Authorizing credit cards and debit cards

Card authorization allows you to accept a credit card or debit card payment from a customer and, within a matter of seconds, have the card transaction approved by your bank. You also have the option of allowing transactions be deferred for authorization at a later time.

Click to view image

Diagram and steps from PayPal

The credit card authorization process includes the following:

1. A customer purchases a product or service from a store.
2. The payment gateway encrypts payment data and securely sends the encrypted data through the payment processing network.
3. The transaction is reviewed, then authorized or declined, and the results are sent back through the payment gateway.
4. The customer receives a confirmation receipt and the order is fulfilled.
5. Once the transaction is processed, funds are transferred from the customer’s bank account to the merchant bank account.

The Gateway Accounts window specifies authorization options for credit cards and debit cards.

From the Staff site, go to Settings > Finance > Gateway accounts. From this window, you can review the defined gateway accounts. To create a new gateway account, select Add new gateway account.

The following fields are displayed:

• Gateway - The authorization gateways supported by iMIS.
• Authorization type - The type of authorization that will be performed for all credit card or debit card cash accounts that use this card authorization account:
  • Manual - Disables automated authorization through a gateway. The payment information can be edited or deleted at any time until invoiced.
  • Immediate - Performs automated authorization through a gateway. Payment information can be edited or deleted the same day only. The following authorization process is used:
    1. Credit card payment is entered.
    2. Credit card information is immediately sent for authorization.
    3. Authorization is returned and transaction is saved for later capture.
    4. Transaction is saved and completed.
  • Deferred - Performs automated authorization through a gateway. Payment information can be edited or deleted until the transaction is captured. The following authorization process is used:
    1.  Credit card or debit card payment is entered.
    2.  Transaction information is saved for later batch processing.
    3.  Transactions are periodically sent in a batch for authorization and capture.
    4.  Transactions in the batch are saved and completed.
• Save CSC prior to authorization - (Deferred authorization only) When enabled, the card security code (CSC) value is saved in an encrypted format in the iMIS database, so that the CSC information can be sent with all other transaction information in the batch for deferred authorization.

iMIS automatically deletes the saved CSC information after successful deferred authorization. If the associated gateway is Other, however, the custom gateway implemented by your AiSP for European debit card authorization is responsible for ensuring that the saved CSC information is deleted from your iMIS database.

• Account code - Short name for the account which must match the value in the web.config file.

Note: When entering gateway information for iATS, SecurePay or Vantiv/WorldPay, your Account code is already predefined. If you want to modify the Account code it must match the entry in the web.config file:
-For iATS, enter IATS.
-For SecurePay, enter SECUREPAY.
-For Vantiv/WorldPay, enter Vantiv/WorldPay.
If you are not self-hosted, you must contact your host for assistance modifying web.config files.

If you are not self-hosted, you must contact your host for assistance modifying web.config files.

The Account code is used to identify which gateway settings should be synchronized with and used by the tokenization engine. This identification happens in the iMIS web.config file (go to C:\AsiPlatform\Asi.Scheduler_[your instance]\web.config). The following Account Codes are available out-of-the-box:

• DVPAYFLOWPRO
• SECUREPAY
• IATS
• Vantiv/WorldPay

If you want to use a different Account code, make sure to update the web.config file. The account codes listed in the authorizationAccounts list for DataVaultPaymentGatewayProvider in the web.config file use the tokenization engine for payment processing.

