Refunds and Fraud Prevention

How did credit card refunds originally work?

For a long long time, the rules were simple. You needed the entire card in front of you. When sending in a request for a refund, you provided the entire card number, expiry and amount.

 

About the Refund Rules (as we understand them today)

Credit card providers felt that the simple rule had too much potential for fraud. And it did: bad guys with cards figured out how to create a lot of refunds and steal a lot of money.

Each credit card merchant provider instituted one or more out of a number of rules to thwart fraud, making the refund process difficult. This generally works fine for one off refunds, but hampers the process when trying to do mass refunds to an entire event meaning it may need a lot of manual intervention.

 

What a Mixture of Rules means for Refunds

Some of the techniques credit card providers implemented that make the refund process difficult to navigate are below. Since the rules have been implemented over time, you may find that mass refunds might encounter one or more of these scenarios:

NOTE: you can set which type of refund(s) your merchant provider allows in merchant setup

If you are allowed both, Theatre Manager tries Linked refunds. If that fails, you can chose to do an independent refund on the payment window

Independent Refunds, Payments Not Linked To An Order

Sending the entire credit card number and expiry date is now known an INDEPENDENT REFUND. This allows a merchant to refund any amount to any customer using and card even if:
  • the amount refunded is more that the original authorization
  • the card number is different than the one used for original authorization

An independent refund means you must supply the full credit card number and expiry. You either have this (because it is encrypted on the database) or you ask the customer for it.

If you have shredded old cards and do not have it encrypted on the database, then you cannot do an independent refund. It will need to be a linked refund (which is generally preferable for the credit card companies)

Bambora and Elavon (Miami-Dade) do not support this feature and only allows linked refunds

To our knowledge, all other merchant providers support independent refunds and some require this permission to be specifically requested.

Conditions Action or Workaround
You must have:
  • stored encrypted credit card data in your database or
  • contact the patron to get the card number
Verify that your PCI Settings in Default Data is PCI Schedule D, with many days of retention since last use of card.
  • The retention period must be at least as far back as you need to go since TM automatically shreds credit cards.
  • For example, if you have 180 days of retention, any card authorized before that cannot be refunded and you will need to contact the owner to get the card and re-enter it.
  • However, most cards in a mass refund should work without issue.
  • If you don't have the encrypted card data for a patron, you must contact them to get the card number to refund to
Some merchant providers require you to sign up for INDEPENDENT REFUNDS. Contact your merchant provider to ensure that you have this feature enabled if you need to do mass refunds. You can call your merchant provider after and disable it when done.

eg:

  • Moneris gives a distinct error if you do not have the feature.
  • Auth.net may need it enabled to correct some error conditions since their refunds are automatically settled (and can't be voided), redoing a refund would need to use Independent Refund
End of day may appear out of balance for Authorize.net Authorize.net processes refunds right away. If you do a lot of refunds before the sweep time and settle end of day after the sweep time, you may be told that you are out of balance by what seems to be the total amount of your refunds.
Refund rejected because card is shredded If you see a message saying that the card was rejected because no encrypted card is on file, then you are trying to do an independent refund.

Instead, change the setting in your merchant profile to allow linked refunds first.

Linked Refund: Merchant Provider limits refunds to xx days to same order using tokens

This is a relatively recent fraud prevention technique implemented by some merchant providers (Moneris, Bambora, PaymentTech Orbital, and Authorize.net) to limit refunds to an amount that has previously been authorized on the card and prevent potential fraud from the wide open "free for all" called Independent Refunds

A linked refund does not require the full credit card number. Instead, it uses a token representing a particular authorization that the merchant processor gave Theatre Manager at time of authorization.

This is the only method of refund that can be used if you are shredding credit cards for PCI compliance.

 

Linked Refund Rules

Typical rules that merchant providers implemented for linked refunds

  • within xxx days since the original authorization. The default we've seen is 120 days.
  • by referencing the same order as the original authorization
  • using the saved transaction token from the original authorization (instead of the credit card data)
  • for no more than the amount of the original authorization (less any other refunds to the card already)
This restriction seems reasonable. If Theatre Manager is able to do a refund with a prior card payment, it will. It usually works.

 

Conditions Action or Workaround
Refund rejected because card is shredded If you see a message saying that the card was rejected because no encrypted card is on file, then you are trying to do an independent refund.

Instead, change the setting in your merchant profile to allow linked refunds first.

Refund gets rejected because of age
IF YOU RECEIVE A MESSAGE THAT THERE ARE NO PRIOR PAYMENTS...

if you receive a message from Theatre Manager there are NO PRIOR PAYMENTS when doing a refund, the root cause is because merchant providers have been forcing venues into using linked refunds, meaning the merchant providers imposed a typical time limit of having to refund within 120 days of purchase.

