Payment options grow, as do security requirements

Guide to E-Commerce Technology

Online retailers already were moving to accept a broader variety of payment methods even before Google introduced its Google Checkout payments service last year. But the entry of the search engine giant has accelerated the trend, and prompted competitors to become more aggressive in pushing their alternate payment schemes.

And alternate payments are just one of the stories in online payments. Security remains a big issue, with online retailers facing increasingly tough data security requirements—and penalties for leaving consumer data unguarded. Plus, the question of applying sales tax to Internet purchases is not going away, adding another complexity to online payments.

The emergence of new ways to pay online beyond credit cards has already made payments more complex for online merchants. Online retailers on average accepted 3.5 payment methods last fall, up from 2.1 a year earlier, according to a survey of 351 U.S. online merchants by payments processor CyberSource Corp. And larger merchants, those with online sales of at least $25 million a year, offered customers 4.7 ways to pay on average, up from 2.6 in the 2005 survey.

Offering more ways to pay seems to boost sales, CyberSource found. The survey indicated that sales went up by an average of 14% when retailers offered three or more payment options.

Competition heats up

Acceptance of credit and debit cards actually slipped slightly in 2006, CyberSource found, from 97% of merchants in 2005 to 94% last year, but those familiar pieces of plastic remained by far the most common payment method offered. Next came PayPal at 34%, up from 23% the prior year, followed by gift cards and certificates at 26% and electronic checks or ACH payments directly from bank accounts at 24%.

Coming on strong was Bill Me Later, a service from I4 Commerce Inc., which allows retailers to offer instant credit to consumers. That method was accepted by 17% of retailers surveyed last fall, up from 9% a year earlier. Although Google Checkout had just been announced a few months earlier, it was already accepted by 6% of merchants as the holiday season was getting under way.

Google caught consumers’ attention last fall by offering coupons worth nearly $60 million for those who paid with Google Checkout. That helped boost Google Checkout’s share of purchases at participating merchants’ web sites to 19% in December, according to Matthew Pace, senior associate at Compete Inc., which monitors traffic to web sites. Among the online retailers accepting Google Checkout were Toys “R” Us, Sports Authority and Linens ‘n Things.

Google Checkout accounted for about 1 million purchases in December, fueled by those handy coupons, Pace says. But, with the coupon offer over, Google Checkout dropped to 250,000 transactions, or about 8% of purchases at those web sites in March, Pace says.

Still, the message had gotten through, not just to merchants and consumers, but also to Google’s rivals. After Google announced its coupon giveaway, PayPal responded by offering consumers up to $100 million if they pay with PayPal Express Checkout, which PayPal had introduced in 2005.

The Google and PayPal checkout services both allow consumers to register their payment card numbers and personal information, then pay by just entering a password at the sites of retailers that accept those payment services. With the PayPal service, consumers also have the option of registering their PayPal account information, debiting purchases directly from a bank account. Yahoo, Google’s chief rival, has developed increasingly close ties to PayPal and its corporate parent, eBay Inc., and promoted PayPal Express Checkout to merchants that use the Yahoo Stores e-commerce platform.

A growing number of larger online merchants are offering Google Checkout, according to a survey in June of the 200 largest Internet merchants by analyst Jim Friedland of investment firm Cowen and Company. He found 26 of those merchants were offering Google Checkout, up from 15 in January, just five months earlier. The similar PayPal Express Checkout was offered by 21 e-retailers in June, also up from 15 in January.

Google has continued to push Google Checkout to merchants, waiving processing fees entirely for this year and promising that in the future any transaction fees can be applied to the cost of buying advertising search terms through Google’s AdWords service.

Those cost savings are attractive, but the main reason larger merchants are adopting alternative payment methods is to attract new customers and higher-margin sales, says Allen Weinberg of the payments consulting firm Glenbrook Partners. “The cost factor is really secondary to the revenue lift factor,” Weinberg says.

