the 2008 epayment management project guide€¦ · order rejection and payment failures, fraud and...

12
A White Paper from the CyberSource and NetSuite Partnership The 2008 ePayment Management Project Guide Benchmarks, Key Projects, Practical Approaches by Payment Consultants Dave Glaser VP Professional Services CyberSource Corporation Paul Brock Sr. Consultant CyberSource Corporation CyberSource Corporation 1295 Charleston Road Mountain View, CA 94043 www.cybersource.com 1-888-330-2300

Upload: others

Post on 16-Aug-2020

4 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

A White Paper from the CyberSource and NetSuite Partnership

The 2008 ePayment Management Project Guide Benchmarks, Key Projects, Practical Approaches

by Payment Consultants Dave Glaser VP Professional Services CyberSource Corporation Paul Brock Sr. Consultant CyberSource Corporation CyberSource Corporation 1295 Charleston Road Mountain View, CA 94043 www.cybersource.com 1-888-330-2300

Page 2: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

Contents

INTRODUCTION ...............................................2 PUTTING PROJECTS IN CONTEXT..........3 PAYMENT ACCEPTANCE ...............................4 ORDER SCREENING........................................6 PROCESSING MANAGEMENT ....................8 COLLECTION & RECONCILIATION ........9 PAYMENT SECURITY/PCI .........................10

1-888-330-2300 www.cybersource.com © 2007 CyberSource Corporation. All rights reserved.

Introduction As we’ve met with clients throughout the summer of 2007, we’ve frequently been asked to review 2008 plans and offer our perspective. In doing so we were struck by the commonality of business challenges and projects, as well as the solution approaches (some good, some inefficient). We felt our other customers and prospective clients might benefit from this insight as 2008 projects are being staged. So, we’ve written this brief guide. In this guide we offer our perspective on ways to look at your payment operations, provide some benchmarks to help you assess your current efficiencies, note the popular projects we’ve seen merchants undertaking for 2008, and provide practical solutions and approaches for you to consider as you stage your initiatives. Overall we believe it is worthy to note that the management of ePayment operations has fast become a mission critical function. It is no longer just a tactical process, but a function that requires active management to optimize business results. The initiatives you embark on and the approaches you use have a direct impact on business profitability and ability to scale. It is with this mindset that we suggest you consider your 2008 projects. About the Authors Dave Glaser is a recognized expert on electronic payments and payment security management practices. His expertise and advice is derived from work with hundreds of Fortune 1000 and Internet 500 companies. Dave is a requested speaker at industry conferences such as the Merchant Risk Council and the Direct Response Forum. Dave is a member of the PCI Standards Council.

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 2 of 12

Paul Brock specializes in the area of fraud and risk management, providing consulting and managed services to Internet 500 companies and other leading brands. Paul serves the Merchant Risk Council as a committee co-chair and speaker at industry conferences.

Page 3: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

Putting Projects in Context: It’s About Your Effective Rate Too often we find projects are evaluated in isolation—both in terms of their approach and ROI assessment. We urge clients to change the way they look at payment issues and the way they ask management to evaluate the return. Payment operations must be examined in the context of the end-to-end payment process—not just the discount rate on your merchant account or your chargeback rate. The costs throughout the process (merchant account rate, sales opportunity costs associated with valid order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective Rate” of payment processing. This is the metric we recommend focusing on, such that all projects, implementation approaches and return are evaluated in that context. In practice we find that many merchants currently operate with an effective rate that is equal to 5-8% of revenues. This is clearly a cost worth managing to optimize business results. As a way of thinking about your process we offer the concept of a “payment management pipeline.” We use this metaphor because it forces one to think about the end-to-end operations involved in processing a payment and the “profit leaks” that can occur (both cost and overhead, and of equal importance, sales opportunity cost) at each stage of the operation.

