response 25 of 59:

Jan 1 20:28 UTC 1995

I don't think it's about impulse so much as about convenience.  I find
mailing checks to be an annoying process, one that I go through once
or so a month for bills and think unkind thoughts about the whole
time, figuring there has got to be a better way to do this.  I hate
this quaint practice of moving around physical pieces of paper which
are read and processed by machines and therefore logically are just
data anyway, but that's just me.

Well, here's the condensed version of how it could work with First
Virtual, omitting some details, given what I know, I could be
mistaken, your mileage may vary, etc.

We establish a "merchant" account with FV.  People who have an FV
"buyer" account can have us "bill" things to it, which in turn goes on
to their chosen payment means with FV (currently MasterCard or Visa,
supposedly there are plans to support direct checking about debits as
well.)

(Getting a "buyer" FV account is free and fairly simple; it involves
filling out a short form with things like your email address and phone
number, and you phone up FV's computer's 800 number and use
touch-tones to give them your credit card number, which is never sent
over the net.  Its security is not perfect, but represents a trade-off
between safety and ease of use.  It's no less secure than most
standard credit card transactions; probably more secure than some.)

People on Grex somehow indicate a desire to charge a given amount on
their FV account; this could be done by a simple program that prompts
for some information and mails the "charge slip" off to FV, or it
could be done by hand.  After verifying the validity of the charge
with the user, FV sends email to our treasurer indicating the charge
was accepted, and then periodically the money gets transferred
directly into Grex's account.  The email is both human-readable and
machine-readable, so in principle its processing could be automated if
desired.

Setup is $10 (one-time) for the "merchant" account.

Per-transaction costs are $0.29 plus 2% of the amount; e.g. a $60
transaction would actually pay $58.51.  I think this could be a
problem with $6 payments, but establishing something like a
three-month minimum doesn't seem unreasonable.  [Heck, charging a full
year's membership and paying it off with interest is a lot cheaper
than paying $6 per month for a year.]

Once per period (I think a period is a month), if there are any
transactions, the total is automagically deposited in Grex's account
less a $1 fee for the transfer.  This is no problem if nobody uses
this service, and no problem if lots of people use this service, but
mildly annoying if one or two people use this service.

There are some other details that would need to get worried about, but
basically that's the deal.  This is me summarizing the information
from FV's web pages at <URL:http://www.fv.com/>, and I may be confused
somewhere.  It's also possible there are other hidden charges; for
instance, Grex's bank might assess a service fee for processing the
funds transfers.  If not, I suspect this is as good a pricing
arrangement as we'd get anywhere, and probably as convenient as can
reasonably be expected.

This is IMHO the only viable aspect of commerce on the Internet for
Grex's purposes that is available now.  Most electronic commerce
concentrates on things like secure versions of HTTP for transmitting
credit card numbers, but still expect the merchant (us) to have an
existing relationship with a bank for processing them via non-Internet
means.

Some other issues come up, of course.  There would be a somewhat
higher latency in terms of how long until we actually get the money,
and it's conceivable a charge noted as approved would later be
un-approved for some uncommon reasons like the account being obtained
in a fraudulent manner.  This probably isn't much if any worse than
the current issue of what we do if a check bounces.  (What do we do if
a check bounces?  Have any?)

response 27 of 59:

Jan 1 22:36 UTC 1995

This is an interesting service.  If I understand what Marc is saying,
FV does all the dealing with the credit card companies, and send the
money to us less a small--and I think reasonable--fee.  One thing I
wonder about is what happens if someone decides to challenge a charge,
but overall this looks promising.

So, Marc, if we sign up with FV are you going to join us?

response 29 of 59:

Jan 2 02:33 UTC 1995

Hmmmm.  I just had a look at the First virtual home page, and I don't
think they're offering the service we've been talking about here.  It
seems what they want to do is be the intermediary between the buyers 
and sellers of "information," not a clearinghouse for any kind of
credit-card purchase.

response 31 of 59:

Jan 2 21:57 UTC 1995

Not surprisingly, there were a few minor errors on my part.  Buyer
accounts actually would cost our users $2 to obtain.  It's still not
entirely clear whether this use would constitute appropriate use under
their guidelines; I'll see if I can get a hold of somebody there (I
know a couple folks in passing) and get a clarification.

response 33 of 59:

Jan 3 05:12 UTC 1995

   I meant that as a joke, mostly.  But one of our first members,
Brude Howard, was just that.  he was so interested in the idea of Grex
that he whipped out his checkbook and gave his check to eitehr Marcus or
Valerie(?).   ...So we really have had "impulse" buys.

response 35 of 59:

Jan 3 19:44 UTC 1995

OK, for the FV thingie, people outside the US can't access an (800) number
to give their credit card #. And, austensibly, this is one of the main
reasons for Grex to take credit cards.

