Credit Card Expires

13 Aug 2008, 14:19

#1

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Credit Card Expires

We have set up our store for a client and all seems to be working quite well! However, the emails generated after a purchase that send purchase and credit card info to the client do not include the cc expiration date, and he needs this to process the order. It does show up in the Admin section under "Customer Orders", but we have not given our client permission to access the Admin area. Is there a way to get this info included in the emails sent to him? Thanks much for your help!

13 Aug 2008, 14:44

#2

stevesh

Black Belt

Join Date:: Feb 2005
Posts:: 19,793
Plugin Contributions:: 2

Re: Credit Card Expires

What payment module are you using?

13 Aug 2008, 14:58

#3

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

sorry 'bout that... We are using the Credit Card-Offline Processing (cc) module.

13 Aug 2008, 15:05

#4

kim

Obaa-san

Join Date:: Jun 2003
Posts:: 26,564
Plugin Contributions:: 0

Re: Credit Card Expires

You could run into major problems with PCI compliance by emailing all of the CC information.

Why are you not letting the client into his admin?

13 Aug 2008, 16:03

#5

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

As recommended by Zen Cart -- and to hopefully be pci compliant -- there are two emails that get sent -- each going to different email addresses and each one having only a portion of the cc number. All we would like is for the expiration date to show up in one of those emails. As far as allowing the client access, we could find no way of limiting access to a specific area -- like Customer Orders -- as was possible when we used MIVA. And I really don't want others to have full access to other Admin areas 'cause I don't want to run the risk of having someone else screw things up and then have to re-do them.

13 Aug 2008, 16:18

#6

stevesh

Black Belt

Join Date:: Feb 2005
Posts:: 19,793
Plugin Contributions:: 2

Re: Credit Card Expires

There's a mod here that allows you to restrict access to some admin areas:

http://www.zen-cart.com/index.php?main_page=product_contrib_info&products_id=86

I haven't used it, so I don't know how the restrictions work.

13 Aug 2008, 16:19

#7

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,506
Plugin Contributions:: 173

Re: Credit Card Expires

kabbinfever:
As far as allowing the client access, we could find no way of limiting access to a specific area -- like Customer Orders

You could try the Admin Profiles addon, as mentioned by stevesh above.

kabbinfever:
And I really don't want others to have full access to other Admin areas 'cause I don't want to run the risk of having someone else screw things up and then have to re-do them.

Sounds like you should really be educating your users, rather than handcuffing them.

13 Aug 2008, 16:40

#8

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

So may I assume that there is no way -- other than adding a mod -- to accomplish what I am wanting to do?

13 Aug 2008, 17:16

#9

stevesh

Black Belt

Join Date:: Feb 2005
Posts:: 19,793
Plugin Contributions:: 2

Re: Credit Card Expires

No, it can be done, with some PHP fiddling.

It's just that you're sending all the credit card information via insecure email that way.

13 Aug 2008, 17:35

#10

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

No, in my 11:03 post, I said that two (2) emails were sent (that's the way Zen Cart has it configured) to two different addresses at his business. One email has 8 of the 16 numbers -- the "outside" numbers -- and the other has the other 8 -- the "inside" numbers. Only by putting the two emails together can the full card number be known. The expiration date of the card shows up in the Admin - Customers - Orders area -- along with the partial card number, but does not show up in either email. Is that not how it is supposed to work? Perhaps I am the one who is confused...

13 Aug 2008, 17:57

#11

stevesh

Black Belt

Join Date:: Feb 2005
Posts:: 19,793
Plugin Contributions:: 2

Re: Credit Card Expires

No, you're right, but if it were up to me, that 'extra' email with the center digits wouldn't be possible. You should have to access the Admin to get those.

As it is, the only info someone would need is the expiration date to use that credit card (not everybody requires CVV). That's why I'd be hesitant to do what you're proposing.

I buy a lot of stuff online, and I don't know who your client is. I might stumble across his/her website and want to buy something, and the idea of all my essential CC info being transferred in the clear via email makes my knees all wobbly.

The real answer to your situation is for the client to get serious about this ecommerce thing and get a proper credit card merchant account.

13 Aug 2008, 20:29

#12

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

I agree with you. I'm not particularly enamored of the double email thing either -- it's just the way that Zen Cart had it configured, so that's the way we let it be since that was the way the client wanted to do things. After all I have read about cc crime and the PCI DSS stuff though, I would like to make things as secure as I can... The way we have it now is probably not the way to go. If you can tell me how to get only one email to be sent, I'd be more than happy to do that and then load the Admin Profiles module and give him access to the rest of the info that way. Thanks.

13 Aug 2008, 22:58

#13

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,506
Plugin Contributions:: 173

Re: Credit Card Expires

The better, and far more secure, way is to use a Credit Card gateway whereby the CC is processed in real time, while the customer is still involved in the process. This has the added benefit of ensuring that the customer actually entered the numbers correctly, since the submission is validated by their own bank when the payment is processed. This way numbers are never stored on your webserver, and the money is immediately sent to your bank for deposit. You'll also only get completed orders whose payments have been authorized, saving you from having to manually process each payment and have to deal with bad cards and insufficient funds etc before processing.
It's way more secure that way, and makes you much less likely to be liable for any CC security matters, since you never have to handle the CC number directly.

If you need a competitively-priced gateway service provider, click on the "Partners" link at the top of this page, and choose the payment providers section. Choosing one of those providers also helps support the Zen Cart project at no extra cost to you, in fact even saves you money in the process.

14 Aug 2008, 00:31

#14

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

We've done gateway providers before and can direct our client to that option... but can you tell me how to delete or keep the one email with the "outside" cc numbers from being sent so that he only receives the one email (with the "inside" numbers) and has to go to the Admin area to get the rest? Where in Zen Cart is the control for that?

14 Aug 2008, 02:20

#15

kim

Obaa-san

Join Date:: Jun 2003
Posts:: 26,564
Plugin Contributions:: 0

Re: Credit Card Expires

You're talking about the Order Confirmation - you can disable the copy being sent in the Admin> Configuration> Email Settings.

14 Aug 2008, 13:57

#16

kabbinfever

New Zenner

Join Date:: Aug 2008
Posts:: 8
Plugin Contributions:: 0

Re: Credit Card Expires

Much thanks for all your help and suggestions. We're making the necessary changes and -- although it may take a while to install and configure the "Admin Profiles" module -- I now feel much better about the security issue. Thanks again!

17 Nov 2008, 16:13

#17

greenraingraphics

New Zenner

Join Date:: Feb 2008
Posts:: 11
Plugin Contributions:: 0

Re: Credit Card Expires

I was looking for the answer to this question:

kabbinfever:
We've done gateway providers before and can direct our client to that option... but can you tell me how to delete or keep the one email with the "outside" cc numbers from being sent so that he only receives the one email (with the "inside" numbers) and has to go to the Admin area to get the rest? Where in Zen Cart is the control for that?

It seems no one really answered. If someone could really just explain, briefly, the line of code involved in getting the middle digits, and the file that pulls that information, I think I can construct a similar line to pull the expiration info.

Our order processor does not need admin login rights, so the way we have things setup is that she gets the order and extra cc info emails to process and ship the orders. It is our decision to keep it working that way. But, we need to include the cc expiration date in the extra cc email as well, otherwise someone will have to login to retrieve that information.

Can someone point out to me what makes this information pull into an email? I can find the defines files just fine. But, that doesn't show me how the extra email gets pulled together.

Your help and suggestions are appreciated!

17 Nov 2008, 16:29

#18

greenraingraphics

New Zenner

Join Date:: Feb 2008
Posts:: 11
Plugin Contributions:: 0

Re: Credit Card Expires

greenraingraphics:
I was looking for the answer to this question:

It seems no one really answered. If someone could really just explain, briefly, the line of code involved in getting the middle digits, and the file that pulls that information, I think I can construct a similar line to pull the expiration info.

Our order processor does not need admin login rights, so the way we have things setup is that she gets the order and extra cc info emails to process and ship the orders. It is our decision to keep it working that way. But, we need to include the cc expiration date in the extra cc email as well, otherwise someone will have to login to retrieve that information.

Can someone point out to me what makes this information pull into an email? I can find the defines files just fine. But, that doesn't show me how the extra email gets pulled together.

Your help and suggestions are appreciated!

I did want to mention that I found another related post:
https://www.zen-cart.com/forum/showthread.php?t=97783

I understand the danger of what I am asking, and that you will not post a solution to this question on this forum.

So - if it's safe to send middle digits in an email, along with an email for order confirmation, can there be a third email that sends the expiration date information? This would give admins the opition of sending that info to yet another email address for security reasons, if they chose to do so. Otherwise, the information could be sent to the same email, just yet another bit of information to put together with the rest.

Just wondering if there's a difference in adding a third email, since in our case we receive both current emails to the same address anyways.

thanks!

17 Nov 2008, 16:34

#19

drbyte

Sensei

Join Date:: Jan 2004
Posts:: 63,506
Plugin Contributions:: 173

Re: Credit Card Expires

greenraingraphics:
Just wondering if there's a difference in adding a third email, since in our case we receive both current emails to the same address anyways.

No, there's no difference. If you're already sending both to the same address, you basically have zero security or protection anyway. That's not how the module is supposed to be used, for security reasons.

18 Nov 2008, 00:44

#20

schoolboy

Totally Zenned

Join Date:: Jun 2005
Posts:: 10,324
Plugin Contributions:: 0

Re: Credit Card Expires

Even if I knew a way to hack this for you, I wouldn't reveal it... I could potentially be party to assisting in the design of a process that enables fraudulent use of c-card details!

Perhaps the reticence of some of ZC's most noted gurus on this thread suggests they feel the same...