eCommerce Case Study

Case Study: EnvisionWare eCommerce Services™ Fine Payment Success Story

In September 2007, a large libary customer with a service area population of approximately 750,000 launched a highly successful web-based fine payment service utilizing EnvisionWare eCommerce Services. The library's stated goal of the project was to provide customers a more convenient and discrete method to pay for accrued fines using credit cards, via the library's web site. In just three months, the library said, "it is hard to argue with the early success of the service."

Summary of Services
Highlighted below are several milestones that the service reached:

• The service passed the $1000.00 fine collection mark the first week of service.

• The service passed the $20,000.00 fine collection mark 4 weeks after “go live.”

• The service passed the $50,000.00 fine collection mark 11 weeks after “go live.”

• The average amount collected each week was approximately $4,000.00. In the final month of the analysis period, the amount per week rose to approximately $6,250.00 per week. The rise was attributed to increased library promotion of the service as well as the initiatives to encourage borrowers to settle fines with the library.

• Over the period, there were 5,374 successful fine payment transactions via the web, an average of 488 transactions per week. Over the last 4 weeks of the reporting period, the average weekly transactions rose to 611 transactions per week.

• The average payment per transaction was approximately $9.83 since the inception of the service.

• The largest single transaction was $135.90.

Growth of service
Promotion and borrower awareness of the service continued to grow consistently from launch. Promotional efforts included prominent promotion on the front page of the library's website, staff interaction with borrowers, promotion to local news outlets, and promotion via printed handouts.
Additionally, with the initiatives to encourage borrowers to settle fines with the library, the service has seen an increase in revenue collected and number of transactions over the last four (4) weeks of the analsys period as demonstrated by the chart at the right.

Summary and forecasts
Based on this data, it is clear to see the impact the service. The data suggests the need to expand fine payment services to the library's self service circulation stations.

In looking at the data, several forecasts were made:

• The library expects to collect as much as $200,000.00 in 2008 from the service (based on a conservative estimate of $4,000.00 collected per week.) This number is expected to rise as eCommerce Services is integrated into self check out stations.

• Borrowers are expected to value the service as the number of transactions is estimated to be in excess of 25,000 transactions in 2008 (based on a conservative estimate of 500 transactions per week.) This number is also projected to rise with integration into self check out stations.

Given the cost of EnvisionWare eCommerce Services, the library concluded that the software, "will pay for itself many times over."

For more information, please contact an EnvisionWare regional office.

eCommerce Services FAQ

This document is designed to answer the most Frequently Asked Questions about EnvisionWare eCommerce Services and credit card processing in libraries.

In terms of credit card, what's the difference between the "bank," a processor, the card (like Master Card or Visa), and a gateway?

Your bank is where you make deposits and write checks (over generalizing). A bank will accept credit card deposits similar to the way it accepts checks. Unlike checks that are taken or mailed to the bank, credit card deposits are transmitted electronically. Banks generally do not process or transmit credit cards, they simply accept them on your behalf.

A processor is a company that handles the card transactions electronically. This may be a terminal transaction in which staff swipes a card into a credit card terminal, or a self-service transaction at a kiosk, self-check, or on the library web site. When the card is submitted via one of the above, the processor handles the transmission from your site to the credit card company (Master Card, Visa, Amex, etc) and then when approved submits the deposit to your bank. Many banks reseller processor services. A bank typically "accepts" credit cards and when you are presented with the agreement, it stipulates the processor used by the bank. Click here for a list of the major processors in North America.

A gateway is a front-end service to processors. Typically, gateway services provide an easy way to integrate card processing into a user's web site. The gateway serves to accept the transactions from a remote web site and then hands off the transaction to a processor. Once the processor completes the task, the deposit is made to the bank. Generally speaking, since a gateway is an added layer in the middle of the process, the gateway service incorporates added fees. This may represent a monthly fee or an increase in the per transaction fee, essentially a commission on top of the processor fee. Examples of gateway services are authorize.net and PayPal, Verisign (now a part of PayPal).

Everyone in the process adds something to the total charge. The processor has a fee, the bank gets a commission, the card company gets a fee, and a gateway service adds a fee. There may be annual fees, programming fees, Internet processing fees, American Express setup fee, customer support fees, etc. All may be aggregated into one total.

How do I get the best deal for processing fees?

Generally speaking, the more choices you have, the better the deal. First you need some information to give to the companies from which you will obtain competitive quotes:

• Your average transaction on a credit card
• Minimum credit card amount
• Monthly total for credit card transactions

If you are not presently accepting credit cards, then you must estimate. It's important to ask the processor for suggestions. Perhaps raising your minimum will decrease your per transaction fee. The processor will also charge different fees based on the information you will provide:

• Card present (swipe) or manual entry (about 1% difference in rates)
• Address Verification - will you ask for the patron's address
• CVV2 - will you ask for the special code printed on the card

The more you ask of the patron, the lower the fees, generally speaking.

