QuickBooks Merchant Service

Yes... in this case 1.8 != 1.8. But that's part of the "fun" of being on the testing team right!! :)

PS - did you redownload from my site? That error code appears in several places in the module, and was fixed in all of them.

cptok:

Yes... in this case 1.8 != 1.8. But that's part of the "fun" of being on the testing team right!! :)

PS - did you redownload from my site? That error code appears in several places in the module, and was fixed in all of them.

Right! And yes, from the link you sent in the PM. As far as I can tell the (the add_session error) was added on several places in that one file was the only difference. Seems to work now, thank you.

On another note, I noticed that AMEX does not send back the CVV verified code for the qb merchant account. So if you set CVV needs to be present and verified, legitimate AMEX cards will be declined. I found in the help file in QB Merchant account page that one can ask AMEX to activate the CVV verified return code as well. I will post more about the process tomorrow from my desktop where I have all the info.

QBMS 1.8 Stable has been uploaded. This includes everything above and cosmetic cleanup of the code for readability.

wow good catch mydanilo, we use amex cards as well. let me know what you find out about the cvv.

keep up the awsome updates cptok!

This is the AMEX situation as mentioned in QB

Important: If you accept AmericanExpress cards

American Express (AMEX) cards have a 4-digit card security code on the front of the card which is used to screen for fraud in card not present and eCommerce transactions. Note that AMEX always approves valid transactions even if the card security code does not match, is not processed, or is not provided. Nevertheless, AMEX does return the card security code status along with the approval response, and you can set your Web store security settings to automatically reject transactions where card security code does not match or is not available. However, these settings will only work if you have specifically requested AMEX to process the card security code when the account was set up. If the account was not set up to do this, AMEX will return a response indicating that the card security code was not processed even when the correct code was provided in the transaction. As a result, even valid AMEX transactions will be rejected automatically if the merchant has selected Web store security settings to reject transactions where the card security code not does not match or is not available.

If you want to prevent valid AMEX transactions to be accepted, you must either make sure your account is set up correctly at AMEX, or change your Web store security settings in the Merchant Service Center so the valid transactions do not get rejected.

I talked to customer service at AMEX and here is what you have to do to requested AMEX to process the card security code:

email to: [email protected]

Ask them to activate the CID for your AMEX merchant account#xxxxxxx

I got a reply and it usually takes 7-10 business days until active.

PS: They will do this only by email. Good luck.

Mydanilo - great information!! Well done. You have clearly laid out what it takes to deal correctly with AMEX - whether by contacting AMEX or by having alternate settings on the QBMS fraud options.

OK, it is now activated, here is the email they send back:

Your Merchant number has now been activated for the CID Fraud Prevention Tool from American Express.

Merchants are required to follow the Card Security Code Validation program requirements. For your convenience, these requirements are attached below as an excerpt from the US Merchant Operating Policies and Procedures guide. These requirements are also available to you at: https://www.americanexpress.com/merchantpolicy

To ensure proper use of the CID fraud prevention tool, please find the following reminders:

* Merchant should never store CID, should re-prompt twice when an incorrect CID is provided and not allow more than three tries for a Customer to enter CID.

* Now that CID has been activated, AMEX will send the following in the ISO 8583 Authorization Response 1110. If you use a processor or vendor to communicate with American Express, they may translate these responses and provide the same information to you in a different field or value.

                     Y = CID matched
                     N=  CID did not match
                     U = CID was not checked

* To correctly utilize the CID fraud prevention tool, every keyed transaction with a CID value must be sent with POS Data code position 7=‘S’. Please reach out to your processor if you have questions regarding this point

* American Express recommends Merchants advise your Processor you plan to use the CID fraud prevention tool

* If you need the approved American Express card image showing CID for use on your website, please e-mail [email protected] with the subject: American Express CID card image needed and in the text of the message indicate your website address

Now I hope that QB Merchant account will understand AMEX CID responses. One would think.... lets see when the first AMEX transaction comes across. I will post how it works out.

So the way I am reading it is, unless you specificaly ask them to check the CVV on amex, it comes default as they don't check it.

meaning...

if i were to use a amex card right now, it wouldnt matter what i put in for the cvv it doesn check it, and it will go through.

Nice research i had no idea that they didnt even check the cvv ive been putting in for the last 4 years!

[QUOTE=Securfocus;684806]S
meaning...

if i were to use a amex card right now, it wouldnt matter what i put in for the cvv it doesn check it, and it will go through./QUOTE]

Not quiet correct. Your qbms payment module will already check if the CVV is filled in but then when it is passed on to QB merchant it will pass it on to AMEX and then AMEX does check the submitted CVV but does not return the result. So there would be no CVV status returned to QB merchant. QB merchant will check your CVV according to your QB merchant settings (Web store security settings). If like me, you want the CVV verified positively you would set:

CSC Settings
If CSC does not match Reject Transaction
If CSC is not available Reject Transaction

Now if the AMEX CID is not activated like I described, ALL your AMEX cards will be rejected as AMEX would not return a positive CSC match!

If:
If CSC does not match Accept Transaction
If CSC is not available Accept Transaction
Then:
you don't have this problem but again no CSC match verification will be enforced on any cards. So you are accepting cards where you do not know if CSC is valid. Did not like it!

