3 ms·

Setup a secure payment page on your site which collects credit card information and saves it to an encrypted file on your server. Then when someone tries to pay

Setup a secure payment page on your site which collects credit card information and saves it to an encrypted file on your server. Then when someone tries to pay upgrade their account automatically just as if you were processing their payments in real-time. As far as they are concerned your site and payment systems now work perfectly. Have your server email you whenever this happens so that you can login and process their payment manually through Paypal's premium merchant service. That provides a virtual terminal which accepts major credit cards and costs something like $30 a month. You will occasionally have trouble processing a payment and have to take the hit or come up with an excuse to get another card from your customer. This isn't a long-term solution but it will tide you over until you have a real processor and 99.9% of your users will never know. Good luck!

marcamillion 16y ago
I know this is a 'quick and dirty' solution, but it just screams security flaw. I am nervous about accepting credit cards period - much less collecting it into a file and trusting myself to encrypt it and secure it properly. I agree with the thinking and sentiment though, and appreciate the suggestion.
- trevelyan 16y ago
  You have to judge the tradeoffs for yourself. That said, whatever you do remember that anyone with access to your server has full access to all your payment data regardless of how you process the actual payments.
ig1 16y ago
You can't do that, it violates the mastercard/visa agreement. If you want to store credit card details you have to get full PCI/DSS compliance and that includes things like third-party auditing. It's a process that's far more complex than simply obtaining a merchant account.
- trevelyan 16y ago
  Oh, you absolutely CAN do it, you're just not supposed to, since the terminal service is designed for merchants who accept fax/telephone orders. It's a totally arbitrary distinction these days, but the risk is Paypal cutting him off if they find out he's using it for online orders instead of faxed ones. It's not the perfect solution, but this guy's alternative is twiddling his thumbs for 5 months while he gets screwed over by high-risk international payment processors and/or spends a couple thousand bucks registering an American business only to be told he can't get a merchant account as a foreign alien unless he shows up stateside in person to fulfill US "know your customer" requirements. It's not a crime for anyone to give him their credit card number, and his worst outcome is Paypal cutting him off before he is processing with someone else. So I wouldn't lose any sleep over PCI/DSS compliance.

marcamillion 16y ago

I know this is a 'quick and dirty' solution, but it just screams security flaw. I am nervous about accepting credit cards period - much less collecting it into a file and trusting myself to encrypt it and secure it properly. I agree with the thinking and sentiment though, and appreciate the suggestion.

trevelyan 16y ago
You have to judge the tradeoffs for yourself. That said, whatever you do remember that anyone with access to your server has full access to all your payment data regardless of how you process the actual payments.

ig1 16y ago

You can't do that, it violates the mastercard/visa agreement. If you want to store credit card details you have to get full PCI/DSS compliance and that includes things like third-party auditing. It's a process that's far more complex than simply obtaining a merchant account.

trevelyan 16y ago
Oh, you absolutely CAN do it, you're just not supposed to, since the terminal service is designed for merchants who accept fax/telephone orders. It's a totally arbitrary distinction these days, but the risk is Paypal cutting him off if they find out he's using it for online orders instead of faxed ones. It's not the perfect solution, but this guy's alternative is twiddling his thumbs for 5 months while he gets screwed over by high-risk international payment processors and/or spends a couple thousand bucks registering an American business only to be told he can't get a merchant account as a foreign alien unless he shows up stateside in person to fulfill US "know your customer" requirements. It's not a crime for anyone to give him their credit card number, and his worst outcome is Paypal cutting him off before he is processing with someone else. So I wouldn't lose any sleep over PCI/DSS compliance.