Upgrade Advice?

[needainstall]

I am currently running v1.3.8a. I know I need to upgrade but...

I've been selling online for over 15 years, during which I've used various carts, but I've always manually processed my credit cards. I actually manually check each order for validity before processing it.

Last year I added additional pre-validation through merchantprotect.com and I haven't had a single chargeback this entire year.

Now of course I am using the manual credit card add-on, which I understand is not/will not be available for v1.3.9h??

So, while I know I need to upgrade, I haven't done so yet because doing so will break a system that has worked so well for me over the years.

Is there anyone else out there that manually processes cards that is using a current version, and, if so, how?

Any advice or suggestions in any direction that will help is much appreciated.

[stevesh]

There shouldn't be any but ... about upgrading. You owe it to your customers to make sure your site is as secure as you can make it.

The manual CC module has been removed from 1.3.9 and newer, for very good security reasons. There is a add on mod available, but I strongly suggest you don't use it.

I'm glad you aren't getting chargebacks, but as your customer I'm more worried about the security of my CC information. Once I saw you were processing my card manually, I wouldn't be able to leave your site fast enough.

[rstevenson]

On the other hand... There is absolutely nothing wrong with manually processing CCs. When I upgraded I started using the Ceon Manual Card mod. I never had any sort of problem before and I don't now and I don't expect to ever have any such problems. Small (one-person in my case) shops can handle manual processing with complete and effective security.

So... upgrade, yes. But don't worry about using manual CC processing, despite the fear and loathing some people express about it.

Rob

[stevesh]

Small (one-person in my case) shops can handle manual processing with complete and effective security.

Prove it to me, your potential customer. Almost all of us are one or two person operations, so that's not really an excuse for sloppy handling of CC info. Manual processing is unlikely to pass PCI scrutiny, either.

[needainstall]

Stevesh, I see your point, but I've got a question for you.

As a potential customer, HOW would you know if your card was to be processed manually? It's not like there's a banner at the top of our site saying "we process all our cards manually".

Maybe AFTER you have submitted the order you might have an idea, but not before.

And as far as not being able to leave the site fast enough, maybe that's your opinion, but it certainly isn't the majority. I do quite well, and have never had a single, not one single, question about how a card is processed, or had any problem whatsoever with cc processing.

I actually do have an authorize.net account, and can automatically process cards if I choose to do so. I just prefer to do it manually as I feel that my personal, hands on investigative scrutiny is superior to any automated score-applying scrutiny that the processor might use.

The plus side is I have NO fake orders, ever. I will likely upgrade and continue using the offline module, now that I know it will work with 1.3.9x.

Thanks!!

[stevesh]

Well, since you use Zencart, I can tell the difference between the manual module and, say, authorize.net. You're right, most people wouldn't.

My issue is that I don't have any idea how you treat my CC information once you've received it. I've seen (worked for, in fact) companies where regular telephone customers' credit card information was 'stored' on Post-It notes stuck to monitors, available to any passers-by and night cleaning service employees.

I'm sure you take proper precautions, but I don't have any way to know that, and if I can buy the same product elsewhere, I will.

There's also the PCI thing to deal with. Have you ever been audited ? I assume your merchant account provider knows you're processing online transactions?

Mainly a philosophy thing, maybe. All you've mentioned are the security precautions you're taking to protect yourself - I guess I'd prefer that you give more thought to my security needs as your customer, that's all. Hard to argue with success, though.

It's also true that I don't know what you're selling, or to whom. If you do a lot of big-ticket business, especially with customers outside the US, things might be different.