2

I'm building a small site that will collect credit card details from customers and store them, but not charge the cards - the transaction will be done by the client manually.

What I'd like to be able to do is check the numbers to make sure the card exists, and if possible, check if it is chargeable (i.e no dice for a zero or negative balance - this isn't required, but would be nice).

Are there any trustworthy (and preferably free to use) card verification web services out there?

Notes:

  • Google-fu doesn't seem to cut it, most of my results return validation libraries rather than anything that will verify that the card numbers actually exist

  • The site has SSL and all sensitive data is encrypted before storage (with salt). Security is outside the scope of this question but any observations or suggestions to improve it are welcome.

8
  • 9
    Storing credit card data is usually a bad idea. If they are compromised you are in big trouble. May 30, 2012 at 12:40
  • 1
    You should use a payment gateway and authorize at the site and capture later. Storing credit card details is a bad idea
    – Broncha
    May 30, 2012 at 12:42
  • 1
    Isn't it illegal too? In some countries, like where I'm from, this isn't allowed by law.
    – Repox
    May 30, 2012 at 12:47
  • 1
    Don't store credit card details. I can't say this enough! May 30, 2012 at 12:48
  • 1
    Curiously, the PCI DSS rules try to give the card schemes the right to issue punitive fines for non-compliance, which is itself illegal in UK law.
    – Alnitak
    May 30, 2012 at 12:58

2 Answers 2

4

Questions of legality or whether you should do this aside, I'm fairly certain such a service does not exist, certainly not a free one.

In order to determine if a card exists or is chargeable a transaction has to be completed against the card. Normally for a 'validation' check this would take the form of a very small 'preauthorization' transaction, which requires a clearing bank, connections to credit card providers and all manner of expensive things.

If your client has the ability to process credit card transactions, he may be able to get you set up with what ever online tools his merchant bank / auth gateway has.

1
1

Bulk is correct. The preferred way to do this is to validate and charge with the same party.

However, other options exist, for example going through third party companies (including AllCharge and CredoRax), which currently provide these services for a wide variety of cards around the world. Usually verification is free if there is a also transaction. If it's just the verification, fees are generally up to 20 cents, depending on the company.

It's also important to note that regarding legality, even if you're not completing an actual transaction with the cards, you're still required to be PCI compliant, since you would be handling the cardholder information.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.