XP Cloud:Tokenization and Re-Use of Saved Credit Cards

X-Payments Cloud User Manual

1. X-Payments Cloud: General information
2. Get Started with X-Payments Cloud
3. Two-factor User Authentication
   • with the Google Authenticator App
   • with SMS/Text Messages
   • with Backup Codes
   • Add an Alternative Method
   • Change the Preferred Method
4. General Settings
5. Payment Configurations
   • Add a Payment Configuration
   • Payment Configurations List
     
   • View the Details of a Payment Configuration
     
   • Enable/Disable a Payment Configuration
     
   • Edit the Details of a Payment Configuration
     
   • Delete a Payment Configuration
     
   • Choice of Payment Configuration for a Payment
6. Services
   • 3D-Secure
   • KOUNT Antifraud Screening
   • NoFraud Fraud Prevention
   • Signifyd Fraud Protection
   • Apple Pay
   • Google Pay
7. Users
   • Add a New User Account
     
   • Users List
     
   • View a User's Account Details
     
   • Edit a User's Account Details
     
   • Change a User's Account Status
     
   • Manage User Permissions
     
   • Request Password Change for a User
     
   • Delete a User Account
     
8. User Interface
   • Customize the Payment Form Appearance
   • Translate or Edit the User Interface Text
9. Payments
   • Payments List
   • Payment Statuses
   • Search for Payments
   • View the Details of a Payment
   • Delete a Payment
   • Auth and Capture (Capturing Funds)
   • Void an Authorization
   • Issue a Refund
     
   • Manage High Risk Transactions
     
   • Emulate Transactions
     
   • Clear Cardholder Data
   • Tokenization and Re-Use of Saved Cards
     
   • Delayed Payment Feature
     
10. Supported Payment Gateways
11. What's New in X-Payments Cloud

In this section:

• Tokenization: Overview
• Tokenization related configuration for Authorize.Net / Intuit QuickBooks Payments
• Charging Saved Credit Cards
• Viewing Payments Made with Saved Credit Cards
• Get/update tokenized card feature

Tokenization: Overview

If you serve repeat customers or need to run recurring payments, you may want to be able to store your customers' credit or debit card information so you will not have to ask for it again every time a purchase is made. However, according to PCI DSS, an industry-wide standard that must be met by any organization that stores, processes, or transmits cardholder data, storing customers' card information is not allowed for regular merchants - unless they take steps to implement a number of security aspects and undergo an expensive and time-consuming process of certification to ensure that all the PCI DSS requirements have been thoroughly met.

X-Payments Cloud provides a PCI DSS compliant solution that allows you to charge customer credit cards again when you use certain payment gateways. You get all the benefits of storing your customers' card information - without actually storing it on your system. This is made possible through the use of the so-called "tokenization". Tokenization is a means of protecting sensitive cardholder data that was designed to reduce the risks associated with storing credit card information for merchants. The technology is meant to prevent the theft of the credit card information in storage. It replaces your customer's credit card details with a special number (token) that can be used to charge again the customer’s credit card via an integrated payment gateway. As sensitive information is stored not on the merchant site, but in a secure PCI DSS compliant environment of the payment system, use of tokenization significantly simplifies PCI DSS compliance for the merchant.

Support for tokenization and re-use of saved credit card information is available for a number of payment gateways with which X-Payments Cloud works. To find out whether a specific payment gateway supports tokenization, see the list of supported payment gateways for X-Payments Cloud.

If your store has an active (enabled) payment configuration associated with a payment method with tokenization support, customers that have a user account at your store will be able to save their credit card information for future orders. They will be able to save a card during checkout:

or via a special section in their user profile (For instance, in X-Cart 5, the respective page can be found under My account > Details > Saved cards):

All sensitive information associated with the card will be saved in a secure PCI DSS compliant environment of the payment system and available for re-use via X-Payments Cloud through the use of tokenization.

X-Payments Cloud allows a customer to save up to three credit or debit cards. Customers who have one or more saved cards associated with their user profile can choose which card to use for each specific order at your store. They can also manage the saved cards in their user profile.

Tokenization related configuration for Authorize.Net / Intuit QuickBooks Payments

For Authorize.Net and Intuit QuickBooks Payments, using sensitive customer payment information tokenization has some specifics described below.

During the initial transaction - when a customer chooses to save their credit card for future use and enters the credit card information to be saved using a secure form provided by X-Payments Cloud - this secure form in which the information is entered requires them to enter a Card Security Code (CSC/CVV2). This code is required only for the authorization of the transaction used to save the credit card info, and it is not saved or stored anywhere. Further payment transactions on the saved credit card do not require that CSC/CVV2 be entered.

However, the merchant back end of each of the above-named payment gateways provides some security settings allowing the merchant to customize the credit card authorization process for online transactions. Among them, there is a setting that can be used to allow or forbid the processing of transactions with Card Security Code unavailable. If this setting is adjusted in such a way that CSC/CVV2 is required for all payment transactions at all times, it will cause problems related to the store's ability to use the tokenization feature: for a saved credit card all payment transactions but for the very first one (the one that was used to save the card info) will be rejected by the payment gateway because of the missing CSC/CVV2. The payment gateway may generate errors similar to the following: "A validation error occurred while processing this transaction: Card Verification Code not available."

To avoid this problem, make sure that the payment gateway setting requiring the gateway to reject payment transactions with no CSC/CVV2 is not enabled. This will not cause your store to stop requesting CSC/CVV2 altogether because the X-Payments Cloud secure form employed by your store to collect credit card information treats the CVV field as required at all times - regardless of the payment gateway settings.

