Updating Credit Card Information for Automatic Recurring Gifts - CVC now required

Nicole Francis · March 18

Hi there,

I was wondering if any other users are having issues with a recent change when updating a credit card information in NXT. I only notice today and wondering if I missed any updates. Before we only needed to ask donors for new card and expiry date. The required fields are now card number, expiry,CVC and postal code. I tried changing in configuration and nothing works.

Karen Diener · March 19

There is a very active user group in Facebook, and members started sharing their issues with it a couple of weeks ago. I have a case logged with support but have not heard anything yet.

To my knowledge, Blackbaud did not indicate that this requirement was forthcoming nor have they communicated that they are aware of it as an issue. We do not know if they plan to change it or if that is simply a new requirement we all needed to learn the hard way.

I'm posting my frustrations and disappointment here in the hopes that someone will provide some clarity.

@Crystal Bruce I'm not sure who I should tag in this specifically because I'm not sure if this is a Blackbaud Payments issue or a RENXT issue.

Laura Berube · March 19

https://community.blackbaud.com/discussion/comment/312016#Comment_312016

Karen, can you share what the Facebook group is? Is it open to new members?

Laura Berube · March 19

Yes, it's very frustrating. I have only experienced it so far when updating credit card payments for monthly gifts, but I am terrified for the day when we need that info to process one-time gifts. We would have to retrain all staff who take donations over the phone to ask for it, update donation forms, etc. And calling donors back after you've already collected their info is just embarrassing.

Jake Gaston · March 19

Hi All,

I hope to add some clarity on the payments side of this.

When a constituent's existing card token is on file, recurring gifts will continue to process without any changes.

Where the new behavior applies is when a staff member enters a new/updated card for a constituent, whether for a one-time gift or to update a recurring gift's payment method. That flow now runs through Blackbaud's updated checkout experience, which collects the card security code (CSC/CVV) and postal code at the time the card is stored/processed. This is aligned with card network and issuer expectations for new card entry, and collecting CSC & postal code at that point improves authorization outcomes leading to higher approval rates and fewer unnecessary declines.

The CSC requirement for new card entry is not configurable, it's a required part of the new checkout flow. For more detail, see the New Checkout FAQ.

If you run into issues or your experience differs from above, please reach out to Support directly and they can help investigate.

— Jake Gaston, Senior Product Manager, Payments

Brian Soucie · March 20

@Jake Gaston Can you please confirm that the CSC is not stored in BBPS? I'm pretty sure this is a requirement of PCI-DSS.

Carlene Johnson · March 20

https://community.blackbaud.com/discussion/comment/312026#Comment_312026

Hi Laura - the group is: https://www.facebook.com/groups/REUserGroup and they are accepting new members.

If you have trouble with the link you can go to FB and search for The Raiser's Edge Users Group Support Forum.

Jake Gaston · March 20

https://community.blackbaud.com/discussion/comment/312047#Comment_312047

@Brian Soucie Correct - we do not store the CSC in BBPS. CSC is used to tokenize the card details and not stored for future use.

Ange Scott · March 22

We cannot ask our donors to provide this CSC code on postal appeals - if that mail got lost it provides the finder with complete access to the donors credit card, which is quite clearly a huge breach. This change may be acceptable in the US, but it is not worldwide.

Brian Soucie · March 23

@Ange Scott We're in Australia and had received similar advice in the past regarding the CSC on paper donation forms. However, I did come across this last week that have given us some reassurance there's a way forward:

PCI Security Standards Council – Protect Payment Data with Industry-driven Security Standards, Training, and Programs

At this point, I'm looking into changing our donation forms to include the CSC/CVV number but this will be removed after credit card processing has been completed (similar to all but last 4 digits of CC number).

Ange Scott · March 23

@Brian Soucie Thanks Brian, That link is helpful.

We may need to think about our postal appeals going forward, as the security may be ok for online donation forms, but it's still a bit dodgy to have that information on paper and going through the mail. We may end up with less donors because of it.

Updating Credit Card Information for Automatic Recurring Gifts - CVC now required

Answers

Categories