View Full Credit Card Number

Im using paypal direct payment pro with api.

In my admin in only shows part of the credit card number. i would like to see the full card number. often a customer emails us to add something to an order or sometimes there was a price error and after talking to the customer they tell us to just charge the difference . however, its unprofessional to have to ask them each time for their credit card number.

paypal does not display the number. in my paypal api logs stored on the server part of the number is xxxxx . how can i find the full number or better have the full number displayed in the admin. this is very important for us.

can the dr. help

You are not allowed to store the full card number on your computer, so you will never be able to display it the way you want.
I don't know how Paypal Pro handles the numbers, so someone else will have to advise on a way to find the rest of the number.

abcgiftcards:

i would like to see the full card number.
Sorry, PayPal NEVER shares the customer's actual payment details with the merchant.
abcgiftcards:

however, its unprofessional to have to ask them each time for their credit card number.
Actually, the opposite is true. If you tell them that your system never stores their actual credit card number once payment is collected, and that's so their financial information is kept private in the name of security, then it's quite likely they'll be very understanding and give you the number to process an additional charge.
You can talk to PayPal support about the matter if you like ... they're going to tell you the same thing: "sorry, the CC info is private".

abcgiftcards:

often a customer emails us to add something to an order or sometimes there was a price error and after talking to the customer they tell us to just charge the difference .
If this is a common occurrence on your site, then I suggest two things:
a) work on helping your customers not make mistakes when placing orders. Having to make price adjustments because of customer confusion is IMO the part that's unprofessional. Perhaps you have things on your site that are unclear to the customer. Fixing that would save you a lot of administrative trouble.

b) You could set up your PayPal module to operate in "authorize only" mode instead of "authorize and capture" mode. That way before you actually settle EACH AND EVERY transaction you can verify the price and then capture the correct amount, at which point the card is actually charged. However, PayPal has some limits on whether they'll allow you to capture more than the original authorization amount. But doing it this way means you'll be manually completing EVERY order's payment details.

the order issue with mistakes is not that common. what is more common is customers call us up to add things to there order. instead of asking them for their number we would rather have it.

if zencart cannot store numbers how do you do it when you install the module for offline cc transactions?

is there a way to at least have part of the numbers emailed to me with api processing just like it can be done with the basic credit card processing?

You can do anything you like with custom coding. However, ANY discussion of storing credit card numbers in the database is not to be posted on the forum, as it is not only dangerous but is contrary to your merchant account TOS and not compliant with PCI security standards. If you want to alter the code, feel free. If you want to hire someone to do it, make sure they are fully aware that what you're asking to do is dangerous and has security implications and under what terms you are engaging them in terms of liability. And if you post the code or share it with others, you may or may not be held responsible for its misuse.

As for the "offline" module ... it's being removed from Zen Cart in v1.3.9 for this and other reasons.

But, you can certainly change the code if you desire to do so ... at your own risk.
*
(Sorry for the heavy reply ... but it's crucial that you understand the security aspect.)*

Just for your information, one of my customers almost got terminated from EVERY merchant provider for violating this term. It's lucky that we found this out before any incident took place.

interesting topic. i was just pondering about the security implications for customers and vendors.

basically... "omg! if one thousand credit card details were stored, and each card has a limit of say twenty grand, then ... that is twenty million dollars worth of credit that the vendor is being entrusted with!"

i think it is great that the offline module is being removed in version 2.0

DrByte:

You can do anything you like with custom coding. However, ANY discussion of storing credit card numbers in the database is not to be posted on the forum, as it is not only dangerous but is contrary to your merchant account TOS and not compliant with PCI security standards. If you want to alter the code, feel free. If you want to hire someone to do it, make sure they are fully aware that what you're asking to do is dangerous and has security implications and under what terms you are engaging them in terms of liability. And if you post the code or share it with others, you may or may not be held responsible for its misuse.

As for the "offline" module ... it's being removed from Zen Cart in v1.3.9 for this and other reasons.

