Summarized using AI

Anatomy of a Payment

Michel Jamati • November 01, 2023 • Montréal, Canada • Talk

In this presentation, titled 'Anatomy of a Payment,' Michel Jamati provides a comprehensive overview of the payment ecosystem. The talk is organized to demystify how payment processing works, focusing on the various actors involved and the economic implications of payment systems.

Key points covered include:

- Actors in Payment Processing: The presentation identifies essential players in the payment chain, including consumers, merchants, issuers, acquirers, gateways, processors, and card networks like Visa and Mastercard.

- Merchant of Record and Payment Facilitators: Jamati explains the concepts of Merchant of Record and payment facilitators (PayFacs) like Stripe and PayPal, highlighting their roles in managing payment processing for merchants, including compliance and risk management.

- Cost Models for Transactions: The discussion elaborates on different pricing structures for payment processing, notably the fixed cost model versus the pass-through model, explaining how they impact transaction fees.

- Payment Processes: A breakdown of card payment processes, including authorization and settlement, is provided. Jamati emphasizes the behind-the-scenes complexity involved in what appears to be instantaneous payments to consumers.

- Types of Payment Methods: The presentation discusses a variety of payment methods including credit/debit cards, electronic funds transfers (EFT), and newer systems like FedNow in the U.S.

- Webhooks and Transaction Status Updates: Jamati outlines how webhooks are crucial for managing the asynchronous nature of payment transactions, ensuring that merchants receive timely updates about their transactions.

- Risks and Fraud Prevention: The speaker addresses the importance of risk profiling in payments, discussing how payment processors assess risk and the implications for merchants.

- Buy Now Pay Later (BNPL): The popularity of BNPL services is touched upon, emphasizing how these services operate and their impact on both consumers and merchants.

The presentation concludes with key takeaways emphasizing the integral relationship between understanding payment processes, managing risk, and the economic factors that influence transaction costs. Jamati's use of Ruby on Rails examples illustrates practical applications of payment processing methods, making the discussion relevant for developers and businesses alike.

Anatomy of a Payment
Michel Jamati • Montréal, Canada • Talk

Date: November 01, 2023
Published: unknown
Announced: unknown

This talk will provide an overview of the business payment world. Attendees will become familiar with the actors and economics of the payment ecosystem, learn about the major regulations in the payment space that need to be complied with, and understand the Lexop approach to navigating these different challenges. Ruby on Rails examples will be demonstrated along the way to illustrate various types of payments that can be made with different payment processors.

