Merchant Mumbo Jumbo

Lots of terms you’ve never seen before, eh? No kidding. Here, let us translate for you.

Merchant Account: A way for businesses to accept credit cards. Also known as payment processing or credit card processing. A merchant account is acquired through a merchant account provider.

Payment Gateway: What “connects” your ecommerce shopping cart software to your merchant account. The equivalent of a physical POS (point-of-sale) terminal in retail stores. CKGold integrates with many popular payment gateways, including Virtual Merchant, Authorize.net, and LinkPoint.

Chargeback: The result when a customer disputes a transaction on their statement, the cardholder will issue a chargeback against the merchant’s account. The amount of the disputed transaction is then debited from the merchant’s bank account. Merchants have a set period of time in which they can dispute the chargeback, usually by providing proof of purchase by the cardholder. This could be a signature or proof of delivery. A fee is generally issued by the merchant provider for the handling of this dispute process, whether or not the merchant wins the dispute, the fee still applies.

Discount Rate: The percentage charged by the merchant provider for each transaction. Discount rates will vary depending on the type of credit card (corporate/rewards cards command a higher rate than regular cards, for example).

Look at Your Needs.

Depending on your business needs, your merchant account needs will be different as well. If you anticipate a gross monthly credit card income of $500-600 or less, your needs are vastly different than a business with more than $600 worth of credit card transactions each month. Keep in mind that the options for smaller businesses are usually less binding, meaning when your business outgrows them, it’s easy enough to move up to one of the options more beneficial for a larger volume of credit card transactions.

$500/$600 or Less

For now, you want a merchant account with lower monthly/annual fees, even if it means higher per transaction fees.

PayPal Standard. The best option for businesses just starting out. Not an actual merchant account, per se, but it has no annual or monthly fees and reasonable per transaction fees, plus integrates beautifully with our ecommerce system. The downside is that customers will be redirected to the Paypal website upon checking out, which can deter some people from completing their order. As your business grows, accepting credit cards directly is desirable as it helps to maintain a level of professionalism. Paypal can always remain a secondary payment option on your site as well.

ProPay. A low annual fee, and 3-3.25% transaction fees. Keep in mind these accounts often have transaction limits – meaning if you gross more than a certain amount in a month, you’ll need to upgrade to a higher plan. This solution does not include any sort of payment gateway – meaning you’ll need to manually enter the credit card numbers to charge the orders as they come in.

$600 or More

You, unlike the smaller businesses, will benefit from a merchant account with lower per transaction fees (since you’ll have more of them), though that usually means higher monthly fees. It’ll even out in the end though.

Your Bank. Sometimes this is the simplest solution. Purchasing merchant processing through your bank will ensure you get your money quicker. If your bank’s options are too expensive (as they can often times be), you can get a merchant account elsewhere.

Costco/Elavon. If you are a Costco member, they offer merchant processing through Elavon for some of the most reasonable rates available. If you’re not a Costco member, Elavon is owned by U.S. Bank, and their services can be acquired through them. You will also want to sign up for their payment gateway, known as Virtual Merchant, to allow real-time processing between Elavon and CKGold. This option does have strings – you must make a 2-3 year commitment. Cancel early and you will be charged a hefty fine.

PayPal Pro. If you like PayPal, their Website Payments Pro is a merchant solution that seamlessly integrates into your website. While the payment is technically made through PayPal, the customer will never leave your website, and cannot differentiate between this and a regular merchant account. The downside is it is pricey, the monthly fee alone puts it over even the more expensive merchant accounts. But it works well and can be integrated into CKGold.

Do the Math

Still not convinced? Let’s compare. Take two businesses. Business A is just starting out, and maybe has 10 orders a month averaging about $50 a piece. Business B has built up its business, and now averages about 50 orders per month, around $50 a piece. We’ll compare the annual costs for these two business using two merchant services, ProPay and Elavon, and their respective fees. The final total shows the total amount spent on fees per year, and the percentage of sales that those fees cost you.

According to this table, Propay is going to be the best option for Business A, while Elavon is the most economical choice for Business B (and keep in mind, after the first year this fee amount will go down even more, as the setup fee only applies to the first year).

Hidden Fees

There are lots of fees associated with processing credit cards, and you’ll want to be sure you know up front what you’re being charged for. Don’t be afraid to call a potential merchant provider and ask them to list these, one by one. Fees are unavoidable, but you want to know what you’re in for so it doesn’t surprise you later.

