CHOOSING BETWEEN PAYMENT GATEWAY & PAYMENT PROCESSOR

Source: http://www.chetu.com/blogs/finance-2/choosing-between-payment-gateway-and-payment-processor-2.php

Quite interestingly I have seen “Payment Gateway” and “Payment Processor” being used as interchangeable terms.

It would be worth noting that the “Payment Gateway” and “Payment Processor” are two completely different entities in the card payment industry world.

What is Payment Gateway?

Payment Gateway is an application service provider that authorizes payments for businesses, online retailers or traditional brick and mortar.

In simple terms a Payment Gateway can be thought of as an interface between merchants and payment processors. The Payment Gateway accepts payment request from merchants and forwards this to payment processor for further processing.

List of some popular Payment Gateways:

• Authorize.net
• Cybersource
• Chase Paymentech Orbital (only works with Chase Paymentech processing network).
• First Data Global Gateway (only works on First Data’s various processing networks. Used to be called Linkpoint, EFSNet and Yourpay, at various points in time).
• Plug N Pay
• Paypal Payflow
• ViaKlix / Virtual Merchant (only works with Nova/Elavon)
• SecurePay
• USAePay
• TrustCommerce
• EPX
• Skipjack
• CenPOS

What is Payment Processor?

Payment Processor is an entity that has a direct interface to card associations or networks such as VISA and MasterCard. The Payment processor receives payment requests from merchants or payment gateways and sends it to the card association or networks such as VISA and MasterCard which in turn routes the transaction to the card issuing bank for authorization.

Payment processors are also referred as “Acquirers”. The Payment processor on a whole is a complete payment processing engine that processes real time transactions and end of day settlement requests and are also responsible for handling chargebacks from the Issuing bank.

List of some popular Payment Processors:

• First Data
  • North (Cardnet)
  • South (Nabanco)
  • Nashville (Envoy)
  • Omaha
  • BuyPass (Concord/Atlanta)
• Vantiv
• Elavon
• Heartland
• Global
• WorldPay
• TSYS
• Chase Paymentech

 Below diagram shows a clear distinction between payment gateway and payment processor in a typical card processing system. As seen below the Payment Gateway is a layer that sits between the merchant and the payment processor.

Choosing Between Payment Gateway VS Payment Processor

While the payment gateway offers an easy integration to merchant application it comes as an additional cost to the merchant. The Merchant can save this additional cost if it integrates directly to the payment processor. While this is true there are several other factors that should be considered while choosing between payment gateway and payment processor.

Below are some tips in choosing between payment gateway and processor:

Total Transaction Volume – The Payment processors have different transaction fee rates that depends on the volume of transactions. Most of the Payment processors offer lower rates for high volume of transactions. It would be more feasible for small businesses to go to payment gateway that have small volume of transactions.

Integration Cost & Time – The development cost and time for integrating with payment processor is higher as compared to payment gateway integration. The Payment processor requires integration to their ISO 8583 platform and undergoing their certification process.

Compliances – Integration to payment processor requires a PCI certified infrastructure and adherence to all compliances set by the card association network (VISA and MasterCard). The payment gateway on the other hand deals with all the intricacies related to ISO 8583 integration and the payment processor certification process. The time and cost associated with payment gateway integration is much lower as they offer a simple API layer for accepting and processing payment requests from merchants.

Settlement – The payment gateway handles the settlement on behalf of merchant while the payment processor expects the merchant to send the end-of-day settlement request and handle the settlement file to be imported back into the system.

Working on different projects related to payment gateway and processors we have seen an emerging convergence between the POS and Payment Gateway industry.

The POS industries are leaning towards implementing their own payment gateway to get a cut of all the transactions that is processed via the POS. Conversely the payment gateway industry is looking to build their own POS systems to process all the transactions originating from the POS system.

Developing EMV POS Solutions to Reduce Fraudulent Liabilities

Source: http://www.chetu.com/blogs/finance-2/developing-emv-pos-solutions-reduce-fraudulent-liabilities.php

The rapidly approaching EMV compliance deadline of October, 1st 2015 marks a liability shift to the least secure entity in the payments chain. To aid their customers in the quest to accommodate EMV standards, a transportation in-vehicle technology solutions company presented Chetu with the task to upgrade their Point-of-Sale (POS) offerings. They wanted EMV payment terminals with the applicable ISO standards to accept mag-stripe, EMV, and contactless card functions, programmed with all the appropriate AIDs and support for offline batch processing. Chetu’s software solutions allowed this proprietor to offer secure and reliable POS terminals to adapt to the changing payments infrastructure.

How the Payments Landscape is Changing

 Fraudulent charges using payment card information is rampant in the United States and around the world. To combat this dilemma traditional credit and debit cards are in the process of being phased out and replaced by Europay, MasterCard, and Visa (EMV) smart card standards. The cards, which have a contact function similar to an ATM or a contactless function that uses NFC technology, are equipped with a microprocessor chip in conjunction with the traditional magnetic stripe. The chip is able to be used more dynamically to validate a transaction by employing inherent cryptography and tokenization features, making it far more advanced than other card payment technology. The conventional mag-stripe uses a signature and visual inspection to safeguard the use of natively stored personal identifiers. Unfortunately, this data can be easily duplicated and reused. The “chip and pin” cards do not store personal data natively making them difficult to decrypt and counterfeit. They also employ a Personal Identification Number (PIN) validation making them a more secure option.

