I have a new client who is a reseller for vacation packages. They have multiple wholesalers, and my client is instructed by the wholesalers to sign into their wholesale account, and enter their customer's credit card details on their behalf to book the trip.
I've personally confirmed this is their standard practice, and the wholesalers offer absolutely no assistance. The way my client handled this with their previous hosting provider was by having a simple form on their website, which their customers would use and the credit card info was sent via email.
This is bad, obviously.
To add to the mess, the wholesalers require the security code for the card.
I don't want to go through the scrutiny of PCI compliance, so I have a few questions:
- Does anyone know of 3rd party service that this form could reside with? Also keeping in mind the CVV is needed.
- What if I created an encrypted file that is emailed to my client upon form submission, and build a desktop app for them to enter in a key in order to decrypt it?
- Is my business potentially liable if we build a solution and some how, some way, someone's credit card info falls into malicious hands? Perhaps I shouldn't allow it on my server and force them to get a new host, regardless if we do the work or not.
I just have absolutely no idea how to best solve this situation. Thousands of resellers of vacation packages around the globe, and this is what they're expected to do? I suggested to my client they take the card details over the phone, and shred it after making their payment, but they're unable to do this due to multiple reasons.
This has ended in a ton of searching and reading other scenarios. All the credit card "storage" services that I've found do not and will not store the security code.
I'm at a total loss. Please advise.