<paymentGatewayService>
<providers>
<add name="PayFlowProPaymentGatewayProvider" type="Asi.PaymentGateway.PayflowProPaymentGatewayProvider, PayflowProPaymentGatewayProvider" authorizationAccounts="VERISIGN,PaymentTech,PAYFLOWPRO" />
<add name="NoProcessingPaymentGatewayProvider" type="Asi.PaymentGateway.NoProcessingPaymentGatewayProvider, NoProcessingPaymentGatewayProvider" authorizationAccounts="NOPROCESS,DEBIT" />
<add name="PayPalPaymentGatewayProvider" type="Asi.PaymentGateway.PayPalPaymentGatewayProvider, PayPalPaymentGatewayProvider" authorizationAccounts="PAYPALEC" />
<add name="MonerisPaymentGatewayProvider" type="Asi.PaymentGateway.MonerisPaymentGatewayProvider, MonerisPaymentGatewayProvider" authorizationAccounts="MONERIS" />
<add name="TnsPayPaymentGatewayProvider" type="Asi.PaymentGateway.TnsPayPaymentGatewayProvider, TnsPayPaymentGatewayProvider" authorizationAccounts="TNSPAYAC,TNSPAYP" />
<add name="DataVaultPaymentGatewayProvider" type="Asi.PaymentGateway.DataVaultPaymentGatewayProvider, DataVaultPaymentGatewayProvider" authorizationAccounts="DVPAYFLOWPRO,SECUREPAY,IATS,Vantiv/WorldPay" />
</providers>
</paymentGatewayService>

For more information, refer to documentation for your preferred gateway.

• Description - A description for the account.
• Admin email - The email address of your iMIS administrator so that the gateway service can contact the administrator if necessary.
• Partner - The gateway partner name that was obtained when you created your account.
• Host Url - Specifies the web address of the gateway.
• Host port - The port number of the gateway.
• Vendor - If you have multiple users on your gateway account, this value is the ID of any user authorized to process transactions. If you do not have multiple users on your gateway account, the Vendor value is the same as the Username value.
• Username - The gateway username or merchant login ID that was obtained when you created your account.
• Password, Verify - The gateway password.
• Timeout - The gateway connection timeout value, in seconds. ASI recommends a timeout value of 30 seconds.
• Proxy server Url - The IP address of your organization's proxy server.
• Proxy server UserId - The user ID of your organization's proxy server.
• Proxy server port - The port number of your organization's proxy server.
• Proxy server password, Verify - The password required by your organization's proxy server.

For more information, refer to documentation for your preferred gateway.

You must set up cash accounts before you can use card authorization. From the Staff site, go to Settings > Finance > Cash accounts.

Click to view image

When you select a cash account of type Credit card, Debit card, Direct debit, or Service, the Gateway account field is displayed, enabling you to associate a card authorization account with a credit card, debit card, direct debit, or third-party payment service (PayPal Express) cash account. The Gateway account field requires a value when you select a cash account of type Credit Card, Debit Card, Direct Debit, or Service.

Defining a new cash account

Before defining new cash account, complete the setup of your card authorization accounts on the Gateway accounts window. Do the following to define a new cash account:

1. From the Staff site, go to Settings > Finance > Cash accounts.
2. Select Add new cash account.
3. In the Code field, enter the abbreviation you want to assign to the cash account you are creating.

You can use any code you prefer for a credit card, debit card or direct debit:

For a credit card number to be validated by iMIS, the value, in addition to being a cash account of type Credit Card, must contain one of the credit card types iMIS supports:

• AMEX
• VISA
• MC
• DISC
• DINERS
• CB

For a direct debit, the first two letters control the country for the direct debit, for example:

• CA = Canada
• US = United States
• AU = Australia

Make sure the correct payment gateway is linked to the appropriate cash account: iATS or Vantiv/WorldPay can be used for Canadian direct debits, SecurePay is used for Australian direct debits, and Payflow or Vantiv/WorldPay can be used for US direct debits. The default Code prefix is US. The prefix determines the region-specific information needed for your payment methods. It is advised that you use the default Code as other countries might be supported in the future.

4. In the Name field, enter the full name you want to assign to the account.
5. Select a Type:
   • Cash - Specifies that the account is a checking or other deposit account (other than a credit card account).
   • Credit card - Specifies that the account is a credit card account.
     • US debit cards and credit cards are handled the same in iMIS.
   • Other - Specifies that the account is a non-cash asset account.
   • Debit card - Specifies that the account is a European debit card account.
   • Service – Specifies that the account is a third-party payment service, such as PayPal Express.
   • Direct debit - Specifies that the account is a direct debit account (payment is taken directly from the bank account) that is used with automatic and recurring payments.
6. (optional) From the Account drop-down, select the cash account.
7. (optional) Select the Entity. For more information, refer to Financial entities.
8. (Credit card, Debit card, Direct debit, and Service only) Select the associated Gateway account.
9. (optional) Depending on the Type and Gateway account chosen, the following checkboxes appear:
   • CSC Required for web transactions - Makes the CSC required for the specified cash account when on the web.
   • CSC Required for desktop transactions - Makes the CSC required for the specified cash account in the AAC/Desktop.

