Expired card was charged.

[Chris74]

Stripe module. Card with expiry date in the past was charged.

Client's card was expired but then he was sent a new card with a new expiry date.

Card details were not updated in WHMCS - so the old expiry date was still there.

 

Problem 1. I thought WHMCS was supposed to automatically remove expired cards? There is an option in the automation settings to NOT delete expired cards if the box is ticked. The box is not ticked - therefore I would assume the card should be removed on expiry?

Problem 2. WHMCS is still attempting payment on an expired card. Why?

This was an issue for us today because the customer didn't want to renew - he assumed that the card in his account showing as expired would not be charged - but it was.

[Chris74]

Responding to my own thread from over a year ago...

Had this again recently. Stripe module. Customers card is not valid as it is expired. WHMCS didn't remove the card and continued to charge it with the incorrect expiry date. The charge went through - but the client's bank later issued a chargeback and the funds were taken back  - and we were issued a chargeback fee. The client had no idea about any of it until we contacted him to explain what had happened.

With Visa cards, perhaps some are re-issued with the same number, but a different expiry date? Not sure. My cards always seem to have a different number on them when I get a new one.

Has anyone else experienced WHMCS not removing expired cards with the Stripe module?

[steven99]

#1 - Do you have "Do Not Remove CC on Expiry" checked under Settings -> Automation settings?  If so, that is why it didn't delete. 

#2 - That is the automatic card update of Stripe.  Basically they get a "notice" that the card was updated in expiration date .   They will then use that card from then on when you charge to the stripe customer object / the payment method object.  Stripe has webhooks for this to be updated at billing systems and such but not sure how much support WHMCS has for it.  

[Chris74]

Thanks for your reply Steven.

#1  In my original post I explained the following "There is an option in the automation settings to NOT delete expired cards if the box is ticked. The box is not ticked - therefore I would assume the card should be removed on expiry? "

#2 When I look in the details of the transaction in Stripe - it shows the OLD expiry date.  So WHMCS has sent the payment through to Stripe and the card saved in Stripe has expired - but the transaction went through anyway. Perhaps this is a problem with Stripe and not with WHMCS?

I can't see anywhere in the Stripe settings in the Stripe dashboard where the handling of card expiry can be managed / configured.

However, if WHMCS was removing expired cards like it is supposed to do - this problem wouldn't happen at all!

I was really hoping others had experienced the same issue of expired cards not getting removed. I don't like the idea that this issue is unique to my installation. We don't have any customisations in place.

[steven99]

6 hours ago, Chris74 said:

#2 When I look in the details of the transaction in Stripe - it shows the OLD expiry date.  So WHMCS has sent the payment through to Stripe and the card saved in Stripe has expired - but the transaction went through anyway. Perhaps this is a problem with Stripe and not with WHMCS?

Stripe doesn't even need the expiration or last 4 digits or anything beyond the payment method token and likely ignores anything else if it thinks it has valid info.   I suspect the removing of expired cards is bugged and I have never used that setting so can't say when it stopped working

Have a look at https://docs.whmcs.com/Stripe#WebHook_Endpoints .  That explains what Stripe Webhooks WHMCS supports and that it should have created them -- at least within 8.0 and later.  Those webhooks fire off when Stripe gets updates from the card networks.  In Stripe, check under Developers -> Webhooks to see if you have any endpoints setup and if they are still valid.   If they are, you could try updating a test user within Stripe to see if it properly sends the callback to WHMCS and then check logs for errors.    At least with the webhooks setup, WHMCS should get updates and clients would then see the right expiration. 

 

[Alex A]

On 25/08/2021 at 11:45 AM, Chris74 said:

#2 When I look in the details of the transaction in Stripe - it shows the OLD expiry date.  So WHMCS has sent the payment through to Stripe and the card saved in Stripe has expired - but the transaction went through anyway. Perhaps this is a problem with Stripe and not with WHMCS?

I can't see anywhere in the Stripe settings in the Stripe dashboard where the handling of card expiry can be managed / configured.

This is a Stripe feature (not a bug) where they use the card networks update service (like Visa Account Updater etc) to get new updates so they continue to work in events like a card expiring. So card issuer issues a new card, files the new details in the update service, and merchants pulls from that to get the new info.