need to store credit card info. what's my best option ?

Question

Hi,

I'm building an auction website that charge small fee for each bid. There is option to buy bank of bids, and there is an option to pay separately for each bid.

When paying for each bid - I don't want to ask the user to re-enter the credit card info each time. On the other hand I'm surely don't want to store the credit card info on DB and I have read that it is not safe to save it as session variable, not to mention cookies.

The client credit card processing company can't store the credit info either. All cc info is entered by user under SSL of course.

So, is it even possible ? Is there a safe (/safer) way to store the cc info in the session ?

Thanks

Answer 1

there are parts of the credit card information that you can store in the database but this does not include CVV2 data (the 3 digit code on the back of the card). I believe all the information you can store needs to be encrypted - check for information here https://www.pcisecuritystandards.org/index.shtml

in my experience i found it easier to just set up real-time system and just get the customer to fill in their details each time - i found it to be much less hassle

Answer 2

Most payment gateways now provide a service now where you send them card details, and they return a token id. When you want to perform an authorization, or take final payment against the card you just send the token id. This is hugely beneficial to helping ease the PCI-DSS burdens that come with taking payments by card, because you only store a benign token id rather than any card details.

This will allow you to capture the card details once, then authorize as frequently as you like. It's worth keeping the frequency as low as possible however, because the payment gateway will typically make a per-authorization charge.

With that in mind, how frequent are the bids? It may be worth summing up the daily bids that a user makes and then authorising/charging for them daily/weekly/monthly, or when a certain value threshold is hit.