Monthly/annual fees: Expect to be charged a monthly or annual (or both) fee for your new merchant account.

Statement fees: Another fee often charged in addition to the regular monthly fee, for sending you your statement each processing cycle.

Gateway fees: Another monthly fee, if you’re using a payment gateway such as Virtual Merchant or Authorize.net. The gateway itself is a separate service, sometimes with a separate company, and thus commands extra fees. Sometimes a gateway will also charge its own transaction fees in addition to the ones your merchant provider will charge.

Setup fees: Fees to get your account up and running. This is a one time fee, and while it’s included in the cost calculations above, it’ll only be a factor the first year. Keep in mind there are often setup fees for BOTH the merchant account AND the payment gateway.

Transaction fees: For every card you charge, the provider will take a cut of it. It’s usually a flat rate ($0.20 to $0.35), plus a percentage of the total charge. Also called your discount rate. The lower the percentage, the more money you’ll save in the long run. Keep in mind most providers charge different rates based on the type of merchant. With your website, you qualify for the internet rate, usually significantly higher than the retail rate. The discount rate also varies depending on the card type, corporate, international, or rewards cards, for example, take a higher percentage than other cards.

Amex fees: If you decide to accept American Express cards, you’ll have to pay an additional monthly fee and transaction fee for all amex transactions. Typically $5.95 per month, plus a slightly higher discount rate and an additional $.05-$.15 cents per transaction. However, keep in mind that in general, amex customers tend to place larger orders. It’s up to you, not all businesses accept amex, but we find the extra cost to be worth it for those that do.

Application fees: Some merchant providers will charge you a nominal fee just to apply for a merchant account with their company. Supposedly this fee covers the cost of processing the application.

Cancellation fees: If your provider requires you to sign a contract and commit to using their services for a certain period of time, chances are there will be a nasty fee if you cut out early. Be sure you know this up front and are ok with those terms.

Monthly fee minimum: Many providers specify a monthly minimum, or the minimum amount of transaction fees you have to pay each month. Say your minimum was $20. If you had a slow month and only had a few charges, you’d still have to pay $20 even if your fees only totaled $10. Once your business grows, this usually isn’t an issue to meet this every month.

Chargeback/Retrieval fees: Should you ever have a chargeback, not only will you lose the money from that charge, but you’ll also get hit with a penalty fee. Never a good thing, and we always try to do everything we can to avoid these altogether.

Transfer/Daily Batch fees: Yes, sometimes providers even charge you to get your own money. Whether you have to transfer it to your bank account, have your daily batch of charges transferred automatically, or get it in another way, many providers will charge nominal fees every time you do this. It adds up.

Voice Authorization fee: Some providers give you the option to phone in a card transaction (say you’re at a craft fair, for example). You can do this, but you’ll usually get charged another fee. How nice of them.

AVS (Address Verification Service) fee: If you charge card-not-present transactions (meaning you don’t physically swipe the card yourself), you might be charged extra to verify the billing address matches that on the account. Some providers charge extra for this, though other times it is already included in the transaction fee.

PCI Compliance fee: If your merchant provider is holding you to PCI security standards (not applicable to paypal/propay accounts, but very likely with any other merchant account), expect to have to pay to uphold this compliance. You’ll usually need to sign up for a service to scan your website monthly or quarterly for vulnerabilities ($100-$300 per year). If you are found to be PCI non-compliant, your merchant provider will charge a non-compliance fee, usually $20/month, every month, until you are compliant.

3rd Party Processors

Be wary of 3rd party/discount processors. While their services might seem cheap, they make their money by subcontracting out their services to multiple other companies. We’ve had experiences where the company you signed up with was completely different from the company who sent your statements and also completely different from the company that sent your transactions to your bank account. If you had a problem, it was your best guess as to which of the three or four different companies you should call, and often times you’d be bounced from one company to another and back again. Merchant processing is already confusing enough, you don’t need to add another layer to it.

A merchant provider is associated directly with a financial institution in order to provide you funds for your credit card transactions. A 3rd party processor is a company that will contract its services with another merchant provider. Think of them as a ‘reseller’ of the merchant services. Wouldn’t it be easier just to go directly to the source? Elavon, who we use for our merchant processing, is owned by U.S. Bank. We have one phone number we call should we need any assistance. Support is hugely important with something as technically complex as merchant accounts. Just keep in mind that price is only part of the equation.