Another form of credit

He says that also accounts for the attractiveness of the Bill Me Later service from I4 Commerce, which encourages consumers to make more expensive purchases when they know they can defer payment for a period of time without interest charges.

More than 500 online retailers now offer Bill Me Later, and 2.5 million consumers have chosen that payment option, says Vince Talbert, vice president of marketing at I4 Commerce. The company does not report the number of transactions, but Talbert says it has more than doubled each year for the past three years.

Talbert says the typical consumer who uses Bill Me Later is a woman between the ages of 30 and 50, who makes many of the purchasing decisions for her family. She may not have her purse handy when she wants to make a purchase, or may prefer not to use a credit card online. With Bill Me Later she does not have to divulge card information to the merchant. She enters the last four digits of her Social Security number and date of birth, and Bill Me Later responds with an approval decision within seconds, Talbert says.

Weinberg notes that payment services offered from well-known companies like Google and PayPal are especially helpful to smaller, niche merchants, as consumers may be reluctant to share card information with retailers they have never heard of. With both the Google and PayPal checkout services the merchant does not see the actual card number.

Online fraud—and fear of fraud—remain important issues for online retailers. As a percentage of U.S. online sales, fraud declined again in 2006 to 1.4%, down from 1.6% in 2005 and 3.6% in 2000, according to an annual survey by CyberSource.

But in dollar terms, fraud losses were expected to reach $3 billion last year, up from $2.8 billion, CyberSource says. And harder to measure are lost sales from consumers not buying online for fear their personal information will be stolen and misused. Forrester Research says 37% of consumers concerned about identity theft have stopped shopping online altogether.

BuySAFE Inc. addresses those concerns by offering consumers a guarantee against merchant fraud. More than 3,000 merchants have been certified and more than 12 million transactions guaranteed, says Jeff Green, buySAFE CEO. The company typically charges consumers 1% to 5% of the transaction amount for the guarantee; or merchants can offer the buySAFE guarantee, paying fees that are typically lower than those charged consumers, Green says.

Data security deadlines

Real fraud, and consumer concerns about fraud, are behind the payment card industry’s adoption of data-security standards known as PCI, which require all parties to a payment transaction—including merchants—to ensure that card numbers and other personal information do not fall into the wrong hands.

With deadlines coming up this fall for merchant compliance with PCI, a growing number of companies are offering merchants technology and consulting services related to the security initiative. Among them is GFI Software, which offers products that monitor computer networks for intrusions, ensure that security patches are installed, and keep track of portable storage devices such as USB tokens, among other services.

Fines for failing to comply with PCI can reach as high as $500,000, says Kevin Hodak, technical support supervisor at GFI. And he notes the consequences of an actual data compromise can be expensive. While smaller merchants can self-certify their compliance with the PCI standards, he says any merchant that suffers a data breach has to comply with the most stringent requirements, usually reserved for the largest merchants. Those rules include on-site security audits by outside firms.

Leave the compliance to us

ACH Direct, a payments processor for 7,000 merchants online and off, has recently introduced a product called WebPay that relieves retailers of compliance worries by transferring all financial data to ACH Direct’s servers. Although consumers are not aware of the shift, they are moved to a page hosted by ACH Direct to enter their payment data, then returned to the merchant site.

That means the responsibility for complying with PCI as well as with the separate standards for automated clearinghouse, or ACH, transactions, moves to ACH Direct, says Jeff Gonzales, director of marketing. But the main selling point, he says, is that it is an easy way for smaller retailers to add payment functionality to their sites.

While working to comply with PCI deadlines, online retailers also will be watching this fall for possible congressional action on a bill that would give certain states the right to require sales tax collection by larger online retailers selling to residents of those states.

The bill introduced this spring by Sen. Michael Enzi (R-WY) would grant the right to collect sales taxes to the 21 states participating in a 2-year-old initiative called the Streamlined Sales Tax project meant to create more standardized sales tax rules among the 50 states. The project provides merchants who voluntarily choose to collect sales taxes with software that handles the collection and remittance procedures.