As others mentioned, save yourself the headache and use Express Checkout.


PCI v3 documents are making quite the change for requirements.

SAQ A-EP was created for the specific purpose of ecommerce sites redirecting or iframe to 3rd party payment applications like PayPal EC, Auth.net SIM, etc. SAQ A-ep is only a few questions short of SAQ-C and does require quarterly scans even to accept PP-EC.

SAQ-D is now required of ecommerce sites accepting payments on-site.

PayPal also requires a PP account if you are wishing to pay with a credit card (contrary to much of their advertisements) after an email address is used 10 times to make payments anywhere on the internet. If the email address was used 10 times elsewhere before finding your site, the customer will be presented a message that a PP account is required before checkout can be completed. Makes for grumpy customer and PP speaking with forked tongue.