ISTech Support Forum

ISTech Support Forum
http://www.istechforum.com/YaBB.pl
Evo-ERP and DBA Classic >> Sales >> Contact Manager Charge Card Info
http://www.istechforum.com/YaBB.pl?num=1116869283

Message started by klconard on 05/23/05 at 09:28:03

Title: Contact Manager Charge Card Info
Post by klconard on 05/23/05 at 09:28:03

Is it possible to put an additional field in the credit card area in contact manager for the verification code from the back of the credit card (usually a 3 or 4 digit number). Can it possibly be done on a future update?

Title: Re: Contact Manager Charge Card Info
Post by aricon on 05/23/05 at 17:23:32

You should check with the bank(s) you use for your merchant accounts, keeping this information is usually against the merchant agreement.

Title: Re: Contact Manager Charge Card Info
Post by kevind on 05/24/05 at 04:54:40

This subject came up before.

Subsequenty, I recieved another merchant mailing from Discover. It was confimed that they expressly prohibit this code being stored.

Section 12.7 of http://www.discovernetwork.com/common/image/operat_reg.pdf
States the following:
You must not retain any CID data for any Card transaction or any Cardmember, in your records or otherwise, for any reason, including recurring billing transactions described in Section 5.3. Furthermore, the CID must not be recorded on Sales Data or any other evidence of the Card transaction.

This Does bring up another requirement.
Section 12.6 states:
Card Account numbers and Card transaction data that you store must be stored in a secure environment that is protected by information security technologies such as encryption, firewalls and access controls.

This tells me that storing the credit card information in plain text form in the customer record is prohibited.

One solution to this is for ISTech to incorporate RSA Encryption on just this field. This would also provide another level of access control to the CC information in addition to masking the plain text CC information from Database Maintenance and ODBC access.