Credit Card Processing For Brick N Mortar Business

How to go about this?

[JerryOdom]

I've a person I have to talk to next week about setting up a website with online shopping capabilities as a companion to his already existing USA based widget business. I'm just curious whats the approach to setting up a website to process credit card transactions online if they already process them in their brick and mortar store? Do they still need a online merchant account with an online processing company or is there a way they can tie this into their existing system of taking payments? If I sound like I have it all wrong then whats the recommended way of going about getting this setup?

note: I'm new to e-commerce payments as my previous experience involved only advertising with things like Adsense.

[Rugles]

Why not just create a website that captures the credit card info? Then they can process it through the normal credit card machine like it was a phone order.

Saves the hassle.

[Corey Bryant]

You need an internet merchant account. This will get you a gateway (LinkPoint, Payflow, Authorize.net) which will then talk to the transaction processor (i.e. First Data) who will either authorize the transaction or send it over for authorization.

Have your client contact their merchant account provider and ask them for an internet merchant account

-Corey

[topr8]

>>Why not just create a website that captures the credit card info? Then they can process it through the normal credit card machine like it was a phone order.

be advised that this is against the terms and conditions of most card processors

[Rugles]

ya, i should have mentioned that

however, it is possible to set it up that way, that is what we do

[rocknbil]

The problem here will be the customer - I have encountered many cases where they see no sense in opening a second merchant account for internet sales when they are paying dearly for the service already via their in-store terminal.

The reason banking institutions don't support this is that they have no idea of how it is implemented in respect to security. I have even had long discussions with customers as to why they cannot simply have the CC info emailed to them. lol . . .

So if your hand is forced to capture information and provided it on your server, you had better be sure it's secure or you are liable for any fraudulent activity. It is indeed often better to leave this up to an approved gateway to manage.

[JerryOdom]

The problem here will be the customer - I have encountered many cases where they see no sense in opening a second merchant account for internet sales when they are paying dearly for the service already via their in-store terminal.

This is what I'm worried about and the reason for this thread. I want to be aware of the options for him when I go in to talk to him.

I don't want to capture the information on my server just for the sake of not having to manage that added complexity and sensitive data.

So it sounds like what I should do so far is find out who processes his merchant sales for his business and see if they can supply him with an Internet merchant account. If they can't do it then I'll need to suggest we set up a second merchant account for him.

Does this sound about right?

Thanks for the replies guys.

[rocknbil]

I can tell you, our experience is that the bank personnel, which often know very little about All Things Internet, will recommend some package that will cause his eyes to pop out of his sockets and he will likely be inclined to scrap the whole idea.

If you go with an online merchant account, you will be the one putting it in place. So do the groundwork, investigate exact costs and more importantly find something you can easily implement yourself. Then let him go to the bank and he will see your solution will be anywhere from half to 1/4 of the cost proposed by his bank. True, he will have two accounts and may whine about this a bit, but the benefits will far outweigh his concerns. Once he learns how to move the funds from your solution to his current account he will be fine.

I will add, capturing CC info **CAN** be done but to do it securely involves a good deal of programming and knowledge of GPG keys, etc, it is not an undertaking for novice programmers.

[Rugles]

>>>>I will add, capturing CC info **CAN** be done but to do it securely involves a good deal of programming

Of course it can be done. Many people are doing it right this second.

How are you planning on handling the phone orders the website will generate?

[edited by: Rugles at 1:59 pm (utc) on Jan. 24, 2007]

[JerryOdom]

He has an existing process for in-store sales and handling phone sales. This project involves just setting up a way for him to processs online transactions and simply ship them out. If people call him to buy the product then thats just their option right?

As it stands I'm just going to get paid based on the technical work for setting up the process and supporting it. Though I suppose pitching an SEO plan with profit sharing would be an approach?. hmm

[Rugles]

He may just want to talk to his current providor of his credit card services. They may just allow him to process his online orders through his current machine. It may be a different rate.

Our banks know that we are doing this with their machines.

However, like was mentioned, make sure your site is secure if you want to capture information.

[rocknbil]

Of course it can be done. Many people are doing it right this second.

Yes but the scary side of this coin, and the reason I bring up these points, is that there are many doing it insecurely and quite often, the site owner doesn't even know it.

In my former position at an ISP I had the unsavory task of picking up the mess after some wizz-bang developers threw together solutions for some of the customers. In a lot of cases I nearly fainted at what I found, for example, free cart solutions modified to store plain text CC info ("all we have to do is add a field, right?") and in one case credit card info was literally being passed in email. The customer was adamant. I've used it for years, "no problems" (almost fainted again) so what's the big deal. Finally we had to present an ultimatum, this needs to change or we need to discontinue your account. The company liability was at stake as well as the customer.

A large portion of the Internet is surviving on pure luck. Do it securely, question your own methods to make sure you are right, or leave it to the Big Dogs. :-)

[Rugles]

>>> one case credit card info was literally being passed in email.

now that is stupid

[LifeinAsia]

I have encountered many cases where they see no sense in opening a second merchant account for internet sales when they are paying dearly for the service already via their in-store terminal.

Their merchant account was most likely approved based on card present processing only. Although they may be able to add Internet processing onto their existing account, they need to verify with their bank IN ADVANCE. Using a non-Internet account for processing Internet orders without prior permission will likely get their merchant account yanked. They could also be subject to higher processing fees applied retroactively.

I will add, capturing CC info **CAN** be done...

There's also the issue that CVV numbers are NOT allowed to be stored online.