Electronic Payments

Secure electronic payment systems

Keeping your payment details secure

• Most electronic payment systems encrypt customer information and card details. Encryption scrambles the information so it can't be read when it travels over the internet and offering your customers this option will make them more likely to buy.

• Look closely into the security of your set-up and that of your bank or PSP. Guard against fraud and protect legitimate customers by keeping the transaction, funds and personal details of customers secure. Under current legislation it is the merchant who bears the cost of fraudulent transactions, being obliged to refund the purchase price (chargeback) as well as losing out on the value of the goods. If a customer disputes ordering or receiving the goods, or if the card is a stolen one, the payment is automatically debited from your account. Many banks and PSPs allow you to pay your way out of this problem by carrying any chargebacks for a fixed monthly fee of around £20 and an additional transaction fee, usually 1 per cent. Examples include: MasterCard's SecureCode or Verified by Visa.

• A high percentage of fraud occurs when hackers get access to insecure merchant data being held on insecure servers. Leaving the processing in the hands of the PSPs means that you don't need to hold the credit card data or get involved in anti-fraud or data protection issues.

Use secure links and servers

• Use SSL (Secure Sockets Layer protocol) encryption when transmitting data. A closed padlock sign at the bottom of the screen shows that details are protected when being sent.

• Only store credit card data on a secure server.

• Remember that encryption and other security measures cannot prevent "unreported" stolen cards being used in transactions. Be vigilant.

Check credit card addresses

• Some PSPs also use an AVS (Address Verification Service) that checks the address of the cardholder against the billing address. Many can only offer this service in their home country while international operators charge a small fee, typically six pence per transaction, to check international addresses. Alternatively, visit an online electoral roll website and check delivery addresses with the names on customer orders.

• A free web-based service called Early Warning (www.earlywarning.org.uk) lists known credit card fraudsters.

• Some PSPs can also look for patterns in the way purchases are made. The more transactions that are stored, the more data the system has to analyse and the smarter it gets. E-mail or IP addresses that look suspicious can be blocked when using these smart systems.

Check the content of the orders

• Beware of users placing orders with free e-mail addresses such as yahoo or hotmail. It is very easy and completely anonymous for potential fraudsters to use these free webbased services.

• Certain countries have a higher percentage of fraud risk and may be considered suspect. Recognise the way your average customer does business, the size of transactions made and how much information is provided so you will become familiar with purchasing patterns. Orders for large quantities of easily saleable electronic goods, for example, should ring alarm bells.

For more information on all these topics, visit the Security section of the DTI website at www.dti.gov.uk.bestpractice