Integration and Testing

[tchandler]

Hi all,

I have a requirement from my customers to use CCV when users pay using the customer website, but not to use it when they pay by telephone. 

Is it possible to configure CCV to be optional, and if left blank, it won't validate; but if filled in it would attempt to process as CCV?

Or could I instead (for the website) issue an authorize transaction to validate the CCV, then if that goes through initiate a capture transaction?

Thoughts, ideas, options?

Thanks!

Tim Chandler

[hotslots132]

Sure, you can do this.  Just make your web site require the CVV and pass it to AIM, and then to use the Virtual Terminal for phone orders and not enter the CVV.  My client does exactly this.

If you want to use your web store for this, then add some sort of admin mode where it will not ask for the CVV or not require it.

[NSS]

As a solution provider you should find out what the client needs are and recommend a solution. Some clients may feel web payments are less “safe” and therefore think it would justify requiring the CCV, on the other hand they may think phone orders are “safer” since a real person will be providing the payment details over the phone. Needless to say, it is incorrect.
 
I would ask the client to explain why they would not require CCV for phone orders. If they do not have a really good reason for it, simply explain to your customer the importance of using the CCV, hopefully they will agree and will use the same page to process payments.
 
Otherwise…
 
The simplest solution would be creating a copy of the payment page excluding the CCV requirement from the form and from the information sent to the gateway. You can place that page anywhere on your website and provide the URL to staff only.
 
To prevent the page from being indexed and appearing in the search engines you can place it in a separate folder and add an exclusion in your robots.txt file to prevent crawlers from indexing it.
 
The solution suggested by Hotshots132 will work however it will require staff to log into Authorize.net account to use the virtual terminal which may represent implications such as access to privileged information among other potential issues.
 
 
Hope this helps.

[3Dmerchant]

HI -

MOTO and an ecommerce merchant accounts have had the same basic interchange rates, but the rules for transaction processing can vary. Secure eCommerce Transaction is a rate offered to only ecommerce transactions. The point being, if the client is doing a large volume of both types of transactions, they should have two merchant accounts to ensure they get the best rate qualification for each type _MOTO and ecommerce. Then you can set up parameters differently too. 

The CVV is taken on the web to protect against chargebacks. It has no other purpose and it is the user who puts it in via secure web page. The phone order is taken by a human being. How do they handle that data? Do they write it down? Immediately enter it into a computer system? CVV should never be stored and there may be greater risk for the merchant if that code is taken via the phone. It all depends on their set-up and security procedures.

I would recommend CVV for both, but when not practical, use AVS for the MOTO and CVV for ecommerce, at a minimum.

( Secure eCommerce Transaction info is in the Visa USA Interchange rates PDF)