- The customer selects their card and configures the controls the issuer has made available.
- A secure communication channel is established between the issuer’s mobile gateway and the Customer Rules API on the Visa Developer Platform. The PAN is encrypted in transmission.
- VTC verifies the account number is within the issuer’s prescribed BIN range and the application is authorized by the issuer. VTC then checks if a “document” already exists for this combination of account number and appID. If so, it returns the existing documentID; otherwise, VTC will create a new control document
Visa On-Behalf-Of Service Flow
- Merchant submits an authorization request (0100).
- Visa sees the account participates in VTC (via whitelist). Sends the authorization data to VTC for a decision. If the transaction violates a VTC setting, then it will be declined in STIP. NOTE: VTC rules are applied after all other Visa risk and processing rules are applied.
- Visa sends a decline response back to the merchant; and,
- Visa sends an Advice msg (120) to the issuer with new STIP Reason Code “9037” identifying the transaction as declined due to VTC settings. The issuer processor will have to update their authorization platform to accept this new value in an existing field.
- If the cardholder’s VTC setting indicates an alert should be triggered; then VTC will send the notification information to the issuer’s Notification Service for final delivery to the cardholder.
- The Notification Service will use the VTC information to identify the cardholder and to send the cardholder notification based on the customer’s communication preferences (SMS, email or Push-Notification).