Paypal - PCI Compliance required from 30th July 2012 - Amazon Checkout??

As from the 30th July, Paypal require any vendors using ther website payments pro service to become PCI compliant,

email excerpt included below.

"PayPal is required by Visa and MasterCard to make sure that all our business customers are PCI DSS compliant"

thefefore without further customisation and support for Mastercard and Visa's authentication methhods the paypal direct functionality will no longer work with NOP.

Are there any plans to add the PCI compliance mechanisms to the standard NOP code?

Another useful payment method is Amazon Pay, where users can check out on the website using their amazon details, are there any plans to support this payment method?

At present payment options are farily limited with NOP making it difficult to use for commercial projects.

nopCom is PCI DSS compliant: https://www.nopcommerce.com/featurelist.aspx

I think there is now an addtional requirement for master card scure code and Visa, 3d sscure, i will contact paypal for confirmation of this and post findings.

watto_uk wrote:

3D secure is only required for Maestro cards as far as I know. 3D secure is already an active task. Unfortunately it hasn't been assigned to a release yet. Fingers crossed it will be soon as we loose sales because of this.

Vote for it here
http://nopcommerce.codeplex.com/workitem/10636?PendingVoteId=10636


Darren

Already voted for that a while ago Darren but thanks anyway. Its posing a huge problem for us at the minute too, because 3d integration is now becoming the Norm with most e-commerce stores cutsomers are losing confidence in paying using a credit card as they expect to see the additional authentication screens.

I have spent two days looking into PCI DSS compliance and so far I have learned;

You as the company/shop/website in the UK must be PCI DSS compliant now. This includes nopCommerce, the payment gateway provider, your LAN, hosting environment, etc.  (Basically everything and everyone who comes into contact with credit card information).

The Bad News
If you want to use a direct integration option with a gateway provider you will need to become PCI DSS level 2/3 compliant. This includes using a dedicated server, not VPS or shared. Normally you would pay an external and approved company often recommended by your merchant bank to carry out an audit and complete an SAQ C / SAQ D form. You would be expected to rectify any areas deemed unacceptable within an agreed time scale. This may be costly. You will also need to pay an external AVS approved company £100's per year to scan your website quarterly and provide certificates to your merchant bank.

I’m sure there’s more to it but I know I’m priced out so when I start making real money I’ll take another look.

The Good News
The cheapest and possibly the only option in my view for small businesses is not to handle any credit card information at any point. This includes taking credit card data on a nopCommerce payment page and sending it over an SSL/TLS connection to the gateway provider. So you’re only option is to use a provider with a hosted payment page integration option like PayPal standard. These gateway providers are usually PCI DSS compliant Level 1, but it is up to you to double check they are.

You can self-certify at PCI DSS compliance Level 4 by completing an SAQ A form provided;

•  You process less than 20,000 MasterCard / VISA transactions per year
•  You use a PCI DSS compliant gateway provider
•  You do NOT store, process or transmit any cardholder data electronically or manually on/from your system. In other words, use a ‘hosted’ gateway provider solution so a customer completes their credit card information on the provider’s website.

Source: https://www.pcisecuritystandards.org/smb/what_to_secure.html

3D Secure
I don’t know much about 3D secure other than if you do not implement it, you may need to pay a higher transaction rate to cover a higher risk of fraud. It is also more likely that you will be a victim of fraud and not be covered for any losses incurred.

Hosted Payment Page Integration (iFrame)
I was dissatisfied with being forced to use a ‘cheap and nasty’ hosted payment page option, but have been told that although not recommended it is possible to include the hosted payment pages within an iFrame. You would however need to buy an SSL cert. to avoid web browser warnings. I need to look into this more closely, specifically if it will work and be cross browser compatible with nopCom (One Page Checkout). Also, there are cross site scripting security issues with iFrames so not sure if this will be more trouble than its worth.

If anyone has attempted this / has any experience with this please let me know.

Checkout the Authorize.Net Server Integrated Method. This method uses an Authorize.net hosted payment page and therefore eliminates the necessity for the NopCommerce site to be PCI compliant.

I've just finished a plugin for v2.8 that uses the SIM method.

I just uploaded the extension today for NopCommerce approval. It's available on my third party site at http://www.Effective-Systems.Net