RetainedProfit

Collection &Reconciliation

Global Payment

Acceptance

OrderScreening

ProcessingManagement

Order

Payment Security

RetainedProfit

Collection &Reconciliation

Global Payment

Acceptance

OrderScreening

ProcessingManagement

Collection &Reconciliation

Global Payment

Acceptance

OrderScreening

ProcessingManagement

Order

Payment Security

Global Payment Acceptance: Everything required to accept the payment types required to maximize sales in targeted markets, including: establishing merchant accounts and domicile, establishing connections to necessary processors, integrating payment capability with customer-facing and back-end systems, and “merchandising” payment options to optimize payment mix. Order Screening (Fraud/Risk Management): Everything required to design, implement, monitor and manage order screening operations for maximum efficiency, sales conversion and fraud control across all payment types accepted and markets served. Processing Management: Everything required to process payments in a way that minimizes payment failures, minimizes processing costs, and ensures compliance with processor requirements and industry standards. This includes interchange management, payment failure management, and processing logic to optimize subscription and installment billing. Collection & Reconciliation: Everything required to maximize collection and streamline payment reconciliation. Includes: reconciliation, retrieval, and chargeback/re-presentment management. Payment Security: Everything required to minimize risk of payment data theft, streamline compliance certification, and manage user access to payment systems with maximum efficiency and security.

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 3 of 12

On the pages that follow we provide some benchmarks and popular projects to optimize results.

Page 4: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

2008 Payment Acceptance: On Demand Platform/Options

Business Benchmarks & Profit Leaks We find that businesses are focusing with greater intensity on increasing the array of payment types accepted, domestically and globally, to increase sales conversion. Statistically we have found that businesses offering 3 or more payment types relevant to a given market achieve 14% higher conversion (active shopping cart to executed transaction) than businesses offering one or two types.

If you are not offering 3 or more types (e.g. not card brands, but 3 types of payment methods: cards, PayPal, Bill Me Later, Direct Debit, Bank Transfers, etc.) you are likely leaking profit in terms of sales conversion. Of course there are challenges to achieve this. To add payment types globally, you must establish merchant accounts and banking relationships—and negotiate hard to achieve good rates despite potentially low entry volumes. And, to get better rates, or even accept some forms of payment at all, you must establish domicile—which can be time consuming and costly. And, as you add payment types and processors, the downstream pipeline impact on reconciliation operations can become a significant scalability issue.

Hot 2008 Projects Here’s a snapshot of the popular projects we see being initiated in this area for 2008. Adding U.S. Payment Alternatives We have seen a significant increase in the number of medium and large-sized companies staging implementation of PayPal and Bill Me Later payment options to increase lift. Many of these projects are being tied-in to the third project we note below. Country-Specific Banking/Payment Types

# o f Payment M et hod s Of f eredby M erchant Size( Online Sales V o lume)

2.2 2.4 2.5

3.3 3.4

<$500K $500K -<$5M

$5M -<$25M

$25M-<$100M

$100M+

On average, approximately 14% of U.S. merchants’ eCommerce sales originate outside U.S. borders—and the trend is growing. Many of our clients are initiating projects to address Europe and Asian markets with country-specific payment types to increase sales conversion. To get to market faster and minimize cost some of our clients are working with vendors who can provide “stand-in domicile” for direct debit and bank transfer payments, thus alleviating the need to establish independent domicile. Note that merchants themselves must establish domicile in-country or region to qualify for local or regional interchange rates for card processing. As with the previous project, many merchants are approaching this via the next project below. Adopting an On-Demand Gateway Structure We have noted that merchants who have more experience with payment type additions, domestic or global, are actively migrating from direct-to-processor connection model, to one of leveraging global gateway infrastructures. They cite the advantages of this being less infrastructure to manage, while gaining faster access to new markets and payment types. Further, we are seeing our clients use such a structure to achieve “best rate processing.” Our clients say that by establishing an on-demand processing infrastructure they have removed the barriers to switch—because the integration is not tied to a specific processor, a merchant account can be shopped, with the ability to switch vendors almost overnight. This increases price competition (in terms of price and overall value offered) since the pain of alternative integration and re-connection has been removed.