   Note: See Requiring a CSC for credit card or debit card transactions for more information.

   • Display issue number - Displays a field for entering a European debit card's issue number in payment entry windows. When cleared, the Issue Number field is not displayed in payment entry windows.
   • Display issue date - Displays a field for entering a European debit card's issue date in payment entry windows. When cleared, the Issue Date field is not displayed in payment entry windows.
10. Click Save.

Modifying a credit card, debit card or direct debit cash account

Card authorization accounts are limited in how they can be modified. You might need to create new card authorization accounts.

1. From the Staff site, go to Settings > Finance > Cash accounts.
2. Select a Code to edit from the cash accounts list.
3. Modify the credit card, debit card, or direct debit cash account.

Note: When editing card authorization accounts, you cannot modify the Code value.

Note: You cannot delete a card authorization account that has been assigned a cash account.

4. Click Save.

As an additional verification for credit card transactions, you can make the CSC a required value for specific credit card or debit card cash accounts. A CSC is the three- or four-digit unembossed number that displays on the front or back of a credit card or debit card. The CSC is not part of the actual card number and is useful in situations where the cardholder is not present when the payment is being made.

Setting the CSC as a requirement

Do the following to set the CSC as a required element for transactions:

1. From the Staff site, go to Settings > Finance > Cash accounts.
2. Select the desired cash account.
3. Select one of the following options for the specified credit card or debit card cash accounts:
   • CSC Required for web transactions
   • CSC Required for desktop transactions

Selecting CSC Required for web transactions makes the CSC required for the specified cash account when viewing on the web. Selecting CSC Required for desktop transactions makes the CSC required for the specified cash account in Advanced Accounting Console. When either CSC Required for web transactions or CSC Required for desktop transactions is selected, a CSC value is required before you can complete the credit card or debit card transaction using the specified cash accounts.

A CSC is not required when processing a reversal payment transaction (for example, entering a credit transaction) or when editing a payment transaction.

• For transactions associated with card authorization accounts that use Immediate authorization, the CSC value is not stored in the database. The value that displays in the Card Security Code or CSC field is deleted once the transaction is submitted for processing.
• For transactions associated with card authorization accounts that use Deferred authorization and for which the Save CSC prior to authorization option has been selected, the CSC value is temporarily stored in an encrypted format in the iMIS database. For the Payflow Pro gateway, iMIS then deletes the stored CSC information after successful authorization. If a saved payment is viewed prior to successful authorization, the CSC number appears as three asterisks regardless of the security level of the iMIS user.
• For Other gateways, the CSC information stored in the iMIS database is not automatically deleted by iMIS after successful deferred authorization. You should ensure that the custom gateway interface implemented by your Solution Provider deletes the stored CSC information after being successfully authorized.
• iMIS only validates that a CSC value is present (if required) and that the value is a three- or four-digit alphanumeric character. CSC validation depends on various factors that go beyond the scope of iMIS (for example, whether the credit card processor supports CSC). For specific information regarding CSC validation, contact your authorization gateway, merchant bank, credit card or debit card processor, or any other third-party involved in validating your credit card transactions.

iMIS accepts and validates Diners Club and Carte Blanche credit cards. To use Diners Club and Carte Blanche credit cards to process payment transactions, you must set up the following two new credit card type values on the Cash Accounts window (from the Staff site, go to Settings > Finance > Cash accounts):

• DINERS (Diners Club)
• CB (Carte Blanche)

The following credit card number is available for testing Diners Club and Carte Blanche credit card transactions:

3056 9309 0259 04

Note: For testing purposes, transactions must be under 100.00.

You can process transactions using credit card types with variations of the supported credit card types (for example, DINERS1, DINERS2).

