IPPay System Reference Manual – Revision 1.

IPPay™
End User System Reference Manual

Document revision 1.3

6 October 2008

1
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

Table of Contents
Introduction 3

DECLINE Response Codes 4

AVS Result Codes 7

CVV2/CVC/CID Result Codes 9

CAVV Result Codes 10

2
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

Introduction

GetReporting.com is IPPay’s real-time online solution for all transaction reporting needs. GetReporting
provides consolidated real-time reporting on all types of electronic payment transactions and provides a simple
and integrated view for reconciliation and review.

In some instances, independent software vendors integrating into IPPay may choose to hide generated response
action codes in order to simplify things for users. However, getting as much information as possible about a
particular transaction becomes useful when trying to perform advanced troubleshooting on problem
transactions. GetReporting provides the advanced user access to this information.

When viewing transaction records within GetReporting, one can view additional transaction codes generated
by the IPPay system that provide more detailed information generated by IPPay. This document discusses the
various codes generated by IPPay and the meaning behind each code type.

3
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

DECLINED Transaction Codes

The IPPay™ System generates a “DECLINED” transaction for many different reasons. The following table is
useful for understanding the various ActionCode results that can occur.

Note that many ActionCode values are associated with a particular credit card type. Any penny-value not
defined on this list will return a “000” ActionCode.

ActionCode Description
001 (V/MC) Refer to card issuer. (Visa/MC)
100 (AMEX) Deny (only for Internet transactions). (Amex)
002 (Visa) Refer to card issuer, special condition (Visa)
003 (V/MC) Invalid Merchant or Service Provider (Visa/MC)
004 (V/MC) Pick up card. (Card most likely reported stolen) (Visa/MC)
200 (AMEX) Deny – Pick up card. (AMEX)
005 (Visa) Do not honor. (Visa/MC)
100 (AMEX) Deny. (AMEX)
006 (Visa) Error. (Visa)
181 (AMEX) Format error. (AMEX)
007 (Visa) Pickup card, special condition. (Visa)
200 (AMEX) Deny – Pick up card. (AMEX)
012 (V/MC) Invalid Transaction. (Visa/MC)
104 (AMEX) Deny – New card issued. (AMEX)
013 (V/MC) Invalid amount. (Visa/MC)
110 (AMEX) Invalid amount. (AMEX)
014 (V/MC) Invalid account number (no such number). (Visa/MC)
111 (AMEX) Invalid account. (AMEX)
015 (V/MC) No such issuer (Visa/MC)
111 (AMEX) Invalid account (AMEX)
019 (Visa) Re-enter transaction (Visa)
103 (AMEX) Deny – Invalid manual Entry 4DBC (AMEX)
182 (AMEX) Please wait (AMEX)
109 (AMEX) Invalid merchant (AMEX)
187 (V/MC) Person claimed they never received the card from (Visa/MC)
the bank and bank is shipping them a new card
809 (Visa) Surcharge amount not permitted on Visa cards (Visa)
805 (Visa) Force STIP. (Visa)
030 (MC) Format Error. (MC)
057 (Visa) Transaction not permitted to cardholder. (Visa)
061 (Visa) Invalid amount. (Visa)
806 (Visa) CVV2 Failure. (Visa)
807 (Visa) Card authentication failed. (Visa)
055 (Visa) Incorrect PIN. (Visa)
055 (Visa) Incorrect PIN. (Visa)
808 (Visa) Revocation of Authorization. (Visa)
808 (Visa) Revocation of Authorization. (Visa)
808 (Visa) Revocation of Authorization. (Visa)
111 (Amex) Invalid account. (AMEX)
912 (V/MC) Invalid Card (Visa/MC)
917 (V/MC) Expired Card (Visa/MC)
999 (Visa) Unable to go online; declined. (Visa)
041 (V/MC) Pick up card (lost card). (Visa/MC)
200 (AMEX) Deny – Pick up card. (AMEX)