But, you can certainly change the code if you desire to do so ... at your own risk.
*
(Sorry for the heavy reply ... but it's crucial that you understand the security aspect.)*

You can store and display credit card information on your website from your shopping cart database if your website AND your company are PCI DSS Compliant. This means that in addition to your website being security scanned (quarterly) by an ASV (Approved Scanning Vendor) service, you have also filled out the Self Asscessment Questionaire and mailed it to your merchant processor for their records.

There are a minimum of 12 Self Asscessment Questions you must answer (more depending on your selling volume) - one pertains to your SSL Certificate, one pertains to your having an ASV scan your website server quarterly (or annually depending upon what Level you fall under) and rest are administrative security questions.

Unless I am mis-understanding this thread and your post specifically, you make it sound like you cannot or should not, be displaying credit card numbers in Zen Cart (or any other shopping cart).

How do you run a business if, after the customer enters an order, you cannot ever see their CC information? PCI DSS certification was designed so that you could do this and be as secure about it as possible. Remember, the PCI DSS security standards were created by the big four credit card companies.

@rfresh: you missed the main point.
For most small business, you dont have to and shouldnt store the CC numbers. There are merchant service providers such as Linkpoint, Paypal, Authorize,.... that store these numbers for you.

In most cases, it is a safer choice to leave those numbers in their hands and have them take full responsibilities of safe guarding those.

Most users here run their cart on a shared hosting, and most of them have no clue about securing their sites.

All of you have some valid points in your posts.

In reading emerging industry standards for security, The credit card vendors have upped their standards recently. I really cannot remember the exact proposed date but they are requesting that all OCC's are to be encrypted now.

I am trying to find in my browser history which site I read that on...

If someone recently read it, could you please post that article url.

rfresh:

This means that in addition to your website being security scanned (quarterly) by an ASV (Approved Scanning Vendor) service,
Note: that this secirity scan is a paid service and a cost to the shop owner and usually in excess of the fee for shared hosting.
rfresh:

How do you run a business if, after the customer enters an order, you cannot ever see their CC information?
Why in the world do you need to know the CC# to be able to conduct business?? You use a gateway processor to process these and do not have a need to know what the details are.
When deposited into your account - The bank also does not share the CC# with you so knowing it does not provide any cross checking value anyway.

Why in the world do you need to know the CC# to be able
to conduct business??

You've never taken a credit card order over the phone?

You make it sound like having the CC # is a bad thing for a business to have. It's not. That's what PCI DSS certification was created for. To ensure that an eCommerce business takes the security steps to safeguard the customer's personal information and this includes all of their financial information. A business if fully entitled to that information and its their responsibility to safeguard it.

And you also are implying that merchant providers do not want you to hold on to CC data. Not true at all. Just call your merchant provider and ask them if they have any problems with you being able to see the full credit card number of your customer on any eCart software. They will tell you they have no problem with you viewing or storing that kind of information as long as you are PCI compliant.

It's up to the individual who owns and operates an online eCommerce store whether or not they want to pay for PCI compliance. It's not up to ZenCart to make decisions for us by designing their software to hide the CC data. It needs to be an option to see the full number, or to enable the split which it current does and WE as business owners need to take full responsibility for turning it on if we choose to see that data.

Yes, it cost money to get PCI compliant, but the fines if you are caught without it are extremely large and can put most small businesses out of business.

rfresh:

They will tell you they have no problem with you viewing or storing that kind of information as long as you are PCI compliant.And ... PCI compliant means that any storage of complete credit card numbers must be encrypted to the proper standards. Zen Cart does not provide such encryption -- that is why it doesn't store the credit card number.

rfresh:

It's not up to ZenCart to make decisions for us by designing their software to hide the CC data. It needs to be an option to see the full number, or to enable the split which it current does and WE as business owners need to take full responsibility for turning it on if we choose to see that data.
Yes, YOU need to take full responsibility. And if you want to modify your Zen Cart site to allow you to take the risks you describe, you're free to do so. However, Zen Cart does not give you the capability of shooting yourself in the foot unless you modify it to do so. That way Zen Cart is itself PCI compliant as much as it can be out-of-the-box. Any alterations thereafter are your responsibility.
https://www.zen-cart.com/tutorials/index.php?article=321

Feel free to do what you like with your site, whether by using available addons or customizing the code to suit your needs.

rfresh:

It's up to the individual who owns and operates an online eCommerce store whether or not they want to pay for PCI compliance.

