Electronic Payments Step Three - How to Create and Sign an Electronic Payment Authorization

Editor's note: Rozanne Andersen, VP & Chief Compliance Officer for Ontario Systems, has written an informative and educational series of articles on payment systems. This is the third in the series. Read them all:

Electronic Payments Step One - Understand the Terminology
Electronic Payments Step Two - Understand Your Authorization Requirements
Electronic Payments Step Three - How to Create and Sign an Electronic Payment Authorization
Electronic Payments Step Four – Don’t Forget the FDCPA, the Consumer’s Rights, or the Proper Notices

This article previously appeared on Ontario System's blog and is republished here with permission.

-----

Now that we’ve covered terminology and authorization requirements, we will turn our attention to the requirements incidental to various types of electronic payment authorizations.

Documenting the consumer’s authorization varies by the type of electronic transaction. To start, terms of a preauthorized electronic funds transfer (Pre-EFTA) must be evidenced by a document and signed or similarly authenticated by the consumer using, for example, a paper writing, webpage, IVR or email. The signature to a paper authorization may be assented to and signed by the consumer using a wet signature, while the signature to a webpage, IVR or email-documented authorization may be assented to and similarly authenticated by the consumer in accordance with the Electronic Signatures in Global Commerce Act (E-Sign Act).

[article_ad]

Be aware of an alternative approach to documenting a Pre-EFTA authorization inferred by many compliance attorneys from the CFPB’s November 2015 Guidance Bulletin: In this Bulletin, the CFPB suggests the E-Sign Act may be interpreted to permit the use of a voice recording to create the Pre-EFTA authorization and to sign or similarly authenticate it.

The EFTA "does not prohibit companies from obtaining signed, written authorizations from consumers over the phone if the E-Sign Act requirements for electronic records and signatures are met." [See: Requirements for Consumer Authorizations for Preauthorized Electronic Fund Transfers, CFPB Compliance Bulletin 2015-06, 11232015, Fed. Banking L Rep. (CCH) P 49-635, 2015 WL 10372389]

The recent case of Blatt vs. Capital One Auto Finance Inc. (COAF) - Case No. 2:15-cv-00015 (M.D. Tenn. Feb. 17, 2017) - has buoyed the argument espousing the position that a voice recording may serve as a means to create the authorization for the Pre-EFTA.Claiming the EFTA governs proper authorization of electronic fund transfers according to 15 U.S.C. § 1693, Blatt argued the defendant violated the EFTA in two specific ways:

(1) COAF did not obtain his authorization to the recurring payments in writing, as the EFTA requires; and

(2) the May 8, 2014 letter COAF mailed to Blatt was insufficient to meet the EFTA's requirement that COAF mail a copy of the authorization to him.

The Court held in favor of the defendant on both counts and explained the defendant stipulated to the legitimacy of his electronic signature obtained electronically (albeit using an IVR process) and was provided with a copy of the electronic authorization in paper form. The court found it persuasive that the defendant did not provide Blatt with a copy of his authorization in the form of an electronic record and instead sent Blatt a paper copy of the authorization.

You should consult with independent legal counsel on this issue if you are considering using a voice recording to create Pre-EFTA authorizations. While it is clear an electronic recording can be obtained using a voice recording, it remains an open question whether a voice recording can indeed meet the E-Sign Act requirements for the Pre-EFTA authorization. [See: http://files.consumerfinance.gov/f/201511_cfpb_compliance-bulletin-2015-06-requirements-for-consumer-authorizations-for-preauthorized-electronic-fund-transfers.pdf]

Regardless of the form of the authorization, after the consumer signs or similarly authenticates it you must promptly provide the consumer with a copy of the Pre-EFTA authorization by mail or by way of an FDCPA appropriate email. We recommend interpreting “promptly” as “within 24 hours.” Also, do not confuse your duty to provide the consumer with a copy of the authorization with an opportunity for the consumer to print the authorization off a web page. The latter does not satisfy the requirement.

