Have an installation of Cartthrob Subscriptions 2.6 installed and semi working with a SagePay Offsite test account which has token and repeat enabled and a continuous authority merchant number attached. I can successfully purchase a subscription using the Sage Pay test CC details, however when it comes to rebill the subscription the following error appears:

The transaction was not registered because although the data sent to the payment gateway was formatted correctly, some information supplied was invalid. E.g. an incorrect vendor name or currency code was sent.5017 : The Security Code(CV2) is required.

Anybody else seen this before with Sage Pay or have any ideas?

Many thanks

1 Answer 1


yep I came across this bug too. Was a long time ago, and had hoped they would have fixed it by now, but here's what I did:

Open up /third_party/cartthrob/payment_gateways/Cartthrob_sage.php

Bug #1: 3DSecure check must be disabled for rebills, so find 'Apply3DSecure' => 0 and change the 0 to 2 (weird that it's not supposed to be zero, but there you go... You can see the values in this ancient document p.38). On my old copy it's at line 379.

Bug #2: Then just after the $post_array variable is set (line 381 for me) we need to switch off the CVV2 check for rebills but keep it on for the initial transaction. Buried deep in the old CT forums is a solution as follows:

    if ($this->order('CVV2'))
        $post_array['CV2'] = $this->order('CVV2');
    } else {
        $post_array['ApplyAVSCV2'] = 2;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.