Credit Card Security and Avoiding Fraudulent Charges

The reason processing credit cards on the internet costs more than doing it in person is the risk. Internet fraud is running rampant, and banks have to charge enough to recover their losses in case of fraudulent charges. Cardholders are protected. If their card is stolen and used to purchase something on your site, guess who foots the bill? You. As an internet merchant, you are responsible for the security of your credit card transactions. And most of what can be done to prevent internet fraud is just a matter of common sense.

Use SSL (Secure Sockets Layer). If you plan to accept anything other than PayPal Standard, you will need an SSL certificate on your site. SSL is an internet protocol that encrypts information sent over the Internet. You should never send any personal information over the Internet unless it is over a secure connection, signified by an https:// domain name and a secure lock icon display. Basically, an SSL certificate prevents hackers from intercepting this information and using it in fraudlent ways.

Use AVS (Address Verification Service). Part of your merchant package, AVS will check the billing address on the order against the billing address on the cardholder’s account. It will return a response code with each transaction, letting you know if the address matches or not. Many merchants will still approve orders with partial or even no AVS match, but that is your call. AVS is not a surefire way to prevent fraud, but it’s all we’ve got. International credit cards are not supported by AVS, so it is up to you whether or not you’d like to accept these at all.

Compare the Shipping and Billing Addresses. It’s not uncommon for someone to have a different billing and shipping address. Maybe they get their credit card statements at home but want their order shipped to their work. It’s also not uncommon for an order to ship to a different person altogether, maybe it’s a birthday gift. However, keep in mind that a non-matching billing and shipping address is one of the first signs of fraud. Especially watch out for shipping addresses in other countries (billing to Utah, shipping to Vietnam? I think not). Bottom line, if it looks suspicious, proceed with caution.

Get a phone number. It’s always a good idea to require a phone number from your customers. If there is a problem with their order, it’s the best way to get in touch with them quickly. And in the case of a fraudlent or suspicious transaction, you can give the customer a call to make sure they did indeed place the order. Check to see if the phone number is even in the same state as the billing/shipping address. If the phone numbers don’t match up, do a whitepages search for the cardholders’ name (as their name and address might be the only accurate information you have).

Watch out for Free Email Addresses: I’m not saying not to accept an order placed with a free email address (ie: @hotmail.com), but if the order already looks suspicious, a free email address is another red flag.

Beware of multiples. Internet scammers don’t usually care what they buy, they just buy it. That order you got for 14 of the same necklace? Unless it’s a wholesale customer, ordering multiples is not normal customer behavior.

Hold off. If you’re unsure about an order, don’t ship it immediately. Credit card charges take a few days to show up on the cardholders’ account. You can give them a bit of time to see the charge, and give you a call if they didn’t authorize the charge (your phone number is listed on all your transactions as it should be, right?)

Don’t store credit card information. Once you’ve shipped an order, you have no reason to keep the credit card number. Especially on your website. CKGold will purge this information for you once you mark an order as shipped.

Use your insctincts. If it sounds fishy, it probably is. Trust your gut, and if an order makes you uncomfortable, look into it more. Call the customer. Or, if nothing else, just cancel it. One lost order isn’t worth the hassle of dealing with a fraudulent charge.

PCI Compliance – Yes it applies to you, too.

PCI Compliance is a set of data security standards created to help merchants avoid credit card fraud. These standards are more and more being imposed on smaller and smaller merchants, so don’t be surprised if your merchant account holds you to them. These standards include business practices and internet security. It’s a complicated process to become PCI Compliant, but in the end it will make for a more secure ecommerce environment. This is something we’ve been through ourselves, and are available to help you along the way. For more information visit https://www.pcisecuritystandards.org/

A Final Word

We know the prospect of all these costs as fees is intimidating. But keep in mind that credit cards are what make the ecommerce world successful. Without credit cards, ecommerce websites would cease to exist. It’s a cost of doing business, and is better than doing no business at all.

If you’re just starting out, PayPal Standard is the best way to begin. As your business grows, you’ll want to give your customers more flexibility in how they pay, and give off an image of professionalism by having the payment & checkout seamlessly integrated into your site. This is when moving up to a merchant account will be beneficial to your business. From personal experience, there are many people who don’t like or don’t trust paypal. When we switched our ecommerce site from just PayPal, to a choice of credit cards or PayPal, business jumped. Now, nearly 95% of our transactions are paid via credit card.

