Does SagePay validate expiry date for repeat transactions in v3 to ensure it's not in the past? - opayo

We're in the process of upgrading to v3 from v2.22. At the moment the expiry date isn't validated as part of a repeat transaction, but is this now required to be valid as part of v3.0?
I've not seen anywhere in their documentation (mainly here) that expiry dates are validated by SagePay. My current understanding is that they basically send a request off to the bank, which then validates it and authorises it or not.
However, I'm starting to question this as v3 also allows for tokenisation. As part of this SagePay presumably store the card details, which they must validate as I believe they bin off tokens and card details when the expiry date is no longer valid.

When you do a repeat transaction through Sage Pay, they will push through the expiry date that they hold - expired or not. It depends on the acquiring bank as to whether they will authorise the transaction with an expired date. In my experience, as long as you are using a continuous authority MID, it shouldn't be a problem if cards are expired.
As far as tokenisation goes, Sage Pay will delete tokens which have expired - eg: an expiry of 1016 will have been binned on the evening of the 31st October 2016. When the token is registered, they obviously will not accept an expired card.

Related

Unable to check the status of Google OAuth consent screen verification process

I submitted the consent screen with some Sensitive scopes (classroom.courses etc) around more than 1 month back and after 1 day i get the message from google that i have to verified the domains so i complete the verification process of domain and submit it again after 2 days. Till now my consent screen is not verified. In OAuth consent screen verification page it shows just this text 'Your consent screen is being verified. This may take up to several days. Your last approved consent screen is still in use' but didnt mention any time frame.
Anyone know from where i get the status of this verification process. It is mentioned that it will takes some weeks if the apps uses some sensitive scopes but still after 5 to 6 weeks i didn't get any notification from google.
You should receive an email from Google with the subject "OAuth Verification Request" stating that your project has been successfully verified. However, in all my cases for Android/iOS projects I first received an email asking me to create a video on YouTube demonstrating the use of the sensitive scopes in the app. After I created that, approval arrived in a few days.
For one of my projects, I never received any email update so I just made some small change to Oauth screen and resubmitted. I then heard back in a few days, so I think for some reason the one verification request got lost.
You can also try respond to the first email you received from google regarding the verification of the domain.

Braintree hosted fields integration - edit existing card data

I'm using Braintree hosted fields to allow credit card payments, and users can use multiple cards.
How can I allow users to edit existing cards? For example, when a card is renewed by the bank, it keeps the same card number, but the expiration date and CVV change. I want users to be able to edit the expiration date and CVV to keep the card active. Is this possible, or does the user have to enter in a new card from scratch with the same card number?
Full disclosure: I work at Braintree. If you have any further questions, feel free to contact support
Once your customer has their payment method stored in a Vault record you can use their associated payment method token to run a PaymentMethod.update() call. Using the payment method update you can change most attributes of the stored method, and you can find a full list of those attributes here. When updating actual card information, such as CC number, expiration date, etc. it is recommended that you generate a nonce with the new information rather than entering it manually, but either will work just fine.

Consumable in app purchases validation

We recently launched the app which has only consumable in-app purchases. We noticed lot of fake purchases - purchases with invalid receipts and also 'valid' receipts but the "in_app" array in the validation response from apple is empty array. I need to know how users are forming such a 'valid' receipts ? Is it the receipt of the app download and not of in-app purchase or what ? I am now putting the following check for validation. Extract "in_app" field in json response from Apple and if it is non-empty, then check the product_id matches or not. I need to know if this check is enough or their is a better fool proof check.
All apps have a receipt. Those apps that have purchased an IAP have an in_app field in their receipt. Your users are pushing a fake call into their updatedTransaction method and you are grabbing their receipt (sans IAP cause they made no purchase)and sending it to your server. Other users might swap some receipt from somewhere (e.g. one of 30 thieves makes a purchase and extracts that valid receipt and sends it to their 29 co-thieves). If they stick that receipt into their device and then push a call to updatedTransactions then your server will get their now-valid-but-duplicate receipt. Your server needs to check *** the date of the receipt and discover it is older than recent or, even better, older than the paymentRequest which you would need to co-send to your server. (it is better to decode on the device - much more secure)
*** you used to be able to check transaction_id for a duplicate transaction_id. Unfortunately you can no longer do that since a restoreCompletedTransaction returns the same transaction_id as the original purchase. I have told Apple about that and they ignored me.
Refer to this In-App Purchase FAQ My app validates its receipt with the App Store via paymentQueue:updatedTransactions: after a successful purchase. However, the returned receipt contains an empty in_app array rather than the expected products.
An empty in_app array indicates that the App Store has not recorded
any transactions for the user yet. It may be that the application
receipt has not yet been updated. When this happens, your app can
inform the user that the receipt does not appear current and ask
whether to refresh it.
Information about consumable products is added to the receipt when
they are paid for and remains in the receipt until you finish the
transaction. After you finish the transaction, this information is
removed the next time the receipt is updated. Thus resulting into an
empty in_app array if your app only sells consumable products.

How do I trigger a webhook for transaction settlement in sandbox?

