I am trying to decrypt the cc numbers after receiving them from the soap API. How can I do this vb?

I am using the following chunk of code to get the encrypted cc num

Dim ccNum = test.getSalesOrder.payment.cc_number_enc

Can I add a decrypt option in the API? If so how?


Thanks everyone for commenting and answering. This has been a good information and think it will help others.

To answer some questions.

We are using our own processing system.

We have a system in place for storing credit card numbers that is PCI Compliment. The problem is getting that information to that system.


Anybody reading this post it is important to read all the comments. Decrypting/storing credit cards is not a good idea, unless you can justify your security.

  • 1
    where are they coming from? What encryption scheme did they use? More specifics please. – JasonS Aug 8 '14 at 20:37
  • 5
    You shouldn't ever do this, ever. – philwinkle Aug 8 '14 at 21:02
  • 1
    Credit card numbers should not be stored, period. If you're using the builtin CC Saved method you should move away from it quickly. If your store is ever compromised the attacker has both the CC numbers and the encryption key right there for them to decrypt. This is not in the best interest of your customers and I personally would never shop at a store where this was the practice. – philwinkle Aug 8 '14 at 21:34
  • 3
    PCI compliance violations cost at least $5,000 - 100,000 a month. Source: pcicomplianceguide.org/pci-faqs-2 What is the store URL and who is your processor? – kab8609 Aug 8 '14 at 21:41
  • 2
    The time is coming soon where people who don't understand why this shouldn't be done will be former business owners when caught storing this data in a non-secure manner. And a name and a password is considered to be a non-secure manner. Pretty much what my credit card processor told me today when certain things came under discussion. – Fiasco Labs Aug 9 '14 at 5:09

You should have a look at:



The encryption key is stored on disk at app/etc/local.xml.

How you implement decryption in your own application is outside the scope of Magento. Adding a decrypt option to the API sounds like a questionable idea. If you have to ask, the answer is probably "you can't". If, instead, you already knew that you wanted to add this to the API and your company's controller says "yes we are allowed do this", then it seems unlikely that you would need to ask this question here.

| improve this answer | |
  • does anyone have an idea of why this data is even in the API? What good is encrypted credit card data if there is no way included to decrypt it? – JasonS Aug 8 '14 at 21:16
  • @pspahn Thanks for the suggestion. I will look into that. I don't believe this out of the scope of magento. I am confident you can add it, I just don't have the skill to do so. – Steven Lynn Aug 8 '14 at 21:17
  • 3
    I meant the decryption of something in your VB application is outside the scope of Magento. I am confident you can add this to the API as well, but as @philwinkle said, you probably shouldn't be doing this. On the off chance that your business is fully aware of the PCI standards they will need to comply with (or potentially face a crippling audit) to have this sort of feature, my answer should point you in the right direction. – pspahn Aug 8 '14 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.