Montreal.rb Meetup November 2023

00:00:00.080 thank you everybody for um for being here uh this is a really cool turnout so very appreciate itive of this uh if you
00:00:07.480 have any questions at any point don't hesitate to raise your hand and like I like to keep things kind of you very
00:00:13.679 Dynamic I'm not big on academic presentations uh so uh we tried to kind
00:00:20.160 of go find all sorts of information about how the payment um how Payment Processing Works in general and kind of
00:00:27.359 demystify some of this and then we're going to go through different points and if uh there are some that you find
00:00:33.360 interesting that you'd like to have us develop maybe into a future presentation so to stand kind of like dig deeper into
00:00:39.760 this don't hesitate to let us know uh perfect so a little bit of background
00:00:45.280 information uh to kind of explain all the different actors in The Chain of uh of making a payment so you have uh a
00:00:52.719 consumer who you can considered to be the person purchasing a service or a
00:00:57.800 product you have a merchant which is is the one that's actually offering the service and expecting the money in
00:01:04.280 exchange you have what's called an issuer and an acquir the issuer is the financial institution that provides the
00:01:11.240 consumer with a payment method so the one where you went to get your credit card or where you have your bank account
00:01:17.080 and you have the choir which is the financial institution where the merchant Banks so where they have their bank
00:01:23.000 account and where the money will be transferred once you complete your transaction you have what's called a
00:01:28.040 Gateway uh and a processor the Gateway and the processor are often used interchangeably even though they're not
00:01:33.680 necessarily the same thing uh the Gateway is the technological stack of
00:01:39.320 tools that um verifies and authenticates the payment methods so that's where the
00:01:44.920 authorization process goes the processor is the one that's actually responsible for the transfer of funds uh between uh
00:01:52.560 issuer and acquirer uh and the last one is card networks right Visa Mastercard AMX uh
00:01:58.560 they have a role to play in the the authorization in the verification and in the transaction process uh when you're
00:02:05.280 dealing with cards so when you're dealing with either credit cards or credit backed debit cards like Visa
00:02:10.720 Mastercard uh debit cards perfect so there are two interesting
00:02:17.160 Concepts when you're um either looking for a provider or when you're deciding to get into the payment space the first
00:02:23.239 one is what's called The Merchant of record and the second one that we're going to see in one slide is uh payment
00:02:28.360 facilitator or Paya The Merchant of record is essentially
00:02:33.519 the one whose name you'll see on the invoice right that's that's the entity that's responsible for the entire risk
00:02:40.040 chain in the transaction process so if you think of Airbnb if you think of uber
00:02:45.560 and uh if you think of um short-term rental say providers and you think of
00:02:51.959 drivers versus Riders and guests what Airbnb and Uber do is they provide the
00:02:57.519 entire infrastructure and they provide the ENT entire Payment Processing they provide all the fraud tools all the uh
00:03:03.879 complaint management tools all the risk checks all the all the detection process
00:03:09.720 because it's a lot more interesting to deal with an entity like this legitimately speaking than to go
00:03:15.239 directly to a driver or directly to somebody who owns a condo and um what
00:03:21.000 Uber does in this case or Airbnb do or AER of record in general is they're going to set up all the relationships
00:03:27.560 with the different banks and with the um processors so they're going to deal with PCI compliance they're going to deal
00:03:34.080 with all the technological stack that's required uh to support things like vating and and so on right because as an
00:03:41.040 individual driver you can't possibly manage all of these
00:03:46.200 things uh payment facilitators they kind of came out when people wanted to get
00:03:51.480 wanted to get into the payment space without dealing with all these complicated processes right so if you
00:03:57.400 take stripe and PayPal as an example um what stripe will do is stripe will set themselves up in the middle of the
00:04:03.519 process so stripe will again like The Merchant of Records uh set up the relationships with the banks and the
00:04:09.799 processors and uh and so on and stripe will allow um independent service or
00:04:16.680 like um like vendors to come in create what's called a partner account and start onboarding themselves uh sub
00:04:24.000 Merchants so you could take you could consider a stripe um placed here and then you could have like a Shopify as an
00:04:31.039 isv that's onboarded as a partner under stripe and then Shopify under them brings in sub Merchants so brings in
00:04:38.320 cupcake stores and like a doggy spa and daycares and all these little institutions that want to be able to
00:04:44.000 take online payments or card payments but don't want to have to manage the process and where the payfac model is
00:04:49.840 interesting is um there's a lot more volume for stripe because of the fact
00:04:55.919 that they're um that they're let's say sub Merchant agnostic they can pretty much accept anybody that satisfies their
00:05:02.600 risk profile so they can take all of that volume and they can go to those different uh Banks and processors and
00:05:09.680 and suppliers and they can negotiate much better rates so which can either help the merchants or help stripe right
00:05:17.440 because then they get more profit from the transactions does that make sense
00:05:24.400 perfect uh there are two models to consider like if you ever start getting into the payment space and if you want
00:05:30.000 to start say onboarding uh processors or you want to offer services you have to consider two different models there's
00:05:35.479 the fixed cost model and there's the What's called the pass through model the fixed cost model is uh providers like
00:05:41.680 stripe and square and PayPal where you have the same transaction cost for any type of credit card any type of debit
00:05:48.280 cards uh stripe will go 2.9% plus 30 cents let's say and they'll do that for
00:05:54.160 any card right whether it's like a Visa Elite conci service or it's a No Frill
00:06:00.680 student cards uh that doesn't have any kind of points and any sort of Services of any kind uh and and I mean PayPal I
00:06:08.280 think is 2.8% or Square is 2.8 like they're all pretty similar in that space and if you want to get a better deal
00:06:14.160 from a stripe or a square then you have to bring in significant volume the other one is the pass through
00:06:21.199 model which is more transparent where the provider shows you pretty much the entire portion of the fee structure uh
00:06:27.440 and the things that you're going to have to consider is what's called called interchange assessment and processor fees uh and this will this will change
00:06:34.840 depending on the type of card depending on the type of transaction you're making uh depending on the sort of merchant you're making the transaction
00:06:41.599 with so very quickly uh interchange fees is uh the biggest chunk of your
00:06:47.160 processing it's about 1 to 3% of the transaction and it goes directly to the bank that issued the payment uh method
00:06:54.280 that issued the credit cards and these fees are there for covering fraud and bad debt and over over all risk of
00:07:00.120 accepting an online transaction or even a a card presence or in store transaction uh and like we said it's 1
00:07:06.879 to 3% and it's higher when you have more expensive or more uh service heavy credit
00:07:14.080 cards assessment fees are roughly 10 basis points so 0.1% and they go
00:07:19.960 directly to the card networks this is the one of the way or or the main way that they make their money right they
00:07:25.479 don't necessarily make their money on you being late and them charging you interest right they make money on every
00:07:31.360 single transaction so at this point you have interchange you have assessment and then you have processor
00:07:38.160 this is how stripe gets paid here right this is how Aden brain tree uh World pay
00:07:44.120 all of these guys get paid is they have their own processing um costs which they
00:07:49.879 show you in this pass through model they tell you uh on this credit card you're you're going to pay interchange which
00:07:55.639 might be whatever the credit card is you're going to pay assessment which is 10 basis points and you'll pay my fees
00:08:00.960 which are 20 basis points 10 basis points 30 basis points whatever they might be and this makes a very big
00:08:07.680 difference when you're comparing the stripe um fixed you know one sort of
00:08:13.639 price Model and uh the ones that are pass through the pass through model it means that you're going to pay a
00:08:19.199 different amount of money on EV every single transaction if it comes through from a different card type or if it's
00:08:25.599 like uh from a different Merchant or in a different situation this is an example if you take a look at
00:08:33.200 um different types of cards you have consumer cards you have corporate cards uh you have like if you take a look at
00:08:38.640 the MasterCard World Elite you have 2.5% interchange uh and by the time you get to the end it's a 2.85% 2.85 plus 23
00:08:47.440 cents take a look at the Visa corporate at the end with all the fees stacked up together you're at about 3.5
00:08:54.440 3.05% so it can go up and depending on this type of business you have
00:09:00.000 if you feel like you're going to have a um you're going to have um a customer
00:09:05.120 base that's leans maybe more heavily towards the expensive cards then it's
00:09:10.959 possible that a stripe is more advantageous for you right uh but there's a
00:09:16.959 caveat if you take debit cards so if you take like your master card or your Visa bank card uh and you go say you take a
00:09:24.200 look at the cost structure in the United States uh for financial institutions that are considered regulated so that
00:09:30.880 have assets that are over 10 that are over1 billion in management the actual
00:09:36.519 considered interchange fee is five basis Points Plus 21 cents so it's
00:09:42.120 0.05% plus 21 cents and for financial institutions that are smaller so that are under $10 billion so you consider
00:09:49.000 the regional Banks uh the credit unions the smaller Banks it's about
00:09:54.079 1.65 so with assessment with processor fees you're looking at 46 or45 or 2% but
00:10:03.120 stripe is still charging you 2.9% right so there's there's a lot of
00:10:08.519 um of money to go get back depending on what your profit margin is depending on
00:10:14.079 what the makeup of your customer basis depending on uh what it is that you're selling so it's it's a consideration to
