Credit/Debit Card Payment Gateway - NON WEB

TheMacintosh

TheMacintosh

Senior Member
Joined
Sep 4, 2012
Messages
981
Reaction score
180
Hi guys...

Does anybody know what payment gateway to use for credit and debit card payments, but not for payments from a web site? Basically the idea is for users to create an account on our system and capture a credit/debit card for billing purposes. So when they actually buy something (mostly e services) from us by using either our ussd or smartphone app, we would like to bill their credit card. Much like the google or apple app store, but we're not selling apps. So it would be a direct integration with xml, ISO8583 etc. I suppose

Not sure what the legalities are in saving card details etc?

Thanks. :)
 
saving card details means you need to be audited and implement specific preventative measures/firewalls/encryption standards and that can take forever.

I'd say check to see if there's a way you can save the cc details on the phone itself and make them verify it's them by entering the CCV2 number each time they purchase (and pin protect the program)

FYI, you'd be using Web Services (API) to auth to a cc card service to do it for you, websites use them, but you can communicate with anything
 
I don't think your allowed to save CCV2 numbers anymore - on all the payment gateways I've used the last few weeks have all popped up a message to say Mastercard no longer allows them to save CVV2 numbers and I need to re-enter them each time I purchase.
 
read this and do some more checking up on the level of stuff you need in order to do this and then think again if you really want to be storing that kind of information.
As soon as you are, you WILL be attacked.
If your security isn't up to scratch then you will be attacked, again and again.
It's a big commitment so be sure you are ready for it..

here's some more:
http://www.visa.co.za/za/en-us/merchants/riskmanagement/accountsecurity.shtml
 
Last edited:
cbrunsdonza said:
I don't think your allowed to save CCV2 numbers anymore - on all the payment gateways I've used the last few weeks have all popped up a message to say Mastercard no longer allows them to save CVV2 numbers and I need to re-enter them each time I purchase.
Click to expand...

That's why I suggested his smart phone app asks for the CCV2 number each time. Reason why I said is it's easier to keep the user's details on the smart phone instead, because if someone tries to hack you, there's nothing for them to hack. Plus you can encrypt and pin-protect the app on the user's device.
 
What you want todo is essentially still "payment over the web" even if the payment is done on a mobile device.

You can use NetCash for this. They have an option where payments are verified "off the book". i.e. if a client pays say R100 for your app the first time, and his CC details are valid, then the next time he makes the same payment it will go through, without you having to store the CC details on your end.

If you absolutely HAVE to store the CC details on your end, you would first need to be PCI complaint, which means
1) your servers need to be very, very secure
2) No one, other than yourself, and limited staff in your company should have remote access to the servers
3) the servers need to be secured properly - i.e. in a cage which only you and limited staff in your company has access to
4) your firewall(s) need to be "top notch"
5) your application needs to be secure
6) the credit CC details need to be encrypted, and the hash key stored off-line.
7) you would need to put down surety / insurance of a value far greater than what it's normally worth. Your bank will tell you what they expect from you. But it normally means that you need to put money into a special type of account with the bank. You can't use that money and it's only purpose is to pay back any legal fess / fines / debt that may occur due to theft of your client's credit card details and fraud. Depending on the volume of sales you expect, this could run into a few million.
8) you can't do this on a shared, reseller or even Virtual Private Server. The server where the CC info is stored needs to be owned by you, or if it's rented, only you should be able to access it locally or remotely. Ask the DC if they are PCI complaint (they will have a certificate to prove it) and if the server you have with them is PCI complaint as well. Most budget hosts will fail this.
there are a few other thing which you would need todo as well but first get past the above options.


Alternatively, if you only want to store the CC number (and use NetCash todo the authentication on the next run), a secure website / server & CC encryption should generally be enough.
 
My company is currently in the process of writing a secure transaction platform, we're directly integrated with most of the major banks. And you will pay for it getting leased lines up, secure tunnels to the bank, and then you'll actually need to develop the systems that do all the transactions. Unless you are very familiar with the field of finance and transactions it will take you a few months if not at least a year or two. We will be supporting NAEDO, AEDO, EFT etc.

If you want credit card go with an already provisioned provider such as Authorize.Net.
 
Right... so definitely not storing that details anymore :p

Thanks again for everyone's help
 
So does anybody know what the costs are at the bank for being an internet merchant? I got the transaction costs from a few gateways, but it seems the bank you're banking with also charge certain costs, any ideas what these might be?
 
adidas said:
So does anybody know what the costs are at the bank for being an internet merchant? I got the transaction costs from a few gateways, but it seems the bank you're banking with also charge certain costs, any ideas what these might be?
Click to expand...

They will only be able to give you a decent quote based on volumes. Otherwise they will start high and until they see it get better they will decrease. But i dont believe banks support "Internet Merchants" they will usually tell you to use one of their already authorized providers. What you are wanting to do is not a simple or cheap task it will take a lot of capital for the banks to even give you five seconds of notice.
 
semaphore said:
They will only be able to give you a decent quote based on volumes. Otherwise they will start high and until they see it get better they will decrease. But i dont believe banks support "Internet Merchants" they will usually tell you to use one of their already authorized providers. What you are wanting to do is not a simple or cheap task it will take a lot of capital for the banks to even give you five seconds of notice.
Click to expand...

Ok, if I use Paygate for example, which is a authorised payment gateway for all 4 major banks and sell stuff on a website (normal e-commerce), Paygate still reckon you need to get a online merchant account with your bank, I'm just wondering what this costs?
 
That's a question you need to ask Paygate and/or your bank. I know Paygate will help you with the process.

However, I think Payfast has the ability to process credit cards/instant EFT payments without requiring a merchant account with a bank.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X