[ic] Credit Card Number Retrieval

[Marc Brevoort]

On Thu, 2003-08-14 at 12:21, Andrew wrote:

As far as I know, Interchange never reveals credit card numbers to
prevent abuse (Depending on who your bank is, I understand one may even
lose their merchant account when storing credit card numbers).

Here in Portugal, in fact, the recommended way of handling credit card
payments is presenting the customer with a page with that sends the
customers' credit card information directly to the bank via a secure
link. 

In other words, the shop website never receives the credit card number. 

After the client sends the payment order to the bank, the bank responds
with a page that contains a bit of javascript (or a noscript tag
containing a submit button 'click here to finalize the transaction')
that connects back to the result page of the web store. 

The server of the web store receives the request for the payment result
page and can then connects to the bank's computer via a secure link to
consult the payment details, using the formerly generated payment
reference number, but once again no credit card number is exchanged. So,
to the customer of the webstore there is no fear that their credit card
number can be abused by the store at which they paid.

In addition, there is a service especially targeted to for internet
payment, where a client has credit card numbers which are only valid for
a single transaction.

To summarize this long story: Interchange may not reveal the credit card
number, but you should never need it.

grtz
MRJB
-- 
e-mail:	marc.brevoort at armazemdedados.com
web:	http://www.armazemdedados.com

Armazem de Dados, Informatica, Lda
Dep. Desenvolvimento
Tel. +351 21 910 83 10 / Fax. +351- 21 910 83 19