00:10:21.200 keep um perfect so we're going to take a look at the different payment methods that we've
00:10:27.200 worked with and kind of how they uh kind of how they operate before I do that is are there any
00:10:33.560 questions perfect so cards which we've touched on a little bit with assessment
00:10:38.839 and interchange so credit cards and debit cards EFT which are Bank transfers
00:10:44.079 and uh instant transfers so think interact and um something called fed now in the United
00:10:51.839 States perfect uh so card payments um the way
00:10:57.639 that card payments work it's a a complicated synchronization between all the different actors that were presented
00:11:04.480 and while they appear instantaneous from um the perspective of the user that's
00:11:09.760 currently making a transaction it is a little bit more complicated and the funds do actually get settled later on so it's two steps
00:11:17.120 first you have something called authorization and then you have something called uh settlement and
00:11:22.240 clearing and a payment Gateway which is essentially the the if frame that you're
00:11:28.320 typing your C C into is quasi identical to a POS terminal when you go into a
00:11:34.399 store and you tap your card on something or you stick it in and you put in your card think of it as that that's the
00:11:39.839 those are the equivalents so the way the authorization works is at the beginning when you first
00:11:47.440 put in your card information uh and you um and you elect to pay there's going to
00:11:54.079 be a number of calls that are going to be made between the payment Gateway which is going to encrypt the information send it over through the
00:12:00.519 processor and then there's going to be a communication process between the processor uh the issuing Banks and the
00:12:06.639 card networks to determine that you are uh legitimately able to make this payment that there's enough money in
00:12:13.120 your in your account that there's no risk of fraud that you know nothing wrong is happening at this point and
00:12:18.880 it's going to go all the way back up to the Gateway which is going to communicate to the front end or to you
00:12:24.639 know in the case of a POS communicate to the actual um customer looking at the terminal that the the the transaction
00:12:32.560 has been accepted at this point no money has been transferred anywhere right all that's happened is that you have a
00:12:38.959 successful completion to the transaction and that um as far as you're concerned the merchant is done and the work is is
00:12:45.720 is passed what's going to happen then at the end of the day is all these transactions that that have been authorized are going to be batched and
00:12:52.600 then they're going to be settled and cleared so more or less the same process is going to happen between the payment
00:12:58.519 process and the card networks uh and the issuers and the acquirers in order to move the money essentially from the
00:13:06.880 acquiring Bank to the Merchant's account and then to move the money out of the uh
00:13:13.639 consumer's account so that's essentially how a car transaction works like it it seems
00:13:20.600 instantaneous um but it's only the authorization and the commitment that is done and at the end of the day
00:13:25.839 everything is batched and processed and I mean if you take a look at it in in 2022 in the US $3 trillion
00:13:32.760 were processed in card payments do you mind zooming a bit on the diagrams yeah of
00:13:41.800 course so this one is the authorization if you look here
00:13:48.839 perfect you'll notice that uh number two transaction info is transfer is transferred via the payment gateway to
00:13:55.120 the processor so the information essentially is encrypted at at this point because of something called PCI
00:14:01.120 compliance you don't want to be able to um intercept any sort of card
00:14:07.560 information and we'll talk about um we'll talk about how we on the API side
00:14:13.160 or on the server side handle this process later on card networks uh will transfer the
00:14:19.519 info to the issuing bank and then essentially it's all just going to go all the way back up like we've discussed
00:14:27.079 uh to the front end to let the person know that the transaction was done correctly and if you look on the other
00:14:35.839 side like we discussed all the authorized transaction that were batched will go back through uh and then will
00:14:42.839 essentially be settled so the merchant account will pull the funds and uh place them in sorry the mer the acquiring bank
00:14:48.839 will place the funds into the merchant account and then the um funds will be
00:14:54.040 debited from the um from the issuing Banks
00:15:02.519 an online pay yes but but in the in the but in the context of a of a card
00:15:09.800 present so in store payment it's pretty much the same the only difference is you don't have a a form like what's a
00:15:16.240 payment gateway to type in your stuff what you have is a terminal that you can either TP tap your card in or that you
00:15:21.759 can um type in your PIN so you say that um like there a batch running at the end
00:15:29.720 like to transfer the funds to the merchant so even though we see the money physically leaving our account the
00:15:36.079 merchant hasn't receive correct yeah the money didn't physically leave your account the money the the
00:15:42.440 spending um your spending capability got reduced on your credit cards right in
00:15:48.360 this case is this credit card only uh it's it's it's the same idea for debit
00:15:53.480 cards for debit cards that are essentially backed by uh credit card Networks so if you use your debit card
00:16:02.160 online you you you see your balance lower on this path but Merchant hasn't
00:16:08.360 received it yet receive it at the end y that's correct
00:16:14.800 perect all right so we wanted to show you an example of um of how this can be
00:16:19.920 managed using um using stripe stripe is probably the easiest thing to integrate
00:16:25.360 um and there's a reason why they're worth what they're worth and there's also reason why they charge 2.9% plus 30
00:16:30.600 cents per transaction so if you take a look at the stripe form what we one of the things you we wanted to draw your
00:16:36.240 attention on is that little checkbox which
00:16:41.519 is where you can save your payment method uh as a default and this is something that um if you're offering a
00:16:48.959 e-commerce experience that you want to consider because it allows you to reduce friction on subsequent transactions so
00:16:55.839 so that somebody doesn't have to come back every time and kind of type in their uh the same information that they're going to use anyways uh and it
00:17:02.920 increases your chance of getting conversion in the e-commerce is a lot more drastic but in the um context of
00:17:10.280 getting anybody to make a payment the less steps they have to go through the higher the likelihood they're actually going to
00:17:17.160 commit and this is kind of an example it's in the in the case of stripe when you come back uh you could reuse your
00:17:24.919 existing payment method and all you would need to do is type in your security code or CV CVC you wouldn't
00:17:31.320 have to go through the process of putting in uh your card number putting in your expiration data and everything
00:17:43.000 else perfect so the way stripe works it's running on what's called a payment
00:17:49.160 intent so payment intent is essentially um a request to initiate and run a
00:17:54.960 transaction so when you come in first and you select credit card cards what you're going to need to do is you're
00:18:00.159 going to create a payment intent that intent or that request is going to go to stripe stripe is going to return uh
00:18:07.000 what's called the client Secrets or a payment token and that client Secrets will be your ID for your payment for
00:18:13.520 your transaction request so taking that client secret that you're going to get back in the front end you're going to
00:18:20.080 create a payment element these are these are stripe terminologies you're going to create a payment elements using that
00:18:25.440 secrets and that payment element when you mount it it'll be your if frame
00:18:30.880 that's that's the form that your your your customer your user is going to see and that's where they're going to input
00:18:37.280 um input their card information perfect and then a second
00:18:43.799 I'm just perfect uh and then once they
00:18:50.640 submit uh and confirm you're going to get um you're going to get a a status
00:18:57.320 back using and using the token and then
00:19:04.280 through web hooks if I go back here you're going to be able to get um updated on the status of your
00:19:12.000 payments and subscribeing so the web hooks are interesting we're going to talk about about that in a bit um the
00:19:18.280 web hooks allow you to deal with payment statuses that could come in after if the front end is not available to receive
00:19:23.840 the information as well so in some cases you might get some uh timeouts or which
00:19:29.559 we've seen situations where the browser drops off for some reason and then you've executed the transaction but you
00:19:36.360 haven't actually received the response in the browser and so you've not created the payment yourself but the card was
00:19:43.400 still tapped and the funds were still pulled and you still had a transaction create on the stripe side but on the
00:19:48.919 side of your system you've missed it so that's why dealing with web web hooks is important because it allows you to make
00:19:54.799 sure that you don't lose any information
00:20:03.520 perfect so this is essenti sorry this is essentially creating a payment intent
00:20:08.600 and if you look at the um information the automatic payment methods enabled true it means that you're you're able to
00:20:15.840 create a checkout iframe that um simultaneously offers every single
00:20:21.159 supported uh payment wallets or you could specify with a
00:20:26.720 different option to only show cards only show a uh only show Clara and afterpay and
00:20:34.360 then bnpl type offer type options where somebody can actually purchase an asset but pay for it over a certain amount of
00:20:43.159 installments this would be the response you get back from a payment intent call
00:20:48.240 and you can see here your client Secrets which is what you're going to use to create your element
00:20:55.559 afterwards oh and also an ID
00:21:03.600 perfect if you look here you already have a payment method
00:21:10.559 ID which um will represent your tokenized payment method so one of the
00:21:17.400 main reasons of using a payment service like stripe or Square Aden or anything else like that is that you yourself
00:21:22.720 don't have to manage um the burden of PCI compliance you don't have to deal with taking in and processing card
00:21:28.880 information which if you did have to which if you did do you'd have to go through a significant amount of audits
00:21:35.440 and infrastructure work to make sure that you're vaulting so that you're storing the information correctly and that it's encrypted and that it's um
