acv validation

[jimathtrf]

Am running MIVA Merchant 4, compiled, for a long time using simple validation. Been having problems with bogus card users and have turned on ACV (reject if zip code does not match). Getting strange behavior even if the correct zip code is entered!

Here is the message returned to the browser in Red letters!

SGS-020009: An order ID is required for this transaction type.

Customers freak out!!

Then, I go to Linkpoint and there is the order (well an authorization since I switched from "sale" to "preapprove"
and here is the validation code.

Y:0443640110577149:YYYM:100424165561:

YYYM says CVV matches, and there are three YYY for all other validation tags.

What is happening? Oh yes, Customer E-mail and E-mail Merchant messages are sent normally and here is the kicker, the approved transaction does not show up under Orders in Miva Administration!

The only thing that appears to work is to switch off the reject on zip code mismatch.

[Vic - WolfPaw Computers]

What versions of MIVA Merchant, Miva Engine, and LInkpoint payment module are you using?

[jimathtrf]

What versions of MIVA Merchant, Miva Engine, and LInkpoint payment module are you using?

MIVA Merchant v4.22
MIVA Engine v4.1400
CardService/Linkpoint Module Version 4.22

[Vic - WolfPaw Computers]

Update your Linkpoint payment module to v4.2403 available from MIVA.

You may also need to turn off AVS. Its very unreliable especially if you do international sales. You're best bet is to require CVV codes and if you have OpenUI, under Stores -> Storename -> Security, adjust the timeouts for retries of transactions.

You can also look into 4thebest.net's module QwkGuard.

[jimathtrf]

Update your Linkpoint payment module to v4.2403 available from MIVA.

You may also need to turn off AVS. Its very unreliable especially if you do international sales. You're best bet is to require CVV codes and if you have OpenUI, under Stores -> Storename -> Security, adjust the timeouts for retries of transactions.

You can also look into 4thebest.net's module QwkGuard.

Thanks for the update on the payment module. I have updated the module.

First timeout delay is 30 seconds, then 240 seconds. At LinkPoint there is also a setting for timeouts. There must be a conflict if I enable both, no? Which is more reliable?

Don't do any international sales (including Canada). Is AVS still unreliable?

I have enabled CVV codes.

Thank You

[Vic - WolfPaw Computers]

It would seem to make more sense to trap the re-submitted transaction through the OpenUI security settings BEFORE they are submitted to the payment gateway.

I dont know if you're gateway charges for denied attempts for validation if the timeout is reached or not, like they do for a declined card.

AVS was a good idea, just poorly implemented and not widely supported globally.

I would suggest using minimal AVS restrictions and be more aware of screening your orders coming through that pass CVV.

Look for flags like US cards and orders being shipped internationally, or not the the card holder's address.

After all, as far as the credit card companies are concerned, the responsibility for fraud - the buck stops with the merchant. Unfortunately.

[jimathtrf]

Vic,

Yes, it makes sense to disable the time out at LinkPoint. There is a setting for disapproved card and a second for duplicate order. The latter is a real problem when someone makes an error in input and fixes using the browser back button then the order is a duplicate!

Regarding AVS, I will turn it off. The eager beaver that inputs the nine-digit zip code will blow it away anyway!

It would seem to make more sense to trap the re-submitted transaction through the OpenUI security settings BEFORE they are submitted to the payment gateway.

I dont know if you're gateway charges for denied attempts for validation if the timeout is reached or not, like they do for a declined card.

AVS was a good idea, just poorly implemented and not widely supported globally.

I would suggest using minimal AVS restrictions and be more aware of screening your orders coming through that pass CVV.

Look for flags like US cards and orders being shipped internationally, or not the the card holder's address.

After all, as far as the credit card companies are concerned, the responsibility for fraud - the buck stops with the merchant. Unfortunately.