4
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

ActionCode Description
807 (Visa) Card authentication failed. (Visa)
043 (V/MC) Pick up card (stolen card). (Visa/MC)
200 (AMEX) Deny – Pick up card. (AMEX)
899 (Visa) Unknown action code returned. (Visa)
051 (V/MC) Insufficient funds. (Visa/MC)
110 (AMEX) Invalid amount. (AMEX)
052 (Visa) No checking account. (Visa)
105 (AMEX) Deny – Account Cancelled. (AMEX)
053 (Visa) No savings account. (Visa)
105 (AMEX) Deny – Account Cancelled (AMEX)
054 (V/MC) Expired Card. (Visa/MC)
101 (AMEX) Expired Card. (AMEX)
055 (V/MC) Incorrect PIN. (Visa/MC)
183 (AMEX) Invalid currency code. (AMEX)
057 (V/MC) Transaction not permitted to cardholder. (Visa/MC)
115 (AMEX) Service not permitted. (AMEX)
058 (V/MC) Transaction not allowed at terminal. (Visa/MC)
103 (AMEX) Deny – Invalid manual Entry 4DBC. (AMEX)
059 (Visa) Suspected Fraud. (Visa)
061 (MC) Exceeds withdrawal amount limit. (MC)
110 (AMEX) Invalid amount. (AMEX)
062 (V/MC) Restricted card. (Visa/MC)
189 (AMEX) Deny – Cancelled or Closed Merchant/SE (AMEX)
063 (MC) Security violation. (MC)
065 (MC) Exceeds withdrawal count limit. (MC)
188 (AMEX) Deny – Expiration date required. (AMEX)
075 (V/MC) Allowable number of PIN-entry tries exceeded. (Visa/MC)
076 (MC) Invalid/Nonexistent “To Account” specified (MC)
077 (V/MC) Previous message located but data is inconsistent (Visa)
with original message.
Invalid/Nonexistent “From Account” specified. (MC)
078 (V/MC) Blocked, first used. (Visa)
New cardholder, card not unblocked yet
Invalid/Nonexistent account specified (general). (MC)
188 (AMEX) Deny – New Card Issued (AMEX)
080 (Visa) Credit issuer unavailable. (Visa)
125 (AMEX) Invalid effective date. (AMEX)
081 (Visa) PIN cryptographic error found. (Visa)
082 (Visa) Negative CAM, dCVV, iCVV or CVV result. (Visa)
122 (AMEX) Invalid card (CID) security code. (AMEX)
083 (Visa) Unable to verify pin. (Visa)
084 (MC) Invalid Authorization Life Cycle. (MC)
400 (AMEX) Reversal accepted. (AMEX)
992 DECLINE/TIMEOUT.
091 (V/MC) Issuer unavailable (STIP not applicable or (Visa/MC)
available)
107 (AMEX) Please Call Issuer (AMEX)
092 (V/MC) Destination cannot be found for routing (Visa/MC)
093 (Visa) Transaction cannot be completed; violation of law. (Visa)
094 (MC) Duplicate transmission detected. (MC)
096 (V/MC) System Malfunction. (Visa/MC)

5
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

Other Responses
The responses on the previous table are not the only ActionCode values you can obtain. Some responses are
generated internal to the IPPay™ server, relying on information already configured within IPPay™ and not
relying on external communications.

A “025” ActionCode is generated when a record cannot be found. For example, if a merchant sends a “CAPT”
transaction to IPPay™, attempting to capture a previously authorized transaction, IPPay™ sends a “025”
ActionCode whenever that previously authorized transaction cannot be found in the database. Because a
merchant can only capture an authorized transaction that has been sent previously, it’s important to recognize
that this “025” ActionCode will be sent whenever that authorization is absent.

The “981” ActionCode is generated by IPPay™ for merchant accounts that are configured to reject transactions
based on AVS results. By observing the AVS results, the merchant can verify that transactions are being
properly rejected by IPPay™ whenever the configured AVS responses appear. Unless a merchant’s account is
boarded to reject certain AVS results, this “981” ActionCode will not appear.

For merchants who do not accept certain credit card types, the “913” ActionCode gets returned when those
card types are detected. For example, a merchant who does not wish to accept any Discover cards can be
boarded to automatically decline that card type; whenever a Discover transaction is sent by that merchant, a
“913” ActionCode is returned. Only a merchant account that is boarded to reject certain card dtypes will
receive this “913” ActionCode.

