Having spent the past 20 years in the card industry -- and the most recent 10 in the online payments industry -- I’ve witnessed first hand the evolution of regulatory and monitoring changes as banks and governments struggle to keep up with Internet technology and, particularly, the exponential growth of online transaction processing.
A Brief History Lesson
No, Al Gore did not invent the Internet.
According to Wikipedia, the World Wide Web was created in 1989 by Sir Tim Berners-Lee, who was working at the European Organization for Nuclear Research in Geneva, Switzerland, and was released to the world in 1992. Sixteen years later, the Internet is the primary business tool -- having taken over for the phone and fax machine -- and has fundamentally changed how we live, communicate, shop and, of course, play!
We started First Atlantic Commerce in 1998, and at that time, the Internet was still very much the Wild, Wild West. The Visa and MasterCard compliance rules were in place for retail point-of-sale businesses and MO/TO businesses -- including telemarketers -- but there were no specifically defined rules for electronic-commerce merchants.
E-commerce was lumped in with MO/TO compliance for card-not-present transactions, and the rules neither meshed with how businesses operated nor with rapidly evolving Internet technology. A few more years passed before the card associations actually updated their manuals and merchant category codes to implement regulations specifically for online businesses -- and this is where life got interesting for all of us in the payments industry.
The Evolution of Merchant Category Codes
In 1998, the Internet had not penetrated many countries in the Caribbean -- the learning curve, therefore, was steep. At the time, a rudimentary level of understanding existed with regard to, one, what an online payment gateway did, and, two, how clearing of online payments would work with acquiring banks that needed to set up separate bank identification numbers for clearing.
Once the Internet gambling industry took hold, banks were hungry for the fee income generated by online casino volumes. Merchants, meanwhile, were signed up by the dozen without anyone realizing the risk associated with card-not-present consumer chargebacks and online fraud.
There was unsophisticated e-commerce monitoring in place, and acquirers were typically assigning the merchant category code 5967 for all online merchants -- regardless of the products they sold. The card associations were unprepared for the exponential growth of online gambling, soon realizing the compliance rules needed to be different than standard point-of-sale rules, which were well-documented in the card association manuals.
Prior to 2000, Visa operating regulations classified online gambling under "High Risk Telemarketing," which included direct marketing; inbound telesales related to telephone gambling; outbound telemarketing; online gambling; in-transit service gambling; and adult entertainment.
In February 2000, Visa adopted a unique category code for online casinos, which included lotteries, off-track betting and the sale of gambling chips. Banks and processors were required to register their online casino merchants with the new 7995 merchant category code -- this in an effort to provide real-time risk monitoring and reporting for the acquiring banks.
Land-based casinos, too, were issued unique codes, allowing those card transactions to be distinguished from Internet casino transactions. The 7995-coded transactions were not blocked by American issuers until sometime in 2001. There were some issuers, however, who posted these transactions as cash advances -- not sales -- creating a customer-service issue for the gaming merchant that could not be easily resolved.
The merchant category code, significantly, is where the difference between gambling merchants and the rest of the merchant world manifests -- the implementation of merchant category code classification and monitoring is, fundamentally, what changed the payments industry and led to the now infamous coded-versus-non-coded payments landscape.
Merchant category codes are intrinsic to all Visa and MasterCard payments, as well as to acceptance of transactions by card-issuing banks. The Visa International Data Quality Improvement Program monitors the acquirer’s use of specific merchant category codes to ensure that the code best describes the type of merchandise or service that the merchant provides.
There are about 580 Visa merchant category codes, and it is the responsibility of the merchant acquiring bank to ensure they have selected and applied the correct code to the merchant identification -- this so that the issuer can identify what type of transaction their cardholder is performing, from what Web site and in which country.
Issuers, then, can block transactions at the interchange bank-identification-number level based on the merchant category code, country code, and more recently, the electronic commerce indicator. Transactions can also be blocked at the point of authorization based on a variety of parameter settings.
Ambiguous Codes of Conduct
What I find fascinating about the merchant-category-code definitions is how the card associations categorize industry groupings -- over the past eight years, the 7995 code has been vastly broadened to include a swath of new commercial activities.
As of June 2008, the 7995 classification includes “merchants who operate gambling or betting establishments, including those that may be associated with hotels, restaurants, riverboats, and resorts, that allow customers to use their bank cards to purchase gambling chips, lottery tickets, or to place wagers. For gambling or betting merchants associated with hotels and restaurants, etc., transactions representing the purchase of gambling chips, lottery tickets, or wagers with a bank card must be classified under this [code]."
So, a riverboat casino that does not have its own, unique code is required to classify its transactions under 7995, which results in approximately 85 percent of those transactions being declined.
Now, if you review the 5999 classification -- a catch-all classification for "Miscellaneous and Specialty Retail Shops" -- acquirers are to “use this [code] for merchants who sell unique or specialized products that are not described by another merchant category code, such as map and atlas shops, firearms and ammunition shops, magic shops, party supply shops, silk flower shops, fireworks shops, ice dealers, picture frame shops, sunglasses shops, beauty supply shops, and dealers of bottled and distilled water. This [code] should be used only when a more descriptive [code] is not available.”
I ask: Why are firearms and ammunition shops in the same code category as picture-frame shops, silk flowers and bottled water?
So an 18-year-old (using his newly issued Capital One Visa card) could buy a 9-millimeter semiautomatic gun online, with bullets, at GunsAmerica.com for $580. Meanwhile, his bank wouldn't know whether he had purchased a nice pair of designer sunglasses or a new military-grade firearm because this merchant code, 5999, includes completely unrelated industries.
It's ironic that I can’t go enjoy my long weekend on a Mississippi riverboat gambling cruise with my Citi Visa card because my transactions would be automatically declined . . . but I can go buy a gun online without my bank ever realizing it.
Gives a whole new meaning to the marketing slogan "Visa: The Currency of Life."