May 2024 Summaries

Dynamic payment routing helps merchants improve transaction approval rates, reduce processing costs, and protect against payment service provider outages by directing transactions among multiple PSPs rather than relying on a single provider. Routing decisions can consider provider availability, customer location, transaction currency, payment method, transaction size, historical close rates, and risk profile, allowing merchants to select the provider most likely to process a payment efficiently and successfully. These factors can be combined in sequential or more complex decision trees that prioritize conditions such as local processing, high approval likelihood, and low fees, though greater sophistication also increases maintenance requirements. As payment volumes grow, merchants may need flexible access to customer payment data and a secure, programmable payment vault to avoid dependence on an initial PSP and enable transactions to be sent to alternative providers without expanding PCI-DSS scope.

Merchants may add a second payment processor to reduce reliance on a single provider, improve payment approval rates, support international expansion, offer localized payment options, and route transactions toward lower-cost providers. A single payment service provider can simplify initial setup but may create risks from outages, high fees, limited negotiating leverage, and sudden account restrictions tied to chargebacks or provider policies. Operating multiple processors introduces added technical maintenance, more complex fee forecasting, and potential PCI-DSS compliance obligations when merchants control customer payment data. Programmable payment vaults are presented as a way to tokenize and secure card data, connect with multiple providers, and reduce the need for merchants to store sensitive information directly. Although a multiprocessor approach requires careful implementation and ongoing management, it can offer growing businesses greater flexibility, resilience, and potential cost savings.

Basis Theory’s April platform updates introduced an automated Account Updater service that lets organizations submit near-expired payment tokens on flexible schedules and receive webhook notifications when cards require processor-token updates. The company also expanded its testing environment with debugging tools and production-like capabilities intended to keep development and production separate, alongside support for proof-of-concept development and implementation assistance. Integration developments include Shopify Payments card-payload decryption and tokenization, compatibility with Braintree’s Forward API for sending vault data to third parties, and guidance for using Stripe’s newly released Forward API to back up Stripe tokens in an external vault. Additional changes include improved PCI 4.0 SAQ report generation, multiple API key management for key rotation, more accurate BIN details, Shopify card-processing connections, and an Android keyboard fix, while API key regeneration was scheduled for deprecation on July 17, 2024 and new rate limits remained undated.

Multi-processor payment routing allows merchants to direct transactions among several payment service providers based on factors such as approval likelihood, processing costs, regional payment preferences, security capabilities, and the ability to retry soft declines. While this approach can improve flexibility and reduce dependence on a single provider, it also creates challenges around managing stored cardholder information, which is vulnerable to fraud, data breaches, and compliance burdens under PCI-DSS when retained within a merchant’s systems. The discussion highlights that merchants can add fraud screening, transaction monitoring, address verification, and card-updater services through multiple providers, but need access to payment credentials to do so. It presents programmable third-party payment vaults that replace card data with tokens as an alternative to local storage, potentially limiting a merchant’s PCI-DSS exposure while supporting more sophisticated routing and security decisions.

Merchants choosing payment infrastructure must weigh the simplicity of a full-service payment service provider (PSP) against the flexibility and resilience of multi-processor routing. Full-service PSPs enable rapid onboarding, predictable pricing, broad payment-method support, tokenization, currency conversion, and reduced compliance responsibilities, but they may carry higher underlying costs, impose restrictive risk policies, create dependence on one provider, and limit access to stored customer payment data when switching providers. Using multiple PSPs can reduce single-point-of-failure risk, improve authorization rates, lower fees through intelligent routing, and match transactions to processors’ differing strengths, but it requires more technical implementation, coordination, and potentially greater PCI DSS compliance responsibility. Merchants should evaluate providers based on their compatibility with the business’s merchant category code, supported payment methods, fraud tools, global reach, reporting, support quality, integration capabilities, pricing, and fit within the overall payments stack.

3D Secure (3DS) adds an authentication step to card-not-present payments to reduce fraud, but its original implementation often disrupted checkout flows through unfamiliar redirects, password requirements, and registration prompts that contributed to transaction abandonment. Because user experience strongly affects conversion, merchants must balance fraud prevention with simple, intuitive payment journeys. The newer 3DS 2.0 standard aims to reduce friction through biometric authentication, risk-based challenges determined by issuers, and mobile-native interfaces that avoid disruptive browser windows. The discussion recommends that merchants assess whether payment service providers support 3DS 2.0 effectively and avoid dependence on a single provider, while using flexible payment infrastructure and tokenized card-data vaults to protect payment information, limit PCI-DSS exposure, and retain the ability to change payment partners.

One-click checkout enables customers to complete purchases with a single action using stored payment and delivery information, reducing friction compared with conventional cart and checkout processes. Popularized by Amazon, which held a U.S. patent on the approach from 1999 to 2017, it can lower cart abandonment, improve mobile conversion rates, and encourage repeat purchases through greater convenience. Payment service providers, e-commerce platforms, and digital wallets strongly promote the feature because shared stored-payment systems can increase customer retention and strengthen their relationships with merchants. However, merchant reliance on these providers may create lock-in, restrict access to cardholder data, limit payment-routing choices, and result in less control over transaction approval rates and processing costs. The proposed alternative is for merchants to manage customer payment data through secure token vaults, allowing them to offer one-click purchasing while selecting the most suitable payment provider for each transaction.