How can EnvisionWare help?

We provide a service to help libraries locate a processor. A separate service is provided to configure your system, whether EnvisionWare eCommerce Services, STS - Staff Transaction Station, or both.

eCommerce System Requirements

EnvisionWare eCommerce Services has three components, a server, a web module, and Windows Clients. Clients operate on any current Windows platform and provide kiosk-based fine payment and account revalue or act as an integrated component that is invoked during the checkout process for some self-check systems. The web server module operates on Apache (Windows or Linux) or IIS web servers and the eCommerce Server runs on a Windows XP Workstation or a server depending on model and library size.

Hardware Requirements for eCommerce Server SLE - Small Library Edition

Windows XP Pro or Windows Server 2003 Operating System
2.5 Ghz Celeron Processor (typical) #
(2) 80GB Hard disk drive (typical), Raid 1 recommended*
512 MB RAM
Ethernet Card
Connectivity path to the Internet and your local LAN

Hardware Requirements for eCommerce Server - Enterprise Edition

Windows Server 2003 Operating System
2.8 Ghz Dual core Processor (typical) #
(2) 80GB Hard disk drive (typical), Raid 1 (minimum typical configuration)*
or
(3) 120 GB Hard disk drive, Raid 5*
1 - 4 GB RAM depending on card transactions per minute
1 GB minimum for 20 transactions per minute
1 GB additional for every (3) Payment Server upgrade modules, max 12 modules
Equals 260 card transactions per minute/ 15,000 per hour, 120,000 per day
Ethernet Card
Connectivity path to the Internet and your local LAN

If you also serve the eCommerce Web components from the same server using the PHP engine and IIS, consider (2) Dual core 3GHz processors for the entire server.

If AAM Database is added to the same server, consider (3) 300 GB Raid 5 Disks instead plus the upgraded (2) processors noted above and less (2) of the maximum additional Payment Servers - total 11 when adding the AAM and web server to the same unit

Separate Web Server

Operate on platform described above with appropriate adjustments or run on separate web server with 1 GB disk space.

The Web Module for eCommerce Services runs on Apache (Windows or Linux) or IIS and may run on other platforms.

* The eCommerce Server holds transaction history so hard disk redundancy should be considered a standard requirement. (Consistent with CISP requirements, we do NOT retain card numbers. As with all EnvisionWare products, we build systems that protect borrower privacy.) While the server may not be mission critical to operation of the library, the data on the server must be resilient and backed up regularly.

# Hardware requirements are stated as typical because the scalability of the software is limited only by hardware. eCommerce Services does not require a dedicated server so the location, dedication, and sharing of other applications depends largely on the size of the institution and the frequency with which patrons will transact self-service fine payments. Hardware requirements are stated as a guide to represent optimal performance under heavy load. They are designed with a 3-5 year hardware life cycle in mind. Historical data suggests that requirements peak when the service is first announced and then taper off to a moderate level. The above are stated to support the potential peaks. Depending on hardware and your library size, you may be able to support the MySQL AAM database, the Web module, and the core eCommerce server on the same device. The processing requirements for MySQL are very low because the architecture is for a data store only, not for execution of scripts or triggers. Your EnvisionWare Regional Manager or a partner salesperson will guide you in configuring hardware to support your enterprise deployment of EnvisionWare.

Magnetic Swipe Readers

eCommerce often implies credit cards. EnvisionWare provides several approaches to the reading of credit cards and campus cards like the Blackboard student card.

Swipe readers are often called Track 2 readers. This comes from the location of the data on the back of the card which is on the second track down from the top. The credit card standard is track 2.

Whether you use the standalone reader (with a keyboard wedge interface), the swipe reader on the EnvisionWare OneStop kiosk, the STS keyboard swipe reader, or the reader on the All-In-One self-check unit, all provide the same ability to interface to the EnvisionWare eCommerce Services Client for payment by credit card.

Merchant Processors

EnvisionWare eCommerce Services provides the broadest compatiblity with merchant processors and gateway services of any product available. The following are the current compatible processors. Additional processor interfaces are under development. A processor is a company that accepts electronic transactions from the eCommerce Server and collaborates with VISA, MasterCard, American Express, and others for clearing and posting. Typically, when you arrange to accept the above or other credit cards with a local bank, the bank is reselling the services of companies like those listed below.

