3

Lets say there is a service that processes a credit card, service X. I want to create a new service (Y) that has a form on it mirroring the fields from service X. I use the credentials entered into service Y and POST them to service X programmatically, and there is credit card information being posted. Is this legal? Is this PCI compliant? I would not be storing any information, however there may be loops involved as in entering this one form in service Y may enter multiple forms on service X, this all would be specified on service Y's Terms and Conditions of course.

Improve this question
1
  • I have a very similar issue. We are trying to build a consistent store-front that allows users to sign up for services from 3rd parties by entering their credit card details into our site, and us (either programatically or manually) signing them up on the 3rd party site. PCI prohibits storing CVVs so even if we were compliant I can't see an obvious way through this. Is this similar to your issue?
    – doza
    Commented Jan 17, 2013 at 10:37

2 Answers 2

Reset to default
2

My recommendation at that point is use a better service that doesn't require you to pass the information from one form to another. If you are handling PCI at all, then you have to worry about at least some of the regulations. It is best to have your system call out to a payment provider, let the user use their site and then their site will tell you about the success or failure. Many vendors will even let you do it in such a way that it doesn't look like they are leaving your site.

Improve this answer
1

So you are just going to put the merchant's credntials that authorize him to use the gateway X as hidden fields in the form so any idiot can view source on your form and get the merchant's credentials, including the ones that should be kept secret and carefully safeguarded?

The only way to overcome the problem above is to have the form submit to your own server and add the credentials before you submit to Gateway X from your own server, but then you come under PCI compliance. If you do what you propose, then you are failing to safeguard the merchant's credentials and thus come under PCI anyway and are OUT of compliance because you are failing to safeguard the merchant's processing credentials.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .