Custom Payment Gateways Development and Their Integration Opportunities

Due to the variety of choices, the “build” route may not initially seem attractive. However, larger companies, who have already done a preliminary vendor assessment, are quick to notice that there are certain limitations, inherent to the off-the-shelf payment gateway infrastructure. In particular:

• A single payment gateway rarely accepts all types of payment methods that you need.
• There may be geographical limitations, and the processor may only support payments from customers located in certain regions.
• Cross-border payment processing fees are steep.
• Enterprise payment gateway services usually come with a higher price tag. As well, you have to meet a certain monthly/yearly transaction threshold to qualify.
• Vendor lock-in is inevitable.

Custom software development addresses these limitations and brings in additional benefits for your business.

The Benefits of Building a Custom Payment Gateway

Better Customization

Create a payment experience that truly matches your business needs and develop a precise feature to support your operations (instead of paying for functionality that you don’t need).

If you refer to our payment gateway list, you’ll be quick to notice that not every payment solution offers recurring, mobile, or multi-currency billing. Finding a payment gateway that, for instance, supports direct debit (SEPA/ACH) and credit card processing at the same time, is quite challenging too.

Lastly, enterprise-grade features are often sold as add-on modules, making the total cost of ownership even higher.

Larger Scope of Payment Gateway Integrations

Develop a custom API to integrate your payment gateway into any type of products – desktop, mobile and web apps, wearable devices, digital kiosks, smart vending machines, or on-board computers in connected cars. With a robust API, you are free to integrate your gateway into as many mediums as you like without any limits.

You can also connect your merchant app to any in-house systems:

• Cloud ERP
• ITSM/ITOM management suite
• Accounting software
• Payroll management app
• Financial reporting software and analytics suite.

Doing so will help you gain a single-pane view in your payment operations. Furthermore, you can send your consolidated data for further analysis to self-service BI apps to obtain additional customer insights or capture anomalies, indicating payment fraud.

Lower Transaction Processing Fees and TCO

Most payment gateways providers charge fees per transaction that vary depending on the customers’ payment method and location, as well as your monthly turnover/transaction volume. These factors cannibalize your profits and can add up quickly. While a custom payment gateway system is more expensive to build, in the long run, it can generate significant savings.

In addition, every payment processor charges separately for disputes, chargebacks, bounced payments, and arbitration. A custom solution minimizes or eliminates these costs.

Innovative Security

Data breaches are not a common occurrence among payment gateway solutions, as most providers invest heavily in security.

However, as the 2019 Application Report published by F5 Labs, suggests few processors can withstand the new type of payment fraud – formjacking.

Formjacking is a form of Megacart attacks. It stems from the fact that a lot of companies now use externally hosted 3rd party shopping carts and credit card payment systems. Such payment experience heavily relies on the usage of imported code libraries and third-party scripts hosted on the web. This means that most of the code responsible for processing sensitive customer information exists outside the purview of the business’s security teams.

Hackers were quick to recognize this trend. What’s even worse is that since most businesses stick with just a handful of popular e-commerce payment gateways, the malicious party only needs to compromise a single component within such a system to gain access to a huge pool of data. The goal of formjacking attacks is to gain access to the system by siphoning sensitive customer information (login credentials, credit card numbers, etc.) from online payment forms.

The same report estimates that in 2019, over 1,396,969 cards were compromised with formjacking. The e-retail industry, in particular, was the prime target. However, some transportation companies got a severe hit too. For instance, Delta Airlines, British Airways, and Amtrak are responsible for 60% of the breached payment cards.

Source

Such breaches are less likely to happen with a custom payment gateway, as your IT security team has full control and visibility into all the payment end-points. Besides, you can implement more advanced customer authentication mechanisms, for instance, powered by biometrics.

On-brand Payment Experience

Merchant gateway providers offer only a certain extent of customization in terms of payment experience. In most cases, you won’t be able to majorly change the standard payment flow or introduce custom payment steps. This, in turn, creates additional friction for your customers, as well as for your payment team, forced to spend a lot of time on manual payment reconciliation, invoice processing, and custom quotes (for instance).

A custom solution is developed based on your needs and can be fine-tuned to precisely match your billing cycles and financial operations. Furthermore, you can infuse it with new-gen automation (powered by RPA and AI) to make your team more productive.

Compliance

Businesses operating in highly-regulated industries may not find a suitable option on the typical payment gateway providers list. For instance, some providers may not meet the requirement of local customer data storage or fail to meet security standards for cloud data storage. Others may not have a GDPR compliance status yet.

Building a custom payment processor that is compliant with PCI DSS, PSD2, and any other local regulations isn’t an easy task too. However, you retain more control over how each component is developed, how sensitive data is processed, and where it is stored.

Besides, if you partner with an experienced financial software development company, you’ll receive strategic advice and proactive guidance on meeting all the compliance requirements. At Infopulse, we also provide our clients with access to our proprietary Standards Compliance Management tool that assesses your current level of security compliance and suggests the next steps for optimizing your compliance-related processes according to specific security and privacy directives such as ISO 27001 and GDPR among others.

