Storing Credit Card information

[t vainisi]

Hi List,

Our company wants me to make it easier for customers to make repeat  
purchases in our e-commerce applications.  Specifically, they want an  
Amazon type system where the customer does not have to pull the  
credit card out of their wallet.  While I agree that this would  
definitely increase sales, I've never done this kind of thing because  
of the liability of having the cc numbers in our databases.  In my  
researching, I'm also seeing that its possibly illegal (though it  
seems hard for me to believe).

Does anybody have any advice for me?  Is there a way I can do it  
(encryption-wise) that would be safe?  Is it totally illegal?  How  
does amazon get away with it?

T Vainisi




--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Eric Landmann]

On 11/5/09 at 3:22 PM, Todd@... (Todd
Vainisi) wrote:

>Our company wants me to make it easier for customers to make
>repeat purchases in our e-commerce applications.  Specifically,
>they want an Amazon type system where the customer does not
>have to pull the credit card out of their wallet.  While I
>agree that this would definitely increase sales, I've never
>done this kind of thing because of the liability of having the
>cc numbers in our databases.  In my researching, I'm also
>seeing that its possibly illegal (though it seems hard for me
>to believe).
>
>Does anybody have any advice for me?  Is there a way I can do
>it (encryption-wise) that would be safe?  Is it totally
>illegal?  How does amazon get away with it?

You have to do a LOT of research on PCI compliance. Start here:

<https://www.pcisecuritystandards.org/>
<http://www.pciknowledgebase.com/>

Basically if you have a big enough budget to jump through all
the hoops, get your application and operating environment
certified, then you're good. But it is a very expensive process.

--Eric


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brad Lindsay-2]

On Nov 5, 2009, at 4:22 PM, Todd Vainisi wrote:

> Hi List,
>
> Our company wants me to make it easier for customers to make repeat  
> purchases in our e-commerce applications.  Specifically, they want  
> an Amazon type system where the customer does not have to pull the  
> credit card out of their wallet.  While I agree that this would  
> definitely increase sales, I've never done this kind of thing  
> because of the liability of having the cc numbers in our databases.  
> In my researching, I'm also seeing that its possibly illegal (though  
> it seems hard for me to believe).
>
> Does anybody have any advice for me?  Is there a way I can do it  
> (encryption-wise) that would be safe?  Is it totally illegal?  How  
> does amazon get away with it?

I believe that many credit card gateways will allow you to store that  
data on their servers so you don't have to worry about it. I would  
check with whomever you're using as a credit card processor and see if  
they don't have some way of storing this data for you and giving you  
and API to hook into it.

-Brad


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

On 2009-11-05, at 4:22 PM, Todd Vainisi wrote:

> Does anybody have any advice for me?  Is there a way I can do it  
> (encryption-wise) that would be safe?  Is it totally illegal?  How  
> does amazon get away with it?


It's not like you can use them behind their back...without going to  
jail.  The only saving you will gain is having the user not re-enter  
thier number.  Is all that worth it?  Your users can initiate sales at  
any time.  It's not like not keeping their cc info is going to have  
them stop.  I'm sure your company doesn't understand the ramifications  
of storing cc information, including PCI compliance, liabilities,  
etc.  16 digits, that's it.

Also, I think your users would be glad to know you don't store their  
cc information.


_____________
Rich in Toronto


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Kevin Bice]

Todd,
Authorize.net, PaymenTech, and probably others have an add-on service  
that allows you to create customer profiles on their servers that you  
can access for returning customers. While it is a convenience, I am  
sometime creeped out at idea of even someone as large as Amazon  
having access to that information.

