Is there a reason why Exp:resso Store 2 doesn't store the last four digits of the customers credit card number in the order details?


The shopping cart and order management are completely separate to payment processing. Store is only concerned with the former and then making sure that an order needs to be marked as paid or not paid. Your chosen payment processor is responsible to taking, securing and processing the payment from your customers and then passing on a success or failure message to Store by way of the API response. In the vast majority of cases this is handled off-site on their servers so Store is never exposed to anything. With that in mind it's not actually possible to capture anything as Store never see's it.

You would still be in line with PCI DSS compliance to store the last 4 digits of the credit card number BUT guidelines strongly suggest that you encrypt this for added security. I certainly don't think any payment gateway would be sending that in a response from their API however so you're only option would be to then take responsibility from the payment processors' hands and take payments on-site meaning that you'd need to read through PCI DSS compliance guidelines and ensure you're secured to the hilt in regards to encrypted transactions, encrypted storage, physical security and every other directive. Expect a considerably high cost for doing this not to mention the burden of responsibility and potential auditing. You could then capture the details on site and send over to the payment processor, keeping the last 4 digits on record. I certainly wouldn't say it's worth it and certainly wouldn't recommend it.

Just be happy in the knowledge that ignorance is bliss and let someone else worry about the burden of online payment processing and PCI DSS compliance. It's what they take their cut for. :)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.