Following are instructions for how to achieve proper payment gateway account configuration for the specific payment gateways.

• Intuit QuickBooks Payments
  In the merchant settings, change the setting for If CSC is not available to Accept Transaction:

• Authorize.Net CIM
  

1. Log on to the Merchant Interface at https://account.authorize.net.
2. Select Settings under Account in the main menu on the left.
3. Click Card Code Verification.
4. Click to select the check box(es) next to the Card Code responses for which the payment gateway should reject transactions. Make sure you do not enable the option to reject transactions where the Card Code is unavailable. This, however, is different from transactions for which the Card Code is incorrect; we strongly recommend you keep the option to reject any transactions with incorrect Card Code enabled.
5. Click Submit. A confirmation message indicates that your settings have been successfully applied.

Charging Saved Credit Cards

X-Payments Cloud allows you to charge again the cards that have been used at your store to pay you via an X-Payments Cloud integrated payment method with support for tokenization and have been saved in the customer's user profile for future use.

There are two ways you can go about charging a saved credit card - via the X-Payments Cloud admin panel or via the admin panel of your online store.

To charge a saved credit card via the X-Payments Cloud admin panel:

1. Find the initial payment that was made using the card that needs to be charged and open its details for viewing. To find the initial payment, use any of the following links:
   
   or
   
   If necessary, use filtering/advanced search.
2. On the Payment details page displaying the details of the initial payment, click the 'Charge this card again' link. A popup form titled 'Charge this card again' will be displayed allowing you to specify the parameters of the new payment:
   
3. In the 'Charge this card again' form, enter the amount that needs to be charged. If you wish you can also provide a comment for yourself - something to make your job easier later when you will be figuring out what this payment is for.
4. Click the Charge this card again button at the bottom of the form.
   
   Confirm the action. The card will be charged, and the new payment will be created in X-Payments Cloud. The newly created payment will be marked as associated with the initial payment:
   
   
5. Once the credit card has been charged, go to your store's admin panel and check the order management section. This section should now contain an empty new order with an order total equalling the amount that has been charged.
6. In your store's admin panel, edit the newly created new order to add the order information you require (products, shipping and taxes information, customer information, etc.). For example, in X-Cart 5, this can be done using the Advanced Order Management (AOM) feature.

To charge a saved credit card via the X-Cart back end:

1. In X-Cart's Admin area, go to the 'Create order' page and start creating a new order like you normally do using the built-in Advanced Order Management module. At the step of selecting the customer, select the owner of the credit card that needs to be charged (The credit card needs to be stored in this customer's user account). Click Create new order.
2. Continue creating the new order - add products, customer information, etc. At the step of selecting a payment method, select Other + Use saved credit card:
   
   
   Important: At each step of creating the order (Edit ordered products, Edit customer information, Edit order totals), click the Save button after making any changes; otherwise your changes will not be applied.
3. After providing all the necessary information and saving the changes, click the Back to details button to go back to review order details. On the 'Order details' page you will see a list of credit cards that the customer has saved in their user account:
   
4. Select the card you require, use the 'Amount' input box to specify the amount that needs to be charged and click Charge card. The store will connect to X-Payments, and the selected card will be charged.

Video - How to create a new order in X-Cart 4.6.1 integrated with X-Payments 2.x:

Viewing Payments Made with Saved Credit Cards

In X-Payments, all payments made using a saved credit card are linked to the initial payment made using this card and are considered "based" on this payment. You can tell whether a payment was made using a saved credit card by the contents of its Reference ID field: independent payments have reference IDs like "#N", whereas payments based on another payment (payments made using a saved credit card) have a link in the Reference ID field that looks like "Payment #N" and points to the 'Payment details' page of the initial payment.

You can view the full list of payments for a specific saved credit card by using this button on the 'Payment details' page of the initial payment made using this credit card:

Get/update tokenized card feature

Starting with X-Payments version 3.0, X-Payments supports the Get/update card feature for some payment integrations. These include:

• Authorize.Net;
• Chase Paymentech Orbital.

The Get/update card feature aims to protect your customer relationships by enabling you to quickly and easily update the details of tokenized cards that have been used for payment at your store (including the masked card number, expiry date, etc.)

Customer card information may change for a variety of reasons, including card expirations, lost or stolen cards, upgrades and so on. The Get/update tokenized card feature enables you to provide uninterrupted service to your customers keeping the updating process transparent to them.

To use the feature, you will need to enable the payment gateway's card information updating service in your payment gateway account (or, depending on the gateway, to have the gateway support enable it for you). This way you will get access to the gateway's interface allowing you to request an update of information for the credit cards that have been previously saved for use at your store and are now stored in the gateway's secure vault. Depending on the gateway, the tools you will get for updating your customers' payment card information will range from the simplest button that you click to request an update to more complex schedulers enabling you to schedule payment information updates according to your needs. After you request an update of your customers' payment information, the gateway will submit a request to VISA/Master Card to check if there have been any changes for the cards stored by the gateway for use in your store. After VISA/Master Card has processed the request (which may take up to 2-3 days), the gateway will get a report of any changed payment card details. Based on the report, the information stored by the payment gateway will be updated to reflect the changes. The updated cards will then be linked to the existing tokens. This way your store will be able to charge the cards after re-issue using the same old tokens already stored by X-Payments.

In X-Payments, you also get a button allowing you to request an update of information for any card involved in tokenized payments directly from the page of any payment made using that card:

If a customer with a tokenized card makes a payment at your store via X-Payments after the card has been re-issued, the card information will be updated automatically and transparently to the customer.