Online ordering for a corner store: the payments side

Adding an ordering page to a counter business changes your payments profile more than most owners expect. You become a card-not-present merchant: different fraud exposure, different dispute rules, different interchange, and a publicly reachable checkout that anyone on the internet can send transactions to.

None of that is a reason not to do it. All of it is a reason to set it up deliberately rather than bolting a payment button onto a website.

Does your existing merchant account cover it?

Often not fully. Accounts are underwritten for a described business, and an in-store retail account may not be configured for card-not-present volume. Running online sales through a retail account without telling your provider is a good way to trigger a review or a hold.

The fix is a phone call before launch. Tell them what you are adding, what volume you expect and what the average ticket will be, and let them configure it.

What fraud controls need to be on?

Four, and most gateways ship with them off. Require the card security code. Enable address verification and act on the result. Limit attempts from a single source so the checkout cannot be used for card testing. And block after a run of consecutive declines.

Ask your provider about the available authentication programmes too, since some shift liability on qualifying transactions. That is a conversation worth having before the first dispute rather than after.

What does pickup discipline mean?

Matching the person collecting the order to the order. For a store, this is where almost all card-not-present fraud is stopped: an order paid online and collected by anyone who says the right name is an easy target.

A workable rule is that first-time orders are collected with the card used, or identification matching the name. Regulars get the fast version. The rule costs a few seconds on the orders that matter and nothing on the rest.

How should refunds work?

Back to the original card, promptly, and with a clear policy on the page. Online orders generate more cancellations and more mistakes than counter sales, and a store that is slow to refund converts an ordinary annoyance into a chargeback with a fee attached.

Write the cancellation and refund terms on the ordering page in plain words. That page is also your evidence if a dispute arrives, which is a second reason to keep it clear.

What about the statement descriptor?

Set it to something a customer will recognise. A large share of disputes start with somebody not recognising a charge on a statement, and an online order placed on a Tuesday and disputed three weeks later is exactly the situation where an unfamiliar descriptor causes trouble.

Check what yours says today by looking at a real charge. It was set when the account opened and it is frequently a legal entity name no customer has ever seen.

What is the minimum viable setup?

A hosted checkout from an established provider, so card data never touches your site. The four fraud controls above, switched on. A descriptor customers recognise. A written refund policy. And a pickup rule your staff can apply without judgment.

That is an afternoon of configuration and it removes most of the ways this goes wrong. Add the pickup rule to your opening checklist so it survives staff turnover, because the control only works if the person on the counter at seven in the evening knows it exists. The Federal Trade Commission's data security guidance is a reasonable companion read for anyone building it.