Manual credit card processing and CCV??

[Annie]

Hello all :)

We have been manually processing customer payment for 4+ years -- for our business it just made sense (we are also a physical store -- so this way all sales are together through one processor, and any changes to orders are done before billing etc etc etc...)

Anyways, we just received a new machine and it requires that keyed in transactions include the CCV number. Now, I know we can not store this number at all.

Wondering if anyone else who uses manual processing has come across this and what you do about it? About all I have come up with is calling the customer and having them give us the number when we are billing it, buyt this isn't a real great solution.

[CybrHost]

Re: Manual credit card processing and CCV??

You can't manually process a credit card without recording that CVV2 number in some form for some period of time when the order is submitted. Can you?

Thank you,
Gary Hodder
Support
--
CybrHost Corp. - http://www.cybrhost.com/ - [email protected]
+1-866-300-MIVA - Professional Miva & E-Commerce web hosting services.

[Annie]

Re: Manual credit card processing and CCV??

Gary, I don't understand? You can manually process ie: if the customer is in the store and for some reason their card won't scan, we can key it manually -- and key the CCV number from their card. So it wouldn't be stored at all -- nor would it be if the customer phoned in with an order and read the number off the card to us. So manual processing is possible, just no longer without the CCV number.

If we could capture the number somehow, then delete it once we have verified the card, it would only be stored long enough to verify the transaction (and I may be wrong but I think this is ok under the agreements).

We haven't had to use the CCV number at all before...

I guess further to this... we use PaymentTech in Canada... and while they have e-commerce solutions, I don't know if they integrate with Miva (when looking at the various payment options/gateways in the Miva admin, it is not listed).

[ILoveHostasaurus]

Re: Manual credit card processing and CCV??

The Payflow Pro gateway should work with your merchant account, it does with just about all.

If we could capture the number somehow, then delete it once we have verified the card, it would only be stored long enough to verify the transaction (and I may be wrong but I think this is ok under the agreements).

In theory your idea would work, unfortunately Miva Merchant does not have a way to collect the CVV temporarily in a way that doesn't violate the PCI Data Security Standard that VISA/MC requires you abide by. Here's a post I made last year about this:

http://extranet.miva.com/forums/show...7&postcount=23

[CybrHost]

Re: Manual credit card processing and CCV??

Sorry, I assumed we were talking about an ecommerce site and not a brick and mortar store.

"If we could capture the number somehow, then delete", If you capture it somehow then you are recording it which defeats the purpose of the CVV2 number.

Thank you,
Gary Hodder
Support
--
CybrHost Corp. - http://www.cybrhost.com/ - [email protected]
+1-866-300-MIVA - Professional Miva & E-Commerce web hosting services.

[Hostasaurus]

Re: Manual credit card processing and CCV??

I guess further to this... we use PaymentTech in Canada... and while they have e-commerce solutions, I don't know if they integrate with Miva (when looking at the various payment options/gateways in the Miva admin, it is not listed).

Paymentech doesn't have a gateway in MIVA Merchant, but the PayPal Payflow Pro gateway does support using Paymentech as the processor with their gateway account. If you can get your processor information from Paymentech you could use Payflow with Merchant as a real-time gateway in the store. It won't store the CVV for you to run at you location, it would charge or authorize the card using the CVV at checkout.
https://www.hostasaurus.com/payment.php

Jen

[Annie]

Re: Manual credit card processing and CCV??

Phooey!

Thanks all :)

[Annie]

Re: Manual credit card processing and CCV??

Sorry, I assumed we were talking about an ecommerce site and not a brick and mortar store.

We are both :)

[Mark Hood]

Re: Manual credit card processing and CVV??

I process all orders manually as well for the same reasons. We however use the address verification method for credit card purchases. This would depend on your in store abilities however it may be worth it in the long run. I'm not sure calling customers for the CVV number would work. I would also imagine you could skip doing either with your machine but one or the other is a better idea.

[wmgilligan]

Re: Manual credit card processing and CCV??

http://www.mivacentral.com/page/m/PROD/Gill/GILL-GOLCCA
For V5.

http://www.vikingcoders.com/store/me...ROK_CARDFIELDS
For V4.

[ILoveHostasaurus]

Re: Manual credit card processing and CCV??

http://www.mivacentral.com/page/m/PROD/Gill/GILL-GOLCCA
For V5.

http://www.vikingcoders.com/store/me...ROK_CARDFIELDS
For V4.

Does your module store the information encrypted? If not, the description you have on it is incorrect and it should never be used for this purpose nor should it be sold in a way that encourages such a use:

Please note:
Visa states: To protect CVV2 data from being compromised, Visa U.S.A. Inc. Operating Regulations prohibit merchants from keeping or storing CVV2 numbers once a transaction has been completed

It is up to the Store Owner to determine what is meant by "once a transaction has been completed". We suggest speaking with a lawyer prior to using this module, as Gilligan On-Line assumes no responsability for its use.

We also strongly suggest turning on encryption.

Visa has already stated, as I quoted in the post I linked to earlier, that "While it is stored, all of the PCI Data Security Standard requirements apply to safeguard this highly sensitive data." This means that if the CVV is stored for any period of time whatsoever, but preferably within a period of time that they allow, it must be encrypted. Your module description implies that they just prohibit storing it beyond when a transaction completes and that period of time is up for interpretation. That is incorrect as well, they prohibit storing it longer than 24 hours but allow for storage up to that amount of time for the purpose of authorization, if it is stored pursuant to the PCI standard. That was why my post stated "Miva Merchant does not have a way to collect the CVV temporarily in a way that doesn't violate the PCI Data Security Standard"

If your module does encrypt the data using a form of encryption approved by the PCI standard, then it could be used for this purpose provided the store owner authorizes all orders within 24 hours and then the CVV is deleted. If not, the description should be changed to one that discourages the use of the module for any CVV-related purpose whatsoever.