Alliance Data Systems, Inc. ADSI

American Express AMEX

Buypass, Inc. BPAS

Echo ( Electronic Clearing House ) ECHO

Elavon (Formerly NOVA)

FDMS Nashville / Envoy FDCN

FDMS North / Cardnet ( Card Establishment Services ) CES

FDMS Omaha / FDR FDC

FDMS South / NaBanco NB

Fifth-Third Bank-St. Pete BPS

Global Payments - East ( National Data Corporation ) NDC

Heartland Payment Systems HPTS

Moneris

National Bankcard Services NBS

NOVA ( See Elavon )

Paymentech ( Genstar, Transnet) GSAR

RBS Lynk systems, Inc. LYNK

Tandem ( NPC, National Processing Company ) NPC

TSYS Acquiring Solutions ( VisaNet, Vital ) VISA

 

PCI and PAPB Compliance

Implementation of an eCommerce solution requires careful control to ensure proper compliance with merchant processing requirements.

PCI: Payment Card Industry Data Security Standard or PCI DDS. PCI is a result of the collaboration between Visa and MasterCard to create common industry security requirements. Other card companies have adopted these standards.

CISP: Cardholder Information Security Program (Visa)

PAPB: Payment Application Best Practices - guidelines that a vendor like EnvisionWare must follow in the creation and delivery of eCommerce applications.

A helpful guide for US customers is available from Visa. Click here to view the PDF.

PCI Compliance

EnvisionWare is a payment application vendor. At no point does EnvisionWare store, process, or transmit cardholder data in our environment. As such PCI DDS does not apply to EnvisionWare.

PCI applies to the organization that actually hosts EnvisionWare eCommerce Services which would include our customers. PCI requirements state that a library is required to obtain PCI Certification from a third party accessor only when the total number of transactions per year will equal or exceed one (1) million. Thus, unless you plan to process more than 1 million payments per year, you are not required to obtain this formal PCI certification.

For more information, visit www.visa.com/cisp.

PCI still requires that your environment meets PCI requirements.

The basics of PCI DDS are as follows:

1. Build and maintain a secure network which means that you must operate with a firewall and you cannot use default passwords.
2. Protect cardholder data - encrypt data across the network (EnvisionWare eCommerce Services encrypts all data)
3. Maintain a vulnerability management program which includes maintaining your anti-virus software and other applications.
4. Implement strong access control measures - control access to your server; do not share IDs
5. Regularly monitor and test networks
6. Maintain an information security policy

PAPB Compliance

At the present time, PAPB is a best practice. EnvisionWare completed an internal audit to ensure our compliance with PAPB standards. PAPB will be a mandatory requirement in July 2008. Prior to that date, EnvisionWare will have completed the certification process and will provide all EnvisionWare eCommerce Services customers with a link to the compliance record.

Payment Servers

EnvisionWare eCommerce Services integrates a variety of Payment Servers which in turn connect to merchant processors.

For customers using Moneris, please state that you will be using the e-eSELECTplus product using the API in a card not present manner and not in an ecommerce manner. This will clarify to Moneris that EnvisionWare does not fall under PCI compliance guidelines.

For customers using the PCC payment server option, information about PAPB compliance is available from Professional Services and is provided as a standard part of the planning and implementation program.

EnvisionWare closely monitors PAPB, CISP, and PCI guidelines for all countries where EnvisionWare eCommerce Services is or will be deployed. Our goal is the delivery of secure products that offer versatile solutions for our customers.

SSL Certificate for eCommerce Services

Proper operation of an eCommerce environment implies the need to protect privacy and control access to sensitive data like credit cards, PIN's, and other information. The EnvisionWare eCommerce web module requires an SSL certificate for operation (all data between the Server and Clients or the Web module is encrypted). In addition, if you host the eCommerce Web Module, you will need to operate a portion of your web site using Secure Sockets (https). 

Obtaining the SSL Certificate

As you begin testing of EnvisionWare eCommerce Services, you can use a self-signed certificate. Our support group provides information on a web site that allows you to fill in the blanks and create a downloadable self-signed certificate. This will enable the system and allow you to perform tests. As you are ready to go live with eCommerce Services, you will need to purchase the SSL certificate for use in your system.

Certificates can be anywhere from free to a thousand dollars or more. The typical expenditure is around $150.

SSL Certificate Providers

Verisign
Thawte
Entrust
Instant SSL
GeoTrust
XRamp
IdenTrust

Enetica (Australia)

And many more - search for “buy ssl certificate.”

Help?
We provide a service to help libraries obtain and install their SSL certificate. Professional Services is the consulting group of EnvisionWare that provides customer guidance and assistance from the receipt of an order through the turnover to support.