00:21:43.200 inaccessible to pretty much anybody so by using an iframe you make sure that there's no way to intercept what's
00:21:49.679 happening and that you only have access to a payment token or or tokenized
00:21:54.760 payment method that alone is just if you could see see this like random strings
00:21:59.919 that has no value outside of the context of the specific operation you're doing for that specific uh
00:22:11.559 Merchant perfect so if you look at this is an
00:22:17.120 example of the front end codes so essentially you create your payment
00:22:22.919 intent you wait for the client's secret to come back through the response
00:22:29.679 right over here you go through your payment element
00:22:35.080 which you
00:22:40.480 create and this is essentially where you mounted so at this point is where your
00:22:47.279 if frame appears on the
00:22:56.960 screen all right and this is standard error
00:23:03.520 handling and this can be interesting if you're um trying to redirect somebody to an additional uh to an additional
00:23:13.799 page this would be the function that runs on the actual submission so when uh
00:23:19.279 when your your user or your customer clicks on a submit button after they've put on all the information
00:23:25.840 in oops and
00:23:31.960 this is essentially how you're a I went back
00:23:39.080 apologies
00:23:44.279 perfect perfect and this is how you're capable of going afterwards to retrieve your payment intents using your client
00:23:51.799 secrets and act on any kind of payment status if you want to display a message
00:23:57.480 to the cust to the user that's currently watching the
00:24:06.799 screen this is the um an example of the web hooks that are supported so the ones
00:24:12.919 that you want to take a look at will normally be things like do you mind defining what a web Hook is for
00:24:20.159 people that are oh yeah sorry about that okay so when we talked about processing web hooks what we mean is processing
00:24:27.000 status updates that come back directly from uh from the provider so in this case stripe you're making a transaction
00:24:33.799 call to stripe so you're making a direct call and you're getting a response through the iframe but you can also get
00:24:40.279 status updates directly from web hooks which is essentially stripe um sending
00:24:46.720 uh sending a payload to a URL that you're listening on so on your side in
00:24:52.279 your system uh you have routes that are defined that you go and you configure in your strip account or in your Aden
00:24:58.919 account or in your uh World pay account and this is the um this is this is the
00:25:05.440 endp point that stripe will hit to send you updates so send you events as they
00:25:10.880 happen so this is kind of a way of processing real-time events without having to do a fetch every time like uh
00:25:16.279 having a timer where you're you're doing a you're doing a get every five seconds to see if anything changed so a good
00:25:22.720 example would be um if you're going through a transaction where you're going to first do what's called an
00:25:27.960 authorization request and then you're going to do something called a capture an authorization is when you confirm
00:25:33.600 that you have what's necessary to use the payment method that you have the right card number right expiration dates
00:25:40.080 there's no risk of fraud uh if you've if you have something called address validation where you have to send the
00:25:46.320 address that's associated to the card then you'll send the address and then you'll you'll you'll confirm that it's
00:25:52.960 the right address right that you are authorized to use this payment method once you have your authorization you
00:25:58.919 will do a capture which is essentially saying I'm closing the transaction on this amount and that's how you complete
00:26:05.279 the transaction so you could be listening on uh charge captured charge failed and
00:26:13.360 um let's see charge succeeded and then you have the whole life cycle of your transaction and a good an interesting
00:26:19.720 thing about web hooks is if you support refunds or uh if you have a situation of chargebacks or disputes right somebody
00:26:28.240 uh 15 days later could say no I never wanted to buy this and they they dispute with the merchant and then they win
00:26:34.760 their case and then they get a they get a refund or they get a charge back or whatever then if you don't have web hook
00:26:41.520 capabilities you're not going to receive that feedback you're not going to get that event so what strip's going to do 10 days later is they're going to create
00:26:47.880 an event that they're going to send to your web hook URL or web hook endpoints and then you're going to get this saying
00:26:53.320 oh this payment that I thought was actually successful 10 days ago was now failed so you'll have to process it and
00:26:58.880 update your system or update your records yes sorry why would you have a
00:27:06.640 checkbox depending of the web say that again why would you have checkbox what
00:27:11.919 would we have checkbox yeah why when us to have all of them oh um I mean it
00:27:17.720 depends it's a good point it depends what you support it depends um for example
00:27:23.960 um it depends on how fast you yeah it's a good depends on how fast you want to go to production it depends on how
00:27:29.480 complicated you want your product to be um it depends on how your process works like if you're making a direct API call
00:27:35.880 for authorization then you're going to get your authorization response in your API call anyways right so it might be
00:27:42.720 Overkill to listen for an event like that if that was there um but yeah it's
00:27:48.200 up to you yeah oh just complimenting his answer I think that the reason why you
00:27:54.159 don't enable every check I think you calling web Hub sorry strive is going to
00:28:00.080 call that URL by every event right and you don't set a like a general URL for
00:28:07.519 everything of them then St will tell you that probably your url is going to be failing and you're going to get a
00:28:14.080 message for that sorry I'm not no sorry to explain it better it's not the best
00:28:19.840 option to enable all the events because if you don't set a correct URL which answer to that event sure then St ring
00:28:27.840 that we start communicating you that for this s this URL is not reing
00:28:34.080 asso and I think that that's one of the reason why you don't enable from the from the first day every oh okay I see
00:28:40.760 what you're saying okay sure sure sure but I mean once you know that your your implementation is correct yeah yeah yeah
00:28:46.080 okay that makes sense yes yes question regarding the
00:28:51.760 risk profile so for every uh purchase so when a person makes a purchase on a site
00:28:57.919 uh you have a risk profile you could have a someone that I guess is more risky and I'm guessing stri has some
00:29:04.080 algorithm to determine the the risk profile of the person based on the the
00:29:09.640 CVV and the the the address they can kind of tell if this looks like uh like
00:29:16.360 a risky transaction or not can you set the risk level at the merchant level can
00:29:23.480 can you say I believe that that's something that you can set at the underwriting level so when you open up
00:29:29.679 so I don't I don't know about strip Stripes specifically uh but I know that um I know that a lot of providers will
00:29:35.919 allow you to to do things like um uh like like sending out an IP address
00:29:43.159 whenever you make a transaction and using the IP address the provider itself will do some analysis and determine
00:29:48.640 whether or not that IP Falls in uh in a risk category right uh and a lot of
00:29:54.480 those tools especially stripe will do uh um fraud analysis on their side right
00:30:01.120 because they are they are they have access to all the data points they have a tremendous amount of transactions that
00:30:07.360 are going through them from different providers so they're able to get a lot of they're able to categorize a lot better and that's what and a lot of
00:30:14.000 additional services do that as well I don't know if you you're if you when you open up a merchant account you can go
00:30:20.399 and select I only want to allow non-risky transactions or I only want to allow transactions that have a risk
00:30:26.840 score below something but um as a merchant you get yourself a risk
00:30:32.840 evaluation right when you're underwritten when you go through um what's called AML so anti-money
00:30:38.519 laundering and kyc which is know your customers this is where um the Gateway
00:30:44.360 or rather the processor the Gateway the provider essentially assesses your risk
00:30:49.519 profile right and says like do I think that there will be a lot of chargebacks coming from this customer do I think
00:30:54.960 that there will be a lot of fraud uh attempts coming from this customer and um the reason why they don't want to
00:31:01.360 allow customers that have a higher risk profile is chargebacks if they get too much chargebacks at some point they can
00:31:08.200 get um they can get problems from the card networks does that does that make sense
00:31:14.559 yeah yeah the the merchants will have a limit so if if it's too high they they don't want the the the c network don't
00:31:21.320 want to work with correct correct so for example a good a good example is um is u
00:31:27.440 um collection agencies collection agencies will have a lot of difficulty
00:31:32.840 opening up um opening up um merchant account at a payment Gateway because they're very high in
00:31:41.279 Risk yes so um there are quite a number of
00:31:47.080 these payment processes that's by so what makes a company choose one
00:31:53.159 over the other is it transaction cost or is it speed simplicity uh it depends
00:31:58.320 right um it could be anywhere from integration capabilities like for example stripe um you can plug them into
00:32:04.639 literally any anything right right uh they're compatible with probably every Marketplace that's out there and and
00:32:10.880 every type of Wordpress and and which is why so popular that yeah so that's one thing and then and then another reason
00:32:17.519 why you might pick another provider is they might have payment methods that um others don't right let's say you want to
00:32:23.440 support alip pay you want to support uh some payment methods in Brazil uh you want to support something else in in
00:32:30.559 like uh in China or who knows where then you you're going to go somewhere different and then like he mentioned is
00:32:37.679 risk some gateways have lower risk tolerance right so if you're not in a
00:32:43.519 specific box they're going to reject you outright and then the final Point can be something like cost right stripe 2.9%
00:32:51.159 plus 30 cents it's not cheap right uh and then like we saw the the actual cost of debit cards in the US is anywhere
00:32:58.360 from4 to to 2% after you factor in processor fees so there's a lot to
00:33:05.480 consider depending on what your margins are okay thanks