I am trying to create a new webhook endpoint for my braintree integration. I added an endpoint to the Control Panel. I am using the Python library and created a a bunch of transactions. Also, I manually settled the transaction using the testing gateway. But I do not get a webhook notification. When is the webhook triggered and I=is there a way to trigger it manually?
Full disclosure: I work at Braintree. If you have any further questions, feel free to contact support.
The Transaction -> Disbursed webhook fires when the transaction has settled, and braintree has begun to move funds from their account to yours. While settling the transaction manually in the control panel would start the process, it does not fire the webhook right away.
There isn't any way to trigger this manually, instead braintree has sample payloads and a way to trigger a "Check" webhook in the control panel.
To answer the question in your comment, this type of webhook does not cover voided transactions.
I also asked a similar question to Braintree support, and the answer may be useful for others, even if I decided to go with Stripe (I found stripe much better after all my tests ;).
Question
Hi,
Just integrating Braintree, but can’t find how I’m supposed to get a transaction confirmation (meaning it has correctly been ‘charged’). When I create a ‘transaction.sale’ (including submitForSettlement) I always get (sandbox) a response indicating the status ‘Submitted for settlement’, and the transaction doesn't go to settled until Braintree globally process it (at night, etc.). I also can’t find a related webhook to get payment confirmation (as I currently get using PayPal - IPN).
When/how can I get a payment confirmation so I can then ‘deliver’ the purchased item? By checking your docs, it’s like you can’t get a confirmation until the next day… how does it work exactly?
Thank you!
Answer
Hi Nacho,
Thanks for reaching out!
A Braintree transaction goes through several steps, the second of which is submitted for settlement. This means that the money has begun to move from the customers account, and is the immediate state of a transaction after being submitted; it's not possible to get an immediate 'settled' or 'complete' status on submission. Transactions in this state will generally move to settling, then settled, within 24 hours, although it can depend on your processing bank.
It is very unusual for a transaction to fail when moving from submitted for settlement to settled, as the amount will have been authorised prior to submission for settlement. Authorising a transaction means the funds are put on hold within the customers account, for a certain timeframe depending on payment method, until they are settled. We get an immediate response from the processing bank as to whether an authorisation is successful, which you'll see in the Braintree_Transaction response object.
As such, you can generally rely on the status of submitted for settlement to reflect a valid, successful transaction.
We don't offer webhooks for transactions - instead, our API is designed to give instant feedback via the response object. Because of this, we only provide webhooks for asynchronous events that aren't triggered by an API call (such as billing a subscription or disbursing funds). We encourage our customers to avail of our API responses, in addition to our reporting system and comprehensive search call options, for any extra functionality they require.
If you wanted to pull updated statuses for transactions, such as to confirm a payment has settled, you could use the Transaction.find() API request, pass in the transaction ID and read in the status from the response object. This could easily be run as a script that iterates through the previous days transaction IDs and updates the status of each on a daily basis.
I hope this explains the transaction process with more clarity and offers you some options!
Kind regards,
Braintree
Just in case it helps!
I also asked kind of the same question to Braintree I got the same answer to check the transaction with Transaction::find() and then asked about the possibility of having a transaction not settled after having a SUBMITTED_FOR_SETTLEMENT status, here is the response, very clear and complete:
Hi Alban,
Thanks for reaching out with this question! Happy to help.
Settlement Declined:
In rare cases, a transaction that has been submitted for settlement will reach a status of settlement declined. For sales, this will only occur with a PayPal transaction. For refunds, this can occur with both PayPal and credit card transactions.
This occurs if the processor declined to settle the sale or refund request, and the result is unsuccessful. This can happen for a number of reasons, but the processor settlement response code may have more information about why the transaction was declined. Again, this status is rare, and only certain types of transactions can be affected.
PayPal sale: We recommend checking the settlement status of all PayPal sale transactions before shipping goods or providing services to customers. To reduce these types of declines, submit your PayPal transactions for settlement either upon creation or within 3 days of creation.
PayPal refund: We recommend contacting PayPal for details on refunds that are Settlement Declined.
Credit card refund: Settlement declines can be hard or soft, just as with authorizations. In regions that support an immediate decline response for refunds, we will return Settlement Declined if the processor responds with a hard decline.
Settlement Pending:
This status indicates that the transaction has not yet fully settled. This status is rare, and it does not always indicate a problem with settlement. Only certain types of transactions can be affected.
--> PayPal sale:
If using multiple partial settlements: Settlement Pending is a normal part of the transaction flow. The parent authorization will remain in this status until all child transactions are settled or the authorization expires. See the multiple partial settlement reference for more details.
If not using multiple partial settlements: Almost all Settlement Pending PayPal transactions will settle without intervention, so we always return a successful result. In general, you can expect these to be updated to Settled within a few days as we confirm their status with PayPal. In the rare case we can't settle a Settlement Pendingtransaction, we'll contact you to resolve the issue.
--> Credit card, Android Pay, and Apple Pay sales: You will only see Settlement Pendingauthorizations if you have contacted us to enable a specific API feature that uses this status.
I hope that provides insight, Alban! Let us know if further questions arise.
Best,
xxxxx.
Braintree

Recurring Payments - Trial without card

We're developing a system whereby the user will be sign-up and have a 3 month trial without entering card details. Once the trial period is up they get sent an e-mail asking them to come back and register card details in order to setup a recurring payment in order to continue accessing the site.
Is it possible to configure recurring payments with Braintree such that we don't provide a card for the trial period and then configure one upon notification that it has expired?
Thanks!
I work at Braintree. If you want more information than you can easily get on Stack Overflow, please reach out to our support team.
Braintree subscriptions require a credit card to be created. That way, the transition from trial period to billing doesn't require any action by the customer or merchant. Since our core service is billing credit cards, that's what subscriptions are designed to do.
In your case, it sounds like you can create a subscription in your application, and only link it to a Braintree subscription if / when credit card details are entered. You'll need to handle tracking the three month time limit yourself.

Resources