Offline payments - advice needed

[xhale2007]

Hi guys.

My stepdad has seen the site im building and is really impressed, so he has asked me to make a similar one to mine, to use as an extra selling point for his bricks and mortar store.

Obviously as he has been in business for alot of year, he takes payment via credit/debit card, using a machine.

I know in magento (which im using) i will be able to collect credit card details, which he can then use his card machine to take a card holder not present payment. My concern here is saftey.

Am i right in thinking the site will need to be pci dss compliant? What exactly is needed to be done to be able to take payment this was? Any pointers?

If its going to be alot of hassle, and costly, for the time being he is happy to use moneybookers/paypal etc etc, then maybe move onto sage/rbs etc, and pointer here would also be helpful.

Regards

Dan

 

[Astaroth]

You cannot put internet transactions through under cardholder not present as this goes via MOTO and you need to put it via Internet.

Likewise you cannot collect and store the CSC number (3 digit security code) and so if you can get a terminal hooked up to a Internet merchant ID you are going to have massive transaction fees because you have no security.

If you were looking to go down this route you would need to be PCI compliant as you are storing card numbers.

You need to be going down an internet solution from the outset rather than storing and transacting offline.

 

[drounding]

The payment collection portion of any website/server needs to be PCI DSS compliant. The only way to achieve this (unless you are really big time) is to pass your customers over to a PSP to collect and process the card details.

Many carts allow you to download and process card details for offline processing but you will have to have a different level of compliance which will be hard to acheive.

 

[xhale2007]

Yea, this is what i thought, and mentioned to him.

So just to make sure, i use the moneybookers payment service which is built into magento.

This part is fully compliant isnt it? Therefore i can start selling safely?

Cheers

 

[xhale2007]

Anyone able to help?

Thanks

Dan

 

[drounding]

If they take the card details on their site and you don't see the details on your site then you don't need to worry about compliance.

 

[xhale2007]

Thanks.

The moneybookers part is integrated, but i never see card details etc. its all via moneybookers.

All i need to do now is get my store moved to the root directory and it can go live