Just something to keep in mind.

Our first suggestion is to take all hosting reviews with a grain of salt. Many of these reviews are paid reviews, not true testimonials from actual customers. So that glowing review you saw of Host X might not actually be the case.

There is no such thing as a perfect host. They are all going to have some problems here and there. The true test of a host is how they handle these problems. How is their support? Do they get back to you quickly? Are they helpful in solving the problem? A host that is quick to respond, and helpful in resolving the problems is a host you want to hang on to.

Ask Yourself: What Do You Need?

The first step in choosing a host is assessing your needs. You need to consider what you’ll be doing with the website before you decide where to host it. A blogsite is going to have different needs than an ecommerce site, for example. When you know what your basic requirements are, you can then begin to explore the hosting possibilities that fit those requirements.

Webhosting lingo:

Bandwidth: The amount of data that can be transferred between your website and the rest of the internet. The larger the bandwidth, the more traffic your site can handle. A host offering 50GB of bandwidth lets you transfer 50 gigabytes of data per month. Things that count against your bandwidth include people visiting your webpages and viewing your images, database queries, files downloaded from your site, and emails sent to and from your web server. If you go over your allotted monthly bandwidth, your host will either disable your site (bad host), or charge you overage fees for the extra transfer (better host). The best hosts will warn you well before you reach your bandwidth limit so you can assess your needs and upgrade your hosting plan if necessary.

Disk Space: The amount of ‘stuff’ actually stored on your web server. This includes all your websites files, pages, and images. If you plan on having a very image-heavy blog, for example, you are going to need more disk space than someone who won’t have nearly as many images.

Server: The physical box that holds your site’s information. Yes, it’s an actual box somewhere (think a giant external hard drive) that stores your site’s files and facilitates the delivery of your website to the world. Technically, any computer connected to the internet can be a server. By purchasing web hosting, you are essentially renting “space” on this server to store your website’s files.

Domain Name/URL: The name of the website that is entered into the browser to access a website (for example, www.purrdesign.com). A lot like your car’s license plate, you must register your domain name and pay an annual fee to keep it registered in your name and continue to use it.

IP Address: The numerical version of a website address/domain name, a unique identifier akin to a telephone number for a computer or device. The IP address is used by machines to refer to each other when sending information through the Internet, it describes the source and the destination of such information. IP addresses, in order to be more human-friendly, are converted to easy-to-remember domain names. Instead of having to remember an insainly complicated number to visit a website, we can simply enter the domain name instead. You IP address will be given to you by your host. Depending on your chosen plan and needs, your IP will either be dedicated (it’s yours and only yours), or shared (other sites on the same server share the same IP address). If you require the use of an SSL certificate, you must have a dedicated IP address.

Database/MySQL Database: Think of a database as a powerful Excel file stored on your webserver, made up of a series of tables and cells that contain related information. If your site is built on a database-driven system (both wordpress and ckgold are mysql-based), a database stores all the content associated with your site, from your blog posts to your product information.

FTP: File Transfer Protocol is a way to exchange files over the internet. When you sign up for hosting, you’ll be given FTP access to your webserver. Through FTP, you’ll be able to upload and download images and files to and from your website. You will need an FTP client to do so. Our favorite is Fetch (MacOSX/$25), but you can find plenty of free clients as well (try CyberDuck for MacOSX, or SmartFTP for Windows).

SSL: Secure Sockets Layer. An SSL Certificate is what lets you shop online without having to worry about someone stealing your credit card information. SSL is a protocol designed to enable applications to transmit information back and forth securely. It’s what makes a website show the little lock icon to indicate that your personal data is safe.

Shared Hosting: Think of a hosting company as a city. Each building in the city is a server that stores website files. Shared hosting is like an apartment building, where you have a bit of space within a larger space. In other words, you share the server with many other people. For most sites, this is the best option, as it is affordable and the landlord takes care of much of the maintenance for you. If your site takes off and you are getting hundreds of thousands of visitors (we can hope, right?) you may outgrow your shared hosting account and need to upgrade to a ‘single family home’ where you have a server all to yourself (vps/dedicated hosting).

Unix/Linux vs. Windows

Many hosts offer two different hosting ‘platforms’ for you to choose from. Unix/Linux and Windows. Do not confuse Windows hosting with the Windows operating system – they are not the same thing. A website hosted on a Unix/Linux plan will work perfectly fine on any PC, and a website hosted on a Windows plan will work just fine when viewed on a Mac.