It is more of an issue if you are playing on the same level as sites  
like Amazon. I agree with Rich that most people would be happier to  
think that  your web site does not have access to such information.
.................................
Kevin Bice
512-879-1653
http://fmpweb.com
.................................
Web Development and Design



On Nov 5, 2009, at 3:50 PM, Viaduct Productions wrote:

>
> On 2009-11-05, at 4:22 PM, Todd Vainisi wrote:
>
>> Does anybody have any advice for me?  Is there a way I can do it  
>> (encryption-wise) that would be safe?  Is it totally illegal?  How  
>> does amazon get away with it?
>
>
> It's not like you can use them behind their back...without going to  
> jail.  The only saving you will gain is having the user not re-
> enter thier number.  Is all that worth it?  Your users can initiate  
> sales at any time.  It's not like not keeping their cc info is  
> going to have them stop.  I'm sure your company doesn't understand  
> the ramifications of storing cc information, including PCI  
> compliance, liabilities, etc.  16 digits, that's it.
>
> Also, I think your users would be glad to know you don't store  
> their cc information.
>
>
> _____________
> Rich in Toronto
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Deco Rior (Tennissource)]

Hi, Todd:

We use the AIM CIM and it is great!

However, these are the issues we have had:

1. It does not return a masked credit card number so you will need to  
store the last four digits

2. It does not return the type of credit card (which may be important)  
so we store that too.

3. It does not store the expiration date...so store that too :-)

DO NOT STORE THEM YOURSELF.

Perhaps to disagree, but our customers and their customers really like  
it!

Deco
On Nov 5, 2009, at 3:30 PM, Kevin Bice wrote:

> Todd,
> Authorize.net, PaymenTech, and probably others have an add-on  
> service that allows you to create customer profiles on their servers  
> that you can access for returning customers. While it is a  
> convenience, I am sometime creeped out at idea of even someone as  
> large as Amazon having access to that information.
>
> It is more of an issue if you are playing on the same level as sites  
> like Amazon. I agree with Rich that most people would be happier to  
> think that  your web site does not have access to such information.
> .................................
> Kevin Bice
> 512-879-1653
> http://fmpweb.com
> .................................
> Web Development and Design
>
>
>
> On Nov 5, 2009, at 3:50 PM, Viaduct Productions wrote:
>
>>
>> On 2009-11-05, at 4:22 PM, Todd Vainisi wrote:
>>
>>> Does anybody have any advice for me?  Is there a way I can do it  
>>> (encryption-wise) that would be safe?  Is it totally illegal?  How  
>>> does amazon get away with it?
>>
>>
>> It's not like you can use them behind their back...without going to  
>> jail.  The only saving you will gain is having the user not re-
>> enter thier number.  Is all that worth it?  Your users can initiate  
>> sales at any time.  It's not like not keeping their cc info is  
>> going to have them stop.  I'm sure your company doesn't understand  
>> the ramifications of storing cc information, including PCI  
>> compliance, liabilities, etc.  16 digits, that's it.
>>
>> Also, I think your users would be glad to know you don't store  
>> their cc information.
>>
>>
>> _____________
>> Rich in Toronto
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

On 2009-11-05, at 5:57 PM, Deco Rior (Tennissource) wrote:

> DO NOT STORE THEM YOURSELF.
>
> Perhaps to disagree, but our customers and their customers really  
> like it!

I'd like to stress that this can be a strong marketing point.  Don't  
overlook this.

When you weigh the time it takes to enter this number, versus the time  
to replace a card and update regular charges, etc., is incomparable.

_____________
Rich in Toronto


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Deco Rior (Tennissource)]

CORRECTION!

It stores them but you cannot return them once entered!

Does that make sense.

