Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant
by tjriley82 on Monday August 17, 2009 @09:26AM
(#768040)
If you have a "continuous authority" facility enabled on your merchant account you can make arbitrary charges on card numbers authorised and stored by your payment processor. CA doesn't seem too hard to acquire, at least here in the UK it was easier than we expected at worldonahanger.com. The downside with this approach is that in the event that you want to switch payment processors, you have to ask your customers to resubmit their card details for reauthorisation (as far as I can tell).
Re:Amazon Confirms EC2/S3 Not PCI Level 1 Compliant
by mseebach on Monday August 17, 2009 @12:13PM
(#768388)
Yeah, that sounds about right. There's apparently also something called "pre-registered card". So, no business idea here :)
EDIT: http://www.braintreepaymentsolutions.com/credit-card-storage...
But to recap the idea -- people become PCI certified because they need to store a creditcard number for recurring charges. There are service for subscription type recurring charges, eg. same amount every X period, but no service where a credit card number can be stored and then charged an arbitrary amount non-periodically? E.g. toll-roads with an RFID in the car, AWS usage-dependant charges or Amazon-like "store-your-creditcard" webshops ..
Are there any other reasons to become PCI certified, short of actually being in the CC business? I guess people are comfortable enough being redirected to a payment window on a third party website, so transmitting is not an issue.