1

We need to save the 3 digit code from the back of the card. I enabled the credit card (saved) payment option but Magento 1.9.1 (although it shows it during the order process) is not saving the Card Verification Number after customer fills that in during the order process. It does not show on the order in the Admin...Any ideas?

4

That's a really, really, really bad idea. PCI compliance regulations absolutely prohibit the CCV from being stored in any form. More info

Really, you shouldn't be storing credit card information locally in any form. Saved cards are nice, but do it with a tokenization solution like Paypal Credit Card Tokenization or Authorize.Net CIM. If you use some other payment processor already, there might be an extension for them too. This gives you the benefits of stored cards, without the major risk and liability of trying to do it locally.

If you have some business process that requires the card details, you should seriously consider changing that process.

Full disclosure: I wrote the CIM extension. These kinds of security concerns are what I deal with.

  • Thank you Ryan for your ideas - it is very much appreciated! :-) The problem is that we are processing transactions using Paypal but had to remove the Paypal setup from our Magento shopping cart because we have a few items that we sell that contain alcohol and apparently - this does not fly well with Paypal...So - I disabled the Paypal automatic processing, we do the saved credit card payment option now and process through Paypal manually...Would the Paypal Credit Card Tokenization help with that? Thanks again for any ideas! :-* – Allysin Aug 17 '15 at 21:44
  • You get a credit card processor that will accept payments for the products you sell. You should never store credit card information on your web server, makes for future bad customer relations when your web server gets hacked. Having all their payment credentials stolen does not fly well with customers. Tokenization is a good step forward, a lot of credit card processors are starting to support this method of handling credit card data. – Fiasco Labs Aug 17 '15 at 22:03
  • @Allysin, Fiasco Labs is correct. If PayPal isn't working out for you, then find another processor that will. Shop around, there are many options. You can start by narrowing it down to ones that will actually work with you, then look at transaction fees, available Magento integrations, etc. FWIW, Authorize.Net does not appear to have any policy against alcohol, and reseller Capital Merchant Services specifically advertises as working with high-risk accounts. I've never worked with them before though. – Ryan Hoerr Aug 17 '15 at 23:25
  • I found an extension that deletes the CODE after it is used. Please - we need this as a temporary kind of a thing - does anyone have any ideas on why the CVV code shows up during the checkout process, you fill it in but the CVV code does NOT show up on the order in Admin? Thanks for any suggestions! :-* – Allysin Aug 20 '15 at 9:34
  • I think this is a bug - I have 2 seperate Magento instalations - Magento ver. 1.9.1.1 and ver. 1.9.1.0 I did test orders on both and it DOES NOT save the CVV code in either! – Allysin Aug 20 '15 at 11:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.