Finally, when a Pre-EFTA varies in amount or timing from the previous transfer under the same authorization you must send the consumer written notice of the amount and date of the transfer at least 10 days before the scheduled date of transfer. In addition, you must inform the consumer of the right to receive notice of all varying transfers. However, when doing so you may give the consumer the option to receive notice only when a transfer falls outside a specified range of amounts or only when a transfer differs from the most recent transfer by more than an agreed-upon amount. [See: Official Interpretation to 10(d) (1)]

Then, dot the I’s and cross the T’s:

Electronic payment authorization requirements differ in timing, form and content depending upon the type of electronic payment. Moreover, authorizations that must be signed or similarly authenticated by the consumer in compliance with the Electronic Signatures in Global Commerce Act (E Sign Act) require the consumer to “affix” their signature to the authorization as their electronic signature.

Credit card authorizations may be documented by a voice recording and need not be signed or similarly authenticated by the consumer. If your organization does not have the ability to record the credit card authorization using voice recording technology, you may want to use a web, email or paper exchange to create evidence of the consumer’s authorization. Among any other required disclosures, be sure to include these elements in your credit card authorization:

Confirmation of the consumer’s name or identity
The amount of the charge
The date of each charge
Credit card number, expiration date and card verification data [3-4 digit number]
Method to revoke the authorization

Single electronic funds transfers and/or single debit or single prepaid card authorizations may be documented by a voice recording and need not be signed or similarly authenticated by the consumer. If your organization does not have the ability to record the authorization using voice recording technology, you may want to use a web, email or paper exchange to create evidence of the consumer’s authorization. Among any other required disclosures, be sure to include these elements in your single debit or single prepaid card authorization:

Confirmation of the consumer’s name or identity
The amount of the debit
The date the debit transaction will be processed
Debit or prepaid card number, bank routing number, expiration date and card verification data [3-4 digit number]
Method to revoke the authorization

All of the information required for these authorizations may be obtained and documented in writing, webpage, voice recording, IVR or email. The consumer need not sign or similarly authenticate credit card or single debit or single prepaid card authorizations.

Preauthorized recurring electronic funds transfer payment authorizations (Pre-EFTA) require more information than credit card and single EFT payment authorizations, including:

Confirmation of the consumer’s name or identity
The amount of each recurring debit payment, or a reference to the method used to determine the amount of each recurring payment
The timing (including the start date), number, and/or frequency of each recurring payment
The debit card number, expiration date and CSC number or the number of the account to be debited and the bank routing number
A telephone number available to the consumer and answered during normal business hours for customer inquiries, revocations, cancellations and stop payments;
The method by which the consumer can stop payment, revoke or cancel the authorization [See below for more detailed information about this requirement]
Statement confirming the date of the consumer’s verbal authorization
The consumer’s verbal, tone or click indicating their assent to the agreement to pay and their intention to sign the authorization electronically by associating a sound or words or click agreement with the authorization

If this seems like a lot of work to document these notices, with a lot of detail – It is. That’s why many who accept electronic payments opt to automate, and coordinate efforts with their partners to remove the element of human error. And this is only the tip of the iceberg. We’ll dive below the surface compliance obligations next.

----------------

Disclaimer: Ontario Systems is a technology company and provides this blog article solely for general informational and marketing purposes. You should not rely on the content of this material for any other purpose or as specific guidance for your company. Ontario Systems’ advice, services, tools and products described herein do not guarantee compliance with any law or industry standard. You are ultimately responsible for your own company’s actions and compliance efforts. Because everyone’s situation is different, you must consult your own attorneys, accountants, and/or other advisors to obtain specific advice on your company’s compliance, legal, tax, regulatory and/or other business needs. Despite Ontario Systems’ efforts to provide current and up-to-date information, you need to recognize that the information contained herein may become outdated quickly and may contain errors and/or other inaccuracies.

© 2017 Ontario Systems, LLC. All rights reserved. Information contained in this document is subject to change. Reproduction of this publication is not permitted without the express permission of Ontario Systems, LLC.