CBM - All recurring payments fail w/PayPal gateway. CVV2 format error

[Ross K]

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE
Parallels Plesk Panel w/CBM, v10.4.4, CentOS, 64-Bit

EugeneL kindly worked with me to resolve some problems in connection with the PayPal gateway API (thead: http://forum.parallels.com/showthread.php?t=114424).

However, our transactions have now started to fail, with the following error:

Notes: 7: Field format error: 10748-This transaction cannot be processed without a Credit Card Verification number.

New customers can still successfully signup and their initial payment taken at signup is succesful. However, when their monthly automatic bill is due, the transaction is declined. It seems, for some reason, PayPal is expecting the CVV2 number on recurring transactions which obviously Plesk isn't passing because its unlawful to store this number. So I'm guessing Plesk isn't sending recurring transactions through correctly, in such a way where the CVV2 isn't necessary (as its validated on the initial payment).

Any help to resolve this would be appreciated.

 

[EugeneL]

Hi, Ross

I checked the module and it looks like rules in US banks and UK banks are completely different (module was developed mostly for US banks).
CVV field is labeled as optional in API spec, however it appears that UK banks require it as mandatory.
When your customers do initial purchase they provide CVV and transactions are processed successfully.
But since CBM doesn't store CVV, all subsequent transactions for recurrent payments will fail.

I've created a feature request for dev team and this will be implemented as an update for 10.4.x release. But I can't give you any ETA now.

 

[EugeneL]

As a temporary solution you can ask you customers to pay the invoices manually - they can do this in Panel.
They need to find unpaid invoice, click to pay it, choose existing billing account and provide CVV code.

 

[Ross K]

Hello again Eugene!

This is most odd. PayPal requires merchants (including UK based) to be PCI DSS compliant. I understand, to be PCI DSS compliant, you must not store the CVV2 number after the initial authorisation has taken place. So by doing so, you become non-compliant and consequently, can be fined and have the merchant account terminated. Perhaps it could be a case that some variable needs to be passed to PayPal during the initial transaction to confirm it will be recurring so PP knows not to request the CVV2 each time.

Would it be helpful if I contacted PayPal Merchant Support and ask them to clarify their position on this?

 

[EugeneL]

Hi, Ross

I think you have understood me incorrectly - I won't ask dev team to start storing CVV. You are right, this is prohibited.

But PayFlowPro API has a method to make recurrent transaction - you (CBM) need to store ID of the first transaction and then to send it as a referrer for all subsequent transactions. Since the first transaction was verified with CVV, all transactions with correct referrer will be processed without CVV.
This is a common practice but it was not implemented because US banks do not requre it.

I'll keep you informed through this thread.

 

[Ross K]

Oh I see!

Thanks for taking the time to explain it. I appreciate you putting it through as a feature request and I look forward to the future update!

 

[Ross K]

Morning Eugene,

Just wondering, as it's been a couple of months, whether this has been resolved yet or if there's any indication when it might be resolved?

Thanks!

 

[EugeneL]

Hello, Ross

I expect new module to be released with the next software version. I can't give you certain ETA but I suppose it to be somewhere in Q2

 

[Ross K]

Hi Eugene,

I'm just wondering whether this is still on track to be fixed this quarter and if you have a more precise ETA yet?

Kind regards,

Ross

 

[EugeneL]

Hi, Ross

Yes, module has been updated and will be shipped with upcoming 11.0 release.
I can't give you precise release date but most probably 11.0 version will go public in Q2

 

[EugeneL]

Hello, Ross

I'm happy to say that Plesk 11 was released and PayFlow module supports recurrent transactions.
I'm sorry about such a huge delay with this fix for you but it has been definitely impossible to ship this fix with any micro-update for CBM 10.4 because of big amount of changes in CBM core.

 

[Jasongr]

The PayPal gateway API really works fine. These kind of errors are categorized in the box of temporary errors. They can be easily corrected with the use of variuos softwares. You need to have a look at the Internet connection for more details. They are also used for recurring payments and even more.
_____________________
recurring payments