Payment systems

Just came across this great article by Daniel Tenner on How to get a Merchant Account.

Considering how many businesses there are out there, one would think this process might be smooth and painless by now. Just apply for a merchant account, sign on the dotted line, and receive your merchant id in the mail a couple of weeks later. Unfortunately, this is not the case. Obtaining a merchant account can be a long and complex process, particularly if you’re a new, small business that’s going through this process for the first time.

Go read his article now if you think you ever need a merchant account. He describes the process very accurately. I thought I’d add my 5 cents to this as well, with a few other things you need to worry about before picking a processor.

Originally the Merchant Account and Credit Card processor were separate companies. They still are, but most processors now hide this fact by offering a bundled merchant account through a partner bank of theirs. You may end up not even knowing what bank that is.

At Agree2 we opened our account last year with Braintree who have been very responsive. The paperwork did take a lot longer than we thought and involved a few changes to our site. They also did want to see a prototype of our credit card payment page as well.

Don’t use a proprietary api

If you use ruby be sure to use ActiveMerchant. It provides a really well designed API for dealing with most kinds of payment processors. I’m sure there are similar libraries for other languages.

The reason why this is important is that it helps protect you against lock in to the processor. If for some reason you can’t open an account with your preferred provider or they close you down, you don’t have to rewrite your code from scratch. These things happen to good companies.

So start your search for a credit card processor from the list of supported gateways on the ActiveMerchant page.

Use a Vault

I would say that if you are building a SAAS kind of business with recurring payments, you absolutely need a processor that supports some sort of vault. A vault is a secure store of credit cards numbers on the credit card operator’s own servers. Several of them do that now. Braintree for one.

Due to new security requirements from the credit card associations (Visa and M/C) it really is not feasible for small operators to store the card details locally anymore. So if you are developing your application with credit cards stored in your database, be aware you will need to change this.

Also never, ever store the CVV anywhere. It is completely against credit card association rules.

Briefly the way the vault works is that when a user gives you their credit card details you store it in the vault, even if you don’t need to charge it straight away. In return they provide you with a vault id. This you DO store in your database and you provide it to them every time you charge it in the future.

Updated Fixed some language issues and explained the Vault further. Thanks to Travis for his feedback.

I am glad to hear that Douglas Jackson and associates manage to avoid jail and get probation, community service and a fine instead.

I still think it’s extremely unfair that a service as innovative as e-gold were punished like this. Apparently so does the US District Judge Rosemary Collyer:

According to cnet:

U.S. District Judge Rosemary Collyer said the men deserved lenient sentences because they did not intend to engage in illegal activity. Even though, Collyer said, the U.S. Justice Department wanted to use the cases to show “this new day of Internet crime is going to be…vigorously prosecuted,” that alone was not enough reason to incarcerate the defendants.

While the courts don’t always do the right thing in this country, I am glad to see that they still serve their function as a safety valve against over zealous government.

Look at the situation the financial system is in right now. It is based on ancient technology and an ancient operating system. The government is throwing trillions of dollars against an unsound system and sending the Patriot Act against innovators.

E-Gold were one of the players, who truly attempted innovation in the financial space. Douglas Jackson’s genius and insight in his quest for sound money is seen in that even after all of this has happened to them, they core value of e-gold still hasn’t changed much.

For more read this article I wrote earlier e-gold innovated and were finally brought down. Also read the DGC Magazine interview with Douglass Jackson here.

update Several people have mistakenly thought my slightly tongue in cheek title to mean that I’m one of the part of the fringe paranoia groups here. While the USDOJ did bring down e-gold. The term “The Man” as well as the use of references to Black Helicopters were an attempt to caricaturize those paranoia groups. Now where did I put my tin foil hat.

e-gold is an 100% gold backed electronic currency. It revolutionized the electronic currency world using pretty simple double entry book keeping technology backed by currently 2.54 metric tons of gold and innovative legal structures to keep it safe. They are in the news today and there are lots of things startups can learn from their story about trust, innovation, legal structures, transparency and how not to deal with regulators.

It is with sadness I today read Douglas Jackson’s blog post outlining the final blow to e-gold by the US government. It felt like this wasn’t written by Doug, but by Doug with the NSA’s secret alien mind control device implanted. In reality the mind control device used was the threat of 20 years of jail and a half million dollar fine.

Also as I write in the Agree2 User Agreement:

We are men of principles, but stronger men than us have changed principles with 3 hovering black helicopters over them. If you know what I mean.

This is a case where probably a bit more than 3 hovering black helicopters were hovering over them. So I guess we can only feel sad and hope the best for Doug and his family.

It appears that the new Google Checkout only support US merchants. How did I find this out? I signed in with my Danish AdWords account and they helpfully filled the sign up form in with my address and AdWords account details, only they changed my country to the US and won’t let me change it.

Now it doesn’t really suprise me. US payment processors are really scared of foreigners, so Google Checkout aren’t really that much different from most other vendors. However there is at the time of writing ZERO information on their site mentioning this tiny but relevant fact. It brings me back to the early days of the web, when 80% of all web forms would require a valid state, zip and US phone number for signing up for their free web services. This because no one tested non US services.

Actually come to think of it when I tried to buy TurboTax earlier this year to do my US tax return, they wouldn’t sell the downloadable version to me with out a US address.

The other funny thing is that Google already have the infrastructure via their AdSense program to handle international merchants. I guess I should be patient. It is the first release.

Due to a recent influx in interest from people I have brought NeuClear.org Wiki and the client NeuClear Signer back from the dead.

NeuClear.org was/is my open source project for creating payment and trading systems. My current ideas is to eventually rewrite it in Ruby on Rails as it would allow some more creative uses of it.

Feel free to add questions within the wiki and if anyone is interested in continuing the work let me know.