YOU MAY NEED THE LINKED REFUND AGE LIMIT CHANGED

Each venue seems to have a different time limit and you can set it in Theatre Manager's Merchant Setup. It may work if you increase the time frame. If not, ask your merchant provider to increase the number of historic days you are allowed to process refunds. We have seen clients with limits as long as 365 days.

Refund Rejected because it is too much In a LINKED REFUND, you can only refund the a maximum amount of the original credit card payment.

If the patron paid with two different payments methods (eg: part in cash and part in credit card), then you will need to:

  • adjust the refunded amount to be no more than the amount available to refund on the card
  • if there is more than one cards in the list, then refund what you can to each one -and-
  • then refund the rest using a check or some other payment method.

NOTE: If the message below indicates your merchant setup supports Independent Refunds, AND you know the entire card number, CVV2 and expiry date, you might be able try an independent refund instead.

Refund gets rejected because it is not connected to order If there are multiple credit card payments for the order and you get this message, you may be affected by the timing of when the payment was authorized. You could have:
  • Authorized an amount many months ago, before the merchant provider instituted linked refunds - in which case Theatre Manager would not have the token available for refunding
  • Authorized an additional amount in the order for exchanged tickets which happened after the implementation of linked refunds (approximately fall 2019) - in which case Theatre Manager would have the token available for that card.

Theatre Manager presents a list of credit cards to refund to - pick the one you want, If you try to refund too much, you'll see an error like the image below. IF this is the case, then break the refund up into smaller amounts.

At this time, the way to refund this card is to either ask for independent refunds, or to employ a trick and:

Refunding against Shredded Credit Cards

In order to do independent refunds, Theatre Manger may be able to use the original encrypted credit card stored on file. However, Credit Cards can be shredded if they have passed their retention period.

Conditions Action or Workaround
Payments without full card data will be rejected with invalid PAN numbers

or that card number has been shredded

If your PCI Settings in Default Data is Schedule C, or D and the retention period for the card has expired, you might see this error.

It means that you attempted to refund to a shredded credit card. The way to refund in this situations is:

  • Ensure you have independent refund capability
  • Call the patron and get their credit card number ending in xxxx
  • Use the following steps to change a post dated payment credit card in any location that it allows it
  • then Authorize the post dated refund in End of Day deposits or Till Balance

Refunds accepted to a certain amount and start getting rejected

Sometimes refunds just work during a day, then they don't.

Conditions Action or Workaround
You may have daily or weekly limits to the amount that can be refunded Verify with your merchant provider if there are limits. If so, then when doing a mass refund to an event:
  • Create all refunds to credit cards.
  • Do not authorize the cards at time of refund - which saves them for end of day
  • In end of day, Authorize refunds up to your limit, use the Remove button in the Deposit window to remove the rest of the refunds. Authorize the remaining refunds on subsequent days.
You may have limits based on bank balance Verify with your merchant provider and bank if there are limits based on balance. If so, then when doing a mass refund to an event:
  • Create all refunds to credit cards.
  • Do not authorize the cards at time of refund - which saves them for end of day
  • In end of day, Authorize refunds up to your limit, use the Remove button in the Deposit window to remove the rest of the refunds. Authorize the remaining refunds on subsequent days.

Refunds with merchant profiles enabled

Merchant Profiles are a feature provided by some merchant providers where, during an authorization:
  • The patron provides the card data to Theatre Manager during an authorization
  • Theatre Manager sends the data to the bank and receives a UNIQUE TOKEN back
  • and the unique token can be used for all subsequent authorizations or refunds, without ever needing the card data again, making it suited for post dated payments for schedule 'C' compliance.

Conditions Action or Workaround
Some cards are accepted and some rejected If you have merchant profiles enabled and cards are being rejected:
  • You may not have a profile for the patron.
Theatre Manger only creates profiles for patrons when they use a card for the first time -or- if you asked Theatre Manager to convert any encrypted card data into merchant profiles after setting the flag.

You cannot create a profile for previously shredded card data.

First Transaction Cannot be a Refund

Conditions Action or Workaround
Cannot send a refund after completing an end of day Some merchant providers instituted a policy that the first transaction after settling batches or the fraud transaction in any calendar day could not be a refund, since that might be considered the first step to fraud.

If Theatre Manager gives you a message that it cannot process a refund as the first transaction, it may be as simple as turning ON setting that first transaction can be a refund in your merchant setup to seeing if your merchant provider still enforces this rule. If they still do, then contact your merchant provider to get that rule waived.

End of Day Imbalance due to Sweep Time

This condition pertains to refunds that actually worked, but causes a seeming out of balance error condition in End of Day when depositing. You may get a list of transactions that are in Theatre Manager and not in Authorize.Net or vice versa.

Conditions Action or Workaround
Refunds appear in Theatre Manager and not in Authorize.net
Refunds are processed immediately by Authorize.net.

If you do a lot of refunds before the sweep time and settle end of day after the sweep time, you may be told that you are out of balance by what seems to be the total amount of your refunds.

See explanation why Authorize.net processes refunds right away.

Transactions in Authorize.net but not in Theatre Manager
Print the Audit report and refer to the help around reading the audit report and actions to take

Refunds using Full Card Data (stored)

Individual Refunds

Individual refunds are easiest when you can refund to a credit card on file. This is possible if

  • You keep encrypted data in the database for all patrons by using Schedule D with a reasonable retention period -or-
  • You are using merchant profiles and a profile has been created for the patron because they used the credit card to buy something -and-
  • You are allowed to do independent refunds by your merchant provider.

 

Mass Refunds of tickets to Events

You can do mass refunds if you have card data stored in the database if the patrons card data meets the individual criteria above.

 

Possible Errors doing Refunds with Full Card Data

We recommend doing the refunds first, then authorizing during end of day. This gives you more control over the authorization process. Typical issues that can arise are:

  • Credit card rejected - you will need to call the patron
  • Independent Refunds - you might see these if they are enabled by your merchant provider.
  • Linked Refunds - you might see some of these errors if independent refunds are not enabled.
  • Shredded Card Errors - the system might create a payment for a shredded credit card. Naturally, this will be declined. The card can be entered manually during end of day.

Independent Refunds using Full Card Data (entered)

Individual Refunds

Refunding using full card data means that you are able to enter the patron's credit card in full and ask for a refund. You should receive an authorization.

Refunding with no previous card on file requires:

 

Mass Refunds of tickets to Events

You cannot do mass refunds unless you have card data (or a merchant profile) stored in the database. If you find that you need to refund a lot of people and have neither, you can still use the mechanisms described in refunding to an entire performance

  • The best way is by:
    • opening the performance attendance tab
    • selecting tickets to an order
    • and refund on a case by case basis (described in the above link)
  • You can refund all tickets and then create refund payments later -or-

 

Possible Errors doing Refunds with Full Card Data entered by you

Since you have to be talking to a patron to refund money when typing in the full card data, you are able to ask them for their card data.

Typical issues that can arise are:

  • Credit card rejected - you will need to call the patron
  • Independent Refunds - you might see these if they are enabled.
  • First transaction is a Refund - You might be prevented from refunding as the first transaction of the day - which might need a flag changed.

Linked Refunds using tokens within xx days

Individual Refunds

Refunding using tokens is like refunding using merchant profiles. It means that you can select a prior card owned by the patron on the payment window based on the last 4 digits. The payment window will appear to show a masked credit card number.

Then submitting the refund for authorization, you are restricted to the rules of Linked Refunds. You must pick a card that belongs to the order, otherwise you will not receive an authorization.

IF YOU RECEIVE A MESSAGE THAT THERE ARE NO PRIOR PAYMENTS...

if you receive a message from Theatre Manager there are NO PRIOR PAYMENTS when doing a refund, the root cause is because merchant providers have been forcing venues to use linked refunds, meaning they imposed a typical time limit of having to refund within 120 days of purchase.

In these times of crisis, each venue seems to have a different time limit and you can set it in Theatre Manager's Merchant Setup. It may work if you increase the time frame. If not, you may need to talk to the bank to have them raise the timeframe on their end as well.

 

Mass Refunds of tickets to Events

Mass refunds of tickets and creating payment at time of refund using tokens is currently not supported.

You can open the attendance window and refund patrons orders one by one, selecting card as the refund method. This will invoke refund by token for that order.

 

Possible Errors doing Refunds with Merchant Profiles

Typical issues that can arise are:

  • Credit card rejected - you will need to call the patron
  • Linked Refunds - you might see some of these errors.

Refunds using Merchant Profiles

Individual Refunds

Refunding using merchant profiles means that you can select a prior card owned by the patron on the payment window based on the last 4 digits. The payment window will appear to show a masked credit card number.

Then submitting the refund for authorization, your merchant provider subjects you to the same rules depending on whether you can do:

  • Independent Refunds: the only difference is you are not typing the credit card and do not need to talk to the patron to get it
  • Linked Refunds: if you pick a card that doesn't belong to the order, you will not receive an authorization

 

Mass Refunds of tickets to Events

You can do mass refunds of tickets using merchant profiles. TM will attempt to use the merchant profile and apply an independent refund. Linked refunds are currently not supported for mass refund of tickets.

 

Possible Errors doing Refunds with Merchant Profiles

We recommend doing the refunds first, then authorizing during end of day. This gives you more control over the authorization process. Typical issues that can arise are:

  • Credit card rejected - you will need to call the patron
  • Independent Refunds - you might see these if they are enabled.
  • Linked Refunds - you might see some of these errors if independent refunds are not enabled.
  • Shredded Card Errors - the system might create a payment for a shredded credit card. Naturally, this will be declined. The card can be entered manually during end of day.