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 4 of 12

Page 5: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 5 of 12

A Way to Address Your Payment Acceptance Projects in 2008 CyberSource offers global, PCI-certified processing infrastructure to reach over 190+ countries and associated currencies and payment types—on demand. Via CyberSource you can secure the necessary processing infrastructure and merchant accounts (with stand-in domicile for bank transfer and direct debit payments), or work with your preferred merchant account provider(s) domestic and global, while using our global processing infrastructure. Via this infrastructure you can add payment types like PayPal and Bill Me Later, as well as similar on-demand access to add country-specific cards and other global payment types in 190+ countries. You access this payment infrastructure via the CyberSource interface built-in to your NetSuite business solution. CyberSource can also provide you with experienced payment integration professionals that will manage, or assist your IT or integration partner with payment integration.

WW Banks & Processors

NetSuiteBusiness

Application

Mer

chan

t

• Online• Call Center• POS• ERP

Payment ManagementServices

More…

Page 6: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 6 of 12

2008 Order Screening: Emphasis on Conversion & Scale Business Benchmarks & Profit Leaks The challenge we typically find in this area is a myopic focus on chargebacks. This creates two over-arching profit leaks: understatement of the actual fraud loss, and often more importantly lack of attention to valid order rejection and scalability issues that translate to huge opportunity and overhead costs for the organization, ultimately undermining profits. Fraud/Risk management is really a process within a process. Like the payment pipeline there is a pipeline for order screening. Though the fraud rates have trended down over time due to active management, the cost of valid order rejection and manual review has remained high or even increased.

Note that the average true fraud loss rate across merchants is 1.4%, which represents chargebacks plus credits/reversals issued due to fraud claims. Typically credits/reversals account for at least as much fraud loss as reported chargebacks, so you are advised to take this into account when you assess your profit leaks. Further, we often find that 25-50% of rejected orders are valid. Attending to your valid order rejection rate often offers far greater business impact than shaving a few more basis points off your fraud rate. Here are the key benchmarks by size: Annual Online Sales

Fraud Rate %

Reject Rate %

Manual Review %

Overall Average

1.1% 4.1% 23%

<$500k 1.2% 3.5% 0<$5M $500-$5M 1.3% 4.1% 36% $5-$25M 1.2% 4.6% 25% $25M+ 0.8% 4.9% 15% As you expand acceptance to alternative payment types and global markets, the demands on your screening infrastructure grows almost exponentially. Payment type and cultural differences demand unique types of validation data and business rules. Failure to adapt screening methods to payment types and markets

costs you sales, fraud loss, and increased overhead. Statistically merchants incur 2.5 times more fraud on cross-border transactions than domestic transactions. Managing this well brings more profit directly to the bottom line. Hot 2008 Projects For all of the reasons above, we see merchants focusing on front-end projects in 2008 that improve conversion and minimize the need for, or streamline, manual review: Global Fraud Portals vs. Fraud Scoring Most merchants are moving away from pure scoring models to screening strategies that use multiple input tests. We see projects being staged that enhance initial screening strategies via a combination of more flexible rules systems that interact with a broader portfolio of global “truth services.” Attention is being placed on dashboards that allow business managers to set rules by payment type, product type and market-specific screens, on-demand, to evaluate the range of “truth” inputs from multiple vendors. Case management systems are being integrated with these portals with accompanying enhancements to streamline workflow. These portal projects typically include requirements for hierarchical management, as companies strive to centralize fraud management across multiple lines of business and geographies.

Review Rate28%

Behavior and Device Mapping Added As part of the portal portfolio of tests, we are seeing a marked increase in projects aimed at “fingerprinting” the customer’s computer (in order to directly validate the purchaser) and monitoring user behavior on the site (to distinguish scripted site interaction vs. human interaction). Outsourcing More than any previous year, we are seeing projects staged to outsource fraud management. The advent of business performance guarantees (conversion and fraud levels) and proven implementations make this a growing option for merchants seeking to reduce fixed costs and infuse business predictability.