00:33:12.240 sure this is what's called so this is an example of what's called a setup intent
00:33:17.320 so it's it's essentially the same thing uh as tribes payment intent but where it differs is it allows you to capture um
00:33:25.000 to capture a payment method with on actually creating a transaction so this can be for um a bu now pay later sort of
00:33:34.080 use case this can be for let's say somebody tells you that you know I'm going to get paid uh because you're
00:33:39.799 sending them a bill for a service and they're saying I'm going to get paid on Tuesday Thursday Friday next week here's
00:33:45.200 my card I'll give you the information but Bill me on Thursday so you create a setup intent and the setup intent comes
00:33:51.480 back to you um with a um with a tokenized payment method and then when the time comes you create your
00:33:57.880 transaction using the setup intent you can correct me anytime Andy
00:34:03.240 by the way yeah I F on that feel feel free to jump in no you nailed it thank
00:34:09.520 you and that's the same concept with canceling the payment like a few days after you let's say you order on Amazon
00:34:17.280 they give you the CH choice to cancel it let's say a day after you've faed the
00:34:22.720 sure the a what do you mean by the same concept same concept as in the action is
00:34:28.520 not really correct correct so you can yeah so you can look at it as essentially just an authorization so
00:34:35.079 there's there some gateways support zero zero doll authorization some you have to do a one cent authorization some they do
00:34:41.399 like a void they just kind of check that the card is valid um but I think in this case if you're talking about buying
00:34:47.560 something in the future um for a certain amount then you're going to do probably an authorization against the amount that
00:34:53.879 you want to make sure that the money is is there right and then you can just
00:34:59.599 void the authorization so that you don't you you release the funds right because when you authorize you do a pre-o on a
00:35:05.480 credit card you're actually holding up that payment space
00:35:11.839 right so this is essentially a uh how to create a setup intent pretty similar to
00:35:17.520 a payment intent uh response is again pretty
00:35:23.400 similar where it differs is you don't have a you're not going to have a payment method token that's sent back
00:35:29.119 but you still have a client
00:35:36.680 secrets you can
00:35:41.920 see this is after capture oh yeah correct sorry so this one you have the payment method there it is apologies so
00:35:48.079 you've got your payment method back here after the
00:35:55.800 capture and this is just the web hooks that you can subscribe to uh as it relates to the payment
00:36:04.560 intents set up intents setup intent sorry thank you Andy so we've seen cards the other type
00:36:12.560 of payment that is interesting to have is efts which are electronic fund transfers and those are interesting
00:36:18.119 because they're also the cheapest kind of transaction you can support it's literally pennies to make a an EFT
00:36:23.760 transaction and they're the most widely used type of trans transactions so think wir transfers direct deposits ATM
00:36:32.079 transactions um in the US there's a thing called a which is a form of EFT a
00:36:38.640 is um well we'll talk about it on the next slide aut clearing yeah automated
00:36:44.760 clearing house and it's also like if you take a look at how much is processed you're looking at 72.6 trillion in the
00:36:50.960 US process last year uh in a transactions so it's pretty big um um
00:36:57.079 what's so what's interesting is it's very low fee it's a it's a very low cost thing to do but there's a delay in the
00:37:03.680 system right in you have same day a but generally you're looking at 24 to 72
00:37:09.359 hours for the transfer to be completed uh and then you got to factor in things like bank holidays and sometimes
00:37:15.720 weekends so um there's there's there's that consideration to have so the way it
00:37:21.520 works it's um essentially when you come in to make your EFT transaction and you
00:37:27.280 commit to itom on diam yeah apologies of course and you actually commit to the
00:37:35.119 transaction so it's like if you click submit uh on the form then you create an order that's added to the system and
00:37:41.680 that order is added to a que or a batch and what happens is at preset times
00:37:48.880 during the day and more and more during the weekends that batch gets executed by the financial institution and the fund
00:37:56.160 transfer actually gets completed so because of this delay between the time
00:38:01.200 you say yes I want to pay and the funds are actually tapped what can happen is
00:38:06.680 the money can actually no longer be available right you could make another transaction uh you could um pay another
00:38:14.319 bill some other fund transfer might pass so this is where web hooks become interesting uh especially in this case
00:38:21.079 it's that you're not going to get a a complete confirmation on the spot ever you're going to just all you're going to know is that you have a pending order
00:38:27.400 that's in the system right you're going to need to um consume web hooks to know
00:38:33.280 if this order passed or failed in the next 24 to 72
00:38:44.119 hours so this is an example of how stripe manages EFT and there's an there's an interesting um spin on it uh
00:38:52.200 that uh that you can add to make the process a bit more um let's say a bit more user friendly for people so if you
00:39:00.280 take a look at the first form this is a Sandbox uh EFT form it allows you to select test institutions and you know
00:39:08.119 failure transaction or not but if you take a look on the right um that's what's called aggregation and there are
00:39:14.000 a lot of providers like plaid that do this aggregation allows you to add a layer on top of your of your form where
00:39:21.200 where a user would otherwise just enter like their account number their routing number their institution number with
00:39:26.720 aggregation they can select from a list of supported FIS financial
00:39:32.000 institutions and they can essentially enter their credentials like if they're logging into the bank account pick an
00:39:38.160 account and then just confirm so it's it's almost as simple as a credit card
00:39:44.000 uh you don't have to go and pull out a checkbook and you don't have to go and look for account numbers and all these annoying little things that nobody wants
00:39:50.440 to do uh and there's a cost with aggregation usually you want to consider
00:39:55.680 that like every aggregation hit can be anywhere from 50 cents to a dollar depending on the volume that you have
00:40:01.920 but EFT is also almost Limitless EFT is like you could make an EFT transaction
00:40:06.960 for $50,000 if you wanted right that really depends on your business model obviously whereas credit card is very
00:40:12.640 risk-based and has limits that are much lower than that generally S I have a question while
00:40:20.720 we're talking on this um so this is cheaper from a transactional standpoint yes are there different fraud
00:40:27.720 considerations because I know for things like let's say intera transfer if I send
00:40:33.160 money that's that the money is gone yes you're never getting it back get it back there's no fraud consideration there
00:40:40.400 what about EFT uh I can't say that I've ever had an
00:40:46.319 EFT transaction that was stopped for fraud reasons um but I would imagine
00:40:51.480 that at the bank level they probably do their own checks right because you're not hitting a card net networ you're
00:40:56.760 going directly you're adding an order directly that's going to be executed by a financial institution but at the aggregation level so providers like I
00:41:03.880 said pla there's I think ficity MX a lot of these different they have their own
00:41:09.040 um fraud capabilities as well so they have Services where they can do an aggregation of the transactions that are
00:41:14.240 happening and kind of give you an idea of do we think that something is going on or not um but but you have a lot less
00:41:21.200 control than or a lot less oversight than you would uh with a credit card right right because my understanding is
00:41:28.160 that the the banks charge a lot mostly because there's the risk that this will be charged back and they need to cover
00:41:34.200 in part of it I'm wondering if the fees here are much lower because charge back is not a consideration at all uh well I
00:41:40.839 mean I can tell you that we haven't seen that many chargebacks so I would think that it's it's a lot less risky whereas online um is probably the most expensive
00:41:48.119 type of transaction to supports because it's kind of easy to grab it's kind of easy to grab um credit
00:41:53.880 card numbers it's a lot harder to find an account number and a routing number uh it's probably harder to get access to
00:41:59.760 somebody's banking credentials as well uh and then the way that these things work mostly is with screen scraping so
00:42:08.160 the the there's there's not a lot of API coverage between Banks and the outside world so the way a provider like this
00:42:15.240 operates like plaid and all these guys is um they'll literally take your credentials that you're inputting and
00:42:21.200 they'll plug them into the actual portal uh and they'll scrape the screen they'll
00:42:27.520 pull all the information that's displayed and then they'll package it into something like this where they can
00:42:33.359 show you um all your available accounts and then you pick the one you want and then once you've picked an account and
00:42:38.440 you've committed this is where they're going to pull that information they're going to go pull those routing numbers those account numbers those institution
00:42:44.559 numbers and they're going to package them back in into a token which you will use to execute your transactions so
00:42:50.480 you're still vaulting a payment methods so you're still storing securely all that information you're getting a token
00:42:56.599 back and with that token you're executing your transactions does that make
00:43:05.079 sense are there um are there limits to credit card transaction even if the card
00:43:10.839 limit has not been reached um I believe that it during
00:43:16.200 during underwriting you may have credit card limits on the transactions that are set at the Gateway level um for for
00:43:23.079 reasons of risk so even if you're credit card can go up to um $20,000 maybe your
00:43:31.240 merchant account can't charge that much on your credit cards you be F through multiple
00:43:37.960 TR uh I mean it depends on what you're selling right if you're if you're if you're selling things that are that have
00:43:43.520 you know that has a very high uh cost then yeah you could you could go with
00:43:49.760 like installment plans where you can break things down into pieces or bnls where you can do that by now bnpl is by
00:43:55.200 now pay later so you can which can also split things usually splits it into
