IP Pay End User System Reference Manual Document revision 1.3 6 October 2008 1
Table of Contents Introduction 3 DECLINE Response Codes 4 AVS Result Codes 7 CVV2/CVC/CID Result Codes 9 CAVV Result Codes 10 2
Introduction GetReporting.com is IPPay s real-time online solution for all transaction reporting needs. GetReporting provides consolidated real-time reporting on all types of electronic payment transactions and provides a simple and integrated view for reconciliation and review. In some instances, independent software vendors integrating into IPPay may choose to hide generated response action codes in order to simplify things for users. However, getting as much information as possible about a particular transaction becomes useful when trying to perform advanced troubleshooting on problem transactions. GetReporting provides the advanced user access to this information. When viewing transaction records within GetReporting, one can view additional transaction codes generated by the IPPay system that provide more detailed information generated by IPPay. This document discusses the various codes generated by IPPay and the meaning behind each code type. 3
DECLINED Transaction Codes The IPPay System generates a DECLINED transaction for many different reasons. The following table is useful for understanding the various ActionCode results that can occur. Note that many ActionCode values are associated with a particular credit card type. Any penny-value not defined on this list will return a 000 ActionCode. ActionCode Description 001 (V/MC) Refer to card issuer. 100 Deny (only for Internet transactions). 002 Refer to card issuer, special condition 003 (V/MC) Invalid Merchant or Service Provider 004 (V/MC) Pick up card. (Card most likely reported stolen) 200 Deny Pick up card. 005 Do not honor. 100 Deny. 006 Error. 181 Format error. 007 Pickup card, special condition. 200 Deny Pick up card. 012 (V/MC) Invalid Transaction. 104 Deny New card issued. 013 (V/MC) Invalid amount. 110 Invalid amount. 014 (V/MC) Invalid account number (no such number). 111 Invalid account. 015 (V/MC) No such issuer 111 Invalid account 019 Re-enter transaction 103 Deny Invalid manual Entry 4DBC 182 Please wait 109 Invalid merchant 187 (V/MC) Person claimed they never received the card from the bank and bank is shipping them a new card 809 Surcharge amount not permitted on Visa cards 805 Force STIP. 030 Format Error. 057 Transaction not permitted to cardholder. 061 Invalid amount. 806 CVV2 Failure. 807 Card authentication failed. 055 Incorrect PIN. 055 Incorrect PIN. 808 Revocation of Authorization. 808 Revocation of Authorization. 808 Revocation of Authorization. 111 Invalid account. 912 (V/MC) Invalid Card 917 (V/MC) Expired Card 999 Unable to go online; declined. 041 (V/MC) Pick up card (lost card). 200 Deny Pick up card. 4
ActionCode Description 807 Card authentication failed. 043 (V/MC) Pick up card (stolen card). 200 Deny Pick up card. 899 Unknown action code returned. 051 (V/MC) Insufficient funds. 110 Invalid amount. 052 No checking account. 105 Deny Account Cancelled. 053 No savings account. 105 Deny Account Cancelled 054 (V/MC) Expired Card. 101 Expired Card. 055 (V/MC) Incorrect PIN. 183 Invalid currency code. 057 (V/MC) Transaction not permitted to cardholder. 115 Service not permitted. 058 (V/MC) Transaction not allowed at terminal. 103 Deny Invalid manual Entry 4DBC. 059 Suspected Fraud. 061 Exceeds withdrawal amount limit. 110 Invalid amount. 062 (V/MC) Restricted card. 189 Deny Cancelled or Closed Merchant/SE 063 Security violation. 065 Exceeds withdrawal count limit. 188 Deny Expiration date required. 075 (V/MC) Allowable number of PIN-entry tries exceeded. 076 Invalid/Nonexistent To Account specified 077 (V/MC) Previous message located but data is inconsistent with original message. Invalid/Nonexistent From Account specified. 078 (V/MC) Blocked, first used. 188 New cardholder, card not unblocked yet Invalid/Nonexistent account specified (general). Deny New Card Issued 080 Credit issuer unavailable. 125 Invalid effective date. 081 PIN cryptographic error found. 082 Negative CAM, dcvv, icvv or CVV result. 122 Invalid card (CID) security code. 083 Unable to verify pin. 084 Invalid Authorization Life Cycle. 400 Reversal accepted. 992 DECLINE/TIMEOUT. 091 (V/MC) Issuer unavailable (STIP not applicable or 107 available) Please Call Issuer 092 (V/MC) Destination cannot be found for routing 093 Transaction cannot be completed; violation of law. 094 Duplicate transmission detected. 096 (V/MC) System Malfunction. 5
