Urgent! S2member is not passing CVC checks to Stripe!

[james282]

Hello!

Recently, we've been struggling with a TON of declines with integrating stripe with s2member. After a bunch of back and forth with Stripe, we learned that part of the issue is the prepaid cards (and I see that's being worked on - thanks!), but that there was a bigger issue at play as well.

From their support:

"I've looked into the payments on your account and it appears that you're not actually passing the CVC code from your customers through the Stripe API when creating your charges, which is likely a big reason for all the declines you've been receiving!

I'd recommend getting in contact with your developer and making sure that your card creation requests are properly passing in the CVC you collect from your customers in Stripe Checkout, as currently the value is being passed as "null"."

My website is dailyfantasysportsrankings.com. The sign-up page is /membership.

This has cost us a couple thousand dollars already, and I'd be happy to pay some amount of money to get this fix expedited, if at all possible. Or, it could just be some silly user error on my end, but I've dug around as much as I can before posting this.

Thanks!

[james282]

Just as a follow-up, my business partner has moved payments back to PayPal for the time being (so the page I linked won't have a stripe form on it - I can set up another page if that would be helpful). Stripe was converting way better for us, but obviously a lot of those gains were mitigated by the declines/canceled memberships. We'd still love to use Stripe, but we're putting it on hold for the time being. Thanks for your help.

[james282]

Hello, the declines continue on, and I was just wondering if there was any progress on this end?

Here's an example of what Stripe passes along to us, where you can see that the CVC and ZIP are coming through as "null" even though they are required fields when you actually try to check out on our site:

XXX's are for privacy.

object: "card"
last4: "XXXX"
brand: "XXXX"
funding: "debit"
exp_month: 9
exp_year: 2016
fingerprint: "XXXXXXXXXXX"
country: "US"
name: "XXXX"
address_line1: null
address_line2: null
address_city: null
address_state: null
address_zip: null
address_country: "US"
cvc_check: null
address_line1_check: null
address_zip_check: null
dynamic_last4: null
metadata:

[jaswrks]

@james282 Thank you for the report!

---

We have been investigating this over the past few days. I am going to send an email to Stripe tech. support and see if they can help us clarify this a bit further. I'll update this issue once we know more.

---

I'd recommend getting in contact with your developer and making sure that your card creation requests are properly passing in the CVC you collect from your customers in Stripe Checkout, as currently the value is being passed as "null"."

I believe that you may have been misinformed. Or, perhaps there was some confusion about which integration method that s2Member Pro uses.

s2Member's integration with Stripe is via "Stripe Checkout (Custom)". This opens a popup/overlay and Stripe collects the CVC. What s2Member gets back is a Card/Source Token that represents the data Stripe collects from the customer.

From my experience, and as I understand the API docs, there is no reason for s2Member to collect and/or pass a CVC to Stripe; i.e., Stripe has already collected this. We simply reference what Stripe has collected via the Source Token.

There is a cvc_check status that is exposed to s2Member, but again, if you configure your Stripe account to reject CVC failures that should automatically result in a decline when CVC checks fail, as would be expected.

---

Of course, Stripe will have a more informed response, so I'll wait for their confirmation before we proceed here with any changes that may or may not be necessary.

[jaswrks]

@james282 I see that your site is offline at the moment: dailyfantasysportsrankings.com

Can you post a screenshot of the Stripe checkout form where you are entering the credit card details please? I'd like to confirm that we are on the same page when it comes to the integration method that is being used.

[jaswrks]

Stripe support request opened. Awaiting response.

Hey guys :-)

I'm the lead dev for s2Member Pro, a popular eCommerce plugin for WordPress. We integrate with Stripe using Stripe Checkout (Custom).

I have a question about CVC checks.

Scenario:

- Stripe Checkout (Custom) popup/overlay.
- Stripe popup collects card, expiration date, and CVC.
- We create a card object via PHP using the token ID.

Do we need to pass and/or validate the CVC?

I'm assuming no. As I understand it, Stripe Checkout collects the CVC, so all that we need to pass in our PHP API call is the token. Right?

If the CVC check fails (and the site owner rejects invalid CVC codes), the charge is declined automatically?

Or, do we need to look at the `cvc_check` status?

[james282]

Thanks so much for getting back to me.

My site is having problems with another plug-in at the moment - sorry about that.

The stripe form is located at: dailyfantasysportsrankings.com/membership.

I just received another email of my own from Stripe support saying that the CVCs are still not going through, in spite of me requiring them to accept payment on Stripe's end.

It's bizarre, because some cards give a "CVC Check: Passed" feedback, and some don't say there's any record of a CVC at all.

Thanks.

[jaswrks]

Reply from Stripe:

Hey there,

Thanks for writing in about this, I'm happy to help! You definitely don't have to validate CVC yourself here especially since you should never send this to your server. Stripe Checkout will collect the CVC for you and send it along the card details to our server so that we can send you a card token back.

You then use that card token on your server through the Create Customer [1] or Create Charge [2] API. When that happens you can see in the response object the field cvc_check to know if the CVC check was successful or not. If it failed and the merchant has the settings to decline those charges automatically then the charge or the customer creation would ultimately fail.

I hope this helps but please do not hesitate to get back to me if you need more details.
All the best,
Thomas

---

So I'm not seeing that we need to change anything in the Stripe integration. I don't see a bug here at all actually.

[james282]

So we're getting conflicting reports from the various employees of Stripe.
I'm at a loss. Declines rage on unabated - there's no way that big
businesses deal with this sort of thing? We'd have to have a full time
staffer just to call all of these people. Ugh. Thanks for looking into it.

On Tue, Apr 14, 2015 at 6:34 AM, JasWSInc notifications@github.com wrote:

Reply from Stripe:

Hey there,

Thanks for writing in about this, I'm happy to help! You definitely don't
have to validate CVC yourself here especially since you should never send
this to your server. Stripe Checkout will collect the CVC for you and send
it along the card details to our server so that we can send you a card
token back.

You then use that card token on your server through the Create Customer
[1] or Create Charge [2] API. When that happens you can see in the response
object the field cvc_check to know if the CVC check was successful or
not. If it failed and the merchant has the settings to decline those
charges automatically then the charge or the customer creation would
ultimately fail.

I hope this helps but please do not hesitate to get back to me if you need
more details.
All the best,
Thomas

---

So I'm not seeing that we need to change anything in the Stripe
integration. I don't see a bug here at all actually.

—
Reply to this email directly or view it on GitHub
#535 (comment).

Summer Camp Revolution
summercamprevolution.com
609-273-8408