Reject Rate4.1%

Loss Rate1.4%

# Tools5 avg

Page 7: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 7 of 12

Some Guidance One common error with the implementation of fraud management solutions is a strict focus on fraud or chargeback reduction. Many times Finance is goaled to control this cost, without deference to overall profitability or allied operations costs. We urge you to take a different view. We suggest your company adopt a view based on profit optimization. It is possible to assess your current operations and determine the optimal point of fraud acceptance and valid order rejection risk. The chart below illustrates this concept (profit is optimized at lowest point on curve).

Because it is not reasonable to operate to this exact point, you then assess which side of that curve to err on. In the case depicted, it is actually better to err on the side of accepting more fraud than rejecting orders. Your profit optimization curve will vary based on margin and operating efficiency. Bear this in mind as you implement new solutions and set business goals. For more information on constructing this curve see our white paper “Managing eCommerce Payment Fraud, a best practices framework for business managers.”

A Way to Address Your Order Screening Projects in 2008 Consider reviewing the ways CyberSource can assist you in three key areas:

Optimization Analysis and Solution Design Bring in our client services team to analyze your business, calculate your profit optimization point, and design rules and screening strategies that optimize sales conversion, control fraud and minimize manual review. Global Fraud Management Portal If you’re planning to add new validation tests, or upgrade your rules or case management system consider implementing our global fraud management portal (Decision Manager).

This hosted portal allows business managers to create screening rules on demand, to automatically disposition orde(accept, reject, review). Includes built-case management system, or option to export data to your system. Fea

Fraud Rate

$ Lo

st (S

ales

or F

raud

)

ProfitImpactCurve

Valid OrderRejection

Fraud Loss

10bps 10bps10bps10bps 10bps10bps

Loss

rs in

tures:

SKU

• Rules interface to over 100 global validation services and tests

• Velocity monitoring • IP geolocation • Multi-merchant transaction

histories/shared data • Global telephone directories • Global delivery address verification

services • Positive and negative list support • AVS (card association address

verification) • CVV2, CVC2, CID (3 or 4 digit

verification number on card) • Set screens by product category or

even• Built-in case management system • Hierarchical management: centrally manage

multiple lines of business • Works with CyberSource and other payment

systems; supports multiple, global payment types. Additional identity validation features planned for availability Q1 2008 (contact us for more information).

Managed Services Performance Monitoring. CyberSource analyzes your process and metrics, designs decision rules and tests, trains your staff and places the solution into production. Ongoing performance is monitored by your CyberSource fraud analyst to ensure business goals are being met.

Fully Managed Service. Performance monitoring, plus order review services and chargeback management. Includes business performance guarantees related to sales conversion and fraud.

Delta

Profit Optimization PointProfit Optimization Point

Page 8: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 8 of 12

2008 Processing Management: Automate Business Benchmarks & Profit Leaks We find this area of operations to typically be the least attended to. However, the business impact of issues in this area can be fairly dramatic, and some businesses—especially those with recurring billing models—are more sensitive to impacts in this area than others. Temporary Payment Failures. Consider temporary authorization failures. About 1.2% of all payment authorization requests result in a “temporary payment failure.” If left unmanaged, these failures place over 10% of the subscription base at risk per year. Many merchants don’t manage this effectively, needlessly allowing subscriptions to lapse and driving up banking costs in an effort to recover payment. With the proper analysis and tools it is possible to automatically recover these failures, ultimately enabling the capture and retention of up to 10% more subscriptions per year. A high percentage of temporary payment failures can be automatically recovered via re-presentment of the payment request during the optimal “capture windows” (these windows vary by failure type and time since initial attempt). Failures of this type include: Do Not Honor (~ 58% of temporary failures) Insufficient Funds (~30% of temp. failures) Generic Processor Decline (~6% of temp.

failures) Other (6%)

