PayPal Basic vs PayPal Pro and credit card security

Question

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to upgrade to PayPal Pro according to customer service.

That is not a problem for me as it costs only 30$/month vs free. But what I really like about the Basic plan, is that I do not have to worry about credit card security and keeping that data, notice last option in the pic > "We manage" vs "You manage".

My question is, can I get the PayPal Pro account with the Pro plan but I want them to take care of credit card transactions. I have no problem taking them to PayPal page.

Secondly is there anything missing? Do I really need the Pro account for transferring money from one user to another? I do have mass pay enable with the basic plan.

Any advice about the security, should I integrate the payment on my site? How much of a risk/security issue this is. I don't want to have a full fledged customer service unless I test the website proper (have enough transactions and have achieved certain goals)?

Answer 1

What I have found is that Paypal provides you advance integration and extra functions for 30$/month but they do not provide you any security.

To complete the integration process, you have to buy SSL Certificate, either from your host or a third party. That is required by credit card companies to allow payment to be made on your site.

I think with that in place, your transaction is pretty much secure, although storing credit card data would be another matter which I don't know about fully.

Answer 2

Secondly is there anything missing?

Yes, about 2% - 3% of your profit, and eventually they freeze your whole account out of the blue - happened to me over a small (<50USD) transaction for some service at some freelance programmer site.

So, if you still want to go for the merchant account you have to handle the cc-transactions yourself, and let me tell you, it's an expensive nightmare you should stay away from unless you really make some serious money form your enterprise.

A few things to keep in mind:

• YOU are responsible for the credit card security. Do NEVER store the full number in plaintext, but you have to keep a transaction record and the first+last4 numbers in case of a chargeback or dispute. Sometimes your payment provider will keep those logs for you.
• Test your payment provider fist before you sign up. I have seen some who are not available half of the time or have a response time of 20 seconds or more before you get an success/failure message back.
• Credit card fraud is a huge issue. There are services who estimate a risk of accepting and order based on email, IP address and assumed location vs. delivery address, cc-number (you can match a cc number to a specific bank, and therefore also know which country the card was issued in) and eventually previous merchant experiences with the same card.
• People can dispute the charge and the bank will take the money back from you and refund the customer, sometimes even after 6 months

Answer 3

Option #2 is essentially the same as having a true merchant account and using a payment gateway like Authorize.Net. They handle the actual processing of the credit cards but you have to deal with the payment form and handling the response (approved, declined, etc). That also means you are responsible for the security of your website and server both of which fall under PCI DSS.

In simplest terms: option 1 is less flexible and professional but easier to implement. Option 2 is more powerful and professional but puts a greater burden on you for development and security.