{"id":3973,"date":"2024-07-24T09:00:00","date_gmt":"2024-07-24T07:00:00","guid":{"rendered":"https:\/\/en.wubook.net\/blog\/?p=3973"},"modified":"2024-07-23T13:58:51","modified_gmt":"2024-07-23T11:58:51","slug":"all-the-risks-of-manual-pan","status":"publish","type":"post","link":"https:\/\/en.wubook.net\/blog\/all-the-risks-of-manual-pan","title":{"rendered":"MOTO operations: risks and contraindications of manual PAN"},"content":{"rendered":"\n

Dear WuBookers,
as anyone who has been running a property for a while knows, \u201ccard not present\u201d transactions (i.e., in the absence of the customer) have been strongly discouraged by European regulation for the past few years. Indeed, the regulations aim to protect buyer and hotelier from the possible – and unfortunately frequent – risks related to so-called manual PAN<\/strong>. Let’s review them together, analyzing how they can be avoided also thanks to the application of the so-called PSD2.<\/p>\n\n\n\n

What is manual PAN and what is meant by MOTO transactions.<\/h2>\n\n\n\n

Let’s start by unraveling some acronyms: MOTO refers to transitions that occur via POS as a result of an order received by mail or telephone (the acronym stands for \u201cMail Order \/ Telephone Order\u201d). These transactions require the hotelier to manually register the<\/strong> guest’s credit card<\/strong> when the guest is not physically present at the hotel. The concept is thus associated with manual PAN, where the PAN (Primary Account Number) is the typically 16-digit number found on the front of payment cards.
In other words, whenever a manager receives a customer’s card information to make a remote charge, we are dealing with a MOTO operation.<\/p>\n\n\n\n

All the risks of manual PAN<\/h2>\n\n\n\n

Seemingly very convenient, manual PAN carries several risks for guests and hoteliers. The first concerns the proper handling and storage of the data<\/strong> by the hotelier, who will have to make sure to carefully protect the information captured to avoid incurring penalties or causing unintentional harm to the customer.
Then it is not certain that the bank will authorize the transaction, especially if it is a European institution, where PSD2 (which we will discuss in a moment) applies.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

The customer themselves could also disallow the charge<\/strong>, as it occurred in their absence. In the event of a dispute, it is up to the property to produce the necessary documentation to prove that the transaction took place with the card owner’s consent, averting the risk of a claim for reimbursement (\u201cchargeback\u201d). An eventuality that could cause quite a few difficulties, especially if the order was placed by telephone, and give rise to recurring fraud attempts<\/strong> against the hotel.
Also to prevent this from happening, ad hoc legislation was introduced in Europe a few years ago to protect merchants and buyers when remote payment occurs: the PSD2.<\/p>\n\n\n\n

PSD2 and SCA: standards and requirements to ensure secure payments<\/h2>\n\n\n\n

The full name is \u201cPayment Services Directive 2,\u201d but it is better known by the abbreviation PSD2 and aims to make digital payments more secure<\/strong>.<\/p>\n\n\n\n

Among the new features introduced by the decree is SCA, which stands for \u201c Strong<\/strong> Customer<\/strong> Authentication\u201d.<\/strong>
<\/strong>Unlike the classic manual PAN, in which it was sufficient to have the card number, SCA requires the additional use of at least 2 of the following<\/strong>:<\/p>\n\n\n\n