640248 - [Join Us] Charge accepted invalid credit card info

Status: RESOLVED WONTFIX

(Websites :: donate.mozilla.org, defect)

Description

[Rebecca Billings [:rbillings]]

I was able to submit info on the Join Us page with a good credit card # with a bad expiration date- the data was accepted and the charge was sent to the bank.

1) https://donate.mozilla.org/page/contribute/protect-the-web
2) enter all valid info including valid credit card number, but with an invalid expiration month/year
3) submit data

expected: unable to process charge with invalid credit card info
actual: charge submitted

Comment 1

[Devin Reams (Crowd Favorite)]

This is Crowd Favorite explicitly noting that this bug is BSD-dependent and no action taken.

Comment 2

[Seth Reznik]

This is pretty surprising, but I actually think comes from the gateway. They are passing back to us that its a valid transaction based on the info we send them.

Is someone able to look at the gateway settings?

Comment 3

[Chelsea Novak [:chelsea]]

I can look at them. What are we looking for specifically?

Comment 4

[Seth Reznik]

I think that we should just be looking for how strict the gateway is set to be for accepting donations.

Also, when you try this, are you using a valid card, but just setting to an invalid date?

Comment 5

[Rebecca Billings [:rbillings]]

yes- it was a valid VISA #, but with an incorrect expiration month/yr

Comment 6

[Chelsea Novak [:chelsea]]

I did see the transaction in PayPal (the gateway), so it did go through initially. I believe it was a valid card with an invalid expiry date.

Comment 7

[Seth Reznik]

I think then that this call is being made at that gateway level. PayPal is telling us that it is ok to accept that charge. I am guessing this is because the card is actually valid and its smart enough to know that you may have inserted the expiration date wrong.

Comment 8

[Samuel Sidler (:ss)]

I've never seen an online form accept an invalid expiration date, PayPal included. (In fact, PayPal once suspended my account for using an invalid expiration date three times in a row.) That seems like a huge problem.

Comment 9

[Chelsea Novak [:chelsea]]

I'm calling PayPal today to get them to investigate the transaction.

Comment 10

[Chelsea Novak [:chelsea]]

Response from PayPal - 

The main thing they look for when validating credit card payments for one-time transactions (like this) is the credit card number and the address. By those measures they can determine if the card is valid or not. If we ask for it, they can also validate against the CNV number on the back.

The name and expiry number don't actually impact if PayPal processes the payment. It's a nice to have for them. It will not decline the transaction if this is incorrect. Expiry dates are only relevant for recurring payments.

Comment 11

[Ryan Merkley]

Do we consider this a blocker to launch? It doesn't seem likely that PayPal will change their system to force the correct expiry date.

Comment 12

[Chelsea Novak [:chelsea]]

It is very unlikely that they will change their system.

Comment 13

[Paul Osman [:paulosman]]

I'd vote to make this a non-blocker. Doesn't sound like we're going to get it resolved any time soon anyway.

Comment 14

[Chelsea Novak [:chelsea]]

+1

Comment 15

[Ryan Merkley]

Hi Mike,

Ignoring expiry dates is standard procedure for PayPal, and we won't be able to get them to change it (definitely for launch, and probably ever). Can we agree that this is not a blocker for beta launch?

Comment 16

[Stephen Donner [:stephend] Not actively reading bugmail]

This was only a blocker in my mind before I knew how PayPal processes the CC info, FWIW.

Comment 17

[Mike Alexis [:malexis]]

marking this "wontfix"