If you receive a “900” ActionCode, your incoming XML transaction contains an XML syntax error. All XML
documents that are not “well-formed” cause the IPPay™ server to return a “900” ActionCode. Additionally,
data values submitted in your XML might be invalid IPPay™ syntax, and this will also return a “900”
ActionCode. Within a “900” response will be an ErrMsg tag delimiting an error message; this will explain
the technical reason (and frequently the location) for a syntax error. By comparing the ErrMsg text to your
submitted XML, you can figure out how to correct all “900” responses. You should correct all “900” syntax
errors on the test system before sending any transactions to the production server.

6
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

AVS Result Codes

IPPay™ offers cardholder address verification through AVS, a system available widely throughout North
America and much of Europe. With address verification, the merchant submits a customer’s address and postal
code information in a transaction and the credit card issue verifies and validates the address information against
their internal billing address data. The result code sent by an issuer advises the merchant of a customer’s billing
integrity when completing the credit card transaction.

Visa and MasterCard both call this feature AVS, which stands for “Address Verification Service.” American
Express calls this feature AAV, which stands for “Address Authentication and Verification.”

Almost all North American issuers support AVS using Visa and MasterCard association rules. According to
these rules, an issuer compares the numeric digits within a cardholder’s address and postal information with
their own stored billing information. All alphabetic information is ignored. The address and postal code match
(or fail to match) and an AVS result code is generated by the issuer. This is returned to the merchant during an
authorization.

American Express adds cardholder name matching to their AAV. A merchant can submit their customer’s
name in addition to the billing address information and may receive a number of additional AVS result codes.
Shipping address information may also be submitted in an Amex transaction, and additional result codes are
anticipated from Amex in the future.

For most issuers, the AVS works independent of the action code. In other words, a transaction may be
approved even though billing address information doesn’t match. Because transaction approval is independent
of billing address integrity, it’s up to the merchant to decide the importance of correct billing address
information when completing a sale. A merchant may simply allow a transaction to proceed, or a merchant
might independently discontinue the sale in spite of an approval.

IPPay™, based on the AVS result code, automatically fills the AddressMatch and ZipMatch elements.
The possible AddressMatch and ZipMatch values are “Y”, “N”, or “X”, and the value is determined with the
AVS result code.

IPPay™ offers an “Automatic AVS Rejection” feature, where merchants may automatically decline transactions
showing degraded AVS results. Automatic AVS Rejection is an optional service that requires a merchant to
subscribe before IPPay™ will automatically reject transaction on behalf of the merchant.

7
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

A result code indicating the AVS (“Address Verification Service”) results for a transaction may be “A”; “B”;
“C”; “D”; “Y”; “M”; “X”; “F”; “G”; “I”; “K”; “L”; “N”; “O”; “P”; “R”; “S”; “U”; “W”; “Z”.

AVS Result Description

A (all) Address matches, postal code absent or does not (All)
match.
D (all) Street address and postal code match. (Visa/MC)
CM Name incorrect, postal code matches. (Amex)
M (all) Street address and postal code match. (Visa/MC)
CM Name, street address and postal code match. (Amex)
N (all) Neither address nor postal code matches. (All)
R (all) Retry. (All)
S (all) AVS unavailable. (All)
U (all) AVS unavailable. (All)
Z (Visa) W was replaced by Z. (Visa)
W (MC/Amex) Postal code matches, address absent or does not (MC)
match.
CM Name, street address and postal code are all (Amex)
incorrect.
Y (all) Street address and postal code match. (All)
Z (all) Postal code matches, address absent or does not (All)
match.
B (Visa/MC) Street address match. Postal code has invalid (Visa/MC)
format.
E (Amex) CM Name incorrect. Street address and postal code (Amex)
match.
C (Visa/MC) Street address and postal code have invalid (Visa/MC)
formats.
K (Amex) CM Name matches. (Amex)
G (Visa/MC) Non-AVS participant outside U.S. Address not (Visa/MC)
verified.
L (Amex) CM Name and postal code match. (Amex)
I (Visa/MC) Street address not verified for international (Visa/MC)
transaction.
O (Amex) CM Name and address match. (Amex)
P (Visa/MC) Postal code match. Street address has invalid (Visa/MC)
format.
F (Amex) CM Name incorrect. Street address matches. (Amex)
X (Visa/MC) Nine-digit postal code match in U.S. Postal code (Visa/MC)
and address match for outside U.S.
F (Visa) Street address and postal code match for U.K. only (Visa)

