Credit card processing need help

Question

Hi all
I am developing a java application for online money transfer.
How will I be able to verify peoples credit card or debt card to:
a)make sure they are valid ie not suspended or cancelled
b)Process the transaction with the person's card company for the transfer of the money to my account
c)What type of security will be recommended for such an application.
Please help m

Answer 1

morgalr wrote:
gcameo wrote:
Hi all
I am developing a java application for online money transfer.
How will I be able to verify peoples credit card or debt card to:
a)make sure they are valid ie not suspended or cancelledYou have to verify the card with the bank.
b)Process the transaction with the person's card company for the transfer of the money to my accountYou don't. You authorize it with your own acquiring bank. For that you need a merchant bank account, some expensive software and hardware, a dedicated line to the bank and the expertise to maintain such a system. In short, you can't
The specifics to do that are dependent on the authorizing entity you use, contact them to see the interface they support.Only the very largest of organisations do this themselves. Nearly everyone will use a dedicated piece of EFT software from a vendor who has a special relationship with the acquiring banks, or an EFT hosting service from one of those vendors. Banking standards are both very complicated to adhere to, and very dynamic. An individual simply isn't up to the job of keeping track.
c)What type of security will be recommended for such an application.Dedicated comms to the acquiring bank, usually. There is some move towards online auth over TCP/IP, eg, t'Internet, but still the security requirements will be large
>
Once again, the specifics on the interface will be dependent on the authorizing entity you use, contact them to see the interface they support.Basically, at this stage, there's little you can do. If this is work for your employer, they need to get in touch with their business manager at their bank, and say "we wish to process card transactions online". Depending on your projected turnover, he'll advise you on your best approach. It could be to use an online service like WorldPay, or the bank may offer a beaureau service to you, or they may steer you in the direction of a specialist software vendor that can help you. But until you've spoken to the banks you want to acquire with, there's nothing you can do yourself. Common card schemes like Visa and Mastercard, your own bank will acquire, others, such as American Express and Diners Club are acquired by the sponsors themselves, that is, you'd need a commercial relationship with Amex to accept Amex, a commercial relationship with Diners Club to accept Diners Club. But I repeat, your first contact for this is your bank manager. If this is an e-commerce website, things might be a bit simpler, there are a few online services (probably even some web services by now) to help you. If it's tills in shops, you might be advised to use PDQ machines. Setting up and maintaining large-scale EPoS is a massive undertaking, and often involves specialist vendors
If it's work for your self, forget it. Just take PayPal or something
Oh yeh, and authorising the card online is only half the fun. All that says is "the card is valid, and the funds are available for the transaction *at this time*". You've then got to settle the transactions in order for funds to actually move to your account, and that's even more complicated than authorisation. You'd also need to work around the fact that at this time doesn't mean and also when you settle so expect some transactions to authorise ok, but to be suspended (not paid) at settlement time. Then there's hot-card management - you'll be issued with files detailing known stolen or lost cards, and check against them yourself - cheaper on the comms than going online all the time. It's a minefield