2 replies to this topic

[ReginaStelling]

Hi!

My client asked me..."Why can't I just send invoices, and let my clients logon and enter the invoice number and amount they want to pay. Then I can just run it through my card swipe machine".

Is this cool? I know we need a digital certificate for this, but what about the credit card company? Would they get mad if they found out this was an internet order and not a call-in order?

Is this a big deal? I thought it was illegal or something...but maybe I am wrong??

Please advise.

THANKS!

[cyanide]

I'm not exactly sure about legalities ...

Well, accepting credits cards through the Internet is considered risky, that is why the rates are much higher... Yes, if you have a standard merchant account and they find out... hmm... well, actually I don't know what would happen... they might pull your client's account.

Also, when the client logs in and enters the invoice number, then what...? do they enter the credit card number through the cart?
Very bad! Credit card numbers should not be stored on the server, especially in a shared environment ...

[dakatone]

The best way to deal with this is ask your client to find out from their merchant account provider if they compensate for "card not present" transactions. This essentially encompasses orders involving the telephone, the Internet in the manner you described and other formulas where the credit card would not be in your possession, but the number, expiration date and possibly the CVV2 number would be in your possession.

It is quite possible that your client's merchant account provider does allow this, as many do, however the pricing structure usually differs from standard "card present" transactions.

Another item to consider is the higher security issues in the form of chargebacks, disputes and whatnot with "card not present" transactions. I would definitely have my client look into this with their MAP and discuss the advantages and disadvantages with their company.

Good luck to both you and your client.

Ruhl