Although chip and pin cards are widely used abroad, they have yet to be mainstreamed in the United States payments infrastructure. By October 2015 major card networks including Visa, MasterCard, AmEx, and Discover will start imposing fraud liabilities on parties that do not switch to the new EMV standards. For merchants, financial institutions, and fuel dispensers, this means adding new payment technologies at the Point-of-Sale.

• U.S. fraudulent charges equates to 51% of the total global cost of $13.9 billion in 2013
• EMV chip and pin cards will be employed to mitigate fraud
• Shift in liability from payment processors to the least secure entity, those using mag-stripe only POS systems
• Compliance date for all merchant POS transactions is October 2015
• ATM owners will be liable for costs associated with counterfeit card fraud in 2016
• In 2017 the least secure entity for automated fuel dispensers will be held accountable
• Merchants need to invest in the new payments technology to avoid liabilities associated with fraudulent activity

Problems Overcoming the Liability Shift

 A client, who is a leading provider of global transportation in-vehicle technology solutions, wished to implement a POS EMV system, to be offered to independent merchant taxi service entities. The inherent problem was that they had to update their current POS systems to alleviate the liability shift from their customers. They wanted to integrate with a leading payment processor that they already associated with, and a certified hardware terminal that supports mag-stripe, EMV, and contactless, which conforms to the following ISO standards:

•  ISO 7816 for contact chip cards in which the chip card communicates with a reader through a contact plate for data exchange between card and reader
• ISO 14443 for contactless chip card functions in which the chip communicates with a reader over a radio frequency for data exchange between card and reader
• ISO 8583 to exchange card transaction data between processors, networks, and card issuers

Additionally, Chetu was tasked with the research to find a suitable mobile card reader device that supports mag-stripe, EMV, and contactless card types. The stipulations to be considered while choosing the card readers were:

• Cost factors
• Ease of integration (SDK/API availability)
• OS support (Windows, iOS, and Android)
• Connectivity (Serial, USB, Bluetooth, etc.)
• Certification and compatibility with processors to inject keys in order to support E2E (end-to-end) encryption

Furthermore, once the hardware is chosen the following issues needed to be addressed:

• Implementation of application Identifiers (AIDs)
• Enable support for offline features

Chetu’s Software Development Solutions

With the extensive research done by the Chetu team the following terminals were found to support the appropriate ISO standards for mag-stripe, EMV, and contactless card functions:

Following the research, it was subsequently decided to select the Ingenico iPP 320 device. With adherence to the aforementioned stipulations this device supports the necessary ISO functions, is First Data certified for supporting end-to-end encryption, is within the proposed budget, and has all necessary features.

 With the proper EMV terminal selected it was then imperative to program the AIDs. EMV chips are equipped with an Integrated Circuit Card (ICC) application. These applications hold the identifiers, or tags, that allow different proprietary card issuers, payment processors, and card networks to uniquely interact with different terminals. A card using EMV standards will contain one or more unique AIDs, as well as each payment terminal used will have one or more of the corresponding Identifiers to accept that card. Each merchant has their own payment partners hence terminals offered were programmed with all available AIDs as to be ready to accept a transportation merchant’s payment network partner’s cards.

 Additionally, the terminals were programed for offline batch processing for areas where internet infrastructure is unreliable and slow. Static Data Authentication (SDA) allows for offline validation by signature and a batch processing function when a solid connection to the internet is maintained.

 Benefits as a Result of Upgrading their Payment Offerings

• This entity can offer their customers a secure, reliable, and cost effective POS terminal for the transportation industry
• Allows this company to offer a payments solution that relieves customers from the liability shift
• Support and receive transactions from multiple payment options including mag-stripe, EMV chip-and-pin / sign, and contactless
• Allows the proprietor to offer mobile, Bluetooth, and USB connectivity for motility within the transportation industry
• Allows this entity to offer offline support and batch processing for areas with unreliable internet infrastructure

 About Chetu

 Chetu is a 16-year old software development provider that delivers world-class software solutions serving entrepreneurs to Fortune 500 clients. With a growing team of highly skilled engineers spread across nine global locations, it is able to provide a modular approach that fits customers’ budgets, yet does not compromise on local interaction or real time collaboration. Beyond providing software resources, Chetu excels in providing industry specific and niche technology solutions for healthcare, retail, finance, telecom, gaming, hospitality, travel, e-learning, supply chain, and many others. Its services include process and systems design, custom application development, business intelligence and reporting, systems integration, mobile plus tablet applications, wearable tech software, as well as testing, maintenance, and support. Chetu’s expertise spans across the entire software technology spectrum.

 Contact Information:

Phone: (954) 342-5676 / Email: Sales@chetu.com / Web: www.Chetu.com