site, we'd be able to take a closer look at what exactly that checkbox does.

After examination of the site in question, it appears that they are using a payment processor named "Converge Virtual Merchant". Their documentation on processing transactions is available on their site, located here https://www.myvirtualmerchant.com/VirtualMerchant/download/transactionProcessingGuide.pdf

Quickly reading through it, it does state the merchant has the ability to mark the card as present for hand-keyed transactions. The payment site in question is locked to say the card was present.

PCI compliance is for storage and security of cardholder information. Because the payment portal itself is hosted by the processor, it appears that it is indeed PCI compliant.

That doesn't negate fraud though. While your card information is secure, it appears as if the merchant COULD BE attempting to commit fraud by marking all transactions as card present. Since card not present transactions usually have higher fees to account for their risk, the merchant would be defrauding the payment processor by applying the lowest fee and moving that risk onto the processor, in this scenario. However the allegations of fraud and its implications is something that should be discussed on the Legal StackExchange site.

Improve this answer
2
  • The merchant site is: <ladot.lacity.org/how-do-i/how-do-i-make-online-payment/…>. I'm not sure how much you'll be able to see of it because it's a truly awful site. You have to make the transaction over the phone, and then they email you a Work Order number, which you have to manually enter along with the price (but not the dollar sign!). It's very much a municipal web site.
    – user1118321
    Commented Jul 22, 2017 at 5:15
  • @user1118321 Upon examining the site, it appears that they're using a payment processor called "Converge Virtual Merchant". After going through their documentation, it appears that this processor does allow their merchants to claim the card was present. Most of the processors I've dealt with charge higher fees for key-ed in transactions because they're more risky.
    – zzarzzur
    Commented Jul 22, 2017 at 5:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .