Secure Servers and taking payments

[RoPey]

Hi
I hope this isn't too far off topic, but I am quite a newbie to e-commerce and I have a customer that wants to set up a site using a secure server to capture customers credit card details and to process them at their reception as 'Cardholder Not Present'.
I'm hoping that maybe a few of you might share your experience in this field and tell me if this acceptable, possible or even wise?

Thanks
RoPey

[Merlinpa1969]

this is acceptable if you follow a few rules, ( these are already present in ZC )
1 you can not store the entire CC number in the DB you cant store the cvv at all

what zc does is store the middle 8 numbers and display them on th einvoice
and emails the other 8 numbers

you then have to match up the invoice numbers


and yes should be SSL

[RoPey]

this is acceptable if you follow a few rules, ( these are already present in ZC )
1 you can not store the entire CC number in the DB you cant store the cvv at all

what zc does is store the middle 8 numbers and display them on th einvoice
and emails the other 8 numbers

you then have to match up the invoice numbers


and yes should be SSL

Thanks for your reply .
However, forgive me for being a bit slow here, but if you cannot capture the full CC number or the CVV number, how would you then process the card payment by hand? I must be missing something.

Any other views gratefully received. I've tried doing numerous Googles on the subject but just get back load of offers for Ecommerce Web Hosting.

[Merlinpa1969]

1/2 of the number and the exp are stored and displayed on order page in the zc admin

the other 1/2 of the number and cvv are emailed to you,

you then match the order numbers and you then have all the information you need

[RoPey]

1/2 of the number and the exp are stored and displayed on order page in the zc admin

the other 1/2 of the number and cvv are emailed to you,

you then match the order numbers and you then have all the information you need

Oh gosh, sorry - you said that in your first reply and I didn't read it properly.
So the CVV number gets sent in the email as well does it?
The hosts I resell for do a secure certificate option on a shared server, would it be safe enough to do this on a shared server?

Thanks ever so much for your help on this..

[DrByte]

A small note of clarification...

1. The middle 8 digits are emailed.
2. The outer 8 digits are stored in the admin area.
3. The CVV should never be collected for offline processing. That's the cardholder's key, and should be kept private by them. You don't need it to process the credit card.

More info on the offline Credit Card module:
https://www.zen-cart.com/tutorials/index.php?article=67

[RoPey]

A small note of clarification...

1. The middle 8 digits are emailed.
2. The outer 8 digits are stored in the admin area.
3. The CVV should never be collected for offline processing. That's the cardholder's key, and should be kept private by them. You don't need it to process the credit card.

More info on the offline Credit Card module:
https://www.zen-cart.com/tutorials/index.php?article=67

Thanks for that Dr Byte. I'll have a good read of that module.