How to Develop a Payment Gateway: Key Challenges Addressed

As suggested in the previous section, compliance will be one of the central challenges of developing a custom solution for your business. So, let’s focus on this matter first.

PCI DSS and PSD2 Compliance

PCI DSS (Payment Card Industry Data Security Standard) is a joint security directive created by four credit-card companies: Visa, MasterCard, Discover, and American Express. The main aim of PCI DSS is to minimize security risks during payment transactions and protect sensitive cardholder information.

In total, there are over 300 compliance requirements, grouped into 12 categories:

Source

While PCI DSS can seem monumental, in reality, it all boils down to following the otherwise necessary software security requirements and ensuring proper data storage.

Below is a quick roadmap towards PCI DSS v3.2.1 compliance:

• Understand which requirements apply to your business. PCI DSS comes with four levels of required compliance based on the volume of credit card transactions your company processes annually.
• Figure out which types of transactions you plan to support based on the provided SAQ (self-assessment questionnaire).

If you already process cards via a third-party payment processor/payment gateway, you should also:

• Map out your data flows. Understand how customer data is traveling through your business systems, where it is stored and processed. In particular, identify every business area that involves payment processing; record how the data is stored and who has access to it; gauge which internal systems and technologies interact with payment transactions – data centers, cloud storage, network systems, etc.
• Conduct a security assessment to see how your current setup stacks against PCI DSS requirements.

Based on this data, you can create the necessary security roadmap for developing a custom gateway.

PSD2 (Payment Services Directive) is another security directive issued by the EU governments. Despite that, it is gradually gaining traction in the US and other regions. Becoming a PSD2 compliant is essential if you plan to accept credit card payments from European consumers.

Primarily, PSD2 is aimed at minimizing card-not-present fraud and introducing strong customer authentication (SCA) for transactions. The regulators placed a strong emphasis on supporting multi-factor authentication based on a combination of knowledge, possession, and inherence factors.

• Inherence factors: fingerprint, retina and iris scanning, face recognition, voice and vein recognition, keystroke dynamics, heart rate, and body movement pattern.
• Acceptable possession factors: OTP-verified devices, cards, apps or browsers; in-browser QR code scans; digital signature based on hardware and software tokens.
• Knowledge factors: passwords, PINs, passphrases, memorized swipe paths, or patterns.

Note: As a standalone measure, 3-D Secure – an XML-based protocol that acts as an extra security layer for online card transactions – isn’t considered a sufficient inherence factor and does not meet SCA requirements.

In Europe, the official deadline for becoming SCA compliant is December 31st, 2020. At the same time, individual countries have the right to extend this deadline for payment gateway companies and payment processors. For instance, the UK’s Financial Conduct Authority (FCA) agreed to a phased implementation of SCA based on an 18-month plan. The regulator will not take any action against organizations who “can show evidence that they have taken the necessary steps to comply with the plan,” but haven’t fully met all the requirements.

Thus, if you plan to release a new payment system for websites in 2020, SCA compliance is not optional. Similarly, to PCI DSS, meeting all the outlined requirements is a matter of security diligence and adherence to the latest best practices for financial software development.

Infopulse team has recently helped an educational services provider to deploy a custom cloud-based portal for processing customer payments. The new solution is fully compliant with DSS, ISO, PSD2, and GDPR.
Find more details in the case study.

Fraud and Scam Prevention Mechanisms

Most of the payment regulations are chiefly aimed at creating a secure payment experience for customers. However, adding a custom payment gateway also creates additional risks for you as a business: additional exposure to customer payment fraud, malicious chargebacks, and unsolicited disputes.

The most effective way to address these is to incorporate a machine learning-driven fraud detection system for all inbound and outbound transactions. Such systems have proved to have 90% higher fraud detection accuracy rates and can reduce investigation time by 70%. The major advantage of ML is that such systems progressively learn about different types of transactions and common customer behaviors to detect fraud at the onset.

Top-Notch Customer Experience

With on-site payment processing comes an added responsibility for building a user-friendly payment interface and shopping cart experience. Because every variable counts: customers today are fast to abandon a payment page. Industry-wide, 79% of carts are abandoned, according to SaleCycle. Oftentimes, this decision is explained with the quality of a gateway:

• 15% of users abandon a shopping cart due to poor experience
• 6% abandon due to limited payment options
• 4% abandon due to technical issues.

Thus, don’t underestimate the importance of good UX design. Take the time to develop a set of user stories that match different payment scenarios. Eliminate unnecessary steps and minimize the number of forms, especially during mobile checkout. Enable single-click payments for returning users and leverage biometric authentication methods instead of clunky passwords to reduce friction even further.

Below are several bite-sized usability tips for payment systems:

• Pre-fill forms
• Provide tooltips to guide users
• Clearly communicate errors
• Prominently display the total price
• Test different button texts and colors to improve conversions.

Conclusions

Building a custom payment gateway isn’t something every business will need. Smaller to medium-sized companies will benefit more from payment gateway integration services, rather than full-fledged development. However, large enterprises that need a robust, secure, and on-brand payment gateway to match their financial operations will realize more value from building a new solution from scratch.

Schedule a free consulting session with one of our specialists to understand which option will work best for your business.