Deco
On Nov 5, 2009, at 3:57 PM, Deco Rior (Tennissource) wrote:

> Hi, Todd:
>
> We use the AIM CIM and it is great!
>
> However, these are the issues we have had:
>
> 1. It does not return a masked credit card number so you will need  
> to store the last four digits
>
> 2. It does not return the type of credit card (which may be  
> important) so we store that too.
>
> 3. It does not store the expiration date...so store that too :-)
>
> DO NOT STORE THEM YOURSELF.
>
> Perhaps to disagree, but our customers and their customers really  
> like it!
>
> Deco
> On Nov 5, 2009, at 3:30 PM, Kevin Bice wrote:
>
>> Todd,
>> Authorize.net, PaymenTech, and probably others have an add-on  
>> service that allows you to create customer profiles on their  
>> servers that you can access for returning customers. While it is a  
>> convenience, I am sometime creeped out at idea of even someone as  
>> large as Amazon having access to that information.
>>
>> It is more of an issue if you are playing on the same level as  
>> sites like Amazon. I agree with Rich that most people would be  
>> happier to think that  your web site does not have access to such  
>> information.
>> .................................
>> Kevin Bice
>> 512-879-1653
>> http://fmpweb.com
>> .................................
>> Web Development and Design
>>
>>
>>
>> On Nov 5, 2009, at 3:50 PM, Viaduct Productions wrote:
>>
>>>
>>> On 2009-11-05, at 4:22 PM, Todd Vainisi wrote:
>>>
>>>> Does anybody have any advice for me?  Is there a way I can do it  
>>>> (encryption-wise) that would be safe?  Is it totally illegal?  
>>>> How does amazon get away with it?
>>>
>>>
>>> It's not like you can use them behind their back...without going  
>>> to jail.  The only saving you will gain is having the user not re-
>>> enter thier number.  Is all that worth it?  Your users can  
>>> initiate sales at any time.  It's not like not keeping their cc  
>>> info is going to have them stop.  I'm sure your company doesn't  
>>> understand the ramifications of storing cc information, including  
>>> PCI compliance, liabilities, etc.  16 digits, that's it.
>>>
>>> Also, I think your users would be glad to know you don't store  
>>> their cc information.
>>>
>>>
>>> _____________
>>> Rich in Toronto
>>>
>>>
>>> --
>>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>>
>>>
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Brad Lindsay-2]

On Nov 5, 2009, at 5:59 PM, Viaduct Productions wrote:

>
> On 2009-11-05, at 5:57 PM, Deco Rior (Tennissource) wrote:
>
>> DO NOT STORE THEM YOURSELF.
>>
>> Perhaps to disagree, but our customers and their customers really  
>> like it!
>
> I'd like to stress that this can be a strong marketing point.  Don't  
> overlook this.
>
> When you weigh the time it takes to enter this number, versus the  
> time to replace a card and update regular charges, etc., is  
> incomparable.

Convenience vs. security is always the debate.  I prefer sites that  
let me choose whether or not to remember my card information, and  
despise sites that automatically remember it whether I want them to or  
not.

-Brad

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Deco Rior (Tennissource)]

So a few more items:

1. It depends on purchase frequency. In our application repeat  
business is very, very high so it makes sense to store the credit  
cards in the AIM servcie.
2. It is more secure since the information is  only being transmitted  
once.
3. It is the ONLY way to do variable recurring billing
4. You can validate the card on file at ANY time, so notify the  
customer if their card has expired before they check out!

Since we introduced it in our solution it has worked very well for us,  
but depends on your business model.

For us, it solves a multitude of issues with swiping or entering a card!

Deco


On Nov 5, 2009, at 3:59 PM, Viaduct Productions wrote:

>
> On 2009-11-05, at 5:57 PM, Deco Rior (Tennissource) wrote:
>
>> DO NOT STORE THEM YOURSELF.
>>
>> Perhaps to disagree, but our customers and their customers really  
>> like it!
>
> I'd like to stress that this can be a strong marketing point.  Don't  
> overlook this.
>
> When you weigh the time it takes to enter this number, versus the  
> time to replace a card and update regular charges, etc., is  
> incomparable.
>
> _____________
> Rich in Toronto
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Steve Piercy]

Don't.  As others have said, the risk of storing CC#s in any
form is too great unless your client has literally $100k's of
resources to pay fines and attorney fees when the data is
eventually cracked or stolen.  Usually the crime is committed as
an inside job.  The monthly fee for gateway services is a great
insurance policy.

