Update to definitions of secure and non-secure transactions

What is Changing? 

In 2016 Elavon introduced new definitions for different types of transaction processing – “secure” and “non-secure”.  The Merchant Service Charge (MSC) is higher for non-secure transactions.

The Schedule of Fees from 2016 stated that secure transactions are:

“Chip & Pin (EMV), contactless, V.me transactions, Verified by Visa, MasterCard SecureCode, and transactions submitted to Elavon within 3 days.”

This definition of secure has now been updated as below and applies from 1 January 2019;

Secure Transactions are transactions designated by Elavon (by reference to the operation of the Card Schemes) to be secure, which includes most Chip & Pin (EMV), contactless and V.me transactions, as well as most transactions using Verified By Visa, MasterCard SecureCode, and those submitted to Elavon within 3 days.

Non-Secure Transactions are any transactions that are not processed as Secure Transactions.

What does Secure and Non Secure mean? 

Secure and non-secure refers to the type of transactions and technology that is used during the authorisation of a card.

Each time a transaction is processed the following elements will be considered:

Entry Type + Region of Issuance + Card Type + Transaction Type.

All four elements must be deemed “secure” by the Card schemes (e.g. Visa or MasterCard, depending on particular card type) in order for the transaction to be processed at the lower secure rate. 

How are fee costs determined?

In general, card schemes split transactions by regions (e.g. within the EEA or inter-regional – US issued card in EEA business), card types (e.g. Visa debit, MasterCard commercial) and transaction types (Chip and Pin, Ecommerce etc.).  Elavon in turn process these transactions as secure or non-secure, any transactions processed as non-secure will incur the higher processing fee.  All transactions must also be sent for processing within the prescribed timelines (3 days) to ensure secure qualification is considered*.

*a transaction not submitted for processing/not batched via end of day process within prescribed timelines will automatically qualify at the non-secure rate, irrespectively. 

How transactions are processed and charged are clearly outlined on the Merchant Billing Statement, in the Card Fees section, each transaction type can be identified under the description, see below, Visa Consumer Debit Non Secure transaction –and the Merchant Service Charge (MSC) will appear under the Discount Rate section. 

Why are “secure” transactions at Point of Sale sometimes charged as “non-secure”? 

Generally the following transaction types will be classified, processed and charged as secure once the issuing region, card type & transaction type are all considered to be secure by Card Schemes.

• Contactless
• Chip & Pin (EMV)
• Verified by Visa
• MasterCard Secure Code
• V.me

However, if the card type, transaction type and/or the region in which the card was issued are deemed to be non-secure, or does not have a secure/non-secure distinction, the overall charging/processing fee of the transaction may default to non-secure irrespective of how the transaction was taken at the Point of Sale. 

Examples of transactions that are treated as non-secure include: 

Any combination of the below;

• Non EEA Issued Card which may be considered by schemes as non-secure – see clarification below: 

EEA country list: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Republic of Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, The Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, United Kingdom.

Non-EEA: Any country not in the EEA country list above.   

• Certain Card Types including (non-exhaustive) :

Commercial Cards: Visa Business, Corporate or Purchasing.

Visa Premium and Super Premium: Infinite, Infinite Privilege, Platinum, Rewards, Select, Signature, Ultra High Net Worth.

• Contactless Transactions over the contactless limit where cardholder verification is not supplied:

For low-value contactless payments below the “Contactless CVM Limit” no CVM is required — the customer can simply tap & go. Note that the Contactless CVM (Cardholder Verification Method) limit varies from country to country.

Cardholder verification is required for contactless card transactions above the CVM Limit (e.g. by online PIN using the merchant PIN pad or signature) or when the issuer of a card enforces the cardholder verification, even if the transaction amount is below the CVM limit.

Contactless transactions above the CVM limit that have no cardholder verification are non-secure transactions.

Schedule of Fees 

Below is an example of the Schedule of Fees as it will appear following the updates.