Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to upgrade to PayPal Pro according to customer service.

That is not a problem for me as it costs only 30$/month vs free. But what I really like about the Basic plan, is that I do not have to worry about credit card security and keeping that data, notice last option in the pic > "We manage" vs "You manage".

enter image description here

My question is, can I get the PayPal Pro account with the Pro plan but I want them to take care of credit card transactions. I have no problem taking them to PayPal page.

Secondly is there anything missing? Do I really need the Pro account for transferring money from one user to another? I do have mass pay enable with the basic plan.

Any advice about the security, should I integrate the payment on my site? How much of a risk/security issue this is. I don't want to have a full fledged customer service unless I test the website proper (have enough transactions and have achieved certain goals)?

share|improve this question
    
Credit Card Security: Payflow Link -- merchant.paypal.com/us/cgi-bin/… –  LazyOne Sep 2 '11 at 1:18
add comment

3 Answers 3

What I have found is that Paypal provides you advance integration and extra functions for 30$/month but they do not provide you any security.

To complete the integration process, you have to buy SSL Certificate, either from your host or a third party. That is required by credit card companies to allow payment to be made on your site.

I think with that in place, your transaction is pretty much secure, although storing credit card data would be another matter which I don't know about fully.

share|improve this answer
add comment

Secondly is there anything missing?

Yes, about 2% - 3% of your profit, and eventually they freeze your whole account out of the blue - happened to me over a small (<50USD) transaction for some service at some freelance programmer site.

So, if you still want to go for the merchant account you have to handle the cc-transactions yourself, and let me tell you, it's an expensive nightmare you should stay away from unless you really make some serious money form your enterprise.

A few things to keep in mind:

  • YOU are responsible for the credit card security. Do NEVER store the full number in plaintext, but you have to keep a transaction record and the first+last4 numbers in case of a chargeback or dispute. Sometimes your payment provider will keep those logs for you.
  • Test your payment provider fist before you sign up. I have seen some who are not available half of the time or have a response time of 20 seconds or more before you get an success/failure message back.
  • Credit card fraud is a huge issue. There are services who estimate a risk of accepting and order based on email, IP address and assumed location vs. delivery address, cc-number (you can match a cc number to a specific bank, and therefore also know which country the card was issued in) and eventually previous merchant experiences with the same card.
  • People can dispute the charge and the bank will take the money back from you and refund the customer, sometimes even after 6 months
share|improve this answer
    
Luckily I have changed my plan. I have decided to stick with standard membership. Dealing with credit cards would be a hassle in itself. –  slow diver Sep 2 '11 at 15:54
add comment

Option #2 is essentially the same as having a true merchant account and using a payment gateway like Authorize.Net. They handle the actual processing of the credit cards but you have to deal with the payment form and handling the response (approved, declined, etc). That also means you are responsible for the security of your website and server both of which fall under PCI DSS.

In simplest terms: option 1 is less flexible and professional but easier to implement. Option 2 is more powerful and professional but puts a greater burden on you for development and security.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.