Web Secure Pay was created to provide merchants with a non-storing solution to help ensure continued compliance with PCI Security Standards. In addition, it eliminates the need for them to endure the certification process imposed by ACXSYS for Interac Online. Because WSP is already certified for Interac Online processing, Interac has waived the certification requirements for any merchants that wish to accept Canadian debit cards online through WSP.

The solution provides Interac Online and credit card processing through a hosted payment page bringing the significant benefit of eliminating the merchant’s exposure to cardholder data. Given the critical nature of PCI compliance, this is an important point. In addition, the merchant no longer needs to be concerned with the purchase and regular renewal of SSL certificates.

Web Secure Pay can be tailored to merchant branding standards providing a continuous user experience as the cardholder moves from shopping into payment selection and processing as merchants can easily add their company logo, colors, and wording to the payment page. Customized pages can be viewed offline using WSP’s preview functionality.

When configuring the payment page, the merchant administrator has a number of other options available:

• Enable only the card types you wish to support: credit card processing, Interac Online, or both.
• Receipt notification email to both cardholder and merchant with customized messaging.

The design of the system makes extending the current offering of Payment Types and Services such as Flex Cash and Verified-by-Visa easier. For the merchant, this means new pay types can be instantly available without the increased expense of software development.

For this example we’ll use a typical merchant website, hosted and controlled by the merchant.

A typical shopping site that offers several products available for purchase (Fig. 1). By clicking on a product, cardholders are then given the opportunity to “Add to the Cart” (Fig. 2). Next, the shopper confirms the items ready for checkout (Fig. 3).

All actions up to this point in time occur on the merchant website. Once the cardholder decides to pay for the purchases, the “Checkout” link is selected triggering Web Secure Pay and transferring them away from the merchant’s website (Fig. 4).

The seamless transition from merchant to external hosting completely isolates the merchant from the cardholder data entry. This “Checkout” page is configured to offer both Credit Card and Interac Online. Notice that there is an option for the cardholder to enter their email address and have a receipt sent to them. This functionality is also customizable. Once the payment method is selected, a CTR is displayed (Fig. 5).

Logging into RPM as a Merchant Administrator accesses the payment page configuration.

On the homepage, Merchant Administrators see the payment page link in the Overview Menu on the right of the screen. They can also access this functionality by clicking on the Administration link.

The payment page screen displays a listing of payment pages already configured by the merchant. Administrators can create new pages or view, edit, or delete existing ones.

To view the configuration of an existing page, click on its payment page link. The setup will also indicate the available payment options: credit card, Interac, or both.

Settings

• “General” tab

  • Payment page title: The header used at the top of the merchant payment page.
  • Payment page ID: Used to identify which payment page will be accessed by the merchant.
  • Processing mode: Indicates if the page is in testing mode
  • Receipt link method: Method for re-directing back from the customer receipt.
  • Receipt link text: Custom text used for the link back to the merchant’s site
  • Return to site link: URL used for the link back to the merchant site.

• “Appearance” tab

  • Header logo URL: Merchants ensure consistent look-and-feel by simply adding a link to the corporate graphics.
  • Color style settings: Enter generic web colors or insert the custom hex codes to ensure that the payment page text settings have hues identical to the merchant site.

• “Terminals” tab

  • Currency: select Canadian or US dollars.
    *Note: Interac is only available for Canadian currency.
  • Credit Card/Interac: Select payment type(s) – credit card, Interac, or both.
  • Credit Card and Interac Online Processing (Terminal Definition): Defines which terminals are to be used for processing: live or test. In order for live processing to occur, a double-lock mechanism is used:
    1. A terminal must be defined in the live area.
    2. The “Test” check-box in the “General” tab must be unchecked.

• “Email” tab

  • Email enabled: Enables system to email receipt information to the cardholder.
  • “From:” email: Email address from which receipts are sent to the cardholder.
  • Notification email: Sends an email to specified address when a transaction takes place.
  • Receipt email header/footer: Customize the messaging in emails to cardholders.

Once a merchant has gone through the process of configuring the page within the WSP application, all that is left is to configure the merchant’s website.

For those merchants not using a Shopping Cart, the process consists of the following steps:

1. Identify the location in the merchant site code where shopping cart or product selection is complete and the payment process begins.
2. Depending on your site language (PHP, Perl, etc.), insert or change the appropriate code snippet values for:
   • URL pointing to the hosting page (https://checkout.e-xact.com/payment) designating “PAYMENT FORM”.
   • Payment page ID (see “General” tab settings). In the code example, this is the “x_login” value.
   • Payment page password (see “Keys” tab settings). In the code example, this is the “x_fp_hash”.
   • Transaction information (amount, time stamp, transaction sequence, and item description). In the code example, this is the “x_amount”, “x_fp_timestamp”, “x_fp_sequence”, and “x_line_item”.

A detailed specification of the advanced features available in this protocol, such as Relay Response Handling, is in the document “Advanced Payment Page Handling”.

Here is an example of a simple HTML snippet needed to activate a payment page:

<form action="https://checkout.e-xact.com/payment" method="post">
     <input name="x_show_form" type="hidden" value="PAYMENT_FORM" />
     <input name="x_login" type="hidden" value="Payment Page Main" />
     <input name="x_fp_hash" type="hidden" value="4b04d15ccd9007658c2dadc679899ec4" />
     <input name="x_amount" type="hidden" value="495.00" />
     <input name="x_fp_timestamp" type="hidden" value="1191600622" />
     <input name="x_fp_sequence" type="hidden" value="123456" />
     <input name="x_line_item" type="hidden" value="1<|>Foremost Cellphone Upgrade<|>Upgrade to Deluxe Service<|>1<|>495.0<|>NO" />
     <input type="submit" value=" Checkout with E-xact.com" />
</form>