How do we accept credit card orders

We will not have a product database

[Larry Howard]

We are fresh out of the box, brand new at this, so please bear with us.

After acquiring a merchant account so we can process credit card orders online, how can our client enter their credit card number on our site (so it is secure) and enter a quote number we previously provided?

We will not have a shopping cart since we have no products and we will be buying wholesale from the manufacturer and selling to our clients. Our web site will have links to all the manufacturer web sites that we represent so our clients can shop.

I presume that once we acquire the credit card number online we would then process the card number via one of those credit card data entry machines.

Your help is greatly appreciated.

[Scruffy]

To accept payments online, as a minimum, a shopkeeper must have an online Merchant Bank account and an internet link into the banking system.
Merchant Bank accounts are part of the service offered by High Street banks.

The actual internet funds transfer is handled by a separate organsation known as a Payment Service Provider (PSP). There are strong ties between PSP's and banks, some PSP's are subsidiaries of specific banks, others are more free to use different banks.

The Merchant service offered by a PSP allows single transactions of a fixed amount to be transferred by Credit Card over the internet. It does NOT perform the function of guiding a customer through a store, collecting a list of items that he wishes to buy and presenting the total. That is the function of a Shopping Cart, which is a third separate service. (and in your case, you don't need it }

All three companies will require separate payments for their services.

You will also need someone to actually create the Web Pages, and an Internet Service Provider (ISP) to 'host' your pages.

A couple of PSP's you might want to try - SecPay and WorldPay - no recommendation implied

[Larry Howard]

What we need from the customer are 2 things: One is the quote number related to the product we quoted and second, a place on the web site to enter their secure credit card number.

Are you saying that if the customer enters their credit card number on our web site and we have set up merchant service with PSP, that should take care of the money transfer?

[Scruffy]

No. not exactly

Inviting a customer to send you a Credit Card number over an ordinary internet connection is very risky because it is possible for someone to intercept the details.
Normally a secure server connection is used for this purpose (it is encrypted). Setting that up is not easy or cheap. Nor do the banks like you to do it.
It is best to leave all of that that to the PSP who will do it for you. They charge quite a lot but it means you take no responsibility for the customer's card security

A PSP (approved by the bank) will provide the secure conection and the card payment processing.
What happens is that you place some code on your web page that display a button (it says 'Buy' or something similar). The button is a link to their secure site. The user enters CC and shipping details on the PSP's forms, the payment is processed and you get an email telling you what was bought (In your case, the quote number), how much and where to ship.
There are people offering 'cheap' ways to do this but they are all open to fraud. I advise that you stick with a PSP.

[Larry Howard]

Thanks scruffy.

I know I will have a few more questions. How is the best way to ask them?

Are you US based or elsewhere?

Thanks.

[Larry Howard]

When we create a button on the web site that says "Buy", do we do a hyperlink to the PSP?

Is this what you mean?

Thanks

[BradleyT]

You're PSP should have an API or Protocol on how you process a payment.

For example, I send a big querystring to my PSP that looks like

mypsp.com?x_login=mylogin&x_chargeamount=8000&x_customername=bob

They then return some information that I parse out to tell me if it's approved or declined.

I'd say you're probably best off hiring a coder for a C-Note to do this part for you.

[LifeinAsia]

Normally a secure server connection is used for this purpose (it is encrypted). Setting that up is not easy or cheap. Nor do the banks like you to do it.

While not exactly one-click-and-you're-done, setting up SSL is not rocket science either. Cheap is relative- yes, you could pay hundereds or even thousands of dollars for SSL, but you can also get one for less than $30/year.
If you are "touching" the credit cards on your site (instead of passing everything off to a 3rd party), you MUST have SSL- Visa/MasterCard require it in their guidelines.

We will not have a shopping cart since we have no products and we will be buying wholesale from the manufacturer and selling to our clients.

HUH? I'm confused- you're buying from the manufacturer and selling to clients, but you say you have no products.

[Larry Howard]

What I meant by having no products was that we have no products with prices that we can enter into a shopping cart from which the customer can select. Our customers will provide us with a manufacturer part number. We buy wholesale from the manufacturer and mark it up.

[Scruffy]

BradleyT is right.
There's a lot more to this than it looks on the surface.
When you are dealing with money and CCs in particular, you are a target for fraud - big time.

Even some of the bigger PSPs offer systems with holes in them. Get a coder who understands this and make sure he implements all the security tools on offer. Particularly make sure you insist on exchange of hash encryption tokens during the transaction to make sure nothing has tampered with the transmission.

[LifeinAsia]

we have no products with prices that we can enter into a shopping cart

You can still make a shopping cart without prices. Just don't include functionality for summing the price, adding taxes & shipping, etc.

Do you really get a lot of people offering up a credit card without knowing how much they're going to be charged? I suspect you're going to have a hard time getting a merchant account like that.

[webtress]

If you are fresh out of the box as you say then you should really consider using a PSP for the first year at least until you get your feet wet. Site security should be your first priority and as someone else mentioned even the large processors (with deep pocket for security) have had issues. Maintaining card numbers is a serious responsibility and new site owner have enough to deal with beside the possibility of a security breach.

[jsinger]

You might take a look at a shopping cart like Shopsite which can handle CC transactions of variable amount (in addition to the normal fixed amounts). For example a charity might use Shopsite to handle donations that can be of any amount.

The cart can add shipping and tax to the amount the customer enters from your instructions.

---