30 ms·

> It seems that, if this was possible to implement (card tokenization obviously being an issue here) It can be implemented, it has been implemented. Let's say

> It seems that, if this was possible to implement (card tokenization obviously being an issue here) It can be implemented, it has been implemented. Let's say that you'd like to move from one PSP to a new one, but you also have old PSP manage storing credit card information for you. All you have is a weird token, which represents your costumers credit card, but locked to you store. When you switch, you send the list of tokens to the PSP, which will then exchange information with the new PSP. Lastly the new PSP will send you a set of replacement tokens. Granted it's not super automated, and not something PSPs will do, unless you're moving between them, but they can do it.

Griffinsauce 5y ago
You're not explicitly mentioning it but this means the PSPs are sending each other the raw credit card data right?
- g_p 5y ago
  This seems to be the case - another comment in this thread links to https://stripe.com/docs/security/data-migrations/exports https://stripe.com/docs/security/data-migrations/exports, which appears to suggest that the data is exchanged to another PCI-DSS provider via PGP-encrypted JSON-dump. That JSON-dump includes the card number, expiry, and billing address.
- mrweasel 5y ago
  I believe so, either that or there's an additional level of tokenization between them and the company doing the actual integration with the credit card companies. Most people don't realize is that paying with credit cards mean dealing with as many as four companies. The store, obviously, then the payment service provider, an acquirer and then the actual credit card company (and then maybe your bank). The acquirer is normally pretty invisible. Some companies acts as both PSP and acquirer, but some PSP also use the same acquirer, or support multiple. In the later case, you can actually switch PSP, but keep the acquirer. In these cases I would guess that you could avoid doing having to transfer raw credit card data between PSPs.

Griffinsauce 5y ago

You're not explicitly mentioning it but this means the PSPs are sending each other the raw credit card data right?

g_p 5y ago
This seems to be the case - another comment in this thread links to https://stripe.com/docs/security/data-migrations/exports https://stripe.com/docs/security/data-migrations/exports, which appears to suggest that the data is exchanged to another PCI-DSS provider via PGP-encrypted JSON-dump. That JSON-dump includes the card number, expiry, and billing address.
mrweasel 5y ago
I believe so, either that or there's an additional level of tokenization between them and the company doing the actual integration with the credit card companies. Most people don't realize is that paying with credit cards mean dealing with as many as four companies. The store, obviously, then the payment service provider, an acquirer and then the actual credit card company (and then maybe your bank). The acquirer is normally pretty invisible. Some companies acts as both PSP and acquirer, but some PSP also use the same acquirer, or support multiple. In the later case, you can actually switch PSP, but keep the acquirer. In these cases I would guess that you could avoid doing having to transfer raw credit card data between PSPs.