If:
If CSC does not match Accept Transaction
If CSC is not available Reject Transaction
Then:
You will never know if AMEX CIC actually matched as the status is not returned by AMEX.

Just have it turned on by AMEX and you will have full control over what you are accepting.

so, since qbms doesnt get a response from amex whether the cvv is turned on or not, we will never know if the cvv passes?

so if you turn it on at amex, will qbms just figure the charge went through because it doesnt get a response that the cvv failed?

if thats the case i think i would rather just leave it to off for checking the cvv, because if it doesnt get a respone saying yes it worked or no it didnt, it must just default to it passed? which would be bad to figure out the charge really didnt go through because qbms wasnt told the cvv failed.

I know it is all a bit confusing. But I do now get the CID response. Here again what it does once CID is activated:

• Now that CID has been activated, AMEX will send the following in the ISO 8583 Authorization Response 1110. If you use a processor or vendor to communicate with American Express, they may translate these responses and provide the same information to you in a different field or value.

Y = CID matched
N= CID did not match
U = CID was not checked

SOOO QBMS can now use these codes like they do with all other cards. No difference anymore once you have
AMEX turn on the CVV verification response.

Conclusion: If you want to only accept cards with a positive verified matching CVV, then you have to have AMEX turn on the CID. If you don't care, don't have it turned on but make sure your QB Merchant security settings do not reject non matching nor not present CVV.

This is worth some thought here... there are two separate checks which happen, Zen and merchant service. You can set Zen to require the CVV code - and it will force inputting the code and send to merchant service. But that does not affect how merchant service handles the transaction.

If I recall correctly, QBMS defaults are to REJECT mis-matched CVV, and ACCEPT matched or "unavailable" CVV. That works pretty well for Visa/MC - but you discovered that AMEX thing - that they report all CVV as "unavailable" or "U". To QBMS, that is acceptable and the charge should go through. BUT that means that a customer can put in a bogus CVV on Amex and it will still run.

So I think the question is - what are the best combination of defaults at QBMS fraud settings and Amex. I think if you have amex verify - that is best. Then you can have Zen require the CVV, and it will come back as match or fail. Easy. But for the default situation - Amex should still clear and run right? As it will come back as "U" which QBMS will accept for CVV (if defaults are still in place). Or am I missing something?

cptok: The way I understand it, you are correct with all your statements except one little thing:

"there are two separate checks which happen, Zen and merchant service" Actually three, merchant service sends the cc info to AMEX (or other cards) and they return the result, then QB merchant service will decide what to do according to your security settings.

Other than this detail, you are correct.

ok, so now Im clear on this...

1)customer enters CVV code, zen checks to see if its right
2)qbms passes it on to approriate company, amex, visa, mc, etc....
3)cc company sends something back to qbms in there own coding.....
4)qbms then sends a response back to zen which is the same coding you would get from any cc company either

Y = CID matched
N= CID did not match
U = CID was not checked

where i was getting confused is that I thought amex sent something straight to zen, which we didnt have coding for, but zen is just looking for the Y, N, or U which is provided by qbms, which it got from amex.

so if amex CVV check is turned on at amex, amex will send to qbms its response, then qbms will send the Y, N, or U. and if the CVV check is turned off qbms will always send a U.

So i should turn on CVV! alright now im clear!

Your conclusion is right but:
"zen is just looking for the Y, N, or U" is wrong. Your QB Merchant account is looking for these and will check with your security settings if this transaction should process.

Zen will only record the completed transaction or give the error message to the customer if the transaction failed.

Well - if we really want to be accurate, Zen parses the "StatusCode" returned in the XML exchange which tells it what happened at QBMS. A "0" is "OK" and then there are a bunch of other 10100 to 10501 codes which are fails with various reasons associated with them. Zen only differentiates between a couple of them and reports. Included in the XML reply will be AVS (zip and street) and CVV results (all Pass, Fail or NotAvailable). We could capture/report those in Zen (in fact I thought about expanding all that error reporting), but why bother. The transaction is already done, and the specific results data available on QBMS website.

Thanks cptok. Of course you would be the one that knows exactly what gets sent back and forth. I think we talked this one to death already. Let's leave it at that...

With AMEX now turned on the CID I can do what I want. Just wanted to share this. Read all the fine print in the QB merchant security settings and I think one will get what it is about.

And for the members that got confused by us all talking about the CID, rest assured the module is now working great! Really happy with it. Thank again.

Yes, this module works 100%

download cptooks awsome updated module and then if you want you can follow my install path i took on page 12!

thanks again you two for all the help!

cptook, if you come across anything that you needed to update dont forget about us poor non coders!!!

thanks yet again!

So I walk into my normal Friday visit to SuperNutrient.com (shameless plug), and our office manager is most happy to tell me about QBMS: she's becoming an expert on QB 2009. She asks me if we can use it on the cart; I say, well we'll have to see if there's a module that supports it. Et viola!
Though I'm late to the party, I'm happy to have found you guys and look forward to employing this after I set it up on a test site.
Excellent serendipity!

Thank you!
:clap: