...
A: As part of PCI compliance, we can never database the CVV2 value. If you send an order to Accounts Receivable for decline, fraud review, etc. you'll either have to contact the customer to obtain the CVV2 value over the phone or configure your payment gateway to allow charges without the CVV2.
End Customer Questions
Q: I tried purchasing your product and the charge was declined, but an authorization is still on my credit card. Can you remove it?
A: When a customer goes to purchase a product from your website, UltraCart communicates with you payment gateway such as Authorize.Net, NMI, PayJunction, Stripe, etc. The gateway in turn issues an authorization request to the credit card network. When the credit card network receives the authorization request they place funds on hold for the credit card and return the authorization response to the gateway. At this point in time the gateway can look at the authorization response and decide that it doesn't like the AVS or CVV2 match details and decide that a decline code should be returned to UltraCart. The customer is then told their card is declined, but what about the authorization that the gateway pulled on the customer's credit card? Well, that all depends upon the payment gateway that you're using an how they communicate to the credit card network. It is not uncommon for those authorizations to take a few business days to fall off. That's not a big deal when the customer is using a credit card with a reasonable limit and your transaction does not represent a large portion of their available credit balance. On the other hand, if the customer is using a prepaid credit card with $100 balance and your transaction represents $80, they are going to be mad and probably contact your customer service. If this happens, engage your payment gateway and see what options they have for more quickly removing the authorization from the customers credit card for declined transactions.