First Atlantic Tries to Solve the 3D Secure Cost Issue

With chargeback rates running well in excess of 1% on Internet transactions, Visa International and MasterCard International have for some time been pushing a form of online cardholder authentication, called 3D Secure, that is intended to make cardholders, issuers, acquirers, and merchants feel confident that Web payments are legitimate. But the cost of implementing 3D Secure has been a stumbling block for acquirers and merchant processors, slowing adoption of online authentication. To address that problem, First Atlantic Commerce Ltd., a payments gateway based in Hamilton, Bermuda, yesterday rolled out the first commercial third-party service that allows acquirers and merchants to process online card payments through the 3D Secure system on a per-transaction basis, avoiding hefty upfront costs and slashing time to market. “We've taken it about as close to plug and play as you can get,” says Andrea Wilson, chief executive of First Atlantic, a 7-year-old, 12-person unit of Capital G Ltd., a Bermuda-based international banking firm. With the company's new service, called cGate SecureVerify, acquirers pay a $75 flat one-time enrollment fee and merchants a flat $125 fee per Web site. FAC then charges acquirers per-transaction fee of 10 cents to 15 cents, depending on volume. Because the transactions are covered under Visa's Verified by Visa and MasterCard's SecureCode online authentication programs, merchants get protection from chargeback liability, which shifts to issuers, and acquirers get a break on interchange fees of up to 40 basis points, which may be passed on to merchants. FAC has installed all necessary software, arranged for mandated system audits, and handles end-to-end testing required by the card associations. Software licensing, audits, tests, and the costs of redundant servers and ongoing compliance for 3D Secure can run acquirers about $125,000, FAC estimates. At the same time, it can take about three months to fully implement 3D Secure. FAC says it can have an acquirer's merchants running transactions in two days. “We looked at doing this for about a year, because we thought (this cost) was not a good way to get good takeup on the (3D Secure) product,” says Wilson. Verified by Visa and SecureCode are the brand names the card networks use for the 3D Secure system, which allows issuers, merchants, and acquirers to establish the identity of online consumers through passwords and secondary security phrases consumers enter in a pop-up window at the time of purchase. So far more than 9,000 Visa and MasterCard issuers in the U.S. have enrolled in the system, but concerns about cost, complexity, and consumer hassles have slowed merchant and acquirer adoption. FAC says interest from acquirers is running high in the new third-party service, in part because of the cost and time savings, in part because fraud rates are running at 1.7% of online volume, and in part because using the service does not require merchants and acquirers to change processor connections. FAC can act as a front end on the Web, with transactions then flowing through already-established links. “Acquirers can do payer authentication with us but don't have to do payment processing with us,” says Wilson. Her plan is to enroll anywhere from “several hundred” to a 1,000 merchants a month for the service between now and year's end. FAC is targeting mid-sized acquirers that rely on third-party processors, since these companies typically have the hardest time justifying the full expense of 3D Secure. “Merchants have been taking a hit for years on fraud (online),” says Wilson. “This is the first time Visa and MasterCard have provided online merchants with a way to cope with fraud losses, and we want to get them enrolled.” FAC focuses on niche markets for online transactions, serving mainly sellers of digital content, though not adult content. Its average merchant site sells about $250,000 monthly, though some sell as much as $3 million, usually internationally. It contracts with Cable & Wireless Bermuda for its data center.