Moto Payments: Merchant Codes Explained

Navigating the world of online and remote payments can sometimes feel like deciphering a secret code. One common point of confusion for businesses looking to accept payments over the phone or by post, often referred to as Mail Order / Telephone Order (MOTO) payments, is the requirement for a specific merchant code. This article aims to demystify the process, particularly within the context of using platforms like GOV.UK Pay, and clarify whether a separate merchant code is indeed necessary for these types of transactions.

What are MOTO Payments?

MOTO payments represent transactions initiated by a customer who is not physically present at the point of sale. Instead, the customer communicates their payment details via telephone, mail, or fax. In the digital age, this often extends to phone-based orders placed through a website or app. These transactions typically do not require the customer to enter their billing address during the payment process, and crucially, they are exempt from the 3D Secure authentication protocol that is standard for online card-not-present transactions.

Taking MOTO Payments with GOV.UK Pay

GOV.UK Pay offers a streamlined solution for organisations to accept payments, including MOTO transactions. To begin accepting MOTO payments through GOV.UK Pay, you must first enable this functionality within your GOV.UK Pay account. This is a crucial first step before you can process any payments received over the phone or by post.

Enabling MOTO Payments: A Step-by-Step Guide

The process for enabling MOTO payments varies slightly depending on whether you are using a test or a live GOV.UK Pay account, and your chosen Payment Service Provider (PSP).

For Test Accounts:

To enable MOTO payments on your GOV.UK Pay test account, you need to reach out to the GOV.UK Pay support team. Simply send an email to [email protected] and request that MOTO payments be activated on your test environment. At this initial stage, you won't need to provide any supporting documentation.

For Live Accounts:

Enabling MOTO payments on a live account requires a more involved process, especially concerning your PSP. The exact steps will differ depending on whether your PSP is Stripe or Worldpay.

General Requirement for Live Accounts:

Regardless of your PSP, a fundamental requirement for processing MOTO payments is to ensure compliance with the Payment Card Industry Data Security Standards (PCI DSS). It is imperative to adhere to the most recent version of these standards to maintain the security of cardholder data.

For Worldpay Users:

A critical point to note for Worldpay users is the necessity of having separate services set up for MOTO and non-MOTO (online) payments. This separation is often linked to the requirement for distinct merchant codes.

To enable MOTO payments with Worldpay, you will need to:

1. Email GOV.UK Pay Support: Contact [email protected] to confirm your PCI DSS compliance. Clearly state your intention to take MOTO payments on your account.
2. Receive Confirmation: The GOV.UK Pay team will then email you to confirm that MOTO payments have been successfully enabled on your account.
3. Create a Separate MOTO Service: Within the GOV.UK Pay admin tool, you must create a new service specifically for MOTO payments. This service should be distinct from your existing online payments service. Navigate to 'Add a new service' to initiate this.
4. Obtain a MOTO Merchant Code: This is where the merchant code question is directly addressed. You are required to process MOTO payments using a separate MOTO merchant code from the one you use for your online (non-MOTO) payments. If you do not already possess a merchant code designated for MOTO transactions, you must request one by contacting Government Banking. This specific merchant code will be essential when you connect your newly created MOTO service to your PSP (Worldpay in this instance).

For Stripe Users:

While the information provided doesn't detail specific steps for Stripe users regarding merchant codes, the overarching principle of enabling MOTO payments and ensuring PCI DSS compliance remains the same. It is advisable to consult with GOV.UK Pay support and your PSP (Stripe) for any specific configurations or requirements.

Do I Need a Merchant Code for MOTO Payments?

Based on the information provided, particularly for users connecting through GOV.UK Pay and especially those using Worldpay as their PSP, the answer is yes, you generally need a separate merchant code for MOTO payments if you are processing them through a distinct service. This is a key aspect of ensuring proper transaction routing, reporting, and compliance, particularly in the context of how different PSPs manage transaction types.

A merchant code, also known as a merchant ID or MID, is a unique identifier assigned to a business by its acquiring bank or payment processor. It helps in identifying the merchant account involved in a transaction. For MOTO payments, having a separate code can be crucial for several reasons:

• Transaction Categorisation: It allows for clearer categorisation of transactions, distinguishing between online card-present and remote transactions.
• Risk Management: MOTO transactions can sometimes carry a different risk profile compared to online transactions, and a separate merchant code can aid in implementing tailored risk management strategies.
• Reporting: Financial reporting and reconciliation become more straightforward when different transaction types are clearly delineated by their respective merchant codes.
• PSP Requirements: As highlighted with Worldpay, some PSPs mandate separate merchant codes for different payment methods or channels to ensure accurate processing and compliance.

PCI DSS Compliance: A Non-Negotiable

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. For MOTO payments, where card details are handled manually or over the phone, robust security measures are paramount. This includes:

• Secure Handling of Card Data: Implementing strict protocols for how card numbers, expiry dates, and CVVs are captured, stored (if necessary), and transmitted.
• Access Controls: Ensuring that only authorised personnel have access to sensitive cardholder data.
• Network Security: Maintaining secure network infrastructure to prevent unauthorised access.
• Regular Security Testing: Conducting regular vulnerability scans and penetration tests.

Failure to comply with PCI DSS can result in hefty fines, reputational damage, and loss of customer trust.

Table: Key Differences in MOTO vs. Online Payments

Frequently Asked Questions (FAQs)

Q1: Can I use my existing online payment merchant code for MOTO payments?

Generally, no. If your PSP, like Worldpay, requires separate services for MOTO and online payments, you will likely need a distinct merchant code for your MOTO transactions to ensure correct processing and reporting.

Q2: What is the primary benefit of having a separate merchant code for MOTO?

A separate merchant code helps in accurately categorising transactions, managing risk profiles specific to remote transactions, and simplifies financial reporting and reconciliation.

Q3: Is 3D Secure required for MOTO payments?

No, 3D Secure authentication does not apply to MOTO payments.

Q4: How do I contact Government Banking to request a merchant code?

The provided text does not specify the contact details for Government Banking. You would typically find this information through official government channels or by inquiring with GOV.UK Pay support.

Q5: What happens if I don't comply with PCI DSS for MOTO payments?

Non-compliance can lead to significant financial penalties, damage to your organisation's reputation, and potential revocation of your ability to process card payments.

Conclusion

In summary, while the specifics can depend on your PSP, using GOV.UK Pay for MOTO transactions often necessitates the setup of a separate service and, consequently, a separate MOTO merchant code. This is a crucial step for ensuring compliance, facilitating accurate transaction processing, and maintaining robust security standards, particularly PCI DSS. By understanding these requirements and taking the necessary steps to enable MOTO payments correctly, businesses can confidently accept payments from customers no matter how they choose to pay.