On the Webmasterworld.com forums I came across an interesting subject that I thought would be very helpful to many of you, since it was extremely helpful for me! A client of mine is interested in collecting credit card data from his customers through his website so that he can process orders offline. On the Webmasterworld.com forums in a thread titled “How to collect credit card numbers securely online?” a member of the community asked this:
I now accept customers’ credit card details by fax. I am wondering how to receive credit card info online and process them offline? how to store customers’ card info securely online? I do not use payment gateway, just collect and store creidt card details in a secure way online.
Can anybody give any suggestion.
The following is a response given back to a member of the community. THIS IS IMPORTANT INFO TO KNOW!
read up on PCI compliance - http://www.pcicomplianceguide.org/pcicomplianceguide.html]PCI Compliance Guide. In a nutshell, this is a data security standard considered acceptable by credit card companies. It involves a rigorous auditing process that reviews your network security systems and methods of collection and storage of credit card information. This means your servers must be under your control, not on a shared or leased hosting, which is out of the reach for most merchants.
The second consideration is that you review your offline merchant account, you will likely be in violation of your contract if you use it for this purpose. This is why an online merchant account is structured differently and generally more expensive than an offline account.
The best option, really, is to relinquish yourself of this responsibility and set up an online merchant account, which places the responsibility of PCI compliance on them or the gateway that interfaces with the merchant account. You then only need to install an SSL cert on your web site and securely pass the info to them, without actually storing this data on your server.
Basically, don’t collect credit card data yourself. Make sure that it is being submitted securely to your Merchant Account Provider like Authorize.net. This puts the liability of holding credit card numbers in their hands.
But what if you don’t want the merchant account to bill the credit card right away? That’s what my client is asking for and that was a major question that I have. Here is another comment in the thread:
I do online processing and store ZERO credit card details, just the authorization information. What it sounds like you want to do since you post the sale later is to use AUTHONLY as a sales type online. With AUTHONLY it pre-authorizes the credit card which will “reserve” the amount specified, it will not actually bill the consumer’s credit card. This process is used for Book and Ship sales transactions, where a merchant gets an order and at a later date, completes the transfer of funds.
Basically you go into the remote control panel for the credit card processor and complete and book the transaction later. 100% secure, NO sensitive credit card, NO details stored on your server or premises, nothing an employee or hacker can steal. Do anything less and you’re at risk and you don’t want to be at risk because fines from Visa can be nasty, like $50K or some other ugly amount to cover their costs of damage control, and you can lose your merchant account.
Summary
Do not store credit card numbers on your own server! If you need to collect credit card data from your customers, only to charge the card later use the AUTHONLY. That way you pass all credit card and personal information of your customer right on to your Merchant Account keeping your customers information safe and secure. You can then bill the credit card at a later date through your web based control panel for your merchant account.
Entries (RSS)