Unless you require any type of ASP/.NET based software, you’re much better off going with a Unix/Linux hosting plan. Unix/Linux hosting tends to be more secure, more affordable, and more reliable overall. Everything we do, including our ecommerce, content management, and blogging systems, require Unix/Linux hosting.

Some things to look for:

24/7 Support: If your site goes down in the middle of the night, you want to be sure you can get in touch with someone, stat! Many hosts may not offer 24/7 phone support, but as long as they’re accessible via email that’s typically a good solution. A good host will respond promptly to all support requests, no matter how small. Don’t be afraid to get in touch with the support before purchasing your hosting and see how prompt they are to respond.

Control Panel: Your control panel is where you manage every aspect of your site, from email to SSL certificates, to visitor statistics. You want to be sure it’s a good one. Look for HSphere or Cpanel control panels. Even better, if they offer a demo of their control panel check it out for yourself. Make sure you’ll be able to do what you need to easily and without much hassle.

Money Back Guarantee: Yes, it’s a sales pitch, but hosts that offer a money back guarantee (for 30-days or otherwise) will ensure your money can be recovered should the host not work out. It happens. The host might look good up front, but once we start poking around and setting things up for your brand new site, there may be a feature they don’t support and are unable to fix. Having a backup escape plan is always a good idea.

SSL Support: If you want to sell anything through your website, and accept any method of payment other than PayPal Standard (in other words, credit cards) you will need an SSL certificate to be able to securely accept this information. And you want to make sure your host will support that. Will they support 3rd party SSL certificates or do you have to purchase your certificate through them? Ask about additional costs, such as fees for a unique IP addresses. Can you install an SSL certificate yourself, or do they need to install it for you (and how much will they charge to do so). All things to keep in mind before you make any commitments.

Add-on/Additional Domains: Many hosts will let you host multiple domain names on the same account. This is always a good feature if you ever see yourself having multiple websites (a personal blog, maybe? or a second business website?) Being able to host multiple sites on one hosting account will save you money, as you won’t have to pay anything more than the domain registration to host another website.

Hosting is Always Limited.

There is no such thing as unlimited space. Be wary of hosts offering this. Also be very wary of hosting reviews sites. Every host will have a few unhappy customers, and chances are those are the people who will be the most vocal. Many reviews sites are also padded with paid/biased reviews, so that glowing review might actually be from an employee of the hosting company, for example. Unless you want to make your head spin, I’d avoid hosting reviews sites altogether.

Registering Your Domain Name

The big question here is should you register your domain with your host or someone else? Without hesitation I will tell you never to register your domain name and host your website at the same place. The reason for this is you want a quick escape route. If (god forbid) your host fails big time, your site is down, and you need to get out quick to avoid losing valuable business, you can. Changing hosts is as easy as moving data from one server to the other, and then ‘pointing’ your domain name to the new host. This ‘pointing’ of the domain, also known as changing your nameservers, is done through the domain registrar. If your registrar is a different company than the host that dropped the ball, it’s no problem. Your site will be back up within a matter of hours. However, if you had your domain registered with the same shoddy hosting company that crashed your site, you’d need to transfer the domain elsewhere as well, a process that can take 3-5 days or longer. I don’t think I need to tell you why having your site down for a few hours is better than close to a week.

I wholeheartedly recommend using GoDaddy to register your domain. Register it there and keep it there for all eternity. They are cheap and efficient. Granted, they will try to sell you the kitchen sink in the process, so hold on to your wallet and don’t let them convince you to purchase any of their add-ons… things like private and ‘enhanced’ registration are unnecessary.

Purr Recommends…

This* – One of our personal favorites. Great support and very reasonable prices make This* webhost a great choice for your blog or ecommerce website.

Fluid Hosting – We’ve hosted our sites with FluidHosting for 5 years. Their support is top notch and they don’t oversell their server space.

GoDaddy – Register your domain here, and that is all. Godaddy is first and foremost a domain registrar, and that should be all they should be used for (with the one exception being affordable SSL certificates). While we recommend GoDaddy for domain registrations and SSL certificates, we avoid their hosting at all costs. Their hosting is not up to par with the aforementioned hosting companies, and is NOT compatible with many of our systems, and for this reason we are unable to work with GoDaddy’s hosting at this time.