View Full Credit Card Number

[abcgiftcards]

Im using paypal direct payment pro with api.

In my admin in only shows part of the credit card number. i would like to see the full card number. often a customer emails us to add something to an order or sometimes there was a price error and after talking to the customer they tell us to just charge the difference . however, its unprofessional to have to ask them each time for their credit card number.

paypal does not display the number. in my paypal api logs stored on the server part of the number is xxxxx . how can i find the full number or better have the full number displayed in the admin. this is very important for us.

can the dr. help

[gjh42]

You are not allowed to store the full card number on your computer, so you will never be able to display it the way you want.
I don't know how Paypal Pro handles the numbers, so someone else will have to advise on a way to find the rest of the number.

[DrByte]

i would like to see the full card number.

Sorry, PayPal NEVER shares the customer's actual payment details with the merchant.

however, its unprofessional to have to ask them each time for their credit card number.

Actually, the opposite is true. If you tell them that your system never stores their actual credit card number once payment is collected, and that's so their financial information is kept private in the name of security, then it's quite likely they'll be very understanding and give you the number to process an additional charge.
You can talk to PayPal support about the matter if you like ... they're going to tell you the same thing: "sorry, the CC info is private".

often a customer emails us to add something to an order or sometimes there was a price error and after talking to the customer they tell us to just charge the difference .

If this is a *common* occurrence on your site, then I suggest two things:
a) work on helping your customers not make mistakes when placing orders. Having to make price adjustments because of customer confusion is IMO the part that's unprofessional. Perhaps you have things on your site that are unclear to the customer. Fixing that would save you a lot of administrative trouble.

b) You could set up your PayPal module to operate in "authorize only" mode instead of "authorize and capture" mode. That way before you actually settle EACH AND EVERY transaction you can verify the price and then capture the correct amount, at which point the card is actually charged. However, PayPal has some limits on whether they'll allow you to capture more than the original authorization amount. But doing it this way means you'll be manually completing EVERY order's payment details.

[abcgiftcards]

the order issue with mistakes is not that common. what is more common is customers call us up to add things to there order. instead of asking them for their number we would rather have it.

if zencart cannot store numbers how do you do it when you install the module for offline cc transactions?

is there a way to at least have part of the numbers emailed to me with api processing just like it can be done with the basic credit card processing?

[DrByte]

You can do anything you like with custom coding. However, ANY discussion of storing credit card numbers in the database is not to be posted on the forum, as it is not only dangerous but is contrary to your merchant account TOS and not compliant with PCI security standards. If you want to alter the code, feel free. If you want to hire someone to do it, make sure they are fully aware that what you're asking to do is dangerous and has security implications and under what terms you are engaging them in terms of liability. And if you post the code or share it with others, you may or may not be held responsible for its misuse.

As for the "offline" module ... it's being removed from Zen Cart in v1.3.9 for this and other reasons.

But, you can certainly change the code if you desire to do so ... at your own risk.

(Sorry for the heavy reply ... but it's crucial that you understand the security aspect.)

[yellow1912]

Just for your information, one of my customers almost got terminated from EVERY merchant provider for violating this term. It's lucky that we found this out before any incident took place.

[previewlounge]

interesting topic. i was just pondering about the security implications for customers and vendors.

basically... "omg! if one thousand credit card details were stored, and each card has a limit of say twenty grand, then ... that is twenty million dollars worth of credit that the vendor is being entrusted with!"

i think it is great that the offline module is being removed in version 2.0

[rfresh]

You can do anything you like with custom coding. However, ANY discussion of storing credit card numbers in the database is not to be posted on the forum, as it is not only dangerous but is contrary to your merchant account TOS and not compliant with PCI security standards. If you want to alter the code, feel free. If you want to hire someone to do it, make sure they are fully aware that what you're asking to do is dangerous and has security implications and under what terms you are engaging them in terms of liability. And if you post the code or share it with others, you may or may not be held responsible for its misuse.

As for the "offline" module ... it's being removed from Zen Cart in v1.3.9 for this and other reasons.

But, you can certainly change the code if you desire to do so ... at your own risk.

(Sorry for the heavy reply ... but it's crucial that you understand the security aspect.)

You can store and display credit card information on your website from your shopping cart database if your website AND your company are PCI DSS Compliant. This means that in addition to your website being security scanned (quarterly) by an ASV (Approved Scanning Vendor) service, you have also filled out the Self Asscessment Questionaire and mailed it to your merchant processor for their records.

There are a minimum of 12 Self Asscessment Questions you must answer (more depending on your selling volume) - one pertains to your SSL Certificate, one pertains to your having an ASV scan your website server quarterly (or annually depending upon what Level you fall under) and rest are administrative security questions.

Unless I am mis-understanding this thread and your post specifically, you make it sound like you cannot or should not, be displaying credit card numbers in Zen Cart (or any other shopping cart).

How do you run a business if, after the customer enters an order, you cannot ever see their CC information? PCI DSS certification was designed so that you could do this and be as secure about it as possible. Remember, the PCI DSS security standards were created by the big four credit card companies.

[yellow1912]

@rfresh: you missed the main point.
For most small business, you dont have to and shouldnt store the CC numbers. There are merchant service providers such as Linkpoint, Paypal, Authorize,.... that store these numbers for you.

In most cases, it is a safer choice to leave those numbers in their hands and have them take full responsibilities of safe guarding those.

Most users here run their cart on a shared hosting, and most of them have no clue about securing their sites.

[Qdixon]

All of you have *some* valid points in your posts.

In reading emerging industry standards for security, The credit card vendors have upped their standards recently. I really cannot remember the exact proposed date but they are requesting that all OCC's are to be encrypted now.

I am trying to find in my browser history which site I read that on...

If someone recently read it, could you please post that article url.