You can enter any credit card value in the Check/CC field on the AAC Sales transactions window (Finance > Transactions > Sales transactions) and the AAC Cash receipts window (Finance > Transactions > Cash receipts). However, for a credit card number to be validated by iMIS, the value entered in the Check/CC field, in addition to being a cash account of type Credit Card, must contain one of the supported credit card types: AMEX, VISA, MC, DISC, DINERS, CB (for example, MY-AMEX).

Organizations that use iMIS to process accounting transactions can have multiple credit card or debit card cash accounts and might want to control how funds are allocated to financial institutions.

For example, an organization that has domestic and international accounts might not want the international accounts processed, but might want to store the information in iMIS. The organization could create a new card authorization account for the international accounts, set the account to Manual Authorization, and create a corresponding cash account and set its CC Auth Account value to the new card authorization account.

Note: This information applies to users who are processing Fundraising payments in the Advanced Accounting Console.

When setting up the Fundraising module for card authorization, we recommend disabling the Do Not Validate Credit Card field option. In the Advanced Accounting Console, go to Settings > Fundraising > Configure fundraising options and disable the Do Not Validate Credit Card field option.

If you enable this option, however, the credit card or debit card number will not automatically format when it is entered on the Fundraising > Gifts window. If Deferred authorization is enabled, then transactions made on the Overview tab on the Gifts window with unformatted credit card or debit card numbers will not display in credit card or debit card searches, and will not print on the Deferred Credit Card Pre-Authorization report.

You must assign a card authorization account to each credit card or debit card cash account you create in iMIS:

1. From the Staff site, go to Settings > Finance > Gateway accounts.
2. Select Add new gateway account.
3. From the Gateway drop-down list, select Other.
4. For the Authorization type, select Manual.
5. Enter NOPROCESS as the Account code.

Note: NOPROCESS has been associated in the web.config file as a non-processing payment gateway. If you enter a different code, you must modify your web.config file for that code to be recognized.
If you are not self-hosted, you must contact your host for assistance modifying web.config files.

6. Enter a meaningful description for the authorization account in the Description field.
7. Click Save.

Card authorization account information and cash account information is kept in the following iMIS tables:

Credit card authorization accounts

The following columns in the CCAuthAcct table are used for card authorization accounts:

Note: Not every column will be used for every credit card.

Column	Data type	Description
CCAuthAcctCode	varchar (20)	The code for the card authorization account.
CCAuthAcctDescription	varchar (255)	Description associated with an account code.
CCAuthMode	tinyint	Authorization mode: 0 (manual) 1 (immediate) 3 (deferred)
CCAuthAdminEmail	varchar (255)	Email address of the system administrator responsible for setting up the accounts.
CCAuthURL	varchar (255)	URL of the test or live site.
CCAuthGateway	varchar (255)	Gateway interface through which card authorization occurs.
CCAuthPort	int	Port address used for transaction processing.
CCAuthUser	varchar (255)	Username created during setup process.
CCAuthPassword	varchar (255)	Password created during sign-up process.
CCAuthVerisignPartner	varchar (255)	Partner name supplied.
CCAuthVerisignVendor	varchar (255)	Vendor name supplied.
CCAuthTimeout	int	Timeout period supplied.
CCAuthVerisignProxyServer	varchar (255)	Proxy server supplied by network administrator.
CCAuthVerisignProxyPort	varchar (255)	Proxy port supplied by network administrator.
CCAuthVerisignProxyUser	varchar (255)	Proxy user ID supplied by network administrator.
CCAuthVerisignProxyPassword	varchar (255)	Proxy password supplied by network administrator.
CCAuthSaveCscBeforeAuth	tinyint	Handling of CSC value for deferred authorization: 0 (do not save CSC in iMIS) 1 (save encrypted CSC in iMIS then delete after successful authorization)

Credit card or debit cards cash accounts

The following columns in the Cash_Accounts table are used for each credit or debit card cash account:

