Dealing with credit card data that is not charged directly

Question

I have a client who is a reseller for vacation packages. For years they've had a payment form on their site where the end user would fill out their credit card data and the information is emailed to the reseller. BAD... I know. The only security they had implemented was the page was SSL.

The client then signs into their wholesaler account and charges the card there.

As a new client, we told them this is bad and needs to be handled differently.

So my question is, what would be the proper method for temporarily storing credit card data? Or do you know of a service that the full credit card data can be passed to but not charged and is secure, PCI compliant? They'd have to sign in to view the credit card, and then charge it via their wholesale account.

I really don't want to store credit card data in their website's database... I inquired, asking if the wholesaler provided them with silent post options, or am embedded form they can use.

I looked into Stripe but it stores the card as a token.

Any advice is much appreciated.

I just honestly think this whole request from my (potential client) is out of whack and I want to make sure we handle it correctly, securely, and properly.

Answer 1

Well if your wholesaler does not offer an automated way to process data, you're going to have a hard time not storing the credit card info. This means that you probably will also have to get SAQ-D.

Storing a token of a card is not the same as storing the card details. In your case you will have to store the PAN and Verification code for as long as the transaction (in this case charge by the Wholesaler) isn't made. Storing that data is what you want to avoid. A token is a lot better in this case. You will still have to be very careful how you store these tokens, but since you do not store sensitive CC data, you are not required to get SAQ-D.

Answer 2

It sounds like Authorize.Net's Customer Information Manager (CIM) would be a good solution.

From http://www.authorize.net/solutions/merchantsolutions/merchantservices/cim/:

Use Customer Information Manager (CIM) to tokenize and store your customers'
sensitive payment information on our secure servers, simplifying your PCI DSS
compliance as well as the payments process for returning customers and recurring
transactions.

Answer 3

Could they not utilise something like a sagepay (UK ) set up? everything hosted on sagepay site nothing stored their end? There are cost implications but would reduce the scope massively if all outsourced.Sorry if this has already been mentioned or os too obvious but just a thought.

Jim