Commonly, little is done to understand the optimum time to attempt recapture. Multiple recapture attempts are initiated (each of which is charged for by the bank), and the methods used rarely capture more than 50-70% of the opportunities. The result? Unnecessary subscription lapse and needlessly high banking costs. By initiating retry requests only during the optimal capture windows, over 95% of these failures can be recovered and banking costs are kept to a minimum. But, temporary payment failures aren’t the only issue. Expired cards also take their toll. Left unmanaged, payment failures resulting from expired cards can place as many as 2.8% of subscriptions at risk each month. Annualized, this means as many as 26 out of every 100 subscriptions will lapse or require merchant intervention to protect them from card expiration failures. Most merchants manage this to some degree, but merchants who actively manage subscription payments can automatically convert over half of these failures, thus minimizing the

cost of sales and avoiding risk of subscription lapse. These failures also impact batch processing. If you batch your authorizations vs. handling them in real time, you risk losing 1.2% of orders to temporary failures, ultimately losing the order or incurring customer service costs to follow-up and capture that order. For these reasons, we recommend real-time authorization to all merchants. Interchange Management Most merchants realize that the data they submit with their authorization request, the time between authorization and settlement, variances in the amount authorized and amount settled can all impact the rate charged for processing. But, we were surprised to find that on average, typically 5% of transactions are downgraded. Some processors provide automated interchange management logic (auth refresh, split shipment re-auth, etc.) that helps you manage these costs. In other cases you may need to build logic into your systems to manage this per card association regulations. Depending on your transaction history and level of processor management, this may or may not be a high priority for optimization and cost recovery. Hot 2008 Projects This seems to be an emerging area of focus, but not yet fully on the radar of all merchants. Here’s the projects we’re seeing in this area: Account Updater Service Implementation of card association account updater services to minimize subscription billing failures. Merchants must be approved by their acquirer to receive the data feeds which originate as a result of issuers updating databases as cardholder records change, thus helping to minimize payment failures.

Real-Time Processing Those merchants that currently use batch authorization processes (and there are still many) are moving to real-time authorization and associated re-try logic in an effort to capture more sales and minimize customer service costs.

A Way to Address Your Processing Management Projects in 2008 CyberSource professional services staff are experts in implementing account updater services, and other interchange management and payment failure recovery services. Contact us for design consultation or complete management and implementation of your project.

Page 9: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 9 of 12

2008 Reconciliation: Order-Level Reconciliation

Business Benchmarks & Profit Leaks We find two major profit leaks in this area of operations, reconciliation overhead and chargeback recovery management.

Reconciliation As more payment types are added, more markets are served, and more processors are used, collection and reconciliation operations become increasingly complex.

Typically reports from each processor carry different data and come in different formats. And, we most commonly find that payment reconciliation systems are not adequately tied to order management systems to facilitate order-level reconciliation and exception management.

Up to 90% of reconciliation operations can be automated by tying order data or payment reports. Some, but not all processors provide electronic data feeds that can be used to automate reconciliation.

Chargeback Recovery In our experience this aspect of payment operations is statistically fairly polarized. Merchants seem to either aggressively fight chargebacks or tend to not challenge them at all. Given the win-rates we see (resulting from both automated management and human diligence), we believe this is an area ripe for profit recovery.

Here are some benchmarks you might find useful when comparing your operations. The chart shows the percent of chargebacks challenged, the percent of those challenged that are won, and the resulting net recovery rate.

Annual Online Sales

% Challenged

Win Rate %

Net Recovery Rate %

Overall Average

53% 42% 32%

<$500k 48% 44% 43% $500-$5M 56% 51% 39% $5-$25M 58% 55% 39% $25M+ 53% 29% 36%

Hot 2008 Projects The drive for global market presence is placing a premium on reconciliation projects for 2008. The projects we see most prevalently pursued are those that streamline reconciliation.

A Way to Address Your Collection and Reconciliation Projects in 2008 Consider reviewing the ways CyberSource can assist you in three key areas: Standardized Reporting: All Payments If you adopt CyberSource for your global payment services infrastructure you will receive payment reports that standardize transaction reporting. Authorization and settlement request reporting is standardized and consolidated across payment types, making it easier to reconcile domestic card and alternative payments, as well as international payments and payment types.

