How do group buying websites handle credit card processing

The way to solve this is to save the customer’s card number, verify that it’s legitimate, and then charge all the customers once the deal’s critical mass has been achieved.

However, storing card numbers is a pain because if the card numbers are stolen from your servers you can face fines which can easily exceed $millions of dollars for a large breach.  Also, to get a a merchant account with a credit card processor you will need to sign a document telling them that you are PCI compliant.  Being PCI compliant (http://feefighters.com/blog/easy...) is pretty easy if you don’t store card numbers, but if you do wish to store card numbers it requires security audits.

You can get most of the benefits of storing card numbers locally without worrying too much about PCI by using tokenization (http://feefighters.com/blog/cred...).

You also have 2 options with respect to verifying the card number before storing it as a token.
  1. Do a quick algorithmic check using the Luhn Algorithm to see if the card number is valid – this is a quick but imperfect check.  It will screen out completely made up account numbers but will not actually check with visa/mc/amex to see if there is an account with that number.
  2. Try to authorize a $0.0 transaction.  This is called a Zero Dollar Value authorization request.  It costs $0.025 from visa, is free from mastercard and your credit card processor will also charge you an authorization fee (which can sometimes be as high as $0.30 — typically merchants that used FeeFighters to shop for a credit card processor will have authorization fees of $0.05-0.010).  This is a 100% effective method of verifying that the card exists and is valid.

Comments

Popular posts from this blog

Ensemble

Bias-Variance tradeoff

AI