Other Responses The responses on the previous table are not the only ActionCode values you can obtain. Some responses are generated internal to the IPPay server, relying on information already configured within IPPay and not relying on external communications. A 025 ActionCode is generated when a record cannot be found. For example, if a merchant sends a CAPT transaction to IPPay, attempting to capture a previously authorized transaction, IPPay sends a 025 ActionCode whenever that previously authorized transaction cannot be found in the database. Because a merchant can only capture an authorized transaction that has been sent previously, it s important to recognize that this 025 ActionCode will be sent whenever that authorization is absent. The 981 ActionCode is generated by IPPay for merchant accounts that are configured to reject transactions based on AVS results. By observing the AVS results, the merchant can verify that transactions are being properly rejected by IPPay whenever the configured AVS responses appear. Unless a merchant s account is boarded to reject certain AVS results, this 981 ActionCode will not appear. For merchants who do not accept certain credit card types, the 913 ActionCode gets returned when those card types are detected. For example, a merchant who does not wish to accept any Discover cards can be boarded to automatically decline that card type; whenever a Discover transaction is sent by that merchant, a 913 ActionCode is returned. Only a merchant account that is boarded to reject certain card dtypes will receive this 913 ActionCode. If you receive a 900 ActionCode, your incoming XML transaction contains an XML syntax error. All XML documents that are not well-formed cause the IPPay server to return a 900 ActionCode. Additionally, data values submitted in your XML might be invalid IPPay syntax, and this will also return a 900 ActionCode. Within a 900 response will be an ErrMsg tag delimiting an error message; this will explain the technical reason (and frequently the location) for a syntax error. By comparing the ErrMsg text to your submitted XML, you can figure out how to correct all 900 responses. You should correct all 900 syntax errors on the test system before sending any transactions to the production server. 6
AVS Result Codes IPPay offers cardholder address verification through AVS, a system available widely throughout North America and much of Europe. With address verification, the merchant submits a customer s address and postal code information in a transaction and the credit card issue verifies and validates the address information against their internal billing address data. The result code sent by an issuer advises the merchant of a customer s billing integrity when completing the credit card transaction. Visa and MasterCard both call this feature AVS, which stands for Address Verification Service. American Express calls this feature AAV, which stands for Address Authentication and Verification. Almost all North American issuers support AVS using Visa and MasterCard association rules. According to these rules, an issuer compares the numeric digits within a cardholder s address and postal information with their own stored billing information. All alphabetic information is ignored. The address and postal code match (or fail to match) and an AVS result code is generated by the issuer. This is returned to the merchant during an authorization. American Express adds cardholder name matching to their AAV. A merchant can submit their customer s name in addition to the billing address information and may receive a number of additional AVS result codes. Shipping address information may also be submitted in an Amex transaction, and additional result codes are anticipated from Amex in the future. For most issuers, the AVS works independent of the action code. In other words, a transaction may be approved even though billing address information doesn t match. Because transaction approval is independent of billing address integrity, it s up to the merchant to decide the importance of correct billing address information when completing a sale. A merchant may simply allow a transaction to proceed, or a merchant might independently discontinue the sale in spite of an approval. IPPay, based on the AVS result code, automatically fills the AddressMatch and ZipMatch elements. The possible AddressMatch and ZipMatch values are Y, N, or X, and the value is determined with the AVS result code. IPPay offers an Automatic AVS Rejection feature, where merchants may automatically decline transactions showing degraded AVS results. Automatic AVS Rejection is an optional service that requires a merchant to subscribe before IPPay will automatically reject transaction on behalf of the merchant. 7
