Entire Credit Card Does Not Display with Authorize.net

[s1b]

At the end of December 2022, I switched from Chase Paymentech to Authorize.net. I can no longer view entire card numbers.

From Miva Admin - Viewing Payment Data for an Order -This is what is happening when trying to display the full credit card:
“Card Last Four: 2145” - displays in regular view data - locked
“Card Number: XXXX2145” – this data displays after unlocked/encryption key entered.

Encryption Key created on 12/28/2022. I created this key after installing Authorize.net

“Store Entire CC Number (Requires Encryption)” has been checked since I installed Authorize.net

THIS IS ONLY HAPPENING with Authorize.net. I previously had Chase Paymentech and had no issues. I can still view the entire credit card number on the orders that were processed with Chase.
I have checked all of my settings and don't see anything that I am missing.

This is a problem as I have custom orders that a client enters at my store. I am now experiencing the following issues because I can't view the entire card.
1 - Upon completion of the order, the total order charge changes, more often than not, I charge more than the original amount. Clients are fully aware of this on custom orders - we have a + or - policy on custom orders. I am now unable to charge for the added balance within Miva.
2 - On some orders, we also capture the credit card for 50% of the order amount upon order placement. I then void the balance of the authorization because some orders can take up to 30 days to ship so we need to release the remaining authorization/hold on the credit card. When we are ready to ship, we then authorize/capture the balance (without CVV) via Miva Admin. I am now unable to do that in Miva since I am unable to view the entire credit card.
3 - Sometimes after order placement, a client will request a change that causes an increase.

Does anyone else have this problem with Authorize.net - or - process cards similarly?

Thanks!
Corina

[ILoveHostasaurus]

This is an intentional functionality limitation in the authorize.net Accept.js method of accepting payments. When a shopper on your site submits the card, that input box is managed by javascript served directly from authorize.net. The card is submitted directly to authorize.net from the shopper, ensuring your site never touches it, which greatly reduces your risk footprint from a PCI and/or liability standpoint. Our software requests the card number from them, however, they do not return the entire card, just the partial, so we have no way to obtain the full card.

What I would recommend you consider as an alternative would be to make use of our free MivaPay service. You can continue to use Authorize.net as your payment gateway, but the shopper's card number flows from them to our MivaPay service, and your store is issued a token for making use of that card number. As long as they keep that card, or other cards, stored in their account in your store, you can generate future orders and charges against the card. You will not have the number itself, but the store can make use of the stored card(s). They can of course go in and remove the stored card at a later date, preventing you from charging it, but if they were doing so maliciously, they'd likely just dispute the second and final transaction you were planning to charge them for regardless.

You could accomplish the above in a few ways. Ask them to set up an account and store a card, then perhaps you approve their custom order and ask them to purchase a custom product that's priced at 50%, or even do it for them. You place a second order for them later on, including adjusting price if needed. You could have a placeholder product with a custom attribute dictating price, so they can set it and order it without your intervention. You could even charge installments along the way; however works best per customer.

[s1b]

If I am following the solution correctly, the customer would have to save and store the card to their account for this "fix." If they opt to not store the card or create an account, then I am in the same predicament.

I work with attorneys and am regularly resetting or reassigning accounts when interns leave, etc. That is why I never added a "save credit card" option. If I were to install MivaPay - do I have the ability to remove all the saved cards for an account? I would have to remember to remove any saved cards before reassigning an account to a new email/contact.

Thanks for your help!
Corina

[ILoveHostasaurus]

Yes, you can delete cards that have been saved in a given customer account from within the store. If the shopper account itself is deleted, the cards associated with it are automatically removed. It is likely to become increasingly difficult to save raw credit card numbers in all payment gateways because all providers are slowly but surely moving away from allowing that for PCI, phishing, and liability reasons. They want to control the input boxes and attempt to limit data theft.