00:44:00.880 installments um but obviously the the more expensive the the transaction is the higher the fraud oversight is right
00:44:10.040 so this the limit from the merchant or the or the the or the bank itself sorry
00:44:15.520 the the limit is it the limit from the merchant or from the uh the card issu I would well mean there's a limit at the
00:44:21.839 card issuing side right but there's a limit there's probably also a limit at the um processor merchant account
00:44:29.160 side and that one can be much lower than the one that your card
00:44:34.839 has yeah just a question regarding um for EFT I was wondering how secure it is
00:44:41.880 for the consumer perspective because in putting your bank account and password I
00:44:47.480 guess this is captured behind corre so by by stripe no stripe doesn't
00:44:55.800 uh get that information so if you're using aggregation the credentials are captured by the aggregation service
00:45:01.640 provider so by plaid or by you know whoever it is and then uh stripe stripe itself will will will not really get
00:45:08.720 that info um what you're going to get back is unless stripe is the one offering the service that's a different
00:45:14.240 thing I think I think it might be stripe has their own sort of aggregation process if I'm not mistaken I believe they do because they
00:45:20.800 used to use plaid before and now they don't use it anymore but um let's say you use plaid plat is the one capturing
00:45:26.920 the credentials so plat is the one that is responsible that has the burden of security so I would say these companies
00:45:33.960 spend a ton of money on security and on audits uh on on infrastructure reviews
00:45:39.680 so so yes there's there's a risk there's a risk but it's often mitigated by the
00:45:45.079 measures they put in place sure perfect so now in this situation
00:45:52.599 you've selected your account you've connected you've authenticated you've ped picked uh where you want the money to come from and then now you come back
00:45:59.400 to stripe and then you can just confirm and pay and this is where you're adding your your your order into the queue
00:46:06.200 that's going to be batch processed at some point uh also in that screen the one yes
00:46:14.040 that one uh at the bottom where it says by saving your bank account for business
00:46:19.240 name that is basically a mandate that is displayed to the customer to agree with
00:46:25.040 for legal iance correct and stripe handles that automatically with their stripe element
00:46:31.280 API yeah so there there are a lot of regulations that you have to cover when you deal with payments depending on
00:46:36.720 which GE geography or jurisdiction you're executing those payments in um and uh in some cases for credit cards
00:46:43.640 for example if you're not making um if you're not making a recurrent payment so if there's no subscription then you
00:46:50.400 might be required to show people that they have the option to refuse storing
00:46:55.559 your credit their credit card information right if you're putting them into a subscription plan then there's a
00:47:01.079 terms and conditions thing you want to show that by agreeing to the terms of this you are um allowing us to charge
00:47:06.960 you on a recurring basis and so on and so on and so on so there are a lot of different things you want to consider
00:47:12.000 when you start playing with payments but often the gateways will take care of that for you and will let you know what you need to configure and what you need
00:47:17.760 to support and also when the user agrees with it a stripe will talk will store
00:47:24.559 the mandate uh agreement as an ID that's tokenized and will return a token for us
00:47:37.960 payment perfect so we saw card payments we saw Bank transfers there's um types
00:47:44.680 of Bank transfers or or Bank payments that are still considered kind of instantaneous
00:47:50.119 um so there's something called fed now that's starting in the US and there's in in Canada which is a good EX
00:47:57.920 example so the way and if you take a look at on top right how much money fed
00:48:03.000 now processes you'll see that it's a lot less widespread than EFT fed now processed 7 19.7 billion uh in the last
00:48:10.720 in the Q3 of 20122 so if you you know you're generous and you multiply that by five it's 100 billion versus 72 trillion
00:48:18.200 that were processed with EFT so um a distinction with something called fed now is the banks need to subscribe to it
00:48:26.000 to have it available it's not a given and the way it works is that you have the Federal Reserve that sits in the
00:48:32.040 middle of every financial institution has access to every single account so the Federal Reserve has
00:48:39.319 um offered a service that you can call to execute quasi instantaneous Bank
00:48:45.240 transfers between supported financial institutions which is very comparable to what we have here with in and uh for
00:48:53.520 those of you who didn't know in was actually founded by most of our banks
00:48:58.799 most of our big Banks I think it was in the ' 80s
00:49:08.720 so so a couple of caveats um when you're dealing with payments and and payment
00:49:14.000 providers is um if you only have one let's say payment Gateway you're only
00:49:19.799 going to use stripe then you're good but if you want to offer multi-gateway support So if you want your customer to
00:49:25.799 be able to come to you and say well I have an Adan accounts I have uh brain free accounts I have an authorized.net
00:49:32.079 account if you want to be able to support all those then you're going to be stuck um building all building out
00:49:38.400 all these Integrations and you're going to be stuck maintaining them and testing them and making sure that when the API
00:49:43.480 versioning changes and that you know something happens on their side that you have to be on top of it and you have to
00:49:49.000 update your codebase uh or you can use what's called
00:49:54.319 um aggregators so you have open source and you have
00:49:59.640 obviously paying services so an aggregator is something that allows you to standardize the transaction
00:50:07.000 mechanism um while communicating to multiple providers so um stripe has its
00:50:13.799 way of operating uh square has its way of operating all of these different providers have their own apis in
00:50:20.200 documentation but you use an aggregator that will expose a single sort of set of
00:50:26.960 methods and then you're going to call these methods and on the back end the aggregator is going to manage the
00:50:32.160 complexity of communicating with the different providers a good example of this open
00:50:37.680 source is active Merchant active Merchant is uh was essentially designed by Shopify uh and is now maintained by
00:50:44.960 the community and I think is also maintained by um one of the paying Services which we're going to see in a
00:50:50.839 bit uh and this is interesting because number one it's very easy easy to add
00:50:56.160 additional support if it's missing so let's say you you know you want to there's one called repay you want to
00:51:02.280 support repay but active Merchant doesn't it's very easy for you to extend
00:51:07.760 the capabilities of active Merchant and add support for an additional Gateway and then you can continue the
00:51:13.799 process um where you might have some complexity is number one it's not
00:51:18.920 maintained necessarily by like you know professional oversight it's
00:51:24.839 maintained by the Community it's maintained by um it's maintained based on priority too right if you have
00:51:29.880 something that's obscure that only you use but nobody else does then nobody is going to be playing in that sandbox and
00:51:36.119 the other thing is uh as an example active Merchant doesn't manage the front end complexities active Merchant only
00:51:42.680 covers the API calls if you still have to do your own work for the different
00:51:47.880 eye frames so you still have some work to do and you still have some maintenance to
00:51:54.359 do you can use a paying service so a paying service good examples are sply uh IOP
00:52:01.520 pay rapid and those services are built around supporting compatibility with
00:52:07.240 different payment gateways but there's a price right so first off um they support
00:52:13.280 the whole process they support the API calls they support the iframes uh so you're only making a call to one
00:52:20.880 provider but you can configure it for multiple gateways so you can essentially
00:52:26.720 support all sorts of uh Merchant accounts without having to do the work yourself you only work with the one you
00:52:32.880 only work with Rapid or spreely uh the expectation is they're going to stay on top of changes so you
00:52:39.119 won't have to maintain this yourself but like we mentioned pricing imagine you're going through 3,000
00:52:45.920 payments per month right for One customer you're a service provider you onboard sub Merchants like you have a
00:52:51.400 cupcake store and then you onboard them onto your platform so they can sell their uh sell their merchandise and they
00:52:57.400 run through 3,000 transactions per month each transaction goes through two API
00:53:02.480 calls and one vating call so one call to store the payment method and return a
00:53:07.520 payment token that you can use that's three API calls two cents each 3,000
00:53:12.760 transactions you're paying $180 a month so you're paying $180 a month to
00:53:17.839 maintain that customer plus you have a monthly probably licensing fee to just to use the service so depending on the
00:53:24.880 kind of margins you have this is something you want to consider right uh it might reduce your profits by a
00:53:33.760 lot another one yes please also uhle still require developers to
00:53:40.920 implement we hooks separately that's correct so we've done some work with sple and spreedly um one of the
00:53:46.880 drawbacks is that um they do not support web hooks so if you remember EFT transactions or or Bank transfers the
00:53:54.319 bank transfer once you confirm the payment all you know is it's pending you still have to wait a day or two or three
00:54:01.240 to receive either the failure or the success event back and that event comes in under the form of a of a web hook
00:54:07.880 spreedly does not support um transmitting web hooks across providers
00:54:13.119 so the the web hook will come in say from stripe uh to spreedly and will stop
00:54:18.200 there so you may find yourself like one one alternative that we haven't necessarily um explored is that you may
00:54:24.520 have to create polling you may have to check back regularly with sply to see how's the
00:54:29.720 transaction doing is it is it good is it good is it good is it good until you get a response right which is
00:54:36.280 inefficient um another caveat when you're dealing with mobile payments is that you have a lot of providers or a
00:54:42.160 lot of types of wallets that will generate a secondary experience so you're you're on your phone they're on
00:54:48.359 your web app they're going through to the payment um to the payment you know step and then say they select interact
00:54:55.520 interact is a good example you click on interact it opens up a popup which you see here on the browser that allows you
00:55:02.400 to select your financial institution and then once you select your institution if the mobile app is installed on your
00:55:08.319 device it opens the mobile app so you're now on the mobile app you're completing the payments once you're done what
00:55:15.280 generally happens is you close everything because you think you're you know my work is done I've paid for my cupcakes I can go home so you close
00:55:22.200 everything and then nothing goes back to the browser so your web app never
00:55:27.599 gets the confirmation the payment was made you have to entirely rely on you have to entirely rely on web hooks right
00:55:34.640 otherwise you'll never know something was done now where you can have a collision is if you're on a desktop or
00:55:41.559 if the person goes back to the browser and then you get the confirmation then you might be set up at the browser level
00:55:47.960 to create the payment there because you're receiving the payload back and so you're also getting a web hook at the
00:55:53.480 same time that comes in to tell you payment was created so you have your front end that may be creating a payment
00:56:00.119 and you have a web hook that might be getting processed at the same time yes sing sorry this is independent of what
00:56:05.760 you talked about regarding spreedly sure yes topic yes apologies if I wasn't clear this is independent of spred Le
00:56:12.400 one one uh thing that I wanted to mention about spr Le not having web hooks means we could do polling but also
00:56:18.880 it me alternatively we could still integrate with stripes web hooks separately that's a good point that
00:56:24.520 would be work and it would defeat the purpose of using sply because you're now still maintaining an integration with
00:56:29.559 every provider it's maybe not as uh involved of an integration but you still
00:56:35.200 have to go and build a client and you still have to build support well maybe not you have to build support anyways for the web hook formats that come in
00:56:41.599 and should they change the payload format then you have to go and maintain so it defeats the point of having to pay three cents per transaction to go and
00:56:48.160 still build an integration with the provider uh yes you mentioned you you
00:56:53.720 play around this freely yes but you also mentioned that you Stripes your business we we've played around
00:57:00.119 with a whole lot of payment gateways have you ever used both in production or this was just an investigation to see uh
00:57:06.440 uh no no we haven't used those in production okay yeah perfect yeah so to to tell you a
00:57:13.640 bit about us initially the way we worked is that or still work is is we support our customers gateways right we don't
00:57:21.280 enforce necessarily anything we have Partnerships and then we're you know we have um a very good knowledge of how
00:57:28.039 gateways work and how providers work and we're able to sort of suggest the ones that fit best with our customers should
00:57:33.280 they need it but generally we don't add that friction to the process uh the onboarding
00:57:38.359 process and could you give us examples of the different gateways that leop supports sure uh I mean you can think of
00:57:45.799 uh let's say boner uh Square vay Zoom World pay um
00:57:53.799 worldline repay repay plenty igen there's a bunch
00:57:59.640 of them to be honest perfect yeah so I was talking
00:58:05.160 about so you have to you have to be careful when you're in a situation where you have a web hook coming in that's
00:58:10.400 signaling uh a new payment and you're also in the process of um dealing with a
00:58:16.839 payload that came back to the browser telling you that a new payment was completed so in some cases you don't
00:58:22.559 want to get stuck creating duplicates uh and then one of the ways you could address this is you could either lock
00:58:28.480 the table or you could lock the records and then you'd make and then once you if you lock the record whoever
00:58:35.200 comes first is the one that gets to create the process the payment sorry and then the one that comes after you have
00:58:42.520 enough information in the payment you've created to determine that you're now trying to create the exact same payment
00:58:47.680 so you can just ignore that duplicates yes did you raise I thought you moved your hand
00:58:53.280 sorry perfect um does that make
00:58:59.640 sense good these are some interesting links in case you guys want to go and
00:59:04.799 read up on how payments work and um thank you do you have any questions anything you want to
00:59:12.599 yes one like when sometimes we use car or maybe we are also using UPI so the I
00:59:22.119 tap the car the payment is deded but uh we receive the failure the payment is
00:59:27.440 deducted but we but we receive the failure so how they manage to after like
00:59:35.599 credit the amount again in the bank sorry when you say the payment is directed but you receive a fail what
00:59:41.160 what do you mean like the amount is deducted from my card okay so okay yeah
00:59:46.480 but but I receive the failure from the API sometimes it's happen it's happen so
00:59:52.720 they also uh credit maybe after 24 or 72 hours after they credit the amount in
00:59:59.520 the bank it's DED before but I see the failure in the APA call but after seven
01:00:04.960 uh they also send a message if the amount is directed but you see failure but they 7 I think 24 72 hours they
01:00:13.680 credit again the amount in the bank so how they handle that sounds like an authorization it sounds like you tapped
01:00:19.119 your card the money the the transaction was authorized so so the funds were held
01:00:24.200 okay right so the the the spending space on your credit card just decreased by that amount and then 72 hours to 24 to 72
01:00:32.240 hours later what banks or or cards will normally do is they release authorizations that are not captured
01:00:37.640 right so the space comes back where you have a problem is if you make another
01:00:42.880 transaction uh it might fail because your initial authorization has removed
01:00:47.960 too much space from the spending capability and now the person can actually pay for it right that could
01:00:53.760 happen yeah sure but I mean when you say there's an API failure you just mean
01:01:00.160 that the actual apis for some reason have failed that is unrelated to the payment itself because you say we are
01:01:06.119 using so much like sometimes we are using so much AP like UPI because of there is also UPI
01:01:14.559 like you can scan the directly pay from your application like PM some other
01:01:20.880 sometimes you you pay the money but money d from your bank but it's after
01:01:26.520 that we see failure from the API so but like because why I know because when I call to the customer they say
01:01:33.799 after you will receive the money back yeah so how they hand that's my
01:01:41.960 like question like they like you say they authorize but uh the the fund is on
01:01:47.680 hold but you uh you face you see the error on your end so when the
01:01:53.440 authorized free so you receive the money back correct what what you could also do
01:01:58.480 is you could you could Implement a process that retries the capture not the authorization because you keep if you
01:02:03.559 keep authorizing then you're going to just burn the card yeah but you could retry a process to you could set up a
01:02:09.680 process to retry the capture depending on the type of error that you're managing like if you get like a a random
01:02:14.960 API error like timeout or or or unavailable or whatever then you can assume that it's a momentary thing and
01:02:20.559 then you can try uh the capture again in a certain amount of time what gets a bit difficult is if you have
01:02:27.680 a customer that's looking at the terminal while you're doing this then they've seen an error right they've
01:02:34.240 received an error message and they might be inclined to refresh the page and try to pay
01:02:40.279 again I think this is not related to like but this is also in car I have seen
01:02:45.839 on I think on YouTube but this is from the company they are they are dealing with the pay letterer method you are
01:02:53.920 paying right right now but the the merchant is directing from my card after like like I have a flexibility to pay in
01:03:01.480 installment sure so like uh how they handle the installment like they are
01:03:06.520 sending some notifications but I don't know the whole scenario I just see the ad I think the payment gate is called I
01:03:13.240 think Tamar I think I seen on internet so they are like firstly like when I C
01:03:18.480 my card there is no typing card they are just have my information so when I go to
01:03:24.839 Merchant so I pay by that company like Tamar so they deduct the amount from Tamara but I have to pay to Tamar in
01:03:31.960 install correct so tomorrow is essentially the one providing you financing for your assets and then you
01:03:37.680 around you turn around and you pay them right yeah but in installment so how they handle like so we also like
01:03:43.279 whenever I I'm paying the money to the merchant so we are also reing like because the uh payment always deduct
01:03:50.279 once in system we are generating an order only once but the the merchant is
01:03:55.880 receiving the payment for like if theying four install no the the so the merchant gets one payment the merchant
01:04:01.440 probably gets paid by tomara so the merchant gets tomara buys it for you tomara buys the asset and finances it
01:04:08.279 for you and you pay it back and the way tomara probably does this is when you make your initial transaction tomara gets a payment token or a tokenized
01:04:15.960 payment method and uh if that tokenized payment method is persistent meaning they can reuse it then they just reuse
01:04:22.960 it at whatever agreed upon dates um you know were yeah yeah like every week
01:04:29.720 every two weeks every so on right so we are receiving like every time when Tamar
01:04:34.760 reive the payment so every time they are sending web books to the system or just like they are receiving the money well
01:04:41.640 the merchant got paid right the merchant doesn't care anymore it's done right now what Tomar is doing is just getting
01:04:47.440 their money back with either interest or fees depending on how it works perfect because this is new thing
01:04:54.760 I I see like right now it's like booming right now
01:04:59.839 the No No but no no the by BAP is huge um the credit card companies and the bank Banks now are getting into bnpl
01:05:07.640 before it was just companies like Clara and so on that were doing this but uh but because there's a lot of money to
01:05:13.720 make be made or or or a lot of let's say value to get they're getting into it themselves too which is difficult
01:05:19.720 because it's like undercutting all those um all those like let's call it startups
01:05:25.400 uh because Banks and and credit cards have massive amounts of resources that these guys can't necessarily easily
