HSBC Secure Code

[Ian Clyde]

Apologies in advance for what is probably a very basic question but technically speaking I'm probably very near the bottom rung. However...

I've had a 'News Letter' from HSBC which contains an article stating that; 'After July 1st your website must be SecureCode enabled..and explains that this is coding which identifies genuine card holders...etc.'

So...I use the HSBC PSP which is pre-configured by Actinic, does this affect me, do I need to change any coding on my actinic site to accomodate this? I will be speaking with HSBC tomorrow but grateful for any 'basic' advice from willing advisors out there(!)

Thanks.....

Ian.

[leehack]

If noone jumps in to answer, you may prefer to search the forum as members have already discussed this in quite some length.

[pinbrook]

Secure Enabled most probably is the same as PCI DSS

there are other threads discussing this

[Ian Clyde]

Jo/Lee,

Thanks for your replies, still not getting far though, searches for PCI or simply HSBC Secure Code doesn't seem to bring up anything.

I spoke with HSBC who simply say I don't have to change anything, so no further forward there either...any other help out there?

Thanks....

[pinbrook]

http://community.actinic.com/showthr...ght=compliance

http://community.actinic.com/showthr...ght=compliance

http://community.actinic.com/showthr...ghlight=PCI%2A

[Ian Clyde]

Thanks Jo.

...penny finally drops, this only applies if you capture card data manually and transact later rather than use a PSP. I do use PSP so now I see this shouldn't affect me.

Thanks again...

Ian

[Mike Hughes]

Sorry to butt in here.

SecureCode is the Mastercard/Maestro equivalent to 'Verified by Visa'. it is the challenge/password system whereby the online purchaser gets asked a pre-agreed question and has to provide the answer to verify that they are who they say they are. If they can't provide the answer the payment gets rejected.

There is no connection between securecode, etc and PCI compliance.

To accept SecureCode transactions you will almost certainly have to use a PSP (or HSBC, etc) to do your card processing. But that on it's own isn't necessarily enough. It also has to be enabled/turned on by your PSP as this has been optional up to now.

Mike

[Ian Clyde]

Hi Mike, Thanks for your comments.

But I DO use HSBC for my card processing and its them thats saying this is a requirement as from 1st July so I assume there is nothing for me to do here, its them that will be 'throwing the switch' on 1st July? I do not collect card data in Actinic, at the payment stage the customer is then passed over the HSBC's site?

[Mike Hughes]

Hi Ian,

My comments weren't directed at you as if HSBC say you're set up then you should be OK. I would try placing a test order though and then refunding/crediting yourself.

You're also meant to place the securecode logos on your website.

My main purpose in posting though was to correct the impression that securecode and and PCI were the same thing and to help other forum members when the subject comes up again (as it will).

Mike

[Ian Clyde]

Thanks for explaining Mike (and Jo)

So, being to lazy as I am to look, where is the best 'Secure Code' logo, just had a quick look on HSBC's site and didn't see one there (amazingly!) Any ideas?

[@Peter]

Does anyone know how this affects Actinic's own SSL service? Does this mean they will no longer be able to offer the option to take CC details (well, at least Maestro for the moment) and allow the site owner to download them and process them manually? We currently use that option as it's easier, because we can delay taking payment, etc, if an item isn't in stock. Presumably you don't get that option using other PSPs?

Also, if we do have to change, would PayPal (currently used for eBay sales) or HSBC (our bank) be the best bet for a PSP? What are people's experiences of either?

Any advice gratefully received!

Thanks,
Peter

[Mike Hughes]

hi Peter,

You're right. Under the new rules from 1st July you will not be allowed to capture Maestro card details for later processing. (Obviously this only applies to online sales as securecode is not applicable to MOTO sales).

As a side note, your psp might offer the option to pre-authorize the payment. i..e get authorization but defer the actual payment until you manually tell them to take it. Check with your psp.

Mike

[@Peter]

Does anyone know how this affects Actinic's own SSL service? Does this mean they will no longer be able to offer the option to take CC details (well, at least Maestro for the moment) and allow the site owner to download them and process them manually? We currently use that option as it's easier, because we can delay taking payment, etc, if an item isn't in stock. Presumably you don't get that option using other PSPs?

Also, if we do have to change, would PayPal (currently used for eBay sales) or HSBC (our bank) be the best bet for a PSP? What are people's experiences of either?

Any advice gratefully received!

Thanks,
Peter

[@Peter]

Quick update - just rang Actinic support, and the chap I spoke to hadn't even heard of SecureCode, let alone the new requirements or whether Actinic Shared SSL supports it or not! I don't hold out much hope that it will!

[pinbrook]

Also, if we do have to change, would PayPal (currently used for eBay sales) or HSBC (our bank) be the best bet for a PSP? What are people's experiences of either?

Both are fine, there are happy Actinic users using both, probably worth comparing the costs/features of each one in order to make an your decision