I guess this is somewhat of a simple question. I have a full merchant account, but due to recent fradulent credit card activity I do not want to automatically process credit cards online via my provider's payment gateway service. General question for all of you is - how are you processing this information without using a gateway? I collect the information via a standard secure html form, but I really don't want to keep the data on the server. Is anyone out there using a good script to encrypt and email the information to an account? What other solutions would you recommend?

Thank you in advance for your help.

captnroger,

We struggled with this at first too, knowing that e-mail is unsafe and so is storing card #'s on the Internet. Here's our solution, which we feel is as safe as it gets, and quite easy to implement:

When a customer places an order, we store all information in an online database. A summary e-mail is sent to us, which notifies us about the order and gives a secure link to view the order online using SSL. When we click the link, the browser opens and requires us to enter a username and password to view the order. We employ client-side and server-side password encryption during this step, so that our password to access this information is not transmitted in plain text across the Internet. Once we review the order, we process it using Authorize.net, and upon approval we then enter the customer's card information into an offline processing system, which handles recurring billing. After that, we just X out most of the card number, so that it looks like this: 4xxxxxxxxxxx1234

Now, at this point, everything is perfect. Card #'s are safely offline and a modem-based terminal is used in the future to process monthly bills. Since we leave part of the card # visible online, this gives the customer a way to see which card # we have on file for them. With no complete card # online, I can't see much desire for a hacker to even try to steal our info.

Anyhow, that's how we do it. If anyone else has a better, safer solution, then please post about it!

Also, if you need help developing a system like this, let us know.

Thanks

Mark

We use something close to that, when someone posts a CC number, we use PGP to encrypt the whole email message with a private key and it sends it off to a workstation. There it gets processed and stored in an offline database. Same idea pretty much. I just felt better avoiding storing CC numbers on the server at all. Got enough stress in my life as it is! :D

Good idea. Sounds even easier to implement too :)

Thank you both for the reply, can either of you point me in the direction of a script to do this encryption?

I have the data sent through a secure server (obviously), and then it is encrypted and emailed to us. The script we use is PGPmail. It's basically FormMail, but with PGP encryption. You can find it at http://www.venturablvd.com/pgpmail/ . There might be a more recent version somewhere else (?). Obviously, you'll need PGP on your server to use this.

Some shopping carts can also use PGP to encrypt the order info before mailing it to you.

Realistically however, the chances of CC info being intercepted via email is still extremely low. I think a server hack is a more likely scenario.

Ouch! I mean, you may be realistically right, but my instincts tell me an email is just so plaintext and simple that it's worse than a non-SSL-encrypted website. It depends on how you trust your network, and every network in between. Any packet sniffer anywhere along the line can pick a plaintext credit card number out of the air pretty easy.

Of course, you can always look at your waiter-at-the-restaurant situation and it sure beats packet sniffing. :rolleyes: I think Dilbert even did a strip or two about it. ;)

Maybe the point is there are many easy ways to get people's credit card numbers, but I'd rather my server wasn't one of them.

Well, he was saying to use PGP to encrypt the order info if you send it through e-mail. So, that should be just as secure as any SSL website, if not more..

Fair enough. I was gonna tack on that it oughta be the responsiblity of the merchant/host to ensure that the data is transmitted in the most secure method feasible. To the best of my knowledge, PGP is pretty good privacy.

But yeah I didn't mean to jump on anybody and sorry I misunderstood.