Is Stripe extension require to be PSD2 Compliant?

Here's information from Stripe on this issue: https://stripe.com/docs/strong-customer-authentication I don't know what the implications are for this extension.

Tested with Stripe's test card numbers for 3D Secure 1&2. Right now, any card that requires 3DS authentication will simply decline. Adding support for this looks very straightforward - in the (new) Intents API. I think most of the work for this enhancement will be to make that API change, so this has a lot of overlap with #29 (closed) and it may be worth scoping work for both of these together.

mentioned in issue #29 (closed)

mentioned in issue #7 (closed)

I didnt quiet understand, so is stripe/paypal any one of them going to be PDS2 compliant soon? Thanks

This fundraiser for the Stripe extension - https://civicrm.org/make-it-happen/stripe-the-next-level mentions the objective of compliance with 'SCA payments', which I believe is part of the PSD2 requirement.

@Upperholme Thanks - yes that's right. @tapash If you are able to contribute to the make-it-happen for Stripe we can develop the required changes more quickly!

@Upperholme @mattwire Thanks both. Will do.

added critical enhancement labels

changed milestone to %MIH

So thanks to all that could help, the MiH is funded.

@mattwire, as you probably know, SCA is for the 15th of september, will you be able to make the required changes before that deadline?

FYI: I'm working on another donation tool that uses stripe too and among the various options offered by stripe, we are going for:

move to stripe elements (with the hope it will make it easier to add new type of national payments, like iDEAL)
obviously move to payment intent
automatic confirmation instead of manual

For the off site authentication (as in recurring donations after the initial one on a subscription), we are still looking if the email stripe can send is good enough (it's not clear if it's only available in english)

What's the plan on your side? happy to chat.civicrm.org ;)

I know we all appreciate the work taking place to get Stripe on CiviCRM to be PSD2/SCA compliant, but would it be possible to have regular updates on progress, and some reassurance that before the 15th Sept (just over 2 weeks away!) the new version will be available. I'm now getting questions from my Trust's Finance Director asking what is happening, and apart from saying that I hope Stripe will be compliant, I can't really give an answer. Once again, many thanks for the work on Stripe (and the rest!)

Hi

I have a customer who is being asked to fill out a SAQ A-EP questionnaire by Stripe which I don't think is acheivable.

Would this MiH version be sufficient to qualify for SAQ A (as opposed to A-EP)?

Or should I be advising them to move to a different payment processor?

Yes, once the MIH version is completed it'll qualify for SAQ A again as we'll be using elements: https://stripe.com/docs/security#validating-pci-compliance

That's good to hear, Matt. It would be useful to know when the new version will be available though (even as a beta), so installation & testing can be scheduled.

Any day now :-) I have elements working and a partial implementation of the new PaymentIntents API

Hi Matt I see the alpha1 is out! I've tried installing on a test system, and get an error saying that extension "mjwshared" is missing. This is cited in the info.xml as a required extension. Help!

OK, I found the mjwshared extension, and installed that, and now the new Stripe extension installs, with changes to the database. Test Stripe payments are going through (i.e. apparently all correct on Stripe), but are pending on CiviCRM, with an error message "Unable to complete payment! Missing paymentIntent ID."

Stripe 6.0 can achieve PSD2 (SAQ-A) compliance on most sites as it uses "Elements".

closed

changed milestone to %6.0

Is Stripe extension require to be PSD2 Compliant?

Designs

Child items ...

Activity