8
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

CVV2 Result Codes

IPPay™ enables credit card validation through the CVV2 feature, a system widely supported throughout the
credit card industry. With this feature, every physical credit card has a three- or four-digit value imprinted on
the credit card in addition to the card number. Submitting this three- or four-digit “security code” enhances
fraud detection for a transaction, ensuring that a genuine physical credit card is present during that transaction.

Visa cards have a three-digit CVV2 value, MasterCard cards have a three-digit CVC2 value, and American
Express uses a four-digit CID value to enable card validation. This three- or four- digit value is found imprinted
on the back side of a credit card, usually inside the signature block (it may also be imprinted on the front side of
the card).

The response code to a Visa CVV2 or a MasterCard CVC2 or an American Express CID submission may be
“M”; “N”; “P”; “S”; “U” or “Y”

o M – CVV2 match
o N – CVV2 Not Match
o P – Unable to Process
o S – The CVV2 should be on the card but merchant indicates it is not
o U – The Issuer is not certified or has not provided Visa with encryption keys.
o Y – Invalid CVV1 Track Present

Participation in CVV2/CVC2 is optional for issuers. The subscribing issuers submit their CVV2/CVC2 keys to
Visa and MasterCard, and these keys are kept secret. The individual CVV2/CVC2 implementation policies of
the tens of thousands of issuers are confidential, and issuers may changes their internal CVV2/CVC2 policies
without notification. Statistics are unavailable as to how many issuers subscriber (or don’t subscribe) to
CVV2/CVC2.

Issuers may decide to return a “806” action code, indicating that a Visa issuer has declined a transaction due to
the submission of an invalid CVV2 value. The “806” action code (a response allowed under Visa’s association
rules) enables issuers to independently decide a policy of rejecting transactions having invalid CVV2 values.
An “806” action code may have a “N” or “U” or “P” response, but never an “M” response.

Another factor that may affect CVV2 result codes is stand-in processing. When Visa or MasterCard performs
stand-in processing for an issuer (because the issuer is otherwise unable to respond directly for a transaction),
Visa/MC will perform the CVV2 calculations on behalf of any issuers who subscribe to CVV2.

9
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991
 IPPay System Reference Manual – Revision 1.3

CAVV Result Codes

Cardholder authentication is now available in the credit card industry through Visa’s Verified by Visa program
and MasterCard’s SecureCode program. Using these systems, an ecommerce merchant enables their customer
to submit an account ID and a password to authenticate their presence during an online transaction. The
authentication process generates a token; the token is submitted within an authorization for a transaction.

IPPay supports these two programs, allowing CAVV and UCAF data to be submitted to IPPay. The merchant
receives a CAVV result code after a transaction is approved.

The response code to a Visa CAVV or a MasterCard UCAF submission is “0” through “9” or ”A” through “D”,
where:

0 – CAVV authentication results invalid.

1 – CAVV failed validation – authentication

2 – CAVV passed validation – authentication

3 – CAVV passed validation – attempt

4 – CAVV failed validation – attempt

5 – Not used (reserved for future use)

6 – CAVV not validated, issuer not participating in CAVV validation

7 – CAVV failed validation – attempt (US –issued cards only)

8 – CAVV passed validation – attempt (US –issued cards only)

9 – CAVV failed validation – attempt (US –issued cards only)

A – CAVV passed validation – attempt (US –issued cards only)

B – CAVV passed validation – information only, no liability shift

C – CAVV was not validated – attempt

D – CAVV was not validated – authentication

10
16W235 83rd Street, Suite A, Burr Ridge, IL 60527  Phone: (847) 346-0990  Fax: (847) 346-0991