Column	Data type	Description
CCAuthAcctCode	varchar (20)	The code for the card authorization account
CSC_REQUIRED_WEB	bit	Indicates whether the CSC value is required on the web: 0 (not required) 1 (required)
CSC_REQUIRED_CS	bit	Indicates whether the CSC value is required in iMIS: 0 (not required) 1 (required)
ISSUE_NO_FLAG	tinyint	Indicates whether the Issue Number field should be displayed in iMIS payment entry windows: 0 (not displayed) 1 (displayed)
ISSUE_DATE_FLAG	tinyint	Indicates whether the Issue Date field should be displayed in iMIS payment entry windows: 0 (not displayed) 1 (displayed)

Note: If you have not set up credit card cash accounts in the Finance module, the Credit card reports item is disabled.

To generate credit card or debit card reports, in Advanced Accounting Console, go to Continuum > Other Reports > Credit card reports. The following report options are displayed on the Credit card reports window:

• Submit Deferred Authorizations – Sends transactions flagged for deferred authorization. All flagged transactions are submitted immediately. This applies only to deferred credit card or debit card authorizations.

Note: If you have not set up European debit card cash accounts in the Finance module, the Print Debit Card Reconciliation Report button is not available.

Note: This information applies to users who are processing payments in the Advanced Accounting Console.

If you have enabled the Immediate authorization option, and then entered a credit card payment, the transaction information is sent immediately through the gateway to the financial institution for authorization. After the payment is authorized, the funds are captured at midnight of the transaction date.

Note: European debit card authorization accounts cannot be configured to use the Immediate authorization option.

1. In Advanced Accounting Console, go to Finance > Transactions > Sales transactions.

Note: For this example, we are using the Sales transactions window. You can enter the credit card payments in any of the windows available for credit card authorization.

2. Click New.
3. Enter the customer ID in the Id field.
4. Enter a product in the Product field, or click the Find icon to select a value.
5. Enter the product quantity in the Quantity field.
6. Enter the credit card code in the Check/CC field, for example, enter VISA for a Visa card. Several additional credit card fields display when you press Tab:
   • Enter the credit card number in the CC # field.
   • If required, enter the Card Security Code in the CSC field.
   • Enter the expiration date in the Exp field.
   • Enter the name on the credit card in the Name on CC field. This does not have to be the same as the customer name.
7. Enter an amount in the Payment Amount field.
8. Click Save:
   • If the transaction was authorized, the Authorize field on the payment transaction window is populated with the authorization code and the transaction is saved. In addition, if you entered a value in the CSC field, the field is now blank because the system automatically deleted the value once the transaction was submitted.
   • If the authorization was declined, an error message is displayed indicating that the transaction was declined. Select OK to exit the Results window and return to the transaction window. If the transaction was declined, DECLINED is displayed in the Authorize field in the payment window.

Note: There could be several reasons for a declined authorization, such as bad card, invalid data, or invalid credit card number.

Note: At this point, you are not able to save the transaction. You can edit the payment date, amount, name, credit card number, and expiration date, and then resubmit the transaction for authorization.

Note: This information applies to users who are processing payments in the Advanced Accounting Console.

Deferred credit card or debit card payments are entered in the same manner as if you were using Immediate authorization. When a deferred transaction is saved (by clicking OK), the word DEFER displays in the Authorize field. If you select the Deferred authorization option, credit card or debit card transactions are deferred until you submit them.

Warning!
Do not accidentally enter any data in the Authorize field. When entering payment information, the Authorize field is empty. It remains empty until you save the transaction, then it populates with the word DEFER to indicate that it is batched for authorization. However, you might need to authorize a payment through a credit card machine or by calling the merchant bank, so iMIS allows you to manually enter authorization codes for these circumstances. However, keep in mind that if you do enter information in this field, iMIS assumes that it is a manually entered authorization code.

Before deferred credit card or debit card payments can be authorized, they must be submitted:

1. In Advanced Accounting Console, go to Continuum > Other Reports > Credit card reports, and click Submit Deferred Authorizations. The Authorization Reports: Submit Deferred Authorizations window is displayed.
2. Enter the Begin Date and End Date of the deferred authorizations. The Begin Date defaults to the current system date, which you can override.
3. Enter the Org Code, or click the Find icon to select a value. If you do not enter an Org Code, the report prints for every Org Code.
4. Click OK.

