Updating Credit Card Information for Automatic Recurring Gifts - CVC now required

Nicole Francis

Hi there,

I was wondering if any other users are having issues with a recent change when updating a credit card information in NXT. I only notice today and wondering if I missed any updates. Before we only needed to ask donors for new card and expiry date. The required fields are now card number, expiry,CVC and postal code. I tried changing in configuration and nothing works.

Karen Diener

There is a very active user group in Facebook, and members started sharing their issues with it a couple of weeks ago. I have a case logged with support but have not heard anything yet.

To my knowledge, Blackbaud did not indicate that this requirement was forthcoming nor have they communicated that they are aware of it as an issue. We do not know if they plan to change it or if that is simply a new requirement we all needed to learn the hard way.

I'm posting my frustrations and disappointment here in the hopes that someone will provide some clarity.

@Crystal Bruce I'm not sure who I should tag in this specifically because I'm not sure if this is a Blackbaud Payments issue or a RENXT issue.

Laura Berube

https://community.blackbaud.com/discussion/comment/312016#Comment_312016

Karen, can you share what the Facebook group is? Is it open to new members?

Laura Berube

Yes, it's very frustrating. I have only experienced it so far when updating credit card payments for monthly gifts, but I am terrified for the day when we need that info to process one-time gifts. We would have to retrain all staff who take donations over the phone to ask for it, update donation forms, etc. And calling donors back after you've already collected their info is just embarrassing.

Jake Gaston

Hi All,

I hope to add some clarity on the payments side of this.

When a constituent's existing card token is on file, recurring gifts will continue to process without any changes.

Where the new behavior applies is when a staff member enters a new/updated card for a constituent, whether for a one-time gift or to update a recurring gift's payment method. That flow now runs through Blackbaud's updated checkout experience, which collects the card security code (CSC/CVV) and postal code at the time the card is stored/processed. This is aligned with card network and issuer expectations for new card entry, and collecting CSC & postal code at that point improves authorization outcomes leading to higher approval rates and fewer unnecessary declines.

The CSC requirement for new card entry is not configurable, it's a required part of the new checkout flow. For more detail, see the New Checkout FAQ.

If you run into issues or your experience differs from above, please reach out to Support directly and they can help investigate.

— Jake Gaston, Senior Product Manager, Payments

Brian Soucie

@Jake Gaston Can you please confirm that the CSC is not stored in BBPS? I'm pretty sure this is a requirement of PCI-DSS.

Carlene Johnson

https://community.blackbaud.com/discussion/comment/312026#Comment_312026

Hi Laura - the group is: https://www.facebook.com/groups/REUserGroup and they are accepting new members.

If you have trouble with the link you can go to FB and search for The Raiser's Edge Users Group Support Forum.

Jake Gaston

https://community.blackbaud.com/discussion/comment/312047#Comment_312047

@Brian Soucie Correct - we do not store the CSC in BBPS. CSC is used to tokenize the card details and not stored for future use.

Ange Scott

We cannot ask our donors to provide this CSC code on postal appeals - if that mail got lost it provides the finder with complete access to the donors credit card, which is quite clearly a huge breach. This change may be acceptable in the US, but it is not worldwide.

Brian Soucie

@Ange Scott We're in Australia and had received similar advice in the past regarding the CSC on paper donation forms. However, I did come across this last week that have given us some reassurance there's a way forward:

PCI Security Standards Council – Protect Payment Data with Industry-driven Security Standards, Training, and Programs

At this point, I'm looking into changing our donation forms to include the CSC/CVV number but this will be removed after credit card processing has been completed (similar to all but last 4 digits of CC number).

Ange Scott

@Brian Soucie Thanks Brian, That link is helpful.

We may need to think about our postal appeals going forward, as the security may be ok for online donation forms, but it's still a bit dodgy to have that information on paper and going through the mail. We may end up with less donors because of it.

Jake Gaston

Thank you all for your feedback on this topic.

While the requirement of CSC and postal code is expected for forms and back-office systems utilizing the new Blackbaud Checkout system, we have received feedback from customers like you around this change and how the CSC code is not always something your team has on hand for back-office processing.

We have determined to revert the back-office functionality to use the older checkout system for card processing, and plan to re-introduce the new Blackbaud Checkout system at a later date after giving organizations more time to prepare and adjust their back-office procedures.

Brian Soucie

Thanks @Jake Gaston

A couple of questions:

1. What do you mean by back-office functionality?
2. When are you reverting to the older checkout for these transactions?

Cheers!

Jake Gaston

Hi @Brian Soucie,

1. Back office refers to merchant-initiated transactions, such as mail order or telephone order, where the organization is inputting the payment details rather than the donor.
2. We reverted on Friday around midday ET.

Aiden Cooper

Hello @Jake Gaston, do you have any ETA for when the system to require CVC will be reimplemented? Having a general estimate for timeline would be really important to us. Thank you! Asking for CVC on mailed documents is rather problematic for us and our vendors (telemarketing, mail) so we are hoping it remains not required.

Brian Soucie

@Jake Gaston I've investigated the three ways of processing credit cards in NXT that I think would fall under your definition of 'back-office':

1. One-off gift from a constituent record
2. Batch gift entry
3. Changing CC details on a recurring gift

Of these three, #1 and #2 still require the CSC. The only one that didn't was updating the CC details for a recurring gift.

Is that the expected result? I'm an Australian customer btw.

Dave Bushell

@Jake Gaston - thanks for the update.
I don't know how this change will be accepted by BB users without it being accompanied by proactive advice from BB on how to handle things like mail campaigns - or preferred methods of working for different sorts of donor comms.

Blackbaud knows how organisations communicate with donors for different channels - so should be able to speak to those points.

The FAQ that was provided for the new checkout rollout addressed none of these concerns, and without a proper lead-in to ask questions/case studies/examples blackbaud can expect the same level of pushback, I would imagine.