Reconciliation Automation: Any Processor As long as your processor(s) support electronic data feeds CyberSource professional services will implement our reconciliation framework with tailored reports to consolidate reporting across processors. With this system you’ll receive automatically reconciled reporting—at the order level, complete with exception management reports to help you capture more revenue.

If your processor supports automated chargeback management, the reconciliation system can also be tied-in to these systems and your order management data to automate re-presentment.

Automated Reconciliation SystemMERCHANT

ORDER MANAGEMENT

SYSTEMS

Automatically requests and integrates data

GLOBAL BANKING NETWORKS

• Capture Payment Network Reports• Order System Data Logging• Re-presentment• Assignment of Chargeback Cases• Exception Reporting• Action/Status Change Logging• Notification of Process Completion and

Exception Information

• Capture Payment Network Reports• Order System Data Logging• Re-presentment• Assignment of Chargeback Cases• Exception Reporting• Action/Status Change Logging• Notification of Process Completion and

Exception Information

• Financial Reconciliation

• Chargeback Management

• Financial Reconciliation

• Chargeback Management

• Financial Reconciliation

• Chargeback Management

Automatically requests and integrates data

Automated Procedures& Processes

Automated Exception Reporting

Integrated Admin.

Interface

Page 10: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 10 of 12

2008 Payment Security: Centralize & Payment Data Out

Business Benchmarks & Profit Leaks The PCI (Payment Card Industry) security standard isn’t just about a compliance requirement, it is now a “way of business life.” All too prevalent are the reports of consumer data theft from major brand name companies. When this happens, not only do these businesses incur fines, but moreover their brand reputation is damaged. Consumers no longer feel safe shopping there.

The typical response we see is a merchant focus on securing the data where it is. While logical, we believe this approach, if not pursued thoughtfully, is neither efficient nor cost effective. You will spend needless amounts of time and money on encryption software and devices, across multiple payment channels and infrastructures, and need to account for this in your compliance audits each year. Therein lies the profit leak. More data. More to manage. More to police and safeguard. When you think about it, there is no real ROI on security per se. By being secure, you only really get back to the point of doing what you intended to do in the first place—transact a sale.

Benchmarks? As of yet, there aren’t a lot of universal benchmarks in this area due to the varying business models and environments. But, one we can offer is that 52% of merchants surveyed identified plans to centralize their payment systems. And this is one of the two hot projects for 2008 in this area.

Hot 2008 Projects For the reasons noted previously, the perspective on managing payment security is changing. The management approach is moving from a primary emphasis on securing data, to an emphasis on

a) system centralization and

b) eliminating payment data storage and handling (getting the data completely off the network)

Centralizing Payment Systems We see a significant number of merchants embarking on projects to centralize their payment systems across channels to eliminate the number of places payment data is stored, processed and transmitted. This enables the business to focus security efforts on the few remaining places data is present. A representative architecture is shown on this page.

Multiple payment channels are supported by a single, underlying system that supports processing, fraud management and reconciliation management across the payment channels.

Web-Based Secure Storage/Hosted Acceptance The other key project we see an increasing number of merchants pursing is getting the payment data out of their environment completely, either by storing the payment data remotely with their processor, managing a secure token only within their environment; or completely eliminating the need to touch payment data by having the payment fields within their checkout page or call center hosted by the processor.

