I recently found the need to do recurrent billing. I am extremely averse to storing people's credit card information and I refuse to take risks in that area.

I am stuck between a rock and a hard place, however. Using a gateway in my local area and currency is prohibitively expensive. Basically, as things stand, we can't do business through a gateway. Yet we need recurrent billing and the need to store credit card information has arisen.

I thought of storing the credit card numbers (encrypted), partially or wholly, then saving the CCV number locally on an unwired machine. To bill customers, I would generate temp billing tables, and fire off a form manually for each customer that needs to be billed. I would manually populate the CCV and pipe a form to my payment processor (they will not store the data, unfortunately--only process the payment).

It's a manual PITA, and defeats the point of automation, but it's my best bet outside of storing the data outright.

Can you give me any advice on my scheme?

  • 5
    Do you know how much it will cost for your system to be certified PCI compliant? If you did, you might rethink "prohibitively expensive". – Rein Henrichs Apr 18 '11 at 7:49
  • 1
    And, for that matter, how much the fines are if you are found to be out of compliance? Or, even worse, what your potential liability is if your system is compromised? – Rein Henrichs Apr 18 '11 at 8:14
  • @Rein Henrichs, the server is on shared hosting. Shouldn't my provider be PCI compliant? – Mohamad Apr 18 '11 at 12:47
  • Irrelevant. How can your provider be PCI compliant when you are storing the credit card details? – Rein Henrichs Apr 18 '11 at 15:49
  • 1
    @Rein Henrichs: PCI compliance requirements aren't going to be waived just because the server is on shared hosting. Mohamad's company is going to be responsible for certifying compliance in any case, and using a shared server is going to complicate that if it doesn't make it outright impossible. Accepting credit cards yourself can be a real pain and a considerable expense. I hear occasional reports by the people responsible for it at my job. – David Thornley Apr 18 '11 at 16:41

I know a bit about PCI-DSS compliance. Storing CC number (PAN) is possible but your compliance scope, cost and effort would be very high. Key management, data backups, tapes, physical security and a lot more things have to be taken care of. Depending on your volume of transactions per year you can get by with a self assessment. But if some data breach happens you will be open to remediation actions, big fines and even disbarment from accepting CC as a merchant. So my suggestion would be to strictly avoid CC storage.

Using payment gateway is definitely an option. Another option is to use a tokenisation provider. This is either your bank or a 3rd party company that can hold a CC for you and issue a token back that can be stored in your DB. For any subsequent transaction the token is used. All major banks in Australia and companies like IPPayments offer this kind of service. Ask your bank. There are also products available like Voltage Security to do tokenisation and key management in house.

And lastly never store CVV number as it is explicitly prohibited. You should not need CVV for recurring payments. You can mark a payment as recurring in all major schemes like Visa and Mastercard. CVV is mainly to stop fraud using stolen cards. Someone who has registered for a recurring payment is very unlikely to use a stolen card. So the business case to store CVV should not exist as well.

  • If you are storing CC details, you can't get by with a self-assessment. You'll likely pay on the order of a hundred thousand dollars in consulting and certification fees. – Rein Henrichs Apr 18 '11 at 15:51

Your scheme is a bad idea. If the credit card companies find out that you store the CVV code, even on an unwired machine, you'll wind up with a big fine and probably lose your authorization to accept credit cards at all.

You should talk to your bank, payment processor, or whoever to see if they have a solution for recurring billing that you can use.

  • @Anomie, how would you handle recurrent billing without storing the CVV? I'm operating in an underdeveloped market and we can't afford available solutions. – Mohamad Apr 17 '11 at 22:56
  • @Mohamad: If your bank or whatever will let you, submit the payment request without the CVV. Or else you're just out of luck. – Anomie Apr 17 '11 at 23:10
  • 1
    the cc company or bank would likely set up the recurrent billing process on first submitting the transaction as being monthly, then never have to worry about it again until such a date as it needs to be suspended or canceled. But OP's too scroogy to use such services, thus is looking for procedures that are inherently insecure, violate his contract with his payment providers, and puts his customers at risk. I'd like to know what company it is so I can make sure I never do business with them. – jwenting Apr 18 '11 at 8:22

The idea is sound as far as it goes if the encryption is good (AES or equiv.) and the key is not stored on the server. I've been working to solve this same problem, and unfortunately, such solutions aren't sufficient from a liability point of view.

There's a new generation of services available which answer this question in a way which satisfys the new generation of PITA lawyers who have come up with an expensive scheme for verifying CC security which is only tangentially related to actual security. These systems store the CC info, billing address etc. on their end and return a "token" to you which can be used for flexible recurring billing.





  • @Devin, thank you. Alas neither authorize.net nor braintree offer their services to international customers (save for a $3 million volume)! – Mohamad Apr 18 '11 at 4:14
  • @mohamad I added in Stripe as an option. I know they are expanding their coverage internationally, and they are who I use most places these days. – Devin Ceartas Feb 16 '15 at 17:39

Do NOT ever store the CVV2. The WHOLE POINT of this number is that only the card holder knows it.

By all means store the card number (but give the users the option not to). Encrypt the card number as it is stored in the DB and obviously ensure you network and your application is secure.

You might be able to set up a continuous payment with the credit card company to allow for repeat payments, so you should not need to manually perform recurrent billing, I'd suggest you explore this option. If this is not possible then you will need to submit payment requests without a CVV2 value - this may be possible but will probably be more expensive.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.