Yes, it cost money to get PCI compliant, but the fines if you are caught without it are extremely large and can put most small businesses out of business.

It's not up to the individual, It's up to if you want a Merchant account or not that's what it boils down too, and for PCI complaint's when you take the questioner all the answers have to be correct and one of them is that you don't store credit card numbers, and it was not cheap, hit me by surprised I had the Merchant account for some time when all this PCI crap came along, but you should not be storing credit card numbers I would not buy from you if I knew that you did.

pete

rfresh:

Why in the world do you need to know the CC# to be able
to conduct business??

You've never taken a credit card order over the phone?

I certainly have, and the paper I wrote it down on goes directly into the shredder when the transaction is over. We make a point of telling customers we don't store CC numbers, and we get a lot more 'Thank You's than we do complaints.

I've seen regular phone customers' CC numbers on Post-It notes stuck to monitors.

It's one thing to save CC numbers when the customer deliberately gives it to you over the phone. It's another when I use your payment processor, thinking you won't have access.

Also, as a business owner, frankly, I don't want the responsibilty of storing those numbers.

I'm not saying you're wrong, since you're PCI compliant, I just wonder how much you gain by storing those numbers vs. the risk.

I just spoke with my merchant provider for offline creditcard transactions because 90% of mine are over the phone...btw never had a vaild chargeback...

They state (in my own words) that if you collect numbers to manually process whether it be on the phone you must properly destroy the full creditcard number in which you wrote down.

I asked well what if the customer wants me to keep the number on file for future transactions?

That is ok if they allow that but you are still 100% responsible and liable for any stolen information.

What are the consequences?
Legal Action, TOS Violation and termination.

So there you have it...

@DrByte

And ... PCI compliant means that any storage of complete credit >card numbers must be encrypted to the proper standards.

FYI - Requirement #6 of the PCI rules says nothing about encrypting CC data in your eCart software. It's a good idea to do that I think everyone will agree, but it's not a PCI requirement.

I went back and checked and it was not the card number but the cvv2 code that you can't store;

3.2.1 Do not store the full contents of any track from the magnetic stripe (that is on the back of a card, in a chip or elsewhere). This data is alternatively called full track, track, track 1, track 2, and magnetic stripe data.

In the normal course of business, the following data elements from the magnetic stripe may need to be retained: the accountholder's name, primary account number (PAN), expiration date, and service code. To minimize risk, store only those data elements needed for business. NEVER store the card verification code or value or PIN verification value data elements.

3.2.2 Do not store the card-validation code or value (three-digit or four-digit number printed on the front or back of a payment card) used to verify card-not-present transactions.

My merchant account requires the cvv2 code to process a card!

pete

I think it is worth reminding small businesses what could happen if the Credit Card data they hold on individuals gets compromised!

Yes there are big fines involved.

Yes you can become liable for fraudulent transactions.

Yes they can ask you to comply as if you are a Level 1 Merchant rather than Level 4 (Level 1 merchants include Paypal, WorldPay etc) which basically means that you would have to spend hundreds of thousands on pounds in order to meet the stringent security standards.

Yes your card services solution could be withdrawn from your business and if you rely on this as part of your daily trade and you lose it overnight. It wouldn't take long for you not to have a business anymore.

Yes it could ruin your business reputation.

Is it worth it? - All for the sake of convenience - I think not!

Most customers these days would respect your reasons for not keeping the CC numbers especially if it involves protecting their own money!

An addendum:
If you, as a merchant, desire to "store cc data"- - PCI-DSS requires that you store them on a server that is NOT web accessible.
This means a seperate server dedicated to CC data storage in an encrypted format that is OFF the web.
Your web server has credentials and a security hash to communicate with it.
And then you need a complete protocol and record for who is allowed to access, when they do, why they access, etc.
This is to be compliant when storing this information.

All this costs and those using ZenCart for the most part are not in a position to be managing a system as required