Merchant Account - To Tell or Not to Tell?

[Bubzeebub]

If you have a company develop an e-commerce site for you, I'm assuming that you have to let them know what your merchant account number is. Are there any risks associated with that?

[Essex_boy]

errr yep I guess so or how else are going to integrate it?

If you dont trust your developers to have this information why are you using them?

[topr8]

as an over the counter retailer, every time i give someone a printout after swiping their card it has my merchant number on it, whats the problem?

[chodges84]

Topr8,

Just out of sheer interest and nothing else, where is this shop you own?

Seriously though, I don't think it will matter if they ahve it, as I don't think you could do a lot with just that. I could give you my merchant account number and feel safe in the knowledge that WP wouldn't let you do anything with it.

And also, Any one may (depending on your cart software) be able to view your account number by going 'View, Source' on the page before you send to their server for processing.

[topher]

If security is an issue (and it should be!) I think it's better using cart code that is dynamically served, where your merchant account number/login and password are transmitted using a COM object (or custom tag, or similar) and never appears on the users browser.

Back to the original post: after your developer is finished with your site and it's running correctly I think you should change the password that accesses your merchant account, just like you are encouraged to do regularly anyway. (Just make sure you know how to mod the cart code accordingly!)