01:05:31.359 compete so if you guys have if you guys noticed not too long ago all those bmls went down uh in value
01:05:38.440 so but I think they're going up now any other questions sh uh yeah before you were
01:05:45.119 talking about webs and duplicates yes what do you mean duplicates well this
01:05:51.319 was what I was mentioning is um if if your your front end is competing with
01:05:56.359 your your web your back end or your server that's receiving web hooks so if you make a payment um you have you have
01:06:03.240 a like an iframe let's say and the iframe makes a executes a transaction call to the gateway gateway returns um
01:06:12.000 essentially the final confirmation that the transaction was done successfully you get that back and then you're
01:06:17.559 creating your payment through that process but if at the same time you're getting a web hook because you could subscribe to web Hooks and web hooks
01:06:23.799 will still tell you payment successful even if your front end knows it's successful so you might have your front
01:06:29.799 end creating a payments while your your back end is man is processing a web hook that's telling him hey payment created
01:06:36.839 so you want to make sure that you're not creating duplicates the duplicate won't cause a consumer facing problem because
01:06:43.839 they they're not going to be build twice but it's going to cause a reporting problem on your platform because you're going to show your Direct customer that
01:06:50.160 is using your product that's you know the one let's say your Merchant your cupcake store that is using a platform
01:06:55.520 to sell its its cupcakes to the outside world they're going to see oh I got two payments right from Raphael but really
01:07:02.799 they just got it once okay uh yes multiple questions uh okay
01:07:10.839 one thing related uh kind of really topic is accounting sure so do you know
01:07:16.359 like especially for stripe uh in terms of accounting if they have a direct uh
01:07:21.839 integration for accounting or a to do accounting directly on stripe I don't know that's a good
01:07:28.200 question I know stripe supports invoicing and and Bill management uh I don't know if they can do accounting I
01:07:34.279 imagine that you can connect a lot of the big accounting platforms to stripe
01:07:39.640 some of that so some yeah I I would think so but but don't quote me I honestly that part I don't
01:07:45.599 know next question U the regarding the subscription uh especially with with
01:07:51.520 stripe uh if you have a subscription payment do you know if you have to uh
01:07:57.920 you have to manually uh tell stripe every time or you can but stripe can do
01:08:03.799 that too a lot of a lot of gateways offer recurring payment services so you can manage it yourself on your tool by
01:08:11.520 tokenizing and storing a persistent token and kind of having the subscription uh data model and
01:08:18.120 processing on your side and like every month you make a one sorry you make a
01:08:23.600 one time transaction for the amount that the person has agreed or you can probably create the subscription on the
01:08:30.759 Gateway side or the processor side or the whatever side and um have them deal with it and you get a web hook event
01:08:37.080 most likely every month when the transaction is either like created um
01:08:42.480 authorized captured successful failed whatever so you can you could it depends
01:08:48.239 on your on your business model it depends on what you want to do right you can either offload it to the provider or
01:08:53.600 you you can manage it yourself okay you could do you could do well okay yeah it it depends on what you're trying to
01:08:59.400 achieve like for example let's say you're trying to create the capability to generate payment arrangements like
01:09:05.120 like a bnpl you're trying to create a bnpl like experience then since that is
01:09:10.359 the core of your business you should probably manage the installments if you're
01:09:15.640 selling um I don't know you're selling a SAS service right you're selling something uh access to something that
01:09:22.640 costs $30 a month then maybe you don't care about this stuff because it's really not part of your core services
01:09:29.400 and let somebody else that's invested a ton of money in building it take care of it right okay yeah so you can have both
01:09:36.600 and you can choose based on your needs um and La last question is regarding the
01:09:42.759 the information when you purchase so each Merchant demands different
01:09:48.239 information some will ask for address some will ask for the CVB some ask
01:09:54.719 for the the card and and the full name some won't even care about the the full
01:10:00.560 name true so what what makes it that it's different is it that
01:10:06.440 every every payment is different or every bank is different or what makes it that every Merchant will ask different
01:10:13.360 information so it's I don't think it's so much the merchant that asks different information it's probably the services
01:10:19.520 that the merchant is using that require different information right um uh an example is uh if you take for example so
01:10:28.719 let's take um world line World line is a payment Gateway World line was previously called bambora um wordline
01:10:35.040 will underwrite a merchant create an account and that um Merchant can decide
01:10:42.719 if they want to enable what's called AVS AVS is like address verification it's
01:10:48.400 it's to ensure that um the person putting in the card information
01:10:54.280 also has the address at which that card was initially registered uh and you can
01:10:59.440 choose to either reject the transaction on AVS failure or you can choose to
01:11:04.800 still charge it right so it's it's a it's a it's a risk situation right for
01:11:10.719 example if I'm selling an asset you buy it and then I ship it to you then I want
01:11:17.600 to mitigate fraud and chargebacks because you've already gotten the assets right I've delivered it to you I I you
01:11:24.640 know I'll I'll recognize a loss so maybe I want to have something called address verification in place because I want to
01:11:29.679 make sure that um there's limited risk of something happening but any
01:11:35.880 additional option you enable always adds more friction in the transaction right
01:11:41.159 because you might forget the address you might not remember the postal code you might like um you might live in a rural
01:11:48.440 area that doesn't really have the same kind of address makeup that's recognized by you know the the provider so it it
01:11:54.520 really depends on what you're trying to I think at some point it's at the merchant level the merchant can decide what they want to enable or disable and
01:12:00.520 then it can also be at the underwriting level based on the risk what do I want
01:12:05.560 to what what information do I do I want to get to mitigate the risk of Fraud and
01:12:13.199 chargebacks I think when you make the request you get a a response message on
01:12:18.880 each payment and that could be yeah ABS failure or CVV fa your card you usually
01:12:24.880 get that at the authorization level like when you authorize the card that's when you send in the address and then at that
01:12:30.880 point you get a failure uh and if you're set up to break on failure then that'll
01:12:38.120 be the that will be the end of the authorization it'll be like a you know it'll be a zero it but if you're set up
01:12:44.199 to decide how you can manage it meaning you get the authorization you have a
01:12:49.719 response that says AVS failure you can decide to void the authorization or you
01:12:54.760 can decide to move forward and accept the risk any other
01:13:02.840 questions if I may ask um you spoke about buy now pay later yes you said
01:13:09.400 that is booming is it booming because why is it booming is it a free service because as a third party coming in isn't
01:13:16.440 it more expensive to have a third party coming in um who is going to charge
01:13:21.520 installment things like that so um like the the person purchasing the
01:13:27.080 the item if they are not paying right now do they end up paying more than what they yeah of course it's like so it's
01:13:33.440 not free so no no nothing is free um so by now pay later are sometimes free for the
01:13:38.760 consumers and it's the merchant that pays for example the merchant might pay so I think I don't know all the
01:13:44.639 different models but the way it works is that the merchant wants to sell its products right and say your product has
01:13:52.960 um a 30% margin right like you're selling a $1100 computer and uh you know it's the computer actually well 30% is
01:14:00.120 okay the computer actually costs $70 and you make $30 on it you you you put it in
01:14:07.159 the hands of somebody and on average factoring in um
01:14:13.080 delinquencies using a bnpl you're going to get $90 back you're still getting 20
01:14:18.679 bucks right so for you the risk the the the
01:14:24.040 risk of losing these transaction the risk of losing the transactions is um
01:14:29.639 worse than the risk of a few people not paying or finishing their commitments so
01:14:35.040 you still get your product out you still get a certain profit margin in and um
01:14:41.040 the rest is just the you know acceptable loss cost of doing business that could be one way of seeing the things right uh
01:14:48.120 because the merchant does you know it's better to get a 20% margin than to get
01:14:53.480 no margin right and also the also make money the person
01:15:01.960 don't pay the installment on time so they it depends the person who makes
01:15:07.000 money in your case might be the the bnpl service provider yeah they're the ones
01:15:12.040 because at this point you are now a customer of the bnpl you're not a customer of the merchant anymore yeah
01:15:17.080 right so um the bnpl might be free like for examp if you go to a store and you
01:15:23.040 buy your appliances and they say it's no interest payments for 24 months it
01:15:28.440 really is no interest payments until you miss a payment so uh and some of them
01:15:33.600 the way it works is it balloons to the end so you have 12 months to pay and if
01:15:38.920 by the end of the 12 months you are $100 you know in the hole then all the
01:15:45.840 unrealized interest comes down and hits you like a ton of bricks and so and that's how on average
01:15:52.120 they make their money right because because they they have to
01:15:58.320 yes yeah yeah so the the bnpl is the One charging interest and that's how they
01:16:03.440 they so they make a bit of money probably from the merchant side so the merchant pays for the capability of uh
01:16:10.960 selling their assets to people who are not able to pay the full amount or don't want to a lot of people can pay the full
01:16:17.199 amount they just choose to pay over interest for things like cash flow management right
01:16:27.199 sure any questions from you Andy did I miss any did I did I miss
01:16:36.080 anything
Explore all talks recorded at Montreal.rb Meetup
+6