Take payment by telephone

[14Steve14]

How do people take payments over the phone and use Phoenix to create the order.

I have signed up for Square Virtual terminal in the hope of being able to take orders over the phone. Everything seems to work as it should. I was planning to use the website to create a customer account, create the order and take the payment. Is that something that can be done, and if so what payment module do you suggest using, and how to stop it being used by other customers.

Any advice welcome.

[ecartz]

The COD module is probably plenty, just retitle it so that it shows up as Phone or whatever. If you want to say something special in the order email, you might modify money order instead.

You can disable it unless connecting from your IP. You might want to make it a configuration option, so you can change it in Admin. Something like

Code: Select all

if (Request::get_ip() !== MODULE_PAYMENT_COD_ALLOWED_IP) {
  $this->enabled = false;
}

Set to the value that you see at https://whatsmyip.com/

[burt]

As per Matts advice. Choose a payment method and limit it to just your IP address - also have some type of ability to login as a customer (eg a "master password" or such). You'd likely need to let the customer know that you are setting up an account for them, or logging into their existing account.

Is there an App to allow shopowner to add/edit order in the backend (ie without logging in the front end as a customer)?

[heatherbell]

Is there an App to allow shopowner to add/edit order in the backend (ie without logging in the front end as a customer)?

app.php/addons/paid_addon/order_editor/

[14Steve14]

Thanks for the rep0lies so far. It would be good to hear how other store owners do this and stay within PCI DSS compliance, although that seems to be taken care of by Square.

Already have a master password up and running so that's one already bit done.

Will have a bash at Matts suggestion and see if I can get something working, failing that will speak to one of the certified developers.

[ReneH4]

The way how I work is that I add the parts to the customers basket (Using MasterPassword). Then I sent them a message telling them they can login and checkout the way they prefer (usually a direct payment).

I know this may rusult in customers not ordering after all, but usually they do after haveing received some good advice.

HtH

[heatherbell]

It would be good to hear how other store owners do this and stay within PCI DSS compliance, although that seems to be taken care of by Square.

Giving card details over a telephone is, by its nature, not secure. Anybody with a card in their hand (including those that have just stolen it) could do that because Strong Customer Authentication is currently not possible.
We do not make (or take) telephone payments for that reason but if you do, PCI DSS compliance is the responsibility of the seller, not the payment provider. The seller must complete a PCI DSS questionnaire and declaration which our merchant bank requires us to do in any case even though we do not accept MOTO payments. That's easy to do but maybe too easy. We recently attempted a purchase on a website but their online payment provider failed. We emailed to tell them this and that we do not use a telephone. They asked us to email our card details - completely insecure and non-compliant! Some sellers will do anything not to lose a sale!

[14Steve14]

It would be good to hear how other store owners do this and stay within PCI DSS compliance, although that seems to be taken care of by Square.

Giving card details over a telephone is, by its nature, not secure. Anybody with a card in their hand (including those that have just stolen it) could do that because Strong Customer Authentication is currently not possible.
We do not make (or take) telephone payments for that reason but if you do, PCI DSS compliance is the responsibility of the seller, not the payment provider. The seller must complete a PCI DSS questionnaire and declaration which our merchant bank requires us to do in any case even though we do not accept MOTO payments. That's easy to do but maybe too easy. We recently attempted a purchase on a website but their online payment provider failed. We emailed to tell them this and that we do not use a telephone. They asked us to email our card details - completely insecure and non-compliant! Some sellers will do anything not to lose a sale!

I can only go buy what I read on the Square website, and where I was directed after a call to them previously about using their virtual terminal, and I quote from their PCI compliance page

Am I responsible for a PCI DSS Compliance Self-Assessment Questionnaire (SAQ)?
The PCI DSS Self-Assessment Questionnaire is a checklist ranging from 19 to 87 pages, created and distributed by the PCI Security Standards Council. It’s used as a mechanism for sellers to self-validate their PCI DSS compliance. Square sellers are not responsible for this SAQ, or for self-validating, since Square’s hardware and software complies with the Payment Card Industry Data Security Standard (PCI DSS) on your behalf.

If what they are saying is wrong, then its only a case of filling out the SQA, as previously done with another payment provider. Its not that hard.

We do have customers that don't seem to understand that once a payment is made we are unable to either reuse the card details, or alter that payment. Stripe, one of our other payment providers allow saved cards to be reused, but we have never done so. We always send an invoice through either PayPal or Stripe and get any additional payments that way. We also receive emails with order details and even full card information in them. Some people just don't seem to care about their information, which is why I am trying to find out how others do it, and the best way to do it.

[heatherbell]

Square

We've had years of excellent service from SagePay when they were a U.K. company but have been ripped off by Opayo and Elavon since they bought them (charging 2.6% for voids and refunds and their telephone support is also appalling!) so we are in process of moving our businesses to Stripe.
Just wondered about your reasons for using Square for MOTO when we see that Stripe provides that.
Interestingly, we also see a Secure Virtual Terminal available from one of Stripe's partners https://stripe.com/partners/paytia which does make telephone payments secure.
We notice our UK suppliers using this since the enforcement of 3DS in UK in March this year.

[14Steve14]

@heatherbell
We chose square as it will provide a full POS system, which is something we are thinking of using both in the online business and when we go out to shows and exhibitions. We are also on the verge of moving into premises where we hope to have either a small shop or a counter with some products on display. It's a case of finding something that will do everything we want, even if it means dropping PayPal and Stripe, which currently is not a plan as so many customers still use them both on the website.

@BrockleyJohn also does a payment module for Square so that could also be an option.