To gateway or not to gateway

Is there an option?

[mrnoisy]

I'm building a shopping cart site for a client who has a merchant account and a credit card processing terminal in her office.

I know I'll need an SSL certificate, but I'm hoping to bypass the whole gateway step.

So I figure the first step is when the customer checks out, the CC# gets encrypted and stored in the database. But then is there a way to access the credit card number to enter it into the terminal?

Is this a recommended method, or should I just go the $30 per month gateway option?

[lorax]

I know folks who keep the CC info stored in a similar manner (encrypted within a secure database). They typically have a card terminal in their office (they run a brick and mortar shop so it's right there) and run a batch at the end of the day.

But consider the time factor. How long will they/you be sitting there manually entering the card numbers, transaction value, and then recording the transaction number each day? If you're talking only a handful of sales, it might be tolerable. If you're talking 20/day that'll take a while. Even if it's only two per day - that'll add up to over an hour of labor over a month. Is it worth it?

Caveat: there may very well be a simpler way avoid the gateway but I don't know of it -- yet. ;)

[Corey Bryant]

There are a lot of security risks involved this way. Plus if you do have a brick & mortar account, it might be against your merchant account agreement to do this. And your discount rate migh be 2% more for keying in your transactions. Plus what happens if the credit card does not go thru? Do you contact them & let them know? We are in another age & people (especially in the United States) wanted the answer yesterday.
-Corey

[mrnoisy]

I get the feeling going with the gateway may avoid a lot of potential problems.

My client has resistance to this. She feels that since she already pays for the terminal, why should she pay extra to get a third party processor.

I'm gonna need a list of reasons why she should spend the extra dough.

• Less time consuming
  
• Against merchant agreement (possible)
  
• Instant customer notification of errors
  
• Better security?
  

Any other good reason to go with a gateway?

[Corey Bryant]

Well does she want a third party processor? This is different than an electronic payment gateway.

Let's make a few assumptions:
Client is in the United States
Client has a brick and mortar account
Client is paying 1.66% in discount rate (qualified)
Client expects to bring in more than $1,000 a month in volume via the internet

First the client needs to review her merchant agreement. In there, it states how she markets & what percentage she will swipe & key. (Assume 95% swiped & 5% keyed). Now if she consistently breaks this part, the processor can raise her discount rate. Plus usually a keyed (non-qualified) transaction is sometimes 2% more, which now that $100 transaction is costing at least $3 (instead of the $1.66). I am not guessing on the transaction rate.

With an internet merchant account, you would see 2.4% discount rate. So there is some savings. True, you are going to pay for the electronic gateway & a month charge (statement, customer service, etc) for this account but at least your consumer will know right away the transaction was approved.

If she is getting in 10 or more transactions a day, think of the time she is going to spend keying in those transactions. How much is her time worth?

You have pretty much covered it I would say. Security is one of the bigger factors though. She could actually be fined by Visa $10,000 & she could lose her merchant account.

-Corey

[SkyDog]

Storing the credit card is probably the worst way to go. First of all the client is probably already processing Card Present transactions. They are not set up for Card Not Present transactions, and if they simply get the cc number and process the transaction in the same matter, this can lead to problems, including hefty fines from the MAP, VISA, etc. Bite the bullet and pay the 30 bucks a month, in the long run it's your best bet.

[lorax]

>> Any other good reason to go with a gateway?

SkyDog pretty well hit the nail on the head. Plus, the longer you keep an online DB with CC numbers in it the more likely you are to become some hacker's target. Granted, you're not as appealing as one of the giant retailers with hundreds of thousands of CCs but you're also more likely to be an easier hack. And as the person who developed the site, you're a potential litigant should someone break in and steal something!

[raywood]

mrnoisy,
I've done it both ways. For me, after looking over expense and risk, there is no question that using a gateway puts more money in my account.

Time spent punching in numbers.
Data entry error rate.
Higher rate for Card Not Present Transactions.
Security risk of storing cc numbers.

The gateway fees are peanuts in comparison. It only takes 20 or 30 sales per day to totally tip the scales in favor of gateways.