Authorize.net Recurring Billing

[design23]

Probably a stupid question, but with WHMCS, we don't need to be paying for Authorize.net's Recurring Billing service, correct? Isn't that already taken care of by the recurring billing functionality in WHMCS? If so, are credit cards stored in the the WHMCS database? Or, is it possible for security reasons to have the card's stored by Authorize.net if we are subscribed to their Recurring Billing service...

[Matt]

Hi,

 

That is correct - you don't need the Recurring Billing service from Auth.net. WHMCS handles the recurring billing and the cards must be stored in the WHMCS database.

 

Matt

[design23]

Matt,

 

Awesome! The amount you save from not having to use their recurring billing service is almost as much as the WHMCS license itself! (Easily a strong selling point for you)

 

Question about credit card storage... are the card numbers encrypted as they go in the database? What other, if any, security protocols are used? The CVV number isn't stored, correct?

[Matt]

The card details are encrypted in the database using the AES Encryption protocol. The CVV number is not stored according to VISA/MC rules. Just the card number and expiry date. The CVV number is used on the first payment when the client is present to enter it only.

 

Matt

[ShoresPC]

This thread was helpful to me, just to tack another question on to this...

 

For future billings the customer doesn't need to do anything, or authorize it, correct? It will just happen and notify them they've been charged automatically?

 

And what if there are additional charges, maybe they used an extra service that had a 1 time fee, like extra bandwidth? Or a domain order? That will be added right into their regular invoice?

[Matt]

Yes, that's correct.

 

Matt

[00Dante]

I see this thread was started a long time ago- but I have the same question.

Have the rules changed, or is this still the case?

[WHMCS John]

This hasn't changed.

[00Dante]

Do you need to meet some sort of 'PCI' compliance, or will it work right out of the box?

[WHMCS John]

WHMCS itself is PCI compliant, but other parts of your operation might not be. We have partnered with McAfee to offer a 65% discount off their PCI compliance scanning service: http://whmcs.com/mcafee.php

[BryanB]

If we didn't want the liability of storing credit cards, is it possible to have recurring billing with authorize.net and not store the cc on our server?

[Matt]

Yes, this thread is from back in 2007 so now you can use the Authorize.net CIM Module in WHMCS for not storing credit card details locally.

[Nimitz1061]

Clarification request:

 

Does John's statement that WHMCS itself is PCI compliant reflect PCA-DSS certification of the software???

 

David

[WHMCS John]

WHMCS is not PCA-DSS certified, but has been designed so that it won't cause you any problems achieving PCI certification.

[craiggallup]

When you use authorize.net in whmcs does that give you the ability to process payments right on the site. Customers are not redirected anywhere else?

[WHMCS John]

Yes, Authorize.net is one of our supported Merchant Gateway modules.

[nobaloney]

Yes, Authorize.net is one of our supported Merchant Gateway modules.

John, I may have asked you this once before but we plan on moving forward to a test in the next few days and I cannot find the answer.

 

Are we able to retrieve credit card numbers from WHMCS if required?

 

Thanks.

 

Jeff

[BryanB]

John, I may have asked you this once before but we plan on moving forward to a test in the next few days and I cannot find the answer.

 

Are we able to retrieve credit card numbers from WHMCS if required?

 

Thanks.

 

Jeff

 

No. I use Authorize.net with WHMCS and you can only see the last 4 digits and the expiration date. We haven't really had any need to see the entire credit card number. I believe credit card numbers are stored using MD5 one-way encryption so there's no way to see the number.... Maybe from Authorize.net but I doubt it.

[WHMCS John]

Yes you can retrieve the full credit card number.

[BryanB]

Yes you can retrieve the full credit card number.

 

How?

 

 

loreum ipsum.saflkajtsfd

[WHMCS John]

Click the Manage Credit Card details link on the client's summary tab, you can get the access key from your configuration.php file.