After you enter credit card or debit card transactions, you can search iMIS for transactions:

1. In Advanced Accounting Console, go to Finance > Transactions > Search credit card info.
   • Enable the Last Four option to search on the last four numbers of the credit card or debit card, or the Full option to search on the full card number.

   Note: If Advanced PCI Compliance options>Do not retain cardholder information is enabled, iMIS saves transactions without cardholder data and shows only gateway reference number and authorization code fields. Therefore, the Full option is disabled, because only the last four credit card digits are saved.
   To enable this option, in the Advanced Accounting Console, go to Finance > Options > Configure accounting options.

   • Enter the card number in the Credit Card # field to search for a specific card number.
   • Enter the customer or company ID in the Id field to search by record. You can search by both Credit Card # and Id, or by one field only.
   • Enter the transaction number in the Trans Number field to search by transaction number.
2. Press Enter. A list of transactions for the selected card or customer record is displayed in the window.
3. To view an individual transaction through the Finance > Transactions > Search credit card info window, double-click the line item. The original transaction window opens.

Note: If Advanced PCI Compliance options > Do not retain cardholder information is enabled, iMIS saves transactions without cardholder data and shows only gateway reference number and authorization code fields. To enable this option, in the Advanced Accounting Console, go to Finance > Options > Configure accounting options.

An acquiring financial institution is a bank or other financial organization that contracts with banks and merchants to allow merchants to accept card transactions. Some financial institutions perform merchant services. Others outsource these services to a third-party processor.

An authorization is an electronic request for approval of the transaction that is sent to the financial institution that issued the customer’s credit card or debit card. Authorization options in iMIS include Manual, Immediate, and Deferred.

• Manual - Enables a system licensed for card authorization to turn off automatic authorization. This is the default setting.
• Immediate - Payment information is sent immediately to the gateway for authorization (and for later capture) when a credit card or debit card transaction is entered.
• Deferred - Transaction information that is saved for later processing.

A capture is the process of submitting a credit card or debit card transaction for financial settlement. When a transaction is captured, the transaction amount is credited to your deposit account through your acquiring financial institution and posted to the cardholder’s credit card or debit card account. This transaction usually occurs after midnight when authorizations for the previous day are batched.

A card authorization gateway is a third-party credit card or debit card interface, similar to an automated point-of-sale system that provides a front end to financial networks, financial institutions, and payment processors, which allows merchants to provide credit card or debit card authorization to their clients.

The three- or four-digit, unembossed number that is displayed on the front or back of a credit card or debit card. This is often used as an added measure of verification for card transactions. The Card Security Code is not part of the actual card number.

A Doing Business As (DBA) name is the name used to identify the business, as opposed to the business’ legal name.

Editing is the process of changing the payment information for a transaction in the Trans database table in iMIS.

Marking a transaction to be processed later.

A gateway batch is an accumulation of card transaction authorizations. The batch awaiting settlement is within and under the control of the gateway.

The five-character date of issue (mm/yy format) that is printed on certain European debit cards, used for authentication.

The one- or two-digit number that is printed on certain European debit cards, which indicate how many versions of the card have been issued to the cardholder. This value is used for authentication.

An issuing financial institution extends credit to a customer through credit card accounts or provides electronic account debiting through debit cards. The issuing financial institution issues a credit card and bills the consumer against the credit card account. An issuing financial institution is also referred to as the cardholder’s financial institution or issuer.

The account that collects the funds from a credit card or debit card transaction. The merchant account receives the funds after the capture is complete.

The process of sending deferred credit card or debit card transactions to a gateway for authorization.

The process in which an electronic credit card transaction is settled between your acquiring financial institution and the customer’s credit card-issuing financial institution. Your acquiring financial institution credits your account for the credit card sale and the sale is posted to the customer’s credit card account.

The account that is debited after an authorized credit card or debit card transaction is captured.

A deleted payment transaction. The transaction can then be replaced with a new transaction.