Where to Find Credit Card Info?

[peachnut]

I have been using Zen Cart for many years now without any problems. I set it up so that when a customer pays with a cc, the middle four digits are emailed to me in a separate email. Lately, I have not been getting this email and am wondering if there is somewhere in my admin that I can go to get these numbers? Any help would be appreciated.

Thanks,
Chris

[stevesh]

No, there isn't. First thing you want to check is that your store hasn't been hacked and the CC info directed elsewhere. If you've been using Zencart for years, chances are you're using an older (and much less secure) version of Zencart. If so you should upgrade to 1.3.9h immediately.

If not, you want to figure out why you aren't getting the emails.

You really should consider using a different payment method. That one is very insecure.

[Amanda61]

oh, it looks like I have been hacked. I have had 1 order that i have not received the middle digits on... and I wont go into admin to check where the email as going as the logg in screen looks different. I have entered a 'test' order & the midde digits have not turned up.... I can access my files under my hosting control panel, but can't find where the email address is stored for sending the midde cc digits ... can anyone tell me the file name?,,, and yes I will stop using this option

Many Thanks

[stevesh]

and I wont go into admin to check where the email as going as the logg in screen looks different.

I don't understand this, but you want to go into admin right away and put your store in mainenance mode so your customer's CC info isn't stolen. You may not be able to get into admin if the hacker has changed your admin logiin. In that case, I would backup your files and then remove them from the site.

[schoolboy]

You MUST also inform any customer who's details you have not received, that their credit card details have been stolen.

It's probably necessary to alert you to the rather horrifying prospect that if these compromised cards have been used illegally, the bank may pursue you for any losses, and the costs of recovering those losses... UNLESS:

1. You have a specific agreement with your C-Card clearing bank to take off-line card details.
2. The server on which your site resides is PCI/DSS compliant.

If you have been "casually" accumulating C-Card details in this manner, and do not have sanction from your card clearing agent to do so, you are also running the risk of a blacklisting, the result of which will be that NO card clearing company will do your card processing.

You should immediately remove the off-line c-card module and set up a system of payment through a payment gateway.

[Amanda61]

Thanks... I was able to turn off credit cards from my hosting control panel and have contacted the one person who would have been affected. I should have followed through with my plans to upgrade versions last monthanybody want the scumbags email address