Hacker News new | ask | show | jobs
by hiciu 3306 days ago
re worldpay - they may be cheap, but you get what you pay for. Their backend still does not support SNI for payment callbacks. I had to debug once my client's integration with their hosted payment form (the one under https://mms.cardsaveonlinepayments.com) - and during debugging I have seen things like this: http://hiciu.org/2016-02-06-010735_1920x1043_scrot.png http://hiciu.org/2016-02-06-010743_1920x1043_scrot.png.

I believe you still can break their hosted payment form if you provide your telephone number with leading zero.

3 comments

I worked with an ecommerce shop for a while that wanted to go with the cheaper payment processor through their bank.

We spent a lot of developer time getting that 0.05% rate difference to work. Yes, that's a lot over a year, but we were constantly discovering undocumented error codes and "interesting" corner cases. The processor went down often enough that we actually ended up configuring a backup payment gateway on top of it (manual failover -- and yes it was well used). A year later and we still didn't have all the bugs ironed out.

Additionally the "PCI Scan" through the bank couldn't handle a DNS name, only a fixed IP address. This was one among many other issues with the PCI scan that ended up wasting weeks of developer time. In the end they literally gave up on scanning the site and just gave it a pass.

Believe it or not (I didn't at the time) there's actually more to card processing and banking than just a rate. You definitely get what you pay for.

Ahhh - this brings back memories. On a more significant note, our student association was able to get a merchant account up and running with them with _significantly_ less work than trying to re-enable our PayPal account after we hit their 'verification ceiling', and the fees worked out vastly cheaper although we did opt for a fixed monthly payment + lower per transaction cost. This was some years ago (in the UK) but I really second the argument that much cheaper rates can be had by simply shopping around (of course like any business/financial decision you'll want to factor in dev time / service levels etc etc) and getting a real merchant account isn't really that difficult.
+1 even their website isn't https... (even for their contact-us page and quote page)
Also I think we just took it down...