Bluepay Merchant Problem

[sashglt]

Dear Support

 

We are using Bluepay gateway and have a little issue with it.

 

Looks like Blesta does not store CVV in the db cause this field is blank, so when I make a payment with the credit card stored on file I got the response from BluePay that the CVV was not processed.

 

On Bluepay the transaction is approved, but because CVV does not exisit, it voids right away on the bluepay side and blesta says: declined.

 

Usually when we use CVV and AVS we need to do "preauth" first, then check cvv and avs, and then if its ok then "capture" transaction

 

Right now Blesta does "sale" instead of "preath" and thats why bluepay charges actual money from the credit card and takes up to 5 days to void the transaction.

 

Can it be fixed?

[Paul]

It's against Mastercard/Visa merchant rules to store CVV data in any way, shape, or form. The CVV data is passed along by Blesta when processed live via customer input, but never saved. This makes it impossible to send CVV data if using auto-debit.

 

Cody or Tyson may be able to comment on sale vs preauth, however I'm not sure I see the correlation with CVV data. I wouldn't think a capture should take place if there is an issue with CVV or AVS. Don't most merchants automatically do a preauth, then capture?

 

I guess the side affect here is that the immediate void BluePay is doing results in the funds being held up in the customers account for several days, and you are charged a processing fee?

[Cody]

Yeah, an authorization won't help you here. Paul is correct, a sale is the same as an authorize and capture. If the sale fails then the authorization would fail.

 

The last time I looked at BluePay they did support payments without card security codes, so it may be a particular setting for your merchant account. Have you tried contact BluePay to see if they will remove that restriction to allow you to process autodebits? It may be that they simply don't want your account processing card not present transactions.

 

If BluePay has modified their payment terms to disallow autodebit then we should certainly update the gateway to prevent autodebits from being processed.

[msleight]

The BluePay Gateway has a CVV filter that can be set by the merchant. It is a list of CVV response codes to accept. If a CVV response code is received that is not on the list the transaction is voided and decline result is returned to Blesta. It is not mandatory that this filter be configured and by default no filter is set. With no filter all CVV response codes are accepted.

 

There are a few ways that the problem could be fixed. The simplest solution would be to remove the filter. This would solve the problem but also create a higher chance of fraud. The better solution would be to include a underscore "_" in the filter. Underscore is the CVV response code when no CVV was supplied for processing. By having the filter include the underscore and the response codes to accept the filter would be used when there was a CVV and bypassed when there isn't.

 

Just for reference here is a list of the possible CVV response codes.

_ = No Value Supplied

M = CVV2 Match

N = CVV2 did not match

P = CVV2 was not processed

S = CVV2 exists but was not input (Not possible on the BluePay Gateway)

U = Card issuer does not provide CVV2 service

X = No response from association

 

Mel Sleight

Integration Support

BluePay Processing, Inc.