Authorize.net offers AIM and CIM methods for CC transactions.  
Both allow for Automated Recurring Billing (ARB).  The
difference is that CIM allows you to store a customer profile
along with billing and shipping profiles on Authorize.net
services.  All you do is store the profile IDs on your server
and retrieve the profile data from Authorize.net's servers
through an XML call.

You can download my AuthorizeNet_AIM tag for more information,
including documentation and requirements.

http://www.tagswap.net/AuthorizeNet_AIM

There is also a thread about the CIM method, along with some
custom tags I wrote, but have not cleaned up and made available yet.

http://old.nabble.com/Authorize.net-CIM---ARB-%2C-xmltree-and-SOAP-to25443822.html#a25517732

--steve



On 11/5/09 at 4:22 PM, Todd@... (Todd
Vainisi) pronounced:

>Hi List,
>
>Our company wants me to make it easier for customers to make
>repeat purchases in our e-commerce applications.  Specifically,
>they want an Amazon type system where the customer does not
>have to pull the credit card out of their wallet.  While I
>agree that this would definitely increase sales, I've never
>done this kind of thing because of the liability of having the
>cc numbers in our databases.  In my researching, I'm also
>seeing that its possibly illegal (though it seems hard for me
>to believe).
>
>Does anybody have any advice for me?  Is there a way I can do
>it (encryption-wise) that would be safe?  Is it totally
>illegal?  How does amazon get away with it?
>
>T Vainisi
>
>
>
>
>--
>This list is a free service of LassoSoft: http://www.LassoSoft.com/
>Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
-- --
Steve Piercy               Web Site Builder              
Soquel, CA
<web@...>                  <http://www.StevePiercy.com/>


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Deco Rior (Tennissource)]

Yes, I think it depends on the business. For us the customers of our  
customers are always local, and know to the customer so convenience is  
key.

However, the CIM method is both more secure and convenient IMHO

Deco
On Nov 5, 2009, at 4:01 PM, Brad Lindsay wrote:

>
> On Nov 5, 2009, at 5:59 PM, Viaduct Productions wrote:
>
>>
>> On 2009-11-05, at 5:57 PM, Deco Rior (Tennissource) wrote:
>>
>>> DO NOT STORE THEM YOURSELF.
>>>
>>> Perhaps to disagree, but our customers and their customers really  
>>> like it!
>>
>> I'd like to stress that this can be a strong marketing point.  
>> Don't overlook this.
>>
>> When you weigh the time it takes to enter this number, versus the  
>> time to replace a card and update regular charges, etc., is  
>> incomparable.
>
> Convenience vs. security is always the debate.  I prefer sites that  
> let me choose whether or not to remember my card information, and  
> despise sites that automatically remember it whether I want them to  
> or not.
>
> -Brad
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Deco Rior (Tennissource)]

Yes to clarify, the ARB does not easily allow for automated billing of  
different amount sand times once setup. although they claim it has  
more flexibility now!

So that is one thing we use CIM for.

Deoc


On Nov 5, 2009, at 4:05 PM, Steve Piercy - Web Site Builder wrote:

