Tag2007 wrote:
> Thanks for that Ive found their forum and put up a post.
>
> Can I ask you guys what I need to consider for payments
and gateways,
> My friend has the little machine at work for taking
credit card
> payments.so do I just get the cart to take the card
details and save
> them to a database for retrieval or whats the way this
is done?
>
> Sorry to ask, Ive done this with paypal but never needed
a secure set
> up if I do need this?
>
> Thanks again
The customer needs an Internet Merchant Account. This is
different from the
Merchant Account he will have for the POS terminal, and if
the bank notice
that a POS terminal is used for internet purchases, he will
probably be in
breach of his contract with the bank - they may take away his
Merchant
Account altogether. The bank *will* notice, because of the
large number of
CNP (customer not present) entries he will be making - even
if there are no
chargebacks (which is the big risk of all internet shopping
carts).
The fact that he already has a merchant account will help
when he applies
for an IMA. He *will* be paying higher fees for an IMA.
When writing the shopping cart, you NEVER store card holders
details on your
site. If you do, and your site is ever compromised, *you* may
be held liable
for any fraudulent transactions made on any card details
stolen from you.
Obivously if you are a massive company, there are business
reasons why you'd
want you own control of all data. But if that was the case,
you wouldn't
have to ask! <g>
For most small shopping carts (i.e, bigger than paypal), I
take the
following approach. I won't claim that it's perfect, or the
cheapest, but it
works (and I'm open to suggestions on improving it).
1. Make sure that the web site to hold the shopping cart is
on a dedicated
IP address. You should then purchase an SSL certificate for
that site.
2. All parts of the shopping cart which collect *any*
customer data - e.g.
name and address - should be protected by the SSL.
3. All monetary transactions should be handled by a card
payment processor,
e.g Worldpay, Metacharge. Let *them* deal with the credit
card details. All
you need to pass are sufficient transaction details so that
you can audit
back to the original sale if there are any queries.
Note that some payment processor company can also help you
set up the IMA
account (Metacharge certainly do), and this may save you some
hassle/money.
Otherwise you need to have the IMA account details to pass to
the payment
processor.
Once you think you're ready to go live, test it thoroughly.
Then test it
again, and test a little more. Test for invalid transactions
are well as
valid ones. The card companies have test numbers you can use,
but also do a
few live payment tests before releasing it to the client (do
it on your own
card, then refund it through the payment processors
interface).
HTH,
Pete.
--
Peter Connolly
http://www.acutecomputing.co.uk
Derby
UK
Skype ID: acutecomputing
11
Replies
AdChoices