A result code indicating the AVS ( Address Verification Service ) results for a transaction may be A ; B ; C ; D ; Y ; M ; X ; F ; G ; I ; K ; L ; N ; O ; P ; R ; S ; U ; W ; Z. AVS Result Description A (all) Address matches, postal code absent or does not (All) match. D (all) Street address and postal code match. CM Name incorrect, postal code matches. M (all) Street address and postal code match. CM Name, street address and postal code match. N (all) Neither address nor postal code matches. (All) R (all) Retry. (All) S (all) AVS unavailable. (All) U (all) AVS unavailable. (All) Z W (MC/Amex) W was replaced by Z. Postal code matches, address absent or does not match. CM Name, street address and postal code are all incorrect. Y (all) Street address and postal code match. (All) Z (all) Postal code matches, address absent or does not match. (All) B Street address match. Postal code has invalid format. E CM Name incorrect. Street address and postal code match. C K G L I O P Street address and postal code have invalid formats. CM Name matches. Non-AVS participant outside U.S. Address not verified. CM Name and postal code match. Street address not verified for international transaction. CM Name and address match. F Postal code match. Street address has invalid format. CM Name incorrect. Street address matches. X Nine-digit postal code match in U.S. Postal code and address match for outside U.S. F Street address and postal code match for U.K. only 8
CVV2 Result Codes IPPay enables credit card validation through the CVV2 feature, a system widely supported throughout the credit card industry. With this feature, every physical credit card has a three- or four-digit value imprinted on the credit card in addition to the card number. Submitting this three- or four-digit security code enhances fraud detection for a transaction, ensuring that a genuine physical credit card is present during that transaction. Visa cards have a three-digit CVV2 value, MasterCard cards have a three-digit CVC2 value, and American Express uses a four-digit CID value to enable card validation. This three- or four- digit value is found imprinted on the back side of a credit card, usually inside the signature block (it may also be imprinted on the front side of the card). The response code to a Visa CVV2 or a MasterCard CVC2 or an American Express CID submission may be M ; N ; P ; S ; U or Y o M CVV2 match o N CVV2 Not Match o P Unable to Process o S The CVV2 should be on the card but merchant indicates it is not o U The Issuer is not certified or has not provided Visa with encryption keys. o Y Invalid CVV1 Track Present Participation in CVV2/CVC2 is optional for issuers. The subscribing issuers submit their CVV2/CVC2 keys to Visa and MasterCard, and these keys are kept secret. The individual CVV2/CVC2 implementation policies of the tens of thousands of issuers are confidential, and issuers may changes their internal CVV2/CVC2 policies without notification. Statistics are unavailable as to how many issuers subscriber (or don t subscribe) to CVV2/CVC2. Issuers may decide to return a 806 action code, indicating that a Visa issuer has declined a transaction due to the submission of an invalid CVV2 value. The 806 action code (a response allowed under Visa s association rules) enables issuers to independently decide a policy of rejecting transactions having invalid CVV2 values. An 806 action code may have a N or U or P response, but never an M response. Another factor that may affect CVV2 result codes is stand-in processing. When Visa or MasterCard performs stand-in processing for an issuer (because the issuer is otherwise unable to respond directly for a transaction), Visa/MC will perform the CVV2 calculations on behalf of any issuers who subscribe to CVV2. 9
CAVV Result Codes Cardholder authentication is now available in the credit card industry through Visa s Verified by Visa program and MasterCard s SecureCode program. Using these systems, an ecommerce merchant enables their customer to submit an account ID and a password to authenticate their presence during an online transaction. The authentication process generates a token; the token is submitted within an authorization for a transaction. IPPay supports these two programs, allowing CAVV and UCAF data to be submitted to IPPay. The merchant receives a CAVV result code after a transaction is approved. The response code to a Visa CAVV or a MasterCard UCAF submission is 0 through 9 or A through D, where: 0 CAVV authentication results invalid. 1 CAVV failed validation authentication 2 CAVV passed validation authentication 3 CAVV passed validation attempt 4 CAVV failed validation attempt 5 Not used (reserved for future use) 6 CAVV not validated, issuer not participating in CAVV validation 7 CAVV failed validation attempt (US issued cards only) 8 CAVV passed validation attempt (US issued cards only) 9 CAVV failed validation attempt (US issued cards only) A CAVV passed validation attempt (US issued cards only) B CAVV passed validation information only, no liability shift C CAVV was not validated attempt D CAVV was not validated authentication 10