Offline credit card processing - displaying CVV number

Question

I am developing a Magento website for my customer. He wants to process credit card payments offline, but in order to do this the customers' CVV number has to be displayed in the Orders section of the Admin section. Can this be done, please? I have told my client that storing of such payment information is not PCI compliant but he insists that this is the way he wants to go and he is intending to delete the CVV number each time an order is processed.

I would be very grateful if someone could suggest away to achieve this objective.

Many thanks,

Clive

Answer 1

Welcome to Magento.SE!

Firstly, you don't need CVV number to process a credit card. Using a CVV may lower your fees for card-not-present transactions but in many cases just not passing it to the provider will still result in a valid authorization.

There are some exceptions:

• The fraud filters in your merchant account REQUIRE a CVV
• The issuing bank has strict Card Not Present fraud monitoring in place which may trigger a decline

However, what I think your client (and possibly you based on context) may be missing here is that you never need to store the credit card number after an authorization has taken place. Most gateways allow you to capture the funds with the authorization key and your API token at a later time.

Because this key is not considered cardholder data by the PCI definition this can be safely stored without risk to the card holder.

So, what I would do, is develop the system for the authorization to take place on a live gateway at the time of the order placement and then be captured later on from another system. This will require some development but is most likely the safest approach here.

Storing cards

Lastly, there is no rule against storing credit cards themselves. You may not want to store them because the PCI burden is too great to bear for the size of the business, but it is not strictly prohibited to store the 15 or 16 digit PAN. If you do store card numbers there are rules to how they should be stored.

Resources

Review the latest PCI 3.1 documentation here:

https://www.pcisecuritystandards.org/document_library

Review some of my presentations on the topic of PCI compliance here:

Wow such PCI Compliance @ Meet Magento Spain 2015 https://www.youtube.com/watch?v=TkEGpQ0uz54

Secure Commerce Panel @ Magento Imagine 2016 https://magento.com/resources/imagine-2016-secure-commerce-what-business-leaders-need-know?_ga=1.238360328.927176022.1437766568

Read my blog on achieving PCI on Magento:

https://blog.philwinkle.com/can-using-authorize-net-on-magento-be-pci-compliant/