The Green Sheet Online Edition

December 28, 2015 • Issue 15:12:02

Now more than ever, managing e-commerce risk matters

By Kirsty Tull
BillPro

Risk is always a factor in e-commerce, but with an increasingly stringent regulatory climate affecting banks in the United States and the European Union, a merchant's risk factors are now more important than ever in determining not only fees and recordkeeping requirements, but also whether the business is viable.

For example, a recent editorial in the Wall Street Journal on the growing practice of "de-risking" banks notes whereby many major banks, fearing government sanctions and private-party lawsuits, have dropped tens of thousands of accounts in bulk and shut off relationships with partner banks in Latin America, Eastern Europe, Southeast Asia and the Middle East due to liability concerns.

For new entrants into e-commerce and existing online merchants, understanding risk factors, managing risk ratings, and reducing risk whenever possible is crucial to success and survival.

Risk is generally sorted into low, medium and high categories, based on such factors as sales volume, average ticket size, industry and location. In theory, it should be easy for merchants to know which category they fall into before they approach payment processors and banks, but the reality is more complicated. Risk categories may be assessed differently by different banks and acquirers, so merchants may have to contact a few to find the best fit. The lower the risk, the more options a merchant has for processor and bank partnerships, and the lower the processing fees will be.

Hard to change risk factors

Some industries are labeled high risk due to qualities such as historically high chargeback rates or excessive friendly fraud. Merchants affected by those would benefit from extra vigilance in reducing other risk factors and finding a reputable processor with high-risk merchant experience. A merchant deemed high-risk by one bank or processor may be rated medium-risk by another, so it behooves merchants to do research.

Another important factor is location. The easier it is for banks and processors to verify the existence and validity of merchant operations, the lower the merchant's risk profile. Based on those criteria, countries and regions such as the United States, Canada, Western Europe, Australia and other developed economies are generally considered low-risk locations for merchants. Higher-risk regions may include Russia, Eastern Europe, the Middle East (outside of Israel) and Southeast Asia. In the middle are regions that aren't necessarily unstable but where banks may have difficulty verifying business registration and accounts: the British Virgin Islands, Cyprus, Central Europe, Israel, Latin America and Malta.

Manageable risk factors

It may be difficult to move from a medium- or high-risk location to a lower-risk area. To manage risk profiles, encourage merchants to focus on the following four risk factors within merchants' control.

1. Sales volume risk reduction: Merchant accounts with monthly sales volumes under $20,000 and average ticket totals under $50 are considered low risk. Sales volumes over $100,000 per month and average ticket totals over $100 are high risk, with numbers in between considered medium-risk. One way to reduce the risks associated with high monthly sales volume is to work with a payment processor who can establish multiple merchant accounts in order to keep individual account sales volumes under the $10,000 (or $100,000) cutoff point.
2. Card-fraud security risk reduction: Banks can be reluctant to do business with merchants whose transactions are inadequately secured against card fraud. Merchants should maintain the latest industry standards for card-not-present fraud prevention, such as 3D Secure programs including Verified by Visa and MasterCard Secure Code. 3D Secure protocols are considered an indicator of low risk, so merchants who aren't already using 3D Secure should adopt it as a risk-reduction or low-risk maintenance measure.
3. Payment page hosting risk reduction: Merchants who choose to host their own payment pages are, in effect, choosing a higher risk rating. Just as with card fraud, banks are concerned about the possible exposure of customer card data to hackers and thieves. Banks prefer to work with merchants whose payment pages are hosted by a payment processor with the strongest possible encryption, Payment Card Industry Data Security Standard compliance and other security tools. Thus, merchants can lower their risk profile by choosing a processor to securely host their payments pages.
4. Merchant business-history risk reduction: If a merchant has had a history of high-risk factors, all is not lost. Changing the past isn't possible, but with effort, merchants can clean up and maintain their credit and banking history going forward. To start this process, a merchant's website copy should spell out crucial customer information on returns, customer service, item descriptions, and credit card statement descriptions to reduce chargebacks caused by customer confusion or disappointment. And merchants should seek a processor with the tools to identify, evaluate and avoid friendly fraud and transactions involving stolen card data, to further reduce chargebacks.

Because excessive risk is costly to everyone in the payments chain, merchants should aim to present the best possible risk profile to banks and processors, and they should seek processors and banks that understand how to spot and reduce the risks facing online merchants. Approaching risk reduction as a team effort can build relationships that help merchants survive and succeed, even in an era when many banks are increasingly risk-averse.

Kirsty Tull is marketing manager for BillPro (www.billpro.com). Follow her on twitter at @Billpropayments.

The Green Sheet Inc. is now a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals. Click here for more information.

Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.