Verisign credit card alternatives?

aboyd

I have a client who will be running a charity auction. They want to allow people to pre-register -- if they have to have a valid credit card. At the end of the auction, the winners will have whatever they bid charged to their cards. My problem: Verisign's Payflow Pro system is burdensome. I need to recompile PHP with the pfpro options enabled, install binaries on my server, etc. I'm not having much luck with that. And, Verisign says that there is no way to simply verify a card is legit -- they say I should try to "authorize" for a small amount (like $1), and upon hearing if the transaction is accepted/rejected, void the $1 hold.

So here are the questions. Is it true that I cannot verify a card without doing an authorization? And second, is there any simpler system? One that doesn't require PHP to be recompiled or binaries to be placed on the server? I was really hoping to find a simple XML system, maybe doing queries via SSH? What systems have you found to be easy to use with PHP?

-Tony

etully

We agree that the charge a dollar, void the dollar solution isn't good because that shows a record on the monthly statement which looks unprofessional. So what you're trying to do is query the card's status without leaving an ugly mark on every customer's monthly statement.

I think that from the CC Company's perspective, they don't want you to be able to simply tell if a card is good or not because you could write a loop that checks a hundred million numbers and finds the good cards. And none of the customers would know that they've just been evaluated.

So I suspect that the function you're looking for was actually left out on purpose.

As for simpler ways to connect to PFP without recompiling PHP, yes, I do think there are ways. I'm pretty sure that one of our programmers looked at the API and wrote something that uses Curl to connect to PFP and conduct a transaction. It did require installing a binary but did not require recompiling PHP as I recall. I will try to get more info on this today.

etully

BTW, I was in a similar situation last month - charity auction, pre-register, the same deal, and what we did was ask people their CC number and their email address. They were allowed to bid once they clicked the link in their email. I know that this has nothing to do with checking the CC but we felt that if someone was going to give us their CC and a real email address, then it was probably safe to let them bid anyway. And we didn't have any problems - everyone's CC worked.