Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've read the many posts on this site that say we are not allowed to store cc numbers if we are not pci-compliant. But, I'm wondering if it is possible to send a CC number through a form to an email address? Would that be still infringing on the standards?

The reason I ask is that a local business owner wants to retrieve a number through a form on his website, so he can manually enter the cc info on his end. I'm assuming the only way to properly get a credit card number is to setup a merchant account?

What's the best way to get a cc number without calling the actual customer? I'm thinking email is a bad idea as well.

share|improve this question

migrated from stackoverflow.com Jun 15 '12 at 22:06

This question came from our site for professional and enthusiast programmers.

    
To process cards manually, some carts split the CC info. For example, they'll email a portion of the CC# and store only the other portion in the database. To get full CC#, you'd have to manually look up and combine the pieces. That way the full CC# is never actually stored in one place. –  Wiseguy Jun 15 '12 at 15:58
    
related Online Credit Card Storage? –  Gordon Jun 15 '12 at 15:59
add comment

5 Answers 5

The form of communication is more or less irrelevant. It's the security of how you handle it. If you can encrypt it from end to end then you'll probably be PCI compliant. Look into PGP for encrypting the email.

share|improve this answer
add comment

You CAN do it, but it's horribly, terribly, shockingly insecure. Email is transmitted across the internet in plain text.

share|improve this answer
    
ok that's what I thought. I don't have expertise in this stuff. My only option is a merchant account? Are there any services that allow me to store a CC without setting up a payment process? I just want the credit card info for right now –  Adam Jun 15 '12 at 15:47
add comment

If you want to be PCI compliant, the form holding the CC data should be send directly to the Payment Provider only. It should not reach/pass any of your servers at all, not for emailing, nor for any other purpose.

For anything else, you need a PCI compliance audit. Consult your Payment Provider of choice for support and options. They are the domain experts.

share|improve this answer
    
Like my comment above, are there providers that allow storage without doing actual payment processing? –  Adam Jun 15 '12 at 15:52
    
@Adam I dont understand. The point of a payment provider is to handle the authorisation and settlement for you. If you are going to mail the CC data to some mailbox (which requires you to make it pass your server, hence not pci compliant), you dont do either of the two. –  Gordon Jun 15 '12 at 15:56
add comment

PCI standards prevent you from storing the credit card number in plaintext. You can still store it in your database encrypted, however. You can do something like the following:

$enc_key = 'some password to (en/de)crypt';
$string = 'credit card number here';
$encrypted = base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, md5($enc_key), $string, MCRYPT_MODE_CBC, md5(md5($enc_key))));

Then later to decrypt:

$decrypted = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, md5($enc_key), base64_decode($encrypted), MCRYPT_MODE_CBC, md5(md5($enc_key)));

Note that you can never store the CVV information though, whether encrypted or not.

share|improve this answer
    
Also, see this document for information on storing credit card numbers -- check page 14. –  Mike Todd Jun 15 '12 at 18:04
add comment

There are several bits to this puzzle. You can "DIY" parts or all of it, or you can contract out parts or all of it.

First: the merchant account. Advantages are generally the smallest percentage overhead, over using something like PayPal. Another advantage is if you have multiple venues -- say, website, brick-n-morter shop, and occasional festivals or off-site charges -- this allows you that versatility. If your client already takes credit cards, this may be a given.

The opposite extreme would be PayPal. The purchaser doesn't even need a PayPal account in order for PayPal to "launder" the transaction through a credit card. This is by far the simplest on-line method: send them a PayPal invoice, and money appears in your PayPal-linked bank account. But it has a pretty steep transaction cost, and you can't use it anywhere that doesn't have an Internet connection. Ideal for someone who doesn't yet have a merchant account and isn't sure they need one.

If you go the merchant account route and take credit card info via a web form, it must be encrypted via the https: protocol. Then you must either "process and forget" or store it encrypted.

Email? Don't even go there. Chopping the credit card info into bits is a huge pain for both parties to the transaction, but only a minor problem for anyone who might be sniffing your email -- they can put it together just as easily as you can. The only exception is if your customer is sophisticated enough to encrypt the email and get you the key separately, in which case, they might as well just call with the credit card number.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.