For merchants
How does the MPO contract differ from the SECURE E-COMMERCE contract?
If you receive credit card data via the postal service, per telephone or fax, you need a MAIL/PHONE ORDER contract.
You need a SECURE E-COMMERCE contract if card data is to be entered directly by cardholders when paying in your online shop.
Can I also process e-commerce transactions through the MPO contract?
No. To process e-commerce transactions you need a valid SECURE E-COMMERCE contract with SIX Multipay.
Can I accept payments with Maestro cards with an MPO contract?
No. In the MPO payment procedure, neither a PIN is entered nor any other electronic authentication is made. Such authentication is mandatory for use of the Maestro card.
With an MPO contract, can I offer my customers the option of paying with DCC (Dynamic Currency Conversion – automatic currency conversion)?
No, the requirements for the proper processing of this procedure cannot be fulfilled with a MPO.
What conditions must I meet to be able conclude a MAIL/PHONE ORDER contract with SIX Multipay?
To conclude a MAIL/PHONE ORDER contract you must meet the following conditions:
- Send us the application form for MPO contracts with a description of your business model or the goods and services you offer.
- Have your company listed in the commercial register; excepted are public bodies and associations (statutes).
- Based on our experience, we assess your business for its potential for improper transactions, possible chargebacks and credits, and then discuss recommended measures to reduce risk.
In case of doubt, SIX Multipay reserves the right to reject a contract application without providing reasons.
How long does it take until I can accept credit card payments in my mail/phone order business?
The verification and contract processing phase normally requires around two weeks. However, if you do not meet all conditions, and should additional clarifications be necessary, then the process can take longer.
How can I submit my transaction data to SIX Multipay with a MPO contract?
You have two options:
- Submission through a Payment Service Provider
- Submission through our new MAIL/PHONE ORDER EASY service
Both solutions guarantee that credit card data is handled in a secure manner.
May I obtain card data per e-mail or allow it to be entered through a Web form?
The transmission of card data per e-mail is not permitted for security reasons, because the data is transmitted unencrypted over the Internet.
What risk do I bear as a merchant with MPO contracts?
With MAIL/PHONE ORDER transactions, as a merchant you basically bear a higher del credere than with presence payments. That means that with distance payments the danger is greater that the cardholder disputes a fraudulent payment which will be charged back to you. That is because the cardholder cannot unambiguously prove his identity per telephone, fax or via the postal service by presenting the card and his/her signature. This gives the cardholder more possibilities to dispute the payment. This also makes things easier for those who would commit fraud.
Which types of businesses are particularly risky?
Experience shows that particularly companies that deliver to countries outside the EU are susceptible to a higher level of risk. Particular caution is to be exercised with African countries as well as certain countries in the Far East and America. We recommend that you only to deliver goods to customers in these countries with whom you are acquainted.
We advise you against delivering to post office boxes or hotel addresses. For more information please read our bulletin about card misuse in distance business.
What are the possible ways to securely carry out MPO transactions?
There is no such thing as absolute protection. However, there are various ways to improve security:
- During each transaction request the CVC2 card verification code (for MasterCard cards) or CW2 (for VISA cards) – consisting of the last three numbers of the seven-digit number in the signature field on the reverse side of the card – and enter this code in your Payment Service Provider’s (PSP) payment software. You can thereby be more certain that the ordering party is authorized to use the credit card number.
- Make sure you stick to the regulations regarding the handling of credit and debit card data. You actively contribute to the prevention of fraud.
Please also read our bulletin “Card Misuse in the Distance Business”.
Which regulations apply to the secure handling of card data with the MPO contract?
If you adhere to the “Instructions for the security of credit and debit card data” you meet the basic security regulations regarding the handling of credit and debit card data. If you go beyond this and use a certified solution from a Payment Service Provider (PSP), you also meet all requirements of the security programs SDP and AIS from MasterCard and VISA, which is primarily intended for e-commerce merchants.
