Credentials-On-File(Cards API)

Credentials-On-File, also known as Card-On-File or simply COF payments, include subsequent merchant-initiated (MIT) billing payment plans, such as subscriptions and membership fees, installments, or customer-initiated transactions (CIT) that are using an already saved payment information for the processing. The Credentials-On-File are often referred to as recurring payments.

In all instances where Credentials-On-File payments are set up, the cardholder must have given their explicit consent for the payment information storing and repeated rebilling.

Credentials-On-File payments are supported via the Paysafe Customer Vault API and Card Payments API. Merchants can use the Customer Vault API to create a customer profile and link a card or payment method to the profile. The Paysafe platform returns a payment token that can then be included in subsequent payment authorization and settlement requests, without requiring the merchant to collect card details again from the cardholder.

Paysafe supports the following Credentials-On-File payments:

If your business model is based on rebilling your customers on their behalf (without them being present at checkout) with transactions that are going to occur on fixed, regular intervals with predefined amount (Example: $15 rebilled on the first day of the month), you need to use the Merchant-Initiated Credentials-On-File (MIT COF) flow with type RECURRING in the storedCredential object of the authorization request and authentication purpose RECURRING_TRANSACTION in the authentication request.

If your business model is based on rebilling your customers on their behalf (without them being present at checkout) with transactions that are going to occur on an unknown date with variable amount, you need to use the Merchant-Initiated Unscheduled Credentials-On-File (MIT UCOF) flow with type TOPUP in the storedCredential object of the authorization request and authentication purpose PAYMENT_TRANSACTION in the authentication request.

If your business model is based on processing transactions from returning customers where the customer is initiating the payment via stored payment information, you need to use the Cardholder-Initiated Credentials-On-File (CIT COF) flow with type ADHOC in the storedCredential object of the authorization request and authentication purpose PAYMENT_TRANSACTION in the authentication request. 

If your business model is based on processing multiple subsequent transactions that are related to the single purchase of goods or services, you need to use the Installment Credentials-On-File payments flow.

An Initial Transaction ID is sent to you when you set up a recurring payment plan with a cardholder with their first successful payment. This is the ID you need to provide for all subsequent Merchant-Initiated Transaction (MIT) payments associated with this payment plan. Please note that different payment plans associated with an existing cardholder will have different Initial Transaction IDs.
In the Paysafe processing environment, the Initial Transaction ID is a Paysafe Transaction ID. The added security of an Initial Transaction ID provides a better customer and merchant experience, leads to increased transaction approval rate and revenue retention.

Under PCI DSS requirements, the Card Verification Value (CVV/CVV2/CVD) cannot be stored on merchant or payment service provider premises. Depending on the type of transaction, you may need to obtain this value from the customer and include it in your authorization request. For example:

• Regular/Cardholder-Initiated Credentials-On-File payment (e.g., customer returning to your website for an additional purchase) - You should obtain the CVV from the customer and include it together with the card details or the token obtained from the Customer Vault.
• Transaction flagged as subsequent recurring payment – Regular or subscription payments can be flagged by including the storedCredential object and setting it to RECURRING or TOPUP type in your authorization request. If you set the occurrence value to INITIAL you may need to obtain the customer's CVV before processing the request. If the occurrence is SUBSEQUENT then you do not need to provide the CVV.

While providing the CVV value with the initial request to establish a payment plan may not always be necessary, including it can enhance the likelihood of the transaction being approved, especially if the business vertical is considered a high-risk one.

• If your customers are based in UK or EEA - regulations require that the customer-initiated transaction that establishes a payment plan must have successfully passed a 3D secure authentication.

• If your customers are based in USA or Canada - Although strong customer authentication is not mandatory in USA and Canada, as it is in EU/UK, it's usage can improve the authorization rate of the subsequent merchant-initiated payments.

While it may not necessarily be always required, performing address verification service (AVS) with a positive outcome on the customer-initiated transaction that establishes the payment plan has proven to be beneficial for the acceptance rate of the both customer-initiated transaction and the subsequent merchant-initiated rebilling transactions.

Clear communication with the cardholder is a key to decreasing checkout abandonment and reducing chargeback. The following steps must be performed in order to achieve customer satisfaction and maintain compliance:

• Obtain written confirmation for storing the payment credentials from the cardholder.

• Provide the cardholder with clear payment plan information:

  • rebilling prices and dates;

  • amount or rebilling frequency variation

  • processing currency, agreement expiration date (if applicable)

  • length of the trial period or any additional promotion offers, and notify the cardholder at least 7 days prior to their expiration

• Provide the cardholder with payment plan establishment confirmation immediately after confirmation.

• Provide receipts to the cardholder (if applicable).

• Provide the cardholder with simple cancellation procedure (email, SMS/text message) and subscription management options.

• Notify the cardholder before each subsequent rebilling payment. At a minimum, provide a notification when the rebilling occurs at intervals of six months or longer.

• Retain all applicable payment plan information and be prepared to present it to the cardholder, PSP, card scheme or card issuing institution if requested.