Home / Transactions

Authorization Controls

Overview

AuthControlsImage.svg

Spend Rules

Spend Rules can be created against specific data on an authorization. You can create Spend Rules that base decisions on merchant category codes, country code of the merchant's acquirer, amount for a currency, card verification value (CVV) result, address verification result (AVS), and merchant identifiers.

Each Spend Control Rule dimension has its own mutation in the API.

Merchant Category

Merchant category codes (MCC) can be used to restrict and block spending at certain merchants. For example, you can block your payment cards from being used to buy airline tickets or only allow your payment cards to be used to purchase fuel.

Our API Reference lists all of the value merchant categories you can block. We rely on data sent to us by the card networks and acquirers in order to determine which category a merchant belongs.

Merchant Country

Merchant Country Spend Rules can be used to restrict and block payments based on the merchant’s geographical location. For example, you can block all payments to merchants located in a specific country that your business may have deemed as high risk.

You can find a list of countries that can be blocked or allowed in the API Reference. In case a blocking rule is set up for the specific location, the payment would be auto declined.

Card Verification Value (CVV)

Card Verification Value (CVV) control can be set to require users to enter their Payment Card’s associated CVV at the point of checkout. CVV checks help verify that the card is in the intended account holder’s possession, and thereby reduce the risk of fraudulent transactions.

You can configure this Spend Rule to block authorizations, based on the CVV response code. For example, you could set a rule to decline all Authorizations to an online merchant in case of a CVV mismatch.

Street Address

Street Address Spend Rules can be set to require Account Holders to enter their Payment Card’s associated address at the point of checkout to run an Address Validation (AVS). This is typically configured for card-not-present transactions, where an Account Holder is physically unable to present a card, increasing the risk associated with the transaction.

You can configure this Spend Rule to block Authorizations based on the AVS response code. For example, you could set a Spend Rule to decline Authorizations at online merchants in case of an address mismatch to control for potential fraudulent behavior.

Amount

Spend Rules on Amount can be set by configuring the maximum currency amount an Account Holder can successfully be authorized against in a single transaction. For example, in the case of setting a spend amount of $100 on a corporate expenditure, an Account Holder would be authorized to make purchases up to a $100 per transaction (i.e. an Authorization would be declined for a $110 but can make two $55 payments).

Merchant Identifier (MID)

When processing transactions, merchants optionally supply an identifier, often called the "MID". The merchant identifier field provided in Highnote’s API accepts input of either a merchant identifier or card acceptor identifier.

Highnote’s Spend Rules allow you to block transactions for specific Merchant Identifiers (MIDs). For example, you can restrict payment cards from being used at a particular online retailer.

Point of Service Category

Point of Service Category Spend Rules can be used to allow or restrict purchases at certain types of payment terminals, such as ATMs or gas station fuel dispensers. For example, you can create a rule for your Account Holders to only approve authorizations at AUTOMATED_FUEL_DISPENSER or AUTOMATED_TELLER_MACHINE point of services.

Attaching to a Card Product

Once you have created a Spend Rule, you can attach the rule to a Card Product. Attaching to a Card Product means that all Payment Cards that have been issued to the Card Product will start using the Spend Rule on future authorizations.

Additionally, you can attach a specific version of the Spend Rule to a Card Product or use the LATEST keyword to always use the most recent version. Using a specific version allows you to make changes to a Spend Rule without affecting current authorizations.

Attaching to a Payment Card

Once you have created a Spend Rule, you can attach the Rule to a Payment Card. Attaching to a specific Payment Card means that the spend rule is only evaluated for that particular Card.

Additionally, you can attach a specific version of the Spend Rule to a Payment Card or use the LATEST keyword to always use the most recent version. Using a specific version allows you to make changes to a Spend Rule without affecting current authorizations.

Updating a Merchant Category Spend Rule

Over time you may need to update the logic of a particular Spend Rule. You can make adjustments by using an update mutation and reattach the new version to any card products, or payment cards that use the rule.

Velocity Controls

Velocity Controls are an extension of Spend Rules, where a time boundary constraint can be applied to a Spend Rule. For example, a Spend Rule may be set to decline all authorizations greater than $1,000 on a payment card; a Velocity Control may be supplemented to the Spend Rule to decline any authorizations which exceed $1,000 in spend within a calendar week. Velocity Controls allow you to refine transaction authorization decisioning to better target fraudulent behavior or allow your customers to budget their spend on your product.

Adding a Spend Rule to a Velocity Control prohibits cumulative spend within a specified time frame: daily, weekly or monthly. A Velocity Control must have an Amount Spend Rule and 2 additional Spend Rules may be added. Cumulative spend amount is based on the sum of all approved authorizations within the cadence you specified on the Velocity control. Daily, weekly, and monthly Velocity Control cadences are available for use at the Payment Card or Card Product level.

Note: Refunds and reversals will not impact the cumulative amount on a Velocity Control.

Create Velocity Control with Spend Rule(s)

After you’ve created your Spend Rule(s), you can create your Velocity Control and connect the Spend Rules. Once the Spend Rule is associated with the Velocity Control, the Spend Rule will calculate cumulative authorizations which meets the Spend Rule’s criteria within the timeframe specified on the Velocity Control. Up to 3 Spend Rules can be associated with a Velocity Control.

Note: An Amount Spend Rule (a cumulative rule) is required to create a Velocity Control.

For example, if you attach an Amount Spend Rule of $1,000 and a Merchant Category Code Spend Rule to allow Airline purchases to a monthly Velocity Control, the user will be declined for all authorizations with cumulative monthly spend greater than $1,000 on Airline purchases. Non-Airline purchases will not count towards the cumulative, monthly $1,000 spend limit on the Velocity Control; all Spend Rules on the Velocity Control must be true for the amount to accumulate.

Attach Velocity Control to a Card Product

Similar to Spend Rules, Velocity Controls can be attached to a Payment Card or a Card Product. Attaching a Velocity Control and Spend Rule to a Card Product will apply the authorization rule(s) to all Financial Accounts' Payment Cards on your Card Product.

Attach Velocity Control to a Payment Card

Velocity Controls and their associated Spend Rules can be attached to individual Payment Cards.

Detach Velocity Control from a Card Product

Over time you may need to update the logic of a particular Velocity Control and it’s associated Spend Rules. You can detach a Velocity Control from a Card Product using the mutation below.

Note: If you update a Spend Rule associated with a Velocity Control, the Spend Rule and Velocity Control will be updated and the Velocity Control cache will reset. Similarly, if you detach and then re-attach a Velocity Control, the balance will reset.

Detach Velocity Control from a Payment Card

You can detach a Velocity Control from a Payment Card using the mutation below.

Note: If you update a Spend Rule associated with a Velocity Control, the Spend Rule and Velocity Control will be updated and the Velocity Control cache will reset. Similarly, if you detach and then re-attach a Velocity Control, the balance will reset.

List Velocity Controls

You can query for a list of the Velocity Controls created within your Organization.

Find Velocity Control Balances

Velocity Controls cache the purchase amount of the authorizations in the specified timeframe, which meet the criteria in the associated Spend Rules. You can look up the cumulative current balances of a Velocity Control on a Payment Card or Financial Account to understand when or why an authorization may be declined. The balances on the Financial Account will belong to the Velocity Controls associated to the Card Product. The balances on the Payment Card will belong to the Velocity Controls associated to the Payment Card.

Provide Feedback

Was this content helpful?