> Don't.  As others have said, the risk of storing CC#s in any form is  
> too great unless your client has literally $100k's of resources to  
> pay fines and attorney fees when the data is eventually cracked or  
> stolen.  Usually the crime is committed as an inside job.  The  
> monthly fee for gateway services is a great insurance policy.
>
> Authorize.net offers AIM and CIM methods for CC transactions.  Both  
> allow for Automated Recurring Billing (ARB).  The difference is that  
> CIM allows you to store a customer profile along with billing and  
> shipping profiles on Authorize.net services.  All you do is store  
> the profile IDs on your server and retrieve the profile data from  
> Authorize.net's servers through an XML call.
>
> You can download my AuthorizeNet_AIM tag for more information,  
> including documentation and requirements.
>
> http://www.tagswap.net/AuthorizeNet_AIM
>
> There is also a thread about the CIM method, along with some custom  
> tags I wrote, but have not cleaned up and made available yet.
>
> http://old.nabble.com/Authorize.net-CIM---ARB-%2C-xmltree-and-SOAP-to25443822.html#a25517732
>
> --steve
>
>
>
> On 11/5/09 at 4:22 PM, Todd@... (Todd Vainisi)  
> pronounced:
>
>> Hi List,
>>
>> Our company wants me to make it easier for customers to make repeat  
>> purchases in our e-commerce applications.  Specifically, they want  
>> an Amazon type system where the customer does not have to pull the  
>> credit card out of their wallet.  While I agree that this would  
>> definitely increase sales, I've never done this kind of thing  
>> because of the liability of having the cc numbers in our  
>> databases.  In my researching, I'm also seeing that its possibly  
>> illegal (though it seems hard for me to believe).
>>
>> Does anybody have any advice for me?  Is there a way I can do it  
>> (encryption-wise) that would be safe?  Is it totally illegal?  How  
>> does amazon get away with it?
>>
>> T Vainisi
>>
>>
>>
>>
>> --
>> This list is a free service of LassoSoft: http://www.LassoSoft.com/
>> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
>> Manage your subscription: http://www.ListSearch.com/Lasso/
>>
>>
>
> -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
> Steve Piercy               Web Site Builder               Soquel, CA
> <web@...>                  <http://www.StevePiercy.com/>
>
>
> --
> This list is a free service of LassoSoft: http://www.LassoSoft.com/
> Search the list archives: http://www.ListSearch.com/Lasso/Browse/
> Manage your subscription: http://www.ListSearch.com/Lasso/
>
>

--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Steve Piercy]

On 11/5/09 at 3:57 PM, decorior@... (Deco Rior
(Tennissource)) pronounced:

>We use the AIM CIM and it is great!

There is no AIM CIM.  AIM and CIM are two methods used by Authorize.net.

>However, these are the issues we have had:
>
>1.    It does not return a masked credit card number so you
>will need to store the last four digits

It depends on the method you use.  
getCustomerPaymentProfileResponse returns a masked CC# with the
last 4 digits displayed as well as the expiration date.  I
assume you are using the
createCustomerProfileTransactionResponse method, in which case
the CC# is not returned (obviously not necessary because the
customer provided it in the transaction).

However the 3- or 4-digit CVS code is not stored, nor should it
be, anywhere.

>2.    It does not return the type of credit card (which may be
>important) so we store that too.

This is true, but it is only important when you want to provide
a hint to the customer about which card number belongs to which
card type.  From an online transaction processing perspective it
does not matter.

>3.    It does not store the expiration date...so store that too :-)

See response to 1 above.

--steve

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
-- --
Steve Piercy               Web Site Builder              
Soquel, CA
<web@...>                  <http://www.StevePiercy.com/>


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Steve Piercy]

On 11/5/09 at 4:05 PM, decorior@... (Deco Rior
(Tennissource)) pronounced:

>1.    It depends on purchase frequency. In our application
>repeat business is very, very high so it makes sense to store
>the credit cards in the AIM servcie.

You mean Authorize.net CIM.

>2.    It is more secure since the information is  only being transmitted once.

Transmission frequency is not security.  Just like an STD, it
only takes one time in Vegas.  Security is in not storing PAN on
your servers, but leaving that to the gateway.

>3.    It is the ONLY way to do variable recurring billing

Yes.  However if the amount is the same on a periodic basis, you
can use ARB with either AIM or CIM.

--steve

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
-- --
Steve Piercy               Web Site Builder              
Soquel, CA
<web@...>                  <http://www.StevePiercy.com/>


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Viaduct Productions]

On 2009-11-05, at 6:22 PM, Steve Piercy - Web Site Builder wrote:

> Just like an STD, it only takes one time in Vegas.

Please elaborate.  I'm not from California.

_____________
Rich in Toronto


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Steve Piercy]

On 11/5/09 at 6:24 PM, lists@... (Viaduct
Productions) pronounced:

>On 2009-11-05, at 6:22 PM, Steve Piercy - Web Site Builder wrote:
>
>>Just like an STD, it only takes one time in Vegas.
>
>Please elaborate.  I'm not from California.

Perhaps you can better relate to this: it only takes one time in
de Wallen.

--steve

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- --
-- --
Steve Piercy               Web Site Builder              
Soquel, CA
<web@...>                  <http://www.StevePiercy.com/>


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Douglas Burchard]

On Nov 5, 2009, at 3:39 PM, Steve Piercy - Web Site Builder wrote:

> On 11/5/09 at 6:24 PM, lists@... (Viaduct  
> Productions) pronounced:
>
>> On 2009-11-05, at 6:22 PM, Steve Piercy - Web Site Builder wrote:
>>
>>> Just like an STD, it only takes one time in Vegas.
>>
>> Please elaborate.  I'm not from California.
>
> Perhaps you can better relate to this: it only takes one time in de  
> Wallen.

I had to look that up on Wikipedia...


--
Douglas Burchard, President
DouglasBurchard.com, Web Applications
15024 NE 66th Street
Redmond, WA  98052, USA

direct: [phone]
solutions@...
http://www.douglasburchard.com/




--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Andre Hopkins-3]

>
> > 3.    It is the ONLY way to do variable
> recurring billing
>
> Yes.  However if the amount is the same on a periodic
> basis, you can use ARB with either AIM or CIM.
>

Can you pass CIM values - customer id - to create an ARB transaction???

have a rough solution working for CIM, i'm going to be diving into ARB next week.

oh and - double clicks on the form submission will kill CIM dead. (aim tag is much more forgiving it seems of spastic clickers). different javascript solutions out there - each with downsides.

but bottom line CIM is awesome and every ecommerce client is going to want it. it costs $20 a month extra, if client does repeat sales at all it will easily pay for itself and then some.

cim kicks back the last 4 digis of the cc number based on the customer id you send them (via xml exchange). existing customer doesn't even need to see a billing address screen! here's your products with tax and shipping totals - they click one button and they are done!

biggest obstacle are the customers who can't or won't store / or use a user name and password. but even for those people - it doesnt take any more time for them and its safer for the merchant not to store cc numbers.

related and very cool - authorize doesn't penalize you to set up a customer id with the same name and credit card number, over and over. in other words for the people who just make up a user and pass every time - they can have multiple customer ids with the same name and credit card number - authorize DOES NOT kick it back and say - oh this customer or cc number is already on file with you - which obviously would be a huge hassle.

the only thing you have to store on the DB is the customer id number, and the id(s) for the different credit cards.



andre






--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/

[Deco Rior (Tennissource)]

Hi, Stve:

Are you sure?

The last time I checked with Authorize.Net they said that this did not  
happen despite the fact the docs says it does?

Deco
On Nov 5, 2009, at 4:17 PM, Steve Piercy - Web Site Builder wrote:

>> 1.    It does not return a masked credit card number so you will  
>> need to store the last four digits
>
> It depends on the method you use.  getCustomerPaymentProfileResponse  
> returns a masked CC# with the last 4 digits displayed as well as the  
> expiration date.  I assume you are using the  
> createCustomerProfileTransactionResponse method, in which case the  
> CC# is not returned (obviously not necessary because the customer  
> provided it in the transaction).


--
This list is a free service of LassoSoft: http://www.LassoSoft.com/
Search the list archives: http://www.ListSearch.com/Lasso/Browse/
Manage your subscription: http://www.ListSearch.com/Lasso/