Credit Card CCV

[agisthos]

My billing gateway eWay has informed me that no payments will be processed without a CCV 3 digit code very soon.

In the 'update credit card' section of Blesta 2.5.2 there is no option to have this 3 digit number. There is only a field for CC number and CC expiry, nothing else.

It has now been so long since I setup Blesta that I cannot remember if this was a feature I turned off on purpose, or if Blesta does not support it. I had a look in admin settings but could not find anything.

[Paul]

CVV is in v3, but CVV data cannot be stored. This means that any payments processed through eWay will have to be manual, ie auto-debit will be unsupported.

If you need auto-debit, I would suggest changing to another gateway.

[agisthos]

This is disappointing, as CVV has been a common requirement on almost every online payment using credit cards since 2006-2007.

So to be clear, you are adding CVV support into Blesta v3, but not the ability to store the data (thus rendering auto-debit useless) ?

It's not eWay that is pushing this change, it is a local legislative requirement on banking transactions in my country unfortunately. For those using eWay outside Australia I think it does not apply.

[Paul]

According to Mastercard, Visa, etc rules the CVV number may NEVER be stored. Since we are adhering to the rules by which all merchants require you to agree, we do not store CVV numbers within Blesta. If a customer logs in to make a payment in v3 we will ask for the CVV number for that payment. But, since auto-debit works by storing the card #, and not the CVV (due to rules) automatic payments wont work with a gateway that absolutely requires the CVV # each and every time.

I believe eWay supports a sort of token based payment method, whereby the card details are stored with eWay and Blesta will just send the token and the amount to charge for recurring payments. While our eWay gateway in v3 currently only supports stored card #'s, if we can we will implement the token system also. I'm assuming the token system would allow auto-debits since they are storing the details.

If we can do that, it would be the preferred method anyway since Blesta wouldn't be storing any card details.

We've discussed this only briefly internally. After the alpha release, we will revisit and see if we can implement the token method.

Looking at the token page at.. http://www.eway.com.au/developers/api/token.html

I see 2 methods of concern.. "ProcessPayment" and "ProcessPaymentWithCVN". The first allows a saved card to be run without the CVV, the second allows it to be run with the CVV. Assuming they will continue to support the first method we should be fine. If not, there's nothing really that can be done and they are essentially forcing card present on every transaction.

NOTE! I sent eWay a message through their live chat. I'm waiting on confirmation from them whether the token method processpayment will continue to work without CVV.

[agisthos]

I now have more information about this Paul....

On the 1st of April, Visa and MasterCard mandated that all online transactions must include the CVN/CVV2 from the credit card being used. But in reality it is up to the individual banks to enforce the rules and none of them are being quick to implement it.

eWay told me they can tag my transactions as recurring anyway, even if Blesta does not support the token system.

Does Blesta 2.xx eWay module support the token system?

[Paul]

The 2.x module does not support the token system, and the gateway we have implemented for v3 currently does not either. We are looking into building in support for the token system in v3, and are in touch with someone at eWay.

If eWay can tag transactions as recurring to get around this issue for the moment, that's my recommendation. I suspect we'll have token support in v3 at some point (probably in time for official release), but it's unlikely for 2.x.