Also, people can still dispute the charges placed through the FV system,
since they have up to 2 months to say they didn't make the charge or
didn't get the merchandise. The merchant has to prove the card holder placed
the order, and this is best done with a signature. I doubt that FV gets
a physical signature.

DanR says he doesn't like the idea of individual transactions. The bank
the merchant account goes through would make automatic (electronic) deposits
for each batch that was closed out, usually 2-3 days after the cards are
entered and then the batch is closed. There is a monthly fee the bank
charges, as well as the percentage, usually 3% nowadays. Fees can range,
but I think $30/month is about  right.

what else would you folks like to know about the mechanics of taking
credit cards?

        Pattie

response 37 of 59:

Jan 4 01:33 UTC 1995

Maybe this doesn't belong here, but it's just another option.  On several
bbs's I've checked out, they participate with some service that has a
900 number.  You call the number, which costs $10, and enter the id#
from the bbs.  That's usually right in the 900# info section.  Then
the 900# service gives you a code.  You go back to the bbs and enter
the code, which immediately changes your status.  If it was possible to
configure the 900# for a different charge (like $6 instead of $10), this
might be a really attractive option to many.

response 39 of 59:

Jan 5 19:34 UTC 1995

Talked to FV and they confirm that collecting donations for Grex should be
an appropriate domain for an FV accout if that's something we decide to do;`
I can send Dan a copy of the note if you like.

If it is decided that it's a sensible option, I probably could be talked
into hacking together some software for handling it.
(or just about any other competent programmer could do it.)

response 41 of 59:

Jan 6 02:01 UTC 1995

Hmmm... do 900 numbers work internationally?  I know 800 numbers
generally do not...

Would it be possible to have a 900 number which bills for a
user-specified amount, rather than a fixed charge?  (Unless we have
something like "Six dollars per minute, stay on three minutes for voting
status, tem minutes for a one year membership."  Ugh.  Doesn't sound
practical.  And what would we let people listen to for ten minutes?  The
sound of backups live from the Dungeon?  A tape of the last board
meeting? :-)

I would sort of assume we would need to have somebody else actually
operate the service and receive a portion of the money.  Anybody have a
good idea of how much of the revenue stream would get gobbled up by the
operator and the telco?

response 43 of 59:

Jan 6 08:12 UTC 1995

Danr is right that Grex is about the size where the membership record
keeping and the money handling functions should be separated. Then, the
treasurer just receives and disburses the funds, but some "office"
function receives (and records) checks and other receipts, and keeps the
membership role. In some organizations this is the secretary, though there
are often different types of secretaries - executive, recording, office,
etc. Well, as usual, I've gone further than necessary. Let's just consider
separating the functions. 

response 45 of 59:

Jan 6 17:02 UTC 1995

Many of our telnet users come in through the MSU public gopher
client or similar avenues.  Just because they can reach Grex
through the Internet doesn't mean they have unrestricted telnet
access.

response 47 of 59:

Jan 6 22:17 UTC 1995

Uh, most mom and pop businesses are in it for the money, and
don't mind spending non-insignificant amounts of time keeping the
books.  Our treasurer is a volunteer, with a real job.  If we
grow much larger we may have to look into paying a CPA to keep
our books.

response 49 of 59:

Jan 7 04:38 UTC 1995

I don't want to put a wet sponge into things, but as things stand, I do
not believe Grex is anywhere near secure enough to have "real money"
floating on this system.

Here's the kind of "worst case scenario" I think any sort of online
money system should be able to survive: the hacker breaks in, steals
root, and has the ability to read or write any file on the login server,
or to muck around with any of the system software and send any sort of
data out on the network.

Here's a kind of minimum list of improvements I think we'd need to be
able to do the online FV thing:

 (1) a network authentication server on a separate secure machine,
        with appropriate firewalls between it and the login machine.
 (2) 24 hr hardware access and "instant response team" in case of
        penetration.
 (3) a "money" server that is also protected like the network
authenticaiton
        database, and using appropriate encryption technology between it,
        the login server, and fv, such that the bad guy can't forge
        phony charges, and that excessively weird activity can be dealt
        with appropriately.