Secure storage andhosted acccan be implementwithin the centralized architecture or autonomously

Merchant Systems

Centralized Payment Management

Payment Broker

PrimaryIntegration

Other Processor Integrations

Workflow Engine

“Systems of Record”

ERP System

HostedForm/Fields

(Option)

Proc

esso

rs &

Ban

ks W

orld

wid

e

Remote Payment Data Storage

InternalSystems

Integration

Payment Management Interfaces (local and processor systems)

AutomatedReconciliation

System

Online Stores

PaymentInfo

Call Centers

PaymentInfo

POS & Kiosk

PaymentInfo

PrimaryProcessor

• Business & Fraud Rule Control• Case Management Screens • Order Detail Review• Reconciliation Reporting• Chargeback Administration• User Administration• Reports and Search

Merchant Systems

Centralized Payment Management

Payment Broker

PrimaryIntegration

Other Processor Integrations

Workflow Engine

“Systems of Record”

ERP System

HostedForm/Fields

(Option)

Proc

esso

rs &

Ban

ks W

orld

wid

e

Remote Payment Data Storage

InternalSystems

Integration

Payment Management Interfaces (local and processor systems)

AutomatedReconciliation

System

Online Stores

PaymentInfo

Call Centers

PaymentInfo

POS & Kiosk

PaymentInfo

PrimaryProcessor

• Business & Fraud Rule Control• Case Management Screens • Order Detail Review• Reconciliation Reporting• Chargeback Administration• User Administration• Reports and Search

eptance

ed

.

ojects

osts

CI

ke

BP

es)

These prserve to minimize cas well as streamline Pcompliance. Note: masure the solutions you use are PA(Payment Application Best Practiccompliant.

Page 11: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

The 2008 ePayment Management Project Guide

A Way to Address Your Payment Security

u may find ne or more of these services helpful.

roject is cost-effective and implemented on time.

cted om the adverse impact of a data breach.

nd checkout model:

on

n billing it

nitial nd subsequent transactions are processed.

ayment information to any processor required.

any neither handles nor stores ayment data.

Projects in 2008 As you assess your security projects yoo System Centralization CyberSource professional services is available to consult, design and manage implementation of a centralized payment system. Experience with multi-channel, global customers ensures you’ll get proven advice to ensure your centralization p Web-based Secure Storage Instead of storing payment information on your company’s systems, CyberSource provides a service that allows you to store sensitive payment data in our PCI-compliant data centers. Your order management system transmits the customer’s payment information to CyberSource at the time of initial payment acceptance. Your systems then receive the response along with a “payment token” that can be used to reference that transaction for any future billing actions. Thus, all payment data is stored on our processing network systems. Your company stores only a secure token. Because you aren’t storing payment data, your brand is protefr Payment Actions and Checkout Models This hosted secure storage approach supportsnearly any payment action a• One-time authorizati• Capture/settlement • Split capture • Recurring/subscriptio• Credit/partial cred• Re-authorization • Standard checkout • “One Click Buy” checkout See diagrams at right that illustrate how ia Processor and Bank Independence These solutions have been architected in a way that permits use of this model even if you maintain a direct connection to a processor or use a processor other than CyberSource. The token provides a means of referencing and transmittingp Hosted Payment Acceptance CyberSource can also host the payment data fields that appear on your checkout page. This can be implemented as an iFrame within your checkout page, or a fully hosted page. Using this service your comp

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com 11 of 12

p

Page 12: The 2008 ePayment Management Project Guide€¦ · order rejection and payment failures, fraud and chargeback management, administration, scalability, and security) sum to your “Effective

About CyberSource CyberSource Corporation is the world’s first payment management company. CyberSource solutions enable electronic payment processing for Web, call center, and POS environments. CyberSource also offers industry leading risk management solutions for merchants accepting card-not-present transactions. CyberSource Professional Services designs, integrates, and optimizes commerce transaction processing systems. Approximately 20,000 businesses use CyberSource solutions, including half the companies comprising the Dow Jones Industrial Average. The company is headquartered in Mountain View, California, and has sales and service offices in Japan, the United Kingdom, and other locations in the United States.

© 2007 CyberSource Corporation. All rights reserved. 1-888-330-2300 www.cybersource.com

About NetSuite Founded in 1998, NetSuite, Inc. is the leading provider of integrated business application software for small and midsize businesses. With thousands of customers globally using NetSuite's online products and professional services, companies are enabled to manage all key business operations—in a single hosted system, including: customer relationship management (CRM